A7043-B IMCA Guidance DP Electrical Power and Control

No 1 The Exchange 62 Market Street

Aberdeen AB11 5PJ UK

Phone +44 1224 289100

Fax +44 1224 289101 www.gl-nobledenton.com

File: a7043-b imca guidance dp electrical power and control

Noble Denton Consultants Ltd trading as GL Noble Denton Registered in England No. 5513434 Registered Office: Noble House, 39 Tabernacle Street, London, EC2A 4AA, UK

Distribution: Company: IMCA Attn: Jane Bugler W/S No: 55/130502

REPORT

IMCA

GUIDANCE

DP ELECTRICAL POWER AND CONTROL Report No: A7043, Rev B, Dated March 2010

DRAFT

IMCA GUIDANCE

DP ELECTRICAL POWER AND CONTROL

W/S No: 55/130502 Page 2 of 194

Report No: A7043, Revision: B, Dated: March 2010

File: A7043-B IMCA Guidance DP Electrical Power and Control

REVISION DETAILS

Revision Date Description Author Checker Approver

B 18/03/10 For client review JM/DT/SC JM BI

A 23/02/10 For internal review JM/DT/SC JM -

DESCRIPTION OF CHANGES

Revision Section Change

INSERTED DOCUMENT/FILE REGISTER

Path and Filename Details of File

IMCA GUIDANCE


W/S No: 55/130502 Page 3 of 194



EXECUTIVE SUMMARY

This guide to DP electrical power and control system is intended to provide those working in the field of dynamic positioning with a reference guide to the general principles of diesel electric propulsion and related controls systems. Reference is made to the concepts of redundancy and fault tolerance in relation to system design.

IMCA GUIDANCE


W/S No: 55/130502 Page 4 of 194



CONTENTS

SECTION PAGE

1 INTRODUCTION 9 1.1 GENERAL INTRODUCTION AND SCOPE OF DOCUMENT 9 1.2 ELECTRIC PROPULSION 9 1.3 POWER STATION CONCEPT 10 1.4 CONVENTIONAL PROPULSION 10 1.5 CONCEPTS OF FAULT TOLERANCE AND CONTROL SYSTEMS 11 1.6 DP CLASS 2 & 3 REDUNDANCY CONCEPTS 12 1.7 FAILURE MODES AND EFFECTS 13

2 POWER GENERATION 16 2.1 GENERAL PRINCIPLES OF POWER GENERATION 16 2.2 ENGINES 28 2.3 ENGINE AUXILIARY SYSTEMS 35 2.4 ENGINE CONTROL AND SAFETY SYSTEMS 42 2.5 SAFETY FUNCTIONS 47 2.6 GENERATORS 48 2.7 FUEL CONTROL 52 2.8 EXCITATION CONTROL 63 2.9 MAIN SWITCHBOARDS AND MOTOR CONTROL CENTRES 68 2.10 POWER SYSTEM FAULTS 70 2.11 OVERALL PROTECTION PHILOSOPHY 71 2.12 GENERATOR PROTECTION PHILOSOPHY 79 2.13 ADVANCED GENERATOR PROTECTION 85

3 POWER MANAGEMENT 88 3.1 REQUIREMENT FOR A POWER MANAGEMENT SYSTEM 88 3.2 POWER MANAGEMENT SYSTEM ARCHITECTURE 88 3.3 POWER MANAGEMENT SYSTEM HARDWARE 89 3.4 POWER MANAGEMENT FUNCTIONS 91

4 POWER DISTRIBUTION 108 4.1 POWER DISTRIBUTION SCHEMES 108 4.2 POWER PLANT CONFIGURATIONS 117 4.3 OPERATIONAL CONFIGURATION 123 4.4 TRANSFERABLE AND DUAL FED CONSUMERS 125 4.5 BATTERY SYSTEMS 126 4.6 SEPARATION OF REDUNDANT ELEMENTS FOR FIRE AND FLOOD 128

5 VESSEL MANAGEMENT SYSTEMS 130 5.1 GENERAL DESCRIPTION 130

IMCA GUIDANCE


W/S No: 55/130502 Page 5 of 194



5.2 NETWORK TECHNOLOGY 136 5.3 REDUNDANCY 147

6 THRUSTERS, DRIVES AND CONTROLS 152 6.1 GENERAL PROPULSION PRINCIPLES 152 6.2 THRUSTER FAILURE MODES 153 6.3 THRUSTER AUXILIARY SYSTEMS 163 6.4 THRUSTER MOTORS 167 6.5 VARIABLE SPEED DRIVES 167 6.6 THRUSTER CONTROL SYSTEMS 171

7 SAFETY SYSTEMS 177 7.1 GENERAL PRINCIPALS OF SAFETY SYSTEMS 177 7.2 REGULATIONS RELATING TO SHUTDOWN SYSTEMS 177 7.3 ESD SYSTEMS AND DP REDUNDANCY 178 7.4 ACTIVE FIRE PROTECTION 181 7.5 EFFECTS OF VENTILATION SYSTEM SHUTDOWN 183 7.6 GROUP STOPS 184 7.7 CONTROL ROOM LAYOUTS 184

APPENDIX A LIST OF ABBREVIATIONS 188

FIGURES

Figure 2-1 Impedance as the Combination of Resistance and Reactance 16 Figure 2-2 Current and Voltage in Phase – Purely Resistive Load 17 Figure 2-3 Current Lagging Voltage by 30º - Slightly Inductive Load 18 Figure 2-4 Instantaneous Power for a Purely Resistive Load 19 Figure 2-5 Instantaneous Power for a slightly inductive load 19 Figure 2-6 Active, Reactive and Apparent Power 20 Figure 2-7 Conductor Passing Through a Magnetic Field Induces an EMF 21 Figure 2-8 Current Carrying Conductor in a Magnetic Field Experiences a Force 21 Figure 2-9 Cross-section of Four Pole, Salient Pole Alternator 22 Figure 2-10 Three-phase alternator with Wye (star) winding 23 Figure 2-11 Voltage waveforms for Red, Yellow and Blue Phases of 11kV Alternator 23 Figure 2-12 Elementary Three-Phase Equivalent Circuit of Synchronous Alternator 24 Figure 2-13 Phasor diagram 25 Figure 2-14 Generator Capability Plot 26 Figure 2-15 Generator Operating Point 27 Figure 2-16 MAN 16V 32/40 Courtesy MAN 32/V40 Project Guide 29 Figure 2-17 MAN 8L 32/40 Courtesy MAN 32/40 Project Guide 29 Figure 2-18 Medium Speed Engine Starting Time 31 Figure 2-19 Load Increase Rates for Generators Operating at Synchronous Speed 33 Figure 2-20 Engineroom combustion air supply and ventilation 38

IMCA GUIDANCE


W/S No: 55/130502 Page 6 of 194



Figure 2-21 Engine HT and LT Cooling Water System 40 Figure 2-22 Engine Control and Protection Based on Engine Manufacturer’s Systems 43 Figure 2-23 Engine Control and Protection Based on Vessel Automation System 44 Figure 2-24 Typical control power arrangement 45 Figure 2-25 engine control power with PMG backup 45 Figure 2-26 Independent engine control supplies 46 Figure 2-27 Diode isolated dual supplies 46 Figure 2-28 Alternator with PMG 49 Figure 2-29 Alternator with AVR powered by Generator VT 50 Figure 2-30 Alternator with auxiliary winding 50 Figure 2-31 Electronic governor with hydraulic actuator 53 Figure 2-32 Speed control for common rail ‘electronic’ engine 54 Figure 2-33 Forward and reverse acting actuators. 54 Figure 2-34 Generators load sharing by speed droop 56 Figure 2-35 Analogue load sharing lines 57 Figure 2-36 Digital load sharing lines 58 Figure 2-37 Master slave load sharing system 59 Figure 2-38 Electronic governor 61 Figure 2-39 Speed offset signal 61 Figure 2-40 Modern digital governor 62 Figure 2-41 Automatic Voltage Regulator - (Divert type) 63 Figure 2-42 Relationship of phase and line quantities 65 Figure 2-43 Voltage representing Blue line current is added to Red-Yellow Line voltage 65 Figure 2-44 Sense voltage increases as reactive component of current increases 65 Figure 2-45 Cross Current Compensation 66 Figure 2-46 Cross current loop - voltage across resisters balances to zero 67 Figure 2-47 Metal enclosed switchgear 69 Figure 2-48 Time graded over current protection 73 Figure 2-49 Differential protection 74 Figure 2-50 Directional over current protection 75 Figure 2-51 Directional over current protection 76 Figure 2-52 Methods of marine power system earthing 77 Figure 2-53 Generator protection relay 80 Figure 2-54 Principle of AGP 87 Figure 3-1 Integrated Automation System 90 Figure 3-2 Standalone PMS 90 Figure 3-3 Blackout detection from single source 93 Figure 3-4 Signals relating to load reduction 98 Figure 3-5 Example Power System 101 Figure 3-6 Initial Thruster, Crane and Hotel Loads 102 Figure 3-7 Thruster, Crane and Hotel Loads after Loss of one 5MW Generator 102

IMCA GUIDANCE


W/S No: 55/130502 Page 7 of 194



Figure 3-8 Effect on Power Available Signals to Thruster and Crane 103 Figure 3-9 Sudden Demand for Thrust 104 Figure 3-10 Bus Load and Power Available Following Large Demand for Thrust 104 Figure 3-11 Thruster Step Load of 5MW 105 Figure 4-1 Service transformers 111 Figure 4-2 Harmonics distortion from 12 pulse drives on 6.6kV marine power systems 113 Figure 4-3 Harmonic content of 6.6kV voltage waveform 114 Figure 4-4 Inter trip for parallel service transformers 116 Figure 4-5 Interlocks to prevent parallel service transformer operation 117 Figure 4-6 Shore supply interlock 117 Figure 4-7 Asymmetric two way split 118 Figure 4-8 Three-way split 118 Figure 4-9 Transferable or dual fed thrusters 118 Figure 4-10 Four way split for semi-submersible 119 Figure 4-11 Split reactor power plant 121 Figure 4-12 Phase shifted power system 122 Figure 4-13 Grid interconnector based power system 122 Figure 4-14 Power supplies to thrusters and their auxiliary systems 123 Figure 4-15 Double conversion or online UPS 128 Figure 5-1 Basic Distributed Control System 130 Figure 5-2 Fieldbus Communications using Profibus DP Protocol 131 Figure 5-3 Star Topology 132 Figure 5-4 Physical Star Logical Bus 133 Figure 5-5 Dual Redundant Star Topology 134 Figure 5-6 Bus Topology 134 Figure 5-7 Physical Bus Logical Ring 135 Figure 5-8 Physical Ring Topology 135 Figure 5-9 Dual Ring Topology 136 Figure 5-10 OSI Network Model 138 Figure 5-11 RS 485 Bus Segment 141 Figure 5-12 FIP Network Configuration 145 Figure 5-13 CANbus Arbitration 146 Figure 5-14 Typical Redundant Field Station 148 Figure 5-15 Redundant Power Supplies 148 Figure 5-16 Typical Control Network 150 Figure 5-17 Typical Line Monitoring Circuit 151 Figure 6-1 Relationship between power and thrust 153 Figure 6-2 Voith Schneider propeller 154 Figure 6-3 Tunnel thruster 155 Figure 6-4 Azimuthing thruster 156 Figure 6-5 Podded thruster 157

IMCA GUIDANCE


W/S No: 55/130502 Page 8 of 194



Figure 6-6 Thruster hydraulic system 164 Figure 6-7 Thruster lubrication system 165 Figure 6-8 Thruster cooling water unit 166 Figure 6-9 Cycloconverter Drive 168 Figure 6-10 Synchroconverter drive 168 Figure 6-11 Voltage source PWM drive 170 Figure 6-12 Variable speed thruster drive 171 Figure 6-13 Sine / cosine potentiometer 172 Figure 6-14 Thruster control unit 174 Figure 6-15 Thruster emergency stops 175 Figure 7-1 Simple Centralise Emergency Stop System 178 Figure 7-2 ESD and F&G System Integrated into VMS 179 Figure 7-3 ESD 0 Split to Match Redundancy Concept 181 Figure 7-4 Typical CO2 fire fighting systems for large vessel 183 Figure 7-5 Fire damper controls 184 Figure 7-6 Positioning of ESD/Safety Systems 185

TABLES

Table 1-1 DP Related Equipment and Functions Associated with the Redundancy Concept 14 Table 2-1 Typical Engine Speeds and Pole Arrangements for 50Hz & 60Hz alternators 24 Table 2-2 Diesel Engine Speed and Typical Use 28 Table 2-3 Maximum Permissible Step Load 34 Table 2-4 Generator Protective Functions 81 Table 4-1 Voltage distribution levels - large vessels 109 Table 4-2 Voltage distribution levels - Smaller vessels 110 Table 5-1 Profibus Maximum Segment Length 141 Table 5-2 Modbus ASCII and RTU Properties 143

EQUATIONS

Equation 2-1 Ohm’s Law 16 Equation 2-2 Impedance 17 Equation 2-3 EMF 21 Equation 2-4 Force 21 Equation 2-5 Relationship between Line and Phase voltage in Wye winding. 23 Equation 2-6 Relationship between speed, frequency and number of poles 24 Equation 2-7 Three Phase Power 26 Equation 4-1 Transformer formula 111

IMCA GUIDANCE


W/S No: 55/130502 Page 9 of 194



1 INTRODUCTION

1.1 GENERAL INTRODUCTION AND SCOPE OF DOCUMENT

1.1.1 This handbook is intended to provide a reference guide for those involved in all aspects of dynamic positioning with particular relevance to those involved in designing, assessing and maintaining dynamically positioned diesel electric vessels.

1.1.2 This document consolidates and updates three existing DPVOA / IMCA guidance documents:-

1. 126 DPVOA – Reliability of Electrical System on DP Vessels

2. 108 DPVOA – Power System Protection and DP Vessels

3. IMCA M154 – Power Management Study

1.2 ELECTRIC PROPULSION

1.2.1 Electric propulsion using steam turbines or diesel engines as the prime mover has been used in ships since the early 1900s. Diesel electric propulsion is now almost universal amongst medium and large dynamically positioned vessels but direct driven and hydraulically driven thrusters are still used in certain applications.

1.2.2 In its simplest form, diesel electric propulsion consists of a diesel engine driving an electrical generator which is connected to a motor driven propeller or thruster by way of an electric cable. The generator and motor may be of the alternating current or direct current type or of different types if converters are included. The thrust developed by the propeller may be controlled by varying the speed of the engine, the speed of the motor, or by varying the pitch of the propeller. Such simple systems can still be found in certain applications but the vast majority of medium to large DP vessels have a diesel electric power plant based on the power station concept.

IMCA GUIDANCE


W/S No: 55/130502 Page 10 of 194



1.3 POWER STATION CONCEPT

1.3.1 In the power station concept, electric power is provided by several synchronous alternating current generators operating in parallel. The generators are connected to switchboards by way of circuit breakers that allow the generators and loads such as thrusters, service transformers and motors to be connected and disconnected as required. Typical power plants have 4, 6 or 8 generators connected to two or more switchboards.

1.3.2 The advantages of the power station concept include:-

1. Greater freedom in location of engines and thrusters

2. Ability to provide large amounts of power for activities other than propulsion

3. Ease with which power can be distributed for auxiliary systems

4. Ease of thrust control for systems of multiple propellers

5. Well suited to fault tolerant and redundant propulsion systems

6. Modular designs allow maintenance to continue during operations

7. Good power plant efficiency

1.3.3 The disadvantages of the power station concept include:-

1. High initial cost

2. Complexity

3. Specialist maintenance requirements

4. The need to maintain a large spinning reserve in fault tolerant DP systems can reduce the efficiency of the power plant and introduce maintenance and emission control issues.

1.4 CONVENTIONAL PROPULSION

1.4.1 Conventional propulsions systems are still widely used in DP applications usually in combination with limited diesel electric systems. Offshore supply vessels and anchor handlers will often have conventional marine engine installations with, gearbox, shaft line and controllable pitch propellers to provide high transit speeds and along ships thrust. A combination of shaft alternators driven by the main engines and auxiliary generators provide power for thrusters and auxiliary systems.

1.4.2 Some offshore supply vessels use direct diesel driven thrusters. Thrust is controlled by varying the engine speed over a certain range and by varying pitch at lower speeds. In some arrangements a slipping clutch is used to control speed at the lower speed range when a fixed pitch propeller is used.

1.4.3 Thrusters driven by a hydraulic motor and power pack are also used in some applications.

IMCA GUIDANCE


W/S No: 55/130502 Page 11 of 194



1.5 CONCEPTS OF FAULT TOLERANCE AND CONTROL SYSTEMS

1.5.1 All DP Class 2 and DP Class 3 vessels are required to be fault tolerant, although there are slight variations between the major Classifications Societies, almost all have requirements similar to those described in IMO MSC 645, ‘Guidelines for Vessels With Dynamic Positioning Systems’, which states in Section 2.2:-

1. For equipment class 1, loss of position may occur in the event of a single fault.

2. For equipment class 2, loss of position is not to occur in the event of a single fault in any active component or system. Normally static components will not be considered to fail where adequate protection from damage is demonstrated and reliability is to the satisfaction of the Administration. Single failure criteria include:

a. Any active component or system (generators, thrusters, switchboards, remote controlled valves, etc)

b. Any normally static component (Cables, pipes manual valves, etc.) which is not properly documented with respect to protection and reliability.

3. For equipment class 3, a single failure includes:

a. Items listed above for Class 2, and any normally static component is assumed to fail.

b. All components in any one watertight compartment, from fire or flooding.

c. All components in any one fire sub-division, from fire or flooding.

1.5.2 Key elements of fault tolerant systems

1.5.2.1 In DP vessel design, fault tolerance is generally achieved by redundancy. Redundancy is defined as having more than one means of carrying out the same function. However the effectiveness of redundancy is degraded if each method of carrying out the function is not sufficiently reliable. The International Electrotechnical Vocabulary’, IEC 60050, defines redundancy and reliability as follows

Reliability ‘The probability that an item can perform a required function under given conditions for a given time interval’

Redundancy ‘The existence of more than one means of performing a required function’

IMCA GUIDANCE


W/S No: 55/130502 Page 12 of 194



1.5.2.2 In fault tolerant systems based on redundancy there are three important elements that must be present and maintained these are:-

1. Equivalence

2. Independence

3. Confidence

1.5.2.3 In practical terms these requirements can be translated to:-

1. Performance

2. Protection

3. Detection

1.5.3 Equivalence

1.5.3.1 Redundant elements must be present in both number and capacity, that is to say that if there are redundant means of performing a function then the secondary means should provide the same level of performance as the primary means. If this is not the case then the vessel’s post failure capability will be determined by the performance of the secondary system.

1.5.4 Independence

1.5.4.1 In practical fault tolerant system based on redundancy there will be a number of common points where redundant elements are linked together. There must be a comprehensive set of protective functions designed to ensure that faults in one redundant element are prevented from adversely affecting the performance of all other redundant elements connected by that common point.

1.5.5 Confidence

1.5.5.1 Where fault tolerance depends on back up system or standby redundancy there will always be a degree of uncertainty about the availability of the equipment when required. Alarms and period testing are generally accepted as means of providing the necessary level of confidence.

1.5.5.2 Fault tolerance also depends on all systems being set up correctly. The correct configuration of such things as cross over valves, backup electrical supplies and duty / standby pumps should be recorded in the appropriate DP checklists.

1.6 DP CLASS 2 & 3 REDUNDANCY CONCEPTS

1.6.1 All DP Class 2 and DP Class 3 vessels must be able to maintain position and heading following any defined single failure appropriate to their DP equipment class. The Worst Case Failure Design intent (WCFDI) defines the minimum amount of propulsion machinery which remains fully operational following the Worst Case Failure and therefore defines the vessel’s post failure capability.

1.6.2 DP Class 2 and DP Class 3 vessels should work within their post failure DP capability, when conducting operations requiring a vessel of that equipment class, so that position and heading can be maintained following a failure.

IMCA GUIDANCE


W/S No: 55/130502 Page 13 of 194



1.6.3 The redundancy concept is the means by which the Worst Case Failure Design Intent is assured and describes how fault tolerance is achieved on a system by system basis. The redundancy concept will be described in the vessel’s DP system Failure Modes and Effects Analysis but may also be contained in a standalone document or in the DP operations manual.

1.6.4 For DP Class 2 the redundancy concept will explain the effects of technical failures within each subsystem of the overall DP system and describe any features and functions upon which fault tolerance depends.

1.6.5 For DP Class 3 the redundancy concept will also describe how the DP system is able to maintain position and heading following the loss of one fire sub division or watertight compartment to the effects of fire or flooding.

1.6.6 In the language of some classifications societies these properties of fault tolerance are described as ‘Redundancy in technical design’ for DP Class 2 with the addition of ‘physical separation’ of redundant elements for DP Class 3.

1.7 FAILURE MODES AND EFFECTS

1.7.1 Throughout the technical discussions that follow, reference is made from time to time to the ways in which systems can fail. The term ‘failure mode’ is used to indicate the manner in which a component or subsystem fails. A faulty component may have several modes of failure. For example, a cable may fail, open circuit, short circuit or develop an earth fault. One component failure mode can have a relatively benign effect while another may cause a blackout. Particular attention must be paid to components that can fail in an active way and not just to an inert state. Generator control systems are a typical example of systems that can fail in this way.

1.7.2 The term ‘failure effect’ is used to describe the effect of that failure mode on the system itself and the systems to which it is connected. The term ‘end effect’ is sometimes used to describe the effect of a particular failure mode on the vessel’s ability to maintain position and heading.

1.7.3 It is a classification society requirement that the fault tolerance of DP Class 2 and DP class 3 vessels is proven by a failure modes and effects analysis.

1.7.4 Typical list of equipment and functions related to DP

1.7.5 Table 1-1 below provides a typical list of the equipment and functions that have an impact on a DP Class 2 or DP Class 3 redundancy concept. Not every vessel will have all the equipment or functions listed but most modern diesel electric vessels will have something along these lines.

IMCA GUIDANCE


W/S No: 55/130502 Page 14 of 194



Table 1-1 DP Related Equipment and Functions Associated with the Redundancy Concept

1 2 3 4 6 7 8 9 10

Engines and Auxiliary Systems

Power Generation

Power Management

Power Distribution

Thrusters & main propulsion

Vessel Management

DP Control Safety systems

Separation for fire and flood

1 Engines and engine mounted systems

Alternators PMS architecture

High Voltage or > 1000V generation level

Tunnel thrusters Topology Main & Backup DP controllers

Fixed fire fighting systems

Cable routes

2 Engine control system and shutdowns

Generator and switchgear control

Standby selection

Service Drilling ROV Diving Pipe-lay

Azimuth thrusters Operator stations Operator stations Fire

dampers Pipe routes

3 Fuel oil storage transfer & distribution

Generator Protection

Generator start/stop

Major auxiliaries 380V – 440V

Main propellers Field stations Remote I/O DP Networks Watertight

dampers Fire sub divisions

4 Lubrication including pre-lube

Bus bar protection

Active and reactive power sharing

LV protection Gearboxes Hubs & Switches

Vessel sensors MRU, gyros, wind, draught gauges

ESD Watertight compartments

5 Cooling SW Synchronising Load dependent start/stop

Service transformers Rudders Distribution

units Position references DGPS,HPR,TW,FB F&G Watertight

doors

6 Cooling LTFW Governors Alarm start Lighting, small power 120V - 220V

Motors UPS for VMS Manual thruster controls

Group E-stop

Compartment analysis

7 Cooling HTFW AVRs PMS blackout prevention

Emergency 380V – 440V Motor starters Independent

Joystick

IMCA GUIDANCE


W/S No: 55/130502 Page 15 of 194



1 2 3 4 6 7 8 9 10

Engines and Auxiliary Systems

Power Generation

Power Management

Power Distribution

Thrusters & main propulsion

Vessel Management

DP Control Safety systems

Separation for fire and flood

8 Charge air cooling / heating

Manual switchboard Controls

Blackout prevention in other systems

Emergency 120V - 220V

Variable speed drives UPS for DP

9 Fuel valve cooling

Blackout restart and recovery

Switchboard control supplies

Thrusters auxiliaries Voice

communication

10 Start air Heavy consumer control

Battery systems 24V dc, 110Vdc,

Thruster shutdowns DP Alert

11 Control air Auto reconfiguration

Wheelhouse 24Vdc

Thruster emergency stops

12 Service air

Control and starting supplies for emergency generator

Speed Torque Pitch control

13 Engineroom ventilation UPS for other

systems Azimuth control

14 Remote control valves Interlocks

15 Emergency Generator

Ventilation & HVAC for spaces other than ER

IMCA GUIDANCE


W/S No: 55/130502 Page 16 of 194



2 POWER GENERATION

2.1 GENERAL PRINCIPLES OF POWER GENERATION

2.1.1 Voltage, Current and Power

2.1.1.1 When a voltage (V) is applied across an electric load it will draw a current (I) depending on the impedance (Z) of the load according to the relationship in Equation 2-1. For alternating current circuits, V, I and Z are complex quantities.

IZV =

Equation 2-1 Ohm’s Law

2.1.1.2 Impedance is measured in Ohms (Ω) and may be resistive or reactive or a combination of these. Reactance (X) itself may be inductive (XL) or capacitive (XC) such that impedance is the algebraic sum of resistance and reactance.

1. Resistance (R) is also measured in Ohms,

2. Inductance (L) is measured in Henrys (H)

3. Capacitance (C) is measured in Farads (F)

2.1.1.3 By convention, inductive reactance is considered to be positive and capacitive reactance is considered to be negative. Figure 2-1 shows the impedance triangle which is one of the core principles of electrical engineering.

Figure 2-1 Impedance as the Combination of Resistance and Reactance

IMCA GUIDANCE


W/S No: 55/130502 Page 17 of 194



2.1.1.4 Where the applied voltage is sinusoidal, the current drawn by the load is displaced with respect to the applied voltage depending on the combination of resistance and reactance. A load consisting of purely capacitive reactance draws a sinusoidal current which leads the applied voltage by 90º. Similarly a load consisting of purely inductive reactance draws a current which lags the applied voltage by 90º. Where the load has an impedance containing both resistance and reactance the current will lead or lag the applied voltage depending on the relative amounts of each. Figure 2-2 shows the current and voltage relationship for a resistive load. Figure 2-3 shows the same for a load with some resistance and some inductive reactance such that the current waveform lags the applied voltage waveform by 30º. The magnitude and angle of an impedance can be calculated using Equation 2-2 below.

RXZXRZ arctan22 =∠+=

Equation 2-2 Impedance

0 5 10 15 20-10

-5

0

5

10

Time (ms)

Vol

tage

-RED

, Cur

rent

-BLU

E

Figure 2-2 Current and Voltage in Phase – Purely Resistive Load

IMCA GUIDANCE


W/S No: 55/130502 Page 18 of 194



0 5 10 15 20-10

-5

0

5

10

Time (ms)

Vol

tage

-RE

D, C

urre

nt-B

LUE

Figure 2-3 Current Lagging Voltage by 30º - Slightly Inductive Load

2.1.1.5 The instantaneous power at any point in time is the product of the instantaneous voltage and current. Figure 2-4 shows that power flow is always positive from the resistive load. This represents fuel from the generator’s fuel tank being turned into mechanical power and waste heat. On the other hand, power flow goes negative in Figure 2-5 indicating that a certain amount of power is being exchanged between the generator and the load. Note that in the case of a thruster motor powered by a variable speed drive with a rectifier front end, the power interchange is between the motor and the drive and thus the generator sees the power factor of the drive and not the motor.

IMCA GUIDANCE


W/S No: 55/130502 Page 19 of 194



0 5 10 15 20-2

0

2

4

6

8

10

12

Time (ms)

Inst

anta

neou

s Po

wer

Figure 2-4 Instantaneous Power for a Purely Resistive Load

0 5 10 15 20-2

0

2

4

6

8

10

Time (ms)

Inst

anta

neou

s P

ower

Figure 2-5 Instantaneous Power for a slightly inductive load

2.1.1.6 The displacement of voltage and current gives rise to the concept of power factor. The power factor of a load ‘Cos Ø’ can be defined in several ways such as the ratio of the apparent power (product of V and I) to the active power (kW) or as the Cosine of the angle between the voltage and current in the case of Figure 2-3 the Power Factor is Cos 30º = 0.866.

IMCA GUIDANCE


W/S No: 55/130502 Page 20 of 194



2.1.1.7 Many marine loads draw a combination of active (P) and reactive power (Q). The active power is measured in Watts or Kilowatts and can be thought of as useful work and waste heat. This requires the consumption of fuel. The reactive power is measured in Volt Amps reactive or kVAr. It is used to maintain the electric and magnetic fields in the cables and electric machines and does not require fuel consumption. Together, the active and reactive power combine algebraically to give the apparent power and the power factor of any load as show in Figure 2-6

Figure 2-6 Active, Reactive and Apparent Power

2.1.1.8 Power factor can vary between 0 and 1 with 0 representing an entirely reactive load and 1 representing an entirely active (resistive) load. Non adjustable loads such as heaters will have unity power factor but pumps and fans will usually have a power factor in the region of 0.85. Loads which can vary the amount of active power they can draw from the generators (such as thruster motors) can have a variable power factor which improves as they draw more active power. Although reactive power does not directly equate to fuel consumption the fact that additional generators must be online to supply the reactive power means that there are additional losses associated with the inefficiency of running another generator just for this purpose. Power factor correction is the term applied to schemes intended to supply reactive power from sources other than generators to improve overall plant efficiency.

2.1.2 Generating electricity

2.1.2.1 There are several ways of generating electricity, such as fuel cells, piezo-electric effects and chemical reactions, but the method employed for large scale power generation involves moving a conductor (or system of conductors) through a magnetic field or moving a magnetic field past a system of conductors as shown in Figure 2-7. This principle is employed in AC and DC power conversion and is governed by Equation 2-3 and Equation 2-4 where:-

1. E is the electro motive force generated in the conductor in Volts

2. B is the magnetic flux density in Tesla,

3. I is the current in Amperes

IMCA GUIDANCE


W/S No: 55/130502 Page 21 of 194



4. l is the length of the conductor in metres,

5. v is the velocity of the conductor in meters per second

6. F is the force in Newtons

2.1.2.2 Note that a force will be created on a stationary current carrying wire sitting in a magnetic field (motor effect) as shown in Figure 2-8. However, to induce an electro motive force (voltage) in a wire and therefore drive a current through a load, the wire must be moving (generator effect).

BlvE =

Equation 2-3 EMF

BlIF =

Equation 2-4 Force

l

Figure 2-7 Conductor Passing Through a Magnetic Field Induces an EMF

l

Figure 2-8 Current Carrying Conductor in a Magnetic Field Experiences a Force

IMCA GUIDANCE


W/S No: 55/130502 Page 22 of 194



2.1.3 Alternators

2.1.3.1 Almost all diesel electric DP vessels use variations on the three-phase, brushless, self-exciting, synchronous alternator as the means of generating electricity. The alternator converts mechanical energy from the diesel engine into electrical energy at nominally constant voltage and frequency. The frequency and voltage produced by the alternator are determined by design parameters but for a given design the frequency of the output waveform is controlled by varying the speed of the diesel engine and the voltage by controlling the current in the rotor winding. The power delivered by the alternator is controlled by varying the fuel admission to the engine. There are two dedicated control systems for this purpose, the engine governor and the automatic voltage regulator. When generators of this type operate in parallel with each other, all connected machines naturally run at exactly the same speed (or related speed if different number of poles) and are said to be synchronised together.

2.1.3.2 Figure 2-9 shows the cross section of a salient pole alternator.

Figure 2-9 Cross-section of Four Pole, Salient Pole Alternator

2.1.3.3 The three-phase winding is located on the stator (or stationary part) and typically configured as a ‘Wye’ (or star) as shown in Figure 2-10. The rotor winding is located on the rotating part and arranged to create the required number of magnetic poles. On a salient pole alternator (as opposed to one with a cylindrical rotor) the rotor poles are easily identified and each is capped with a dedicated pole piece. On brushless alternators the rotor winding is connected to a small ac generator (exciter) mounted on the same shaft by way of diodes. The stationary part of the exciter winding is powered from the automatic voltage regulator.

2.1.3.4 The stator winding may have a three or four wire connection depending on whether the neutral point (or star point) of the Wye is used. The terminals of the machine are often annotated Red, Yellow and Blue or U V W. Note that it is possible to specify an alternator with a clockwise or anticlockwise phase rotation and this needs careful consideration in relation to an engine’s direction of rotation. Failure to properly specify the direction of rotation can result in problems in the distribution system including motors running the wrong way.

IMCA GUIDANCE


W/S No: 55/130502 Page 23 of 194



Figure 2-10 Three-phase alternator with Wye (star) winding

2.1.3.5 The stator winding is arranged to create a 120º phase shift between the three voltage waveforms produced. Figure 2-11 shows the phase voltage waveforms produced by an 11kV, 60Hz alternator.

0 5 10 15 20-10

-5

0

5

10

Time (ms)

Vol

tage

(kV)

Figure 2-11 Voltage waveforms for Red, Yellow and Blue Phases of 11kV Alternator

2.1.3.6 The alternator’s nameplate voltage rating is called the ‘line voltage’ and refers to the Root Mean Square (RMS) voltage between the terminals e.g. Red to Blue, Blue to Yellow and Yellow to Red. The term ‘phase voltage’ refers to the voltage developed across each winding e.g. Red to Neutral, Yellow to Neutral and Blue to Neutral. The phase voltage and the line voltage are related as shown in Equation 2-5. The line currents are equal to the phase currents in a Wye winding.

3 VphaseVline =

Equation 2-5 Relationship between Line and Phase voltage in Wye winding.

IMCA GUIDANCE


W/S No: 55/130502 Page 24 of 194



2.1.3.7 Equation 2-6 below can be used to determine the engine speed required to produce the desired frequency for an alternator with ‘p’ poles. Table 2-1 lists the engines speeds required to produce 50Hz and 60Hz from 4, 8 and 10 pole alternators.

pfn 120

=

polesofnumberthepandfrequencyfminutepersrevoultioninspeednwhere === ,

Equation 2-6 Relationship between speed, frequency and number of poles

Table 2-1 Typical Engine Speeds and Pole Arrangements for 50Hz & 60Hz alternators

Engine Speed (rpm) Frequency (Hz) Number of Poles

1800 60 4

1500 50 4

900 60 8

750 50 8

720 60 10

2.1.3.8 The basic, per phase, equivalent circuit of an elementary three phase synchronous alternator operating under steady state conditions is shown in Figure 2-12 below. E represents the Electro Motive Force (EMF) created by the excitation system and Xs is the internal impedance, called the synchronous reactance, represented by an inductance. V is the voltage across one winding (phase voltage) at the terminals of the machine. In practice, the windings also have resistance but this is generally neglected for ease of comprehension.

Figure 2-12 Elementary Three-Phase Equivalent Circuit of Synchronous Alternator

IMCA GUIDANCE


W/S No: 55/130502 Page 25 of 194



2.1.3.9 The phasor diagram in Figure 2-13 shows the currents and voltages when the generator is delivering power to a lagging (inductive load) as is typical for a marine application.

Figure 2-13 Phasor diagram

2.1.3.10 The phasor sum of the terminal voltage (V) and the voltage drop across the internal impedance (ILXS) add to give the EMF of the machine. The angle of the internal voltage drop depends on the power factor (Cos Φ) of the load and together with the magnitude of the current being supplied determines the load angle (δ) of the generator. In theory, the alternator will stay synchronised for load angles up to 90º but in practice, the stability limit of the machine will be much lower. Large voltage and current swings can occur if a machine loses synchronism with other machines when the practical limit is exceeded.

2.1.4 Generator Capability

2.1.4.1 Several other design features determine the operating limits of the generating set and it is common practice to develop a generator capability plot which shows the steady state limits of machine operation as shown in Figure 2-14. The plot takes the form of a P and Q axis with the 1st quadrant representing power flow out of the generator and lagging reactive power. In most practical applications, the upper limit is determined by the power that can be delivered by the engine. The limits of positive reactive power are defined by the thermal rating of the windings. The limits of negative reactive power form the practical limit of stability. Parallel operation beyond this limit risks the machine breaking synchronism leading to severe voltage and current transients with the potential for blackout. In practical operations the machine will almost always operate in the first quadrant. How the alternator is protected against the effects operating out with this envelope is discussed later in section 2.12.

IMCA GUIDANCE


W/S No: 55/130502 Page 26 of 194



Figure 2-14 Generator Capability Plot

2.1.5 Alternator nameplate power factor and operating power factor

2.1.5.1 The nameplate power factor of an alternator is just one of the parameters used to define the power capability of a generating set. Electrical standards typically state that the output rating of the generator will be given in kVA at rated voltage, current, frequency and power factor. Alternators are rated in kVA or MVA but the amount of active power (kW) they can deliver is determined by the power of the engine driving the alternator. The amount of current they can deliver is determined by winding construction and cooling etc.

2.1.5.2 The nameplate power factor (Cos Ø) is the ratio of the real power (P in kW) delivered to the apparent power (S in kVA) delivered when the generator is operating at rated current, voltage and frequency. cos Ø = P/S

2.1.5.3 Typical nameplate data:-

1. 5375kVA = S = Apparent power (approx 5.3MVA)

2. 11kV = VLINE

3. 282A = ILINE

4. 0.8 p.f. (Cos Ø)

2.1.5.4 From the information above it is possible to calculate the rated output power by using Equation 2-7.

Ø3 CosIVP LINELINE=

Equation 2-7 Three Phase Power

IMCA GUIDANCE


W/S No: 55/130502 Page 27 of 194



2.1.5.5 The mechanical power into the shaft of the alternator must be higher than the electrical power output so the example alternator would typically be driven by an engine capable of slightly more power than this to allow for losses such as fiction, windage and waste heat.

2.1.5.6 The nameplate power factor indicates how much reactive power (kVAr) the generator can supply continuously without overheating when it is delivering rated active power (kW). In the case of the example generator 4.3MW / 5.3MVA = 0.8. The nameplate power factor operating point is just one point in the generator’s operating range.

2.1.5.7 The operating power factor is the ratio of the real power (kW) to the apparent power (kVA) that the generator is actually supplying to any load, and changes as the load conditions change, so can be any value from 0 to 1, leading or lagging - (loads are mostly lagging)

2.1.5.8 The generator can supply loads at any operating power factor within its capability curve. If the operating point goes outside the capability curve the alternator may trip on over current or some other protective function. It may also become unstable and lose synchronism with the network if the operating point swings across the stability limit.

2.1.5.9 However, regardless of nameplate details the generator must accept whatever power factor is demanded by the load, as shown in Figure 2-15. In the case of parallel operation of two or more generators, each generator can be arranged to provide different portions of the kW and kVAr demand (normally set to be equal).

(W) ACTIVE POWER

W LIMIT IMPOSED BY ENGINE

1ST

QUADRANT

LOAD ANGLE

PRACTICAL STABILITY LIMIT

Ø

δ

WINDING THERMAL LIMIT

OPERATING POWER FACTOR

REACTIVE POWER (VAr)

OPERATING POINT

3MW

1.5 MW

3MVAr1.0MVAr

Figure 2-15 Generator Operating Point

IMCA GUIDANCE


W/S No: 55/130502 Page 28 of 194



2.2 ENGINES

2.2.1 Marine Engine Types

2.2.1.1 Engines for electric power plant are almost invariably four stroke, turbocharged medium speed diesel engines. Some applications use two stroke diesels, and others such as those for FPSOs make use of dual fuel (MDO or fuel gas), and some applications use gas turbines.

2.2.1.2 Marine diesel engines are categorised by their speed. Table 2-2 shows the speed range and traditional application in DP vessel power plant. Slow speed engines are used primarily in merchant vessel applications and usually only found in DP vessels that have been converted from an existing merchant ship such as a tanker.

Table 2-2 Diesel Engine Speed and Typical Use

Category Speed range Application

High speed >1000 rpm Auxiliary and emergency generators

Medium speed 400 – 1000 rpm Main, auxiliary and emergency generators

Main propulsion engines

Slow speed < 400 rpm Main propulsion engines

2.2.1.3 Typical medium speed diesel engines for DP vessel applications are rated from around 1MW in small vessels to 10MW in large vessels. Installations of 4, 6 or 8 engines are commonplace with 2MW to 7MW being a popular power range. The engines are invariably multi cylinder units in either ‘in-line’ or ‘V’ configuration as shown in Figure 2-16 and Figure 2-17 below.

IMCA GUIDANCE


W/S No: 55/130502 Page 29 of 194



.

Figure 2-16 MAN 16V 32/40 Courtesy MAN 32/V40 Project Guide

Figure 2-17 MAN 8L 32/40 Courtesy MAN 32/40 Project Guide

2.2.2 Engine rating

2.2.2.1 Diesel engines for generators are rated in kW at synchronous speed. The engine manufacturer’s data sheets may provide information such as:

1. Cylinder bore 320 mm

2. Piston stroke 400 mm

3. Cylinder output 500 kW/cyl

4. Speed 750 rpm

5. Mean effective pressure 24.9 bar

IMCA GUIDANCE


W/S No: 55/130502 Page 30 of 194



2.2.2.2 For an HV generator, the electrical power output is typically around 3% less than the power rating of the engine, to allow for the losses in the electrical machine. In the case of vessels with different sizes of engines such as in a ‘father – son’ arrangement, the same alternator may be fitted to all the engines such that the smaller engine is rated well below the alternator rating. Care must be taken when specifying engine and generators of different sizes. Transient stability may require closer scrutiny as the difference in generator ratings approaches 2:1.

2.2.3 IMO NOx Emissions

2.2.3.1 The performance of modern diesel engines is influenced by the need to comply with IMO requirements for exhaust gas emissions described in Annex VI of the MARPOL 73/78 convention. Engines complying with these requirements are described as IMO Tier I. Further reductions in NOx emissions to be designated IMO Tier II and Tier III become effective for ships built on, or after, the 1st of January 2011 and 2016 respectively.

2.2.4 Speed regulation

2.2.4.1 Diesel engines are fitted with a speed governor, which will control the engine fuel admission, so as to maintain the desired speed (and load in the case of parallel operation of generators) within the engine’s ability to accept the load change. In diesel electric power plants it is possible for very large load changes to occur in normal operation, or in response to faults in the power system, and the plant designers must ensure that measures are in place to limit the magnitude and rate of change of load to levels within the capability of the engines. The ease with which the power consumption of large variable speed drives can be controlled has greatly improved the management of such load changes.

2.2.4.2 The major classification societies are fairly well aligned on requirements for the speed regulation of engines for main and emergency power. In general:-

1. Transient frequency variations will not exceed 10%

2. Steady state frequency must be achieved within 5s of the maximum permissible step load being applied or thrown off.

3. Transient frequency variations in excess of 10% are accepted in the case of 100% load rejection provided the generator does not trip on over speed.

4. For diesel generators, the over speed protection will shut down the engine at 115%.

2.2.5 Engine start up time

2.2.5.1 Generators using high speed and smaller medium speed engines are generally able to start and achieve nominal speed within 8 to 10 seconds. Larger medium speed engines can reach nominal speed in around 20 seconds, but some larger medium speed engines may take longer and have special requirements in respect of pre-lubrication, length of time on standby and the need to perform a slow turn before starting. The run up time may also be controlled to limit the acceleration and therefore the amount of smoke generated during starting.

IMCA GUIDANCE


W/S No: 55/130502 Page 31 of 194



2.2.5.2 Figure 2-18 shows the starting time for a large medium speed diesel engine starting from the ‘not on standby’ condition. If the engine must be prelubricated it can take over 2 minutes to connect the generator. If prelubrication was running at the time of the start signal then the connection time begins with the slow turn function and reduces to around 1.5 minutes. If the generator was in ‘hot standby’ mode then the slow turn is omitted and connection times reduce to around 1 minute. The time taken to synchronise the generator may depend to some extent on the stability of the power system at the time of connection.

2.2.5.3 It may be possible to improve upon standard starting and connections times with the engine manufacturer’s agreement and assistance. Designers should enquire about starting restrictions as these can significantly influence time taken to connect standby generators in response to engine failure. This may in turn influence the power plant operating strategy in respect of the amount of spinning reserve that must be maintained.

2.2.5.4 Blackout recovery times can also be adversely affected by starting requirements which should be minimised as far as possible for DP vessels.

0 20 40 60 80 100 120 140 160

0

20

40

60

80

100

Time (s)

Spee

d (%

)

Figure 2-18 Medium Speed Engine Starting Time

Prelubrication Slow Turn

Run Up

Sync

Start Signal

IMCA GUIDANCE


W/S No: 55/130502 Page 32 of 194



2.2.6 Restriction on standby status and starting time

2.2.6.1 Some diesel engines have restrictions on the time they can remain on standby without an increase in the starting time. These restrictions can be due to such things as oil build-up due to prelubrication which must be removed. Power management systems may include engine management routines specifically to deal with these features. Typical restrictions may include:-

1. Engine must be at preheat temperature and prelubrication must be running

2. Up to 12 hours engine may start without slow turn. This condition is sometimes referred to as ‘Hot standby’

3. After 12 hours of prelubrication, engine must perform a slow turn before starting. This extends starting time. This condition is sometimes referred to as ‘Cold standby’

2.2.6.2 Management of these restrictions typically includes the power management system monitoring the time an engine has been on standby. As the time approaches 12 hours, the PMS will start the engine and run at 30% power or above. If this is not possible the engine status will be changed to ‘Not standby’.

2.2.7 Black start capability

2.2.7.1 Most engines are capable of being started in an emergency situation without pre-lubrication providing the engine jacket water is at or above a defined temperature and the prelubrication was running a short time before the start request. A time limit may be set for the maximum time after which the engine can be started without prelubrication. Such limits can be of the order of one minute, which should be adequate for most DP blackout recovery purposes. Confirmation should be sought from the engine manufacturer that the engine can be started in this way. It may be necessary to provide a dedicated ‘black start’ signal to the engine control system. Although it is good practice to design the blackout recovery system to be independent of the emergency generator, it is prudent to ensure that all systems required to black start the engines can be supplied from the emergency generator in case the engines cannot be started within the prelubrication override time. A dual supply to such consumers from the main and emergency power system is recommended, with the main power system providing the ‘normal’ source of power.

2.2.7.2 Where an exemption from prelubrication is not possible, or as additional protection, an air driven prelubrication pump can be driven from the starting air system.

2.2.7.3 Where the engine requires fuel pressure for starting it may be possible to arrange a gravity feed tank or an air driven fuel pump to be activated for blackout recovery.

IMCA GUIDANCE


W/S No: 55/130502 Page 33 of 194



2.2.8 Load application time

2.2.8.1 Most engine manufacturers will provide figures for the maximum continuous rate of application of load (kW/s) and for the maximum step load that can be applied. In DP applications, the rate of load application required by the thrusters for accurate station keeping may approach the limits of the engine’s capability and plant designers should ensure that loading ramps are not unnecessarily severe. Most thruster control systems can be programmed to accept a loading ramp to ensure limits are not exceeded. Similar safeguards should be applied to large non DP related consumers such as active heave compensation or drilling consumers.

2.2.8.2 Load increase on an engine may occur due to increasing demand from consumers, but also as a result of engine failure leading to loss of generating capacity. In many DP power plant designs it is possible for several generators to be lost together as the result of a single failure. Therefore, plant designers need to consider the maximum loss of power generating capacity that is likely to occur, not just failure of one generator. Rapid load shedding functions may assist in meeting engine manufacturer’s requirements.

0 20 40 60 80 100 120 140 160 1800

10

20

30

40

50

60

70

80

90

100

Time(s)

Pow

er(%

)

Figure 2-19 Load Increase Rates for Generators Operating at Synchronous Speed

2.2.8.3 Engine manufacturers may also define an emergency or blackout load up ramp which is considerably steeper than the normal ramp.

2.2.8.4 In Figure 2-19, the load ramp required by thrusters, i.e. ‘DP’, falls between the normal operating curve and blackout curve.

Blackout Normal

Standby

DP

IMCA GUIDANCE


W/S No: 55/130502 Page 34 of 194



2.2.8.5 Note that load application may be the combination of load increase on the overall system and the load transfer to a newly connected generator which is following a load up ramp.

2.2.9 Load steps

2.2.9.1 At one time classifications societies required generators to be capable of a 50% load step without unacceptable fall in frequency. Many modern medium speed diesels are highly turbo charged and cannot achieve these levels of step load because of the lag introduced by the turbocharger. Current practice is to make reference to IACS requirements or ISO 8528-5 which can be achieved. Engines which meet these requirements may be referred to as 3 or 4 step engines, that is to say they require that the largest instantaneous load step be limited to some specified value. Some manufacturers simply state a maximum step load such as 33% of MCR where as others relate the maximum permissible step load to the load on the engine at the time the step is applied as shown in Table 2-3 below. Limits may include a period of stabilisation after application of the step load which may be of the order of 10s.

Table 2-3 Maximum Permissible Step Load

% MCR 0 33 56 74

Max load step % 33 23 18 26

2.2.9.2 To reduce the effects of turbocharger lag and thus improve the step response some manufactures employ other methods such as a combination of mechanically/electrically driven compressors and exhaust gas driven compressors. Driving the turbocharger compressor with a short blast of compressed air is another method used to improve step response.

2.2.10 Load rejection

2.2.10.1 The engine manufacturer may specify the maximum load rejection rate for normal operation but in diesel electric designs the possibility of the generator circuit breaker opening with the engine at or above full load must be considered.

2.2.10.2 In cases where the generator remains connected to the power distribution system and the load rejection is caused by tripping of consumers, medium speed diesels can generally accept instantaneous 100% load rejection without operation of the over speed device, but speed deviation may be higher than that specified for normal operation.

2.2.10.3 For power system operating in uncorrected droop the requirement to accelerate a large number of pumps and fans from low frequency to high frequency can act as a buffer to limit the rate of load rejection.

IMCA GUIDANCE


W/S No: 55/130502 Page 35 of 194



2.2.11 Low load running

2.2.11.1 The following terms are used by engine manufactures to describe engine loading

1. Overload > 100% rated power

2. Full load = 100% rated power

3. Part load < 100% rated power

4. Low load < 15% (MDO) 25% (HFO) rated power

5. No load = 0% rated power

2.2.11.2 Long periods of low load running can be a feature of DP operations particularly where the fault tolerance of the power plant depends on maintaining a large spinning reserve. As this type of operation is detrimental to engine, efficiency, emissions, performance and reliability, some engine manufacturers state a minimum figure such as 15% of MCR if the engine is operated on diesel fuel oil.

2.2.11.3 If the DP power plant has been designed to have a low impact worst case failure (WCFDI = 1 Generator) then the plant can generally be run at relatively high loads. However, if prolonged low load running is unavoidable there are a number of features that can be considered to improve conditions.

1. Most power management systems load dependent stop as a way to manage low load running but most operators prefer to use this in an advisory mode.

2. Most power management systems offer an asymmetric load sharing functions to allow soot deposits to be burnt off on one engine at a time

3. Engines can be fitted with part load nozzles

4. Engines can provided with two stage charge air cooling systems

5. Some high speed diesels can reduce the number of cylinders in use at low power output levels.

2.3 ENGINE AUXILIARY SYSTEMS

2.3.1 General

2.3.1.1 The term ‘marine auxiliary systems’ is used to describe all those systems and functions required to support thruster, generator and related plant. Some of the systems may be mounted on the generator skid or as standalone units while others may be part of the engineroom and pump room design. In any fault tolerant system based on redundancy it is the common points between otherwise separate and redundant elements of the design that allow faults to propagate from one redundant element to the other. This is particularly true of engine auxiliary systems related to fuel, compressed air and cooling water systems where several generators may be connected to a common system. In recent years some classifications societies have introduced additional DP rules related to the design of marine auxiliary systems to try and limit the potential for more than one generator to be lost as the result of a single failure. There are significant advantages to making generators as independent as possible even if power distribution system faults could cause the loss of multiple generators.

IMCA GUIDANCE


W/S No: 55/130502 Page 36 of 194



2.3.2 Fuel

2.3.2.1 Most engines for DP vessels use diesel fuel oil but heavy fuel oil system can be found in some applications such as heavy lift vessels and shuttle tankers. Heavy fuel oil system need careful attention to ensure there are no single point failures associated with fuel heating systems or changeovers from HFO to DFO.

2.3.2.2 A secure supply of clean fuel is essential for reliable operation. Although redundancy in DP system design generally begins at the fuel oil day tanks, reliability begins with the design and operation of the fuel oil storage, purification and distribution systems. Fuel system faults are generally associated with blockages, leaks and contamination by water or MBC.

2.3.2.3 Although DP Class 2 failure definitions allow redundant generators to share common pipe work, some classification societies now require that fuel systems for engines considered to provide redundancy are totally separate. Cross over valves are permitted for maintenance but they must be kept closed during DP operations requiring the vessel to be fault tolerant.

2.3.2.4 Fuel system design benefits from fuel oil pressure alarms, differential pressure alarms at filters, water detectors at purifiers and leak detectors for high pressure fuel lines. Provision of independent tank level gauges and low level alarms offers additional protection against an empty day tank.

2.3.2.5 The practice of running ballast or cooling water lines through fuel storage tanks should be avoided. Faults in engine fuel oil coolers can also be responsible for water contamination.

2.3.2.6 Where engine operation depends on fuel pumps, consideration should be given to how a fuel supply can be provided for blackout recovery. A limited supply from a gravity tank or pneumatically operated black start fuel pump are amongst the options.

2.3.2.7 In general the design of the engine fuel supply system should follow the overall split in the redundancy concept including, day tanks, supply and return lines, filters, pumps, quick closing valves and their controls.

2.3.3 Lubricating oil

2.3.3.1 Engines generally have independent lubrication systems but engineroom pipework intended to provide facilities for replenishing engine sumps and recovering waste oil may increase the risk of inadvertently emptying one engine and simultaneously overfilling another. Consideration should be given to the provision of valves and control measures to prevent such acts of mal-operation.

2.3.4 Starting systems

2.3.4.1 Starting system for diesel engines can be by electric or pneumatic starter motor, or by distributor type starting where high pressure air at 30bar is injected directly into the engine cylinders. The later is the most common system on large medium speed engines.

IMCA GUIDANCE


W/S No: 55/130502 Page 37 of 194



2.3.4.2 The starting air system must be designed to meet classification requirements for the type of vessel, in relation to numbers of starts on each engine etc. Where fault tolerance depends on the successful connection of standby generators the starting system must be particularly robust.

2.3.4.3 The design of the starting air system must also consider the blackout restart strategy. In some designs the power management system will simultaneously order the start of all available generators following detection of blackout. In such cases the starting air system must be designed to allow simultaneous cranking.

2.3.4.4 Where low pressure control air supplies are derived from high pressure starting air systems, a risk of overpressure exists if the pressure reducer fails in such a way that it passes high pressure air to the lower pressure system. Overpressure in the control air system can cause unexpected effects including the operation of engine stop cylinders. Correctly calibrated pressure relief valves provide a degree of protection as does the relative volume of the lower pressure system if it is large in comparison to the high pressure systems.

2.3.5 Control air

2.3.5.1 Control air systems for engines can have a wide variety of uses including.

1. Oil mist detectors

2. Start and stop cylinders for the fuel system

3. Operation of ‘rig saver’ combustion air shut off valves

4. Operation of combustion air dump valves

5. Temperature control valves for HTFW and LTFW systems

6. Jet assist for the turbocharger

7. Pneumatically operated governors

2.3.5.2 Problems with the design of control air systems generally arise when failure of the control air supply has an adverse effect on engine operation and several engines share a common control air supply.

2.3.5.3 At least one classification society now requires full separation of pneumatic systems serving equipment intended to provide redundancy even for DP Class 2 designs.

2.3.6 Combustion air and engineroom ventilation

2.3.6.1 For DP Class 2 and Class 3 vessels ventilation and the supply of combustion air to the engines is considered in the same way as any other marine system. No single failure should cause the engines to be adversely affected to the point where position and heading cannot be maintained. Although DP Class 2 permits designs having a single engineroom, most modern DP Class 2 vessels have at least two enginerooms making it easier to split ventilation and fire control measures along the lines of the redundancy concept.

IMCA GUIDANCE


W/S No: 55/130502 Page 38 of 194



Figure 2-20 Engineroom combustion air supply and ventilation

2.3.6.2 Combustion air can be drawn from inside the engineroom or from outside the vessel by way of dedicated combustion air vents connected to the turbocharger inlets. Figure 2-20 shows the conventional arrangement where combustion air is drawn internally. A flap can be arranged to draw combustion air from inside the engineroom to ease starting in cold climates. Ventilation is primarily concerned with the extraction of heat and fumes to maintain acceptable engine room conditions. Engine manufacturers may stipulate a range of permissible combustion air temperatures such as 15ºC to 35ºC with an occasional increase to 45 ºC. Vessels for arctic service may require heating of combustion air in some circumstances. Sources of air for ventilation and combustion should be arranged to avoid sea spray dust and exhaust fumes in all wind directions and vessel headings. Control of engineroom internal pressure is important for safety reasons and a slight overpressure is often recommended.

2.3.6.3 Engineroom ventilation and combustion air supply may be arranged separately with dedicated combustion air fans directing air to the turbocharger inlets and ventilation being ducted to locations for heat extraction.

2.3.6.4 Ventilation and combustion air failures can be related to:-

1. Failure of ventilation fans or their supplies

2. Closure of fire or watertight dampers

3. Operation of combustion air shut-offs on engines

4. Operation of combustion air dump valves on engines

5. Release of fire-fighting medium

IMCA GUIDANCE


W/S No: 55/130502 Page 39 of 194



2.3.6.5 Experience suggests that fan failure does not usually affect engine operation in the short term but temperatures may rise relatively quickly. See also crankcase breathers in Section 2.3.9.

2.3.6.6 Design problems may arise in respect of fault tolerance when fire damper operation is linked to fan running status such that the fire dampers close when the fans stop. Closure of fire dampers on a running engineroom has a more severe effect and may result in significant negative pressure in the engineroom. This can represent a safety hazard and this should be borne in mind when conducting DP FMEA proving trials. Engineroom fire dampers should generally fail ‘open’ or ‘as set’ on loss of actuator power or control signal but classifications society requirements may also influence such designs.

2.3.6.7 Poor design of F&G and ESD systems has also been known to cause fire dampers in otherwise independent engineroom to close because of power and communications faults in safety system field stations. Poor choice of ‘fail safe’ settings can also have this effect.

2.3.6.8 Closure of combustion air shut-offs (rig savers) results in immediate stop of the engine and tripping of the generator on reverse power. Rig savers are normally designed to require air pressure to close, and failures are generally related to spurious activation. Design problems in relation to fault tolerance can arise where engines share a common control system for the rig savers.

2.3.6.9 Combustion air dump valves (or flaps) are located after the turbocharger and are designed to vent the air from the turbocharger into the engineroom when the rig saver closes. Failure of this valve to the open position results in a large reduction in the engines ability to generate power. This creates a severe load sharing imbalance accompanied by large amounts of black smoke from the exhaust because the governor advances to the full fuel position in order to try and restore power output. This may distract attention from the true cause of the failure. Design problems can arise in respect of redundancy when these valves fail to the open position on loss of air supply and multiple engines share a common control air supply or control system.

2.3.6.10 Classification societies may require that rig saver valves are located after the turbocharger in view of the risk of over speeding of the turbocharger if the combustion air supply is cut off.

2.3.6.11 It has been stated that using combustion air from outside the vessel provides protection against release of unexpected fire-fighting medium. This is an unlikely failure mode for established fire-fighting systems but has occurred.

2.3.7 Jacket cooling water and control

2.3.7.1 Most engines for DP vessels are fresh water cooled by way of heat exchangers served by the vessel’s seawater cooling system. On smaller DP vessels engines may be radiator cooled or by way of box coolers set into the hull. In some cases equipment may be directly cooled by the seawater system. Circulation of coolant may be provided by engine driven pumps or electrically driven pumps or by a combination of the two as shown in Figure 2-21 below.

IMCA GUIDANCE


W/S No: 55/130502 Page 40 of 194



EXPANSION TANK

ALTERNATOR

TT

ENGINE JACKET

M

LUBE OIL COOLER

CHARGE AIR COOLER STAGE 2

CHARGE AIR COOLER STAGE 1

PREHEATER

ENGINE DRIVEN PUMP

ELECTRIC PUMP

TT

SW

HEAT EXCHANGER

ELECTRIC PUMP

ENGINE DRIVEN PUMP

36°C

90°C

LT

HT

LT

Figure 2-21 Engine HT and LT Cooling Water System

2.3.7.2 Engine cooling system may be divided into:-

1. High Temperature Fresh Water cooling (HTFW) – typically 90ºC

2. Low Temperature Fresh Water cooling (LTFW) – typically 36 ºC

2.3.7.3 These systems may in fact share the same cooling water and expansion tank by way of three-way mixing valves designed to regulate the relative system temperatures.

2.3.7.4 The HTFW circuit will normally be connected to such things as :-

1. 1st stage charge air cooler

2. Engine water jacket

3. Jacket water pre heater

4. Water maker

5. Water maker booster heater

2.3.7.5 The LTFW circuit will normally cool such things as:-

1. 2nd stage charge air cooler

2. Lube oil cooler

3. Alternator cooler

IMCA GUIDANCE


W/S No: 55/130502 Page 41 of 194



2.3.7.6 Control valves for regulating engine temperature are generally:-

1. Wax element type – AMOT

2. Electric actuator with electric controller – Motorised valve

3. Pneumatic actuator with electric controller

2.3.7.7 Control valves are generally designed to fail to full cooling. Fail ‘as set’ may not be sufficient to prevent temperature instability in the power plant. Wax element type valves may fail to open on rising temperature but the use of multiple elements means that failure is usually gradual, providing an opportunity for the degradation of performance to be noticed.

2.3.7.8 Where several engines share a common LTFW system controlled by a single valve, failure of the valve to open on rising temperature due to mechanical faults may be enough to cause generators to trip even if the valve normally fails to the open position.

2.3.7.9 Temperature control may be by way of dedicated PID controllers, the engine manufacturers control system, or by the vessel management system.

2.3.7.10 Problems with the design of cooling systems in respect of fault tolerance usually arise when designers interconnect generator cooling water systems say to a common engineroom LTFW system or to supply a single water maker.

2.3.7.11 Design errors also include failure to correctly assign power supplies for pumps, temperature control valves and their controllers in line with the overall split in the redundancy concept. At least one classification society now requires that that FW cooling systems for engines and other equipment intended to provide redundancy are totally separate (even for DP Class 2) in view of the risk of leaks leading rapidly to overheating.

2.3.8 Jet assist

2.3.8.1 Jet assist is a function added to highly turbocharged medium speed diesels to reduce the turbo lag and increase the step response. Nozzles within the compressor casing direct air on to the impeller to accelerate it rapidly in response to load changes. Jet assist may be activated in response to:-

1. Engine starting

2. Generator circuit breaker closing

3. Speed undershoot

4. Sudden increase in fuel racks

2.3.8.2 Jet assist time can be varied according to demand – 5s to 10s is typical.

2.3.8.3 The activation and duration of the jet assist function can be controlled by the engine manufacturer’s control system or by the vessel management system and requires information on the speed of the engine, the fuel admission and starting air pressure. A number of conditions are monitored and may cause Jet Assist to be inhibited to prevent it being on for too long or depleting the air supply.

IMCA GUIDANCE


W/S No: 55/130502 Page 42 of 194



2.3.8.4 Experience suggest that failure of the jet assist function to operate in response to step loads does not cause generators to trip but may cause frequency based load shedding to function briefly in extreme cases. Nevertheless, air supplies and control systems for Jet Assist functions should be split along the lines of the redundancy concept.

2.3.8.5 Information from one engine manufacture of large medium speed diesels suggests that pulsating load changes of greater than 25% can occur as frequently as 30 times per hour in dynamically positioned vessels.

2.3.8.6 Design errors in relation to Jet Assist functions are normally related to under sizing the air supply and introducing commonality between redundant generators by way of the air supplies or control systems.

2.3.9 Crank case breathers

2.3.9.1 The crank case breather is intended to allow oily fumes to escape from the engine crankcase and vent any slight pressure build up. More severe pressure build up related to crankcase explosion is vented by dedicated crankcase doors or expanding bellows. Engine manufacturers may recommend that crank case breathers are taken to the funnel top by way of individual pipework for each engine. In the case of vessels intended to work in explosive atmospheres, the crankcase breathers may be fitted with spark arresters.

2.3.9.2 Spurious operation of oil mist detectors can occur if crank case breathers become blocked, and design problems related to fault tolerance and redundancy can arise if the pipework for crank case breathers is made common such that multiple engines may be affected by a blockage in the pipe or spark arrester.

2.3.9.3 Engineroom ventilation failures have been known to cause multiple engine loss when engine safety shut downs include crank case differential pressure. This occurs because the crankcase internal pressure is determined by the pressure outside the engineroom through the crank case breathers while the external pressure on the crankcase is determined by the pressure in the engineroom. In DP Class 2 vessels with a single engineroom this can cause loss of engines exceeding the worst case failure design intent.

2.4 ENGINE CONTROL AND SAFETY SYSTEMS

2.4.1 Control topologies

2.4.1.1 Most modern diesel engines have comprehensive and complex control and monitoring systems. Various control topologies are possible using either the engine manufacturer’s control system or the vessel automation system as shown in Figure 2-22 and Figure 2-23 respectively. Various hybrid combinations which use the electronic speed governor as part of the control system are also possible. Many DP vessel owners also specify unmanned machinery space notations such as UMS, ACCU or E0, not because they intend to operate with an unmanned engineroom but because these notations provide a suitable standard for the control and safety systems required in a redundant propulsion system.

IMCA GUIDANCE


W/S No: 55/130502 Page 43 of 194



2.4.1.2 It is extremely important to understand the extent of control and safety functions provided by engine control system and the common mode failures that can be introduced by connecting engines together through these systems. In general, redundant systems should, have as few common points between them as possible and any such common points should fail to the safest condition and have a comprehensive set of protective functions designed to prevent faults in one redundant element affecting another.

UPS

DIESEL ENGINE

ENGINE TERMINAL BOX

GOVERNOR ACTUATOR

TO VESSEL SWITCHBOARD

ENGINE SAFETY SYSTEM

ENGINE CONTROL SYSTEM

AUXILIARY SYSTEM

CONTROL

SPEED CONTROL

ENGINE CONTROLS

ECR

ENGINE CONTROLS

WHEELHOUSE

VESSEL AUTOMATION

PMS

ENGINE MANUFACTURER’S CONTROL SYSTEM

MAIN POWER SUPPLY

FIELD STATION

NET A NET B

EMERGENCY POWER SUPPLY

Figure 2-22 Engine Control and Protection Based on Engine Manufacturer’s Systems

IMCA GUIDANCE


W/S No: 55/130502 Page 44 of 194



DIESEL ENGINE

ENGINE TERMINAL BOX

GOVERNOR ACTUATOR

TO VESSEL SWITCHBOARD

ENGINE SAFETY SYSTEM

ENGINE CONTROL SYSTEM

AUXILIARY SYSTEM

CONTROLSWITCHBOARD

CONTROL

SPEED CONTROL

UPS

VESSEL AUTOMATION SYSTEM FIELD STATION

NET A NET B

VESSEL AUTOMATION SYSTEM

LOCAL CONTROL

PANEL

NET A NET B

VESSEL AUTOMATION SYSTEM

PMS AND SWITCHBOARD CONTROL FIELD

STATION

MAIN POWER SUPPLY

EMERGENCY POWER SUPPLY

Figure 2-23 Engine Control and Protection Based on Vessel Automation System

2.4.2 Control power

2.4.2.1 Engine control power is typically 24Vdc which may be derived either from a DC power supply with battery backup or from a control system which is itself powered from a UPS. Switchboard control supplies are typically 110Vdc and may mirror the 24Vdc distribution to the engines. Occasionally, engine and switchboard control and protection functions are supplied from a common DC distribution system. This arrangement introduces a common point of failure between control and protection that can leave one or more uncontrolled generators connected to the switchboard with no way to trip them. In such cases it may be necessary to have another supply to trip the generators in the event that control power is lost. The circuit breaker spring winder supply is sometimes used for this purpose.

2.4.2.2 The engine control and safety system should have separate power supplies. Ideally, these supplies should be from separate sources but class may accept separate fuses from the same distribution. UPS battery endurance should be a minimum of 30 minutes. The UPSs (or DC supplies) should have a dual power supply from the normal and emergency distribution. The normal source of supply should be the main power system.

IMCA GUIDANCE


W/S No: 55/130502 Page 45 of 194



Figure 2-24 Typical control power arrangement

2.4.2.3 Figure 2-24 shows the most common supply arrangement where all engines on one bus share a control power supply. However, there are significant benefits to making each generator as independent as possible, even if the redundancy concept is only a two way split. Losing multiple generators as the result of a single failure is extremely disruptive to the power system. Where the alternator has a permanent magnet generator consideration can be given to using this as one source of control power such that each generator is independent of the external control power source once it is running. Figure 2-25 shows just such an arrangement.

Figure 2-25 engine control power with PMG backup

2.4.2.4 Alternatively each generator can be supplied from its own control power system as shown in Figure 2-26.

IMCA GUIDANCE


W/S No: 55/130502 Page 46 of 194



Figure 2-26 Independent engine control supplies

2.4.2.5 In a few cases designers have elected to supply some engine control systems on each side of the split in the redundancy concept from the same power source. Although this arrangement ensures that a control power fault will not disable all generators on one bus, it may introduce unacceptable restriction on the combination of generators that can be connected as any combination powered from the same source will result in loss of control over all running engines, and possibly a blackout.

2.4.2.6 Cross connecting redundant engine control power supplies by way of diodes as shown in Figure 2-27 is also not recommended as a way of improving reliably as a voltage dip associated with a fault in one control power supply will be seen by all control systems. If the voltage dip ride through is insufficient then all running engines may malfunction. This arrangement is also dependent on the selectivity of the fuses at the generator and power supplies to ensure a fault in one engine supply does not blow the main fuses at each DC supply output.

Figure 2-27 Diode isolated dual supplies

IMCA GUIDANCE


W/S No: 55/130502 Page 47 of 194



2.5 SAFETY FUNCTIONS

2.5.1 General requirements

2.5.1.1 Modern diesel engines are supplied with a large range of alarms and protection functions. Specific requirements for safety systems depend on the size of the generators and also whether the vessel has unmanned machinery space notation or not. The redundancy concept needs to carefully consider the implications of each function which is capable of stopping the engine. Some classifications societies require that power failure in the safety system is not to lead to a loss of propulsion. Engine safety systems are generally created using hardwired relay logic. A few of the more common engine shut down functions are discussed in the sections which follow.

2.5.2 Over speed

2.5.2.1 This may be a mechanical or electronic device and must be independent of the normal speed control system. Sometimes the electronic over speed is based on a transducer sensing the passing of teeth on the flywheel or similar arrangement. These devices normally fail safe (engine continues to run) on failure of the power supply. However, there have been cases where low voltage (rather than zero voltage) in the power supply to the transducer and electronics has caused it to falsely indicate over speed and shut down the engine. In designs where all engines share a common power supply it is possible for all engines to trip if the power supply voltage goes out of tolerance.

2.5.2.2 Other control devices can also malfunction. Certain models of governor are known to fail to full fuel if their 24Vdc supply falls to 18Vdc.

2.5.3 Rig savers

2.5.3.1 In the case of vessels operating in explosive atmospheres the over speed device must be supplemented by a device that shuts off the combustion air supply as discussed in Section 2.3.6. These devices normally fail as set on loss of control air supply.

2.5.4 Oil mist detection

The presence of oil mist in the crankcase may indicate main bearing failure but also represent a potentially explosive condition. In other cases the condition is caused by a blocked crankcase breather. Oil mist detectors are generally arranged to stop the engine on detection of oil mist. The detectors generally operate on optical principles in which a sample of the crankcase gases is drawn through a sensing chamber using a venturi effect. The air supply to drive the venturi is typically derived the from the engine control air supply. Loss of the air supply causes an instrument alarm but does not usually cause a false indication. Very occasionally oil mist detectors on multiple engines have been known to operate spuriously is response to certain tropical atmospheric conditions or if engine share crank case vents.

IMCA GUIDANCE


W/S No: 55/130502 Page 48 of 194



2.5.5 Crank case differential pressure

2.5.5.1 Crankcase differential pressure sensors are arranged to stop the engine if significant pressure difference is detected. The presence of significant pressure in the crankcase may indicate a cracked piston, broken piston ring or water in the crankcase. As it takes a short time for the crankcase and engineroom pressure to equalise following a sudden change, loss of engineroom ventilation may trigger a spurious shut down on multiple engines. A time delay may be introduced in to the alarm and shut down circuit to overcome this problem.

2.5.6 Fuel shut down

Engine emergency stops and safety system may act in several ways to ensure an engine is stopped:-

1. Governor signal to zero

2. Air cylinder pushes fuel rack to zero fuel – A ‘break back’ system may be used to overcome the force of a faulty governor

3. Fuel solenoid valve will be closed

4. Electrically drive fuel pumps will be turned off

2.5.7 JW temperature high

2.5.7.1 High jacket water temperature may indicate a problem with the engine cooling water systems. Loss of cooling water can cause engines and thrusters to overheat in a matter of seconds, so operator intervention to isolate leaks is not a credible mitigation. It is for this reason that IMCA and some major classification societies require complete separation of freshwater cooling systems for equipment intended to provide redundancy, even in DP class 2 designs.

2.5.8 Emergency stops

2.5.8.1 In addition to any other location required by Class, engine emergency stops should be provided for DP operators and engineers at the vessel management station close to the main DP station. In DP Class 3 designs, line monitoring systems should be used to prevent loss of multiple engines if emergency stop control lines pass though areas subject to fire or flooding.

2.6 GENERATORS

2.6.1 Types of AC machine

2.6.1.1 The generators used in the majority of modern DP vessel are three phase, synchronous, self exciting, alternating current generators with brushless excitation systems. Variations on this design include:-

1. Self excitation based on build up from remnant field

2. Permanent magnet exciter

3. Excitation supply from auxiliary stator winding

IMCA GUIDANCE


W/S No: 55/130502 Page 49 of 194



2.6.1.2 In almost all self exciting generators the main DC field current is provided by way of shaft mounted diodes from a small AC generator on the same shaft. This AC generator is called the exciter. The stationary winding of the exciter is supplied with variable DC power from the Automatic Voltage Regulator (AVR) which may be supplied from another shaft mounted AC generator called the PMG, as showing in Figure 2-28, or by way of a transformer at the generator terminals as shown in Figure 2-29 . Some generators have an auxiliary stator winding for this purpose as shown in Figure 2-30. Self exciting alternators can excite without an external source of power. In the case of generators that do require an external source of power, class may require that a redundant source is provided for field flashing.

Figure 2-28 Alternator with PMG

IMCA GUIDANCE


W/S No: 55/130502 Page 50 of 194



Figure 2-29 Alternator with AVR powered by Generator VT

R

Y

B

POWER IN

CURRENT SENSE

VOLTAGE SENSE

POWER OUT

AVR

Figure 2-30 Alternator with auxiliary winding

IMCA GUIDANCE


W/S No: 55/130502 Page 51 of 194



2.6.2 Short circuit performance

2.6.2.1 Classification societies typically require that alternators are able to deliver at least three times rated current for 2s. Such large currents are often necessary to ensure the over current protection scheme operates selectively. Alternators with permanent magnet generators or auxiliary windings as the primary source of excitation power can maintain excitation through the severe voltage dip associated with a close short circuit fault. However, alternators using the terminal voltage as the source of excitation power require excitation support for the duration of the short circuit fault. Excitation support is generally created by providing the AVR with an alternative power supply from current transformers which allow it to derive power from the fault current itself. Without excitation support, the generator may not be able to deliver enough fault current to operate the over current relays, and the voltage dip may be extended to the point where the generator feeders or other circuit breakers trip on under voltage protection, leading to blackout or widespread dislocation of the power distribution system.

2.6.3 Generator voltage ratings

2.6.3.1 Generators for marine applications are typically rated for one of the many standard voltages such as 380V, 440V, 480V, 690V, 3.3kV, 6.6kV and11kV.

2.6.3.2 In marine rules and guidelines any voltage less than 1000V is considered to be Low Voltage (LV) and anything above that is referred to as High Voltage (HV). Shore based utilities and their equipment supplies may refer to marine HV voltage levels as Medium Voltage (MV).

2.6.3.3 For any given power rating the line current falls as the generator’s voltage rating increases. A significant factor in the choice of the system voltage level is the short circuit fault withstand rating of the switchboards. Generally, the higher the fault withstand level the more expensive the switchboard. Thus the higher cost of high voltage equipment may be offset by lower short circuit fault withstand level. Higher current levels in Low voltage equipment and distributions also requires more copper and thus the cost, bulk and weight of cables may also have an influence on the design. HV solutions tend to be favoured for power plants above about 10MW installed power.

2.6.3.4 Alternators may be fresh water cooled, air cooled or seawater cooled. Bearings may be provided at both the non drive end and the drive end. In some designs, the engine and alternators share the drive end bearing.

2.6.3.5 Alternators are typically provided with a range of alarm and monitoring functions including:-

1. Current transformers for monitoring and protection

2. Stator winding temperature sensors

3. Air temperature indicators

4. Lubrication flow

5. Cooling water temperature indicators

6. Cooling water leak indicators

IMCA GUIDANCE


W/S No: 55/130502 Page 52 of 194



2.6.3.6 The generator protection scheme is discussed in more detail in Section 2.122.12 on generator protection philosophy.

2.7 FUEL CONTROL

2.7.1 Compression ignition

2.7.1.1 Diesel engines operate on the principal of compression ignition. Fuel is admitted to the cylinders as the piston rises, compressing the air and increasing its temperature to the point where it can ignite the fine spray of fuel.

2.7.1.2 There are three typical types of fuel control system for diesel engines.

1. Small multi cylinder engines may have a rotary distributor type pump were each injector is connected to a high pressure fuel pump in turn according to the firing sequence.

2. Modern ‘electronic’ diesel engines may have a ‘common rail’ fuel system where a supply of fuel is maintained at high pressure by the fuel pump and continuously distributed to the injectors by high pressure pipework. Injection is triggered electronically. The amount of fuel admitted is controlled by the time each fuel valve is open.

3. Large medium speed diesel engines usually have one fuel pump and one fuel valve per cylinder. The fuel pumps are operated by a camshaft and fuel is sent to the fuel valve (injector) from the fuel pump at high pressure causing a spring loaded valve to lift from its seat in the nozzle admitting fuel at the right time for combustion. The amount of fuel admitted is controlled by varying the stroke of the fuel pumps. This function is carried out by the fuel rack.

2.7.2 Engine governors

2.7.2.1 The engine governor controls the fuel admission to the engine to maintain the desired speed when the engine is operating independently and to maintain both the system frequency and the desired share of the total system load when the generator is operating in parallel with other generators.

2.7.2.2 There are various types of governors but the market for DP vessel generators is now dominated by electronic governors with electric or electro hydraulic actuators to control the fuel rack on the engine as shown in Figure 2-31.

IMCA GUIDANCE


W/S No: 55/130502 Page 53 of 194



Figure 2-31 Electronic governor with hydraulic actuator

2.7.2.3 Some governor actuators contain a mechanical ‘ball head’ governor as backup to the electronic unit. Although this feature was introduced to improve reliability it can be difficult to coordinate with some load sharing systems and has caused blackouts in a few cases.

2.7.2.4 Many older vessels were fitted with hydro-mechanical governors. These units are often interfaced to the power management system by a speeder motor (or pilot motor) which physically adjusts the speed set point up and down in response to electric ‘raise speed’ and ‘lower speed’ commands.

2.7.2.5 The governor is essentially a speed control system. The speed of the engines is monitored by a magnetic pickup and transmitted to the speed control unit. Here the speed of the engine is compared with the speed set point. The speed error is applied to a three term controller which drives the fuel rack actuator to reduce the speed error. When two or more generators are required to share load between them a power sensor is added to the control scheme although it is possible to make generators load share without measuring the power being delivered.

2.7.2.6 Electronic governors from the main manufactures have reached such a level of sophistication that they can be programmed to carry out many features normally found in vessel management systems such as load sharing, synchronising, power management, alarm and monitoring, and control of auxiliary systems such as fuel and cooling water pumps.

2.7.2.7 Fuel control for ‘electronic’ engines is usually provided by the engine manufacturers themselves and may be integrated into the engine control system as shown in Figure 2-32.

IMCA GUIDANCE


W/S No: 55/130502 Page 54 of 194



Figure 2-32 Speed control for common rail ‘electronic’ engine

2.7.3 Actuators

2.7.3.1 Governor actuators for electronic governors can be electric torque motors or electro hydraulic actuators. Actuators are described as forward acting if power is applied to drive them towards the full fuel position and reverse acting if power is applied to drive them to the zero fuel position as shown in Figure 2-33. Forward acting actuators are the most common but a few vessels were fitted with reverse acting actuators containing a mechanical ‘ball head’ backup governor. The principle of operations is that if the electronic governor fails, the spring will pull the fuel rack to the operating point of the mechanical back up governor which is adjusted to a slightly higher set point.

2.7.3.2 Forward acting actuators fail to the zero fuel position on loss of power or signal. This is a relatively safe failure mode. Reverse acting actuators fail to the full fuel condition. This is not a safe failure mode and can cause blackout unless another system intervenes. Electro hydraulic actuators derive their power from the engine by way of a gear drive from the camshaft or other source. Electric actuators usually derive their power from a UPS or battery charger supply associated with the electronic governor.

2.7.3.3 Problems can arise with actuators if they stick in one position.

Figure 2-33 Forward and reverse acting actuators.

IMCA GUIDANCE


W/S No: 55/130502 Page 55 of 194



2.7.4 Speed pickups

2.7.4.1 Engine speed is usually measured by a magnetic pickup sensing the passing of teeth on a toothed wheel which may be the engine flywheel or mounted on an auxiliary shaft. Sometimes, the toothed wheel is inside the actuator itself, mounted on the drive for the hydraulic pump.

2.7.4.2 Failure of the magnetic pickup to ‘no signal’ may cause the engine governor to go to full fuel as it assumes the engine is not running fast enough. Most electronic governors have a motoring function that will shut down the engine if the speed pick-up fails electrically. This function can be turned off during certain maintenance procedures so it may be prudent to confirm the function is active by periodically failing the speed pick up when it is safe to do so. There have been a few cases where the speed pick up became loose and started to miss pulses. This failure mode defeats the monitoring system and has caused a few blackouts.

2.7.4.3 Some governors are fitted with dual speed pick-ups. The governor will normally take the highest reading pick-up as representing the engine speed. If one pick-up fails the governor will issue an alarm but the engine will continue to operate. If the second pickup also fails the engine will stop. It may be necessary to stop and start the engine to clear the alarm on the first pickup after it has been repaired or replaced.

2.7.4.4 Dual speed pickups can also be used to improve frequency stability on generators with flexible coupling between the engine and the generator. Such couplings have been known to introduce very severe frequency oscillations leading to blackout if a single speed pick is installed on the engine side of the coupling. Special software must be installed in the digital governor to take advantage of this arrangement. If this feature is not available on the governor in question, the pickup should normally be installed on the generator side of any flexible coupling to get the best results.

2.7.5 Load sharing schemes

2.7.5.1 There are three basic types of load sharing scheme

1. Speed droop

2. Compensated speed droop

3. Isochronous

4. Master slave

IMCA GUIDANCE


W/S No: 55/130502 Page 56 of 194



2.7.6 Speed droop

2.7.6.1 In this mode of load sharing, the governor is adjusted to allow the engine speed (system frequency) to droop slightly as the load on the generator increases. Typical values for speed droop are 3% to 5%. The generator’s speed may start to oscillate if the droop is too low and 2.5% is about the practical limit of stability. When two or more generators are operating in parallel they naturally share load at a balance point where the common network frequency intersects their respective droop lines. In Figure 2-34 the total system load is equal to the rating of one generator. G1 and G2 are identical and have 3% droop represented by the solid droop lines. Each generator therefore carries 50% of the available load at 60.9Hz. If the droop line on G2 is offset upwards (dashed line) the system frequency rises to 61.25Hz and load sharing becomes imbalanced with G1 carrying about 30% and G2 about 70%.

0 20 40 60 80 10060

60.5

61

61.5

62

62.5

63

Load (%)

Net

wor

k Fr

eque

ncy

(Hz)

G1

0 20 40 60 80 10060

60.5

61

61.5

62

62.5

63G2

Load (%)

Figure 2-34 Generators load sharing by speed droop

IMCA GUIDANCE


W/S No: 55/130502 Page 57 of 194



2.7.7 Compensated speed droop

2.7.7.1 Power management systems use the method of offsetting the droop line in Figure 2-34 to adjust both the network frequency and the relative load carried by each generator to compensate for changes in total system load and engine/governor characteristics. In this method of load sharing, which is sometimes called pseudo isochronous, the PMS is constantly moving the droop lines on all the generator governors up and down to make each generator carry an equal share of the load and maintain a constant system frequency across the entire load range. To do this the PMS needs to know that a generator is connected and what load it is delivering. The PMS also need to know the bus frequency. Problems can arise with this type of load sharing system in a number of ways.

1. A raise, lower signal sticks in the speed raise direction

2. A generator circuit breaker gives false indication of status

3. A generator kW transducer reads too low

4. A bus frequency transducer reads too low

2.7.7.2 Compensated droop can also be used to make one generator carry a much higher load for engine conditioning purposes. This method of load sharing is often called asymmetric or fixed target load sharing.

2.7.8 Isochronous

2.7.8.1 In this mode of control, the governors act to balance load sharing and maintain a constant steady state frequency regardless of system load. The electronic control units for each governor are directly connected by analogue or digital load sharing lines which transmit information on generator load to the governors for all other connected generators. In the case of analogue units, load bridges are used to develop a speed bias representing the difference in the load carried by each generator as shown in Figure 2-35. This bias is applied to the speed control loop in each generator to balance load at the desired bus frequency.

MAIN BUSTIE

LOAD SHARING LINES

POWERDG 2

SPEED BIAS

POWERDG 1

POWERDG 4

POWERDG 3

SPEED BIAS SPEED BIAS SPEED BIASGEN CBGEN CBGEN CBGEN CB

Figure 2-35 Analogue load sharing lines

IMCA GUIDANCE


W/S No: 55/130502 Page 58 of 194



2.7.8.2 In the case of digital load sharing Figure 2-36, the digital speed control units are connected by a communications network.

DG 1

DSC

DG 2

DSC

DG 3

DSC

DG 4

DSC

COMMUNICATIONS NETWORK

MAIN BUSTIE

Figure 2-36 Digital load sharing lines

2.7.8.3 Although synchronous generators run at exactly the same speed it is not possible to set the speed set point of every generator exactly the same so the speed control loops will always have a small error. This creates a very slight load sharing error that cancels out the speed error provided the load sharing control loop is working properly.

2.7.8.4 Problems can arise with this type of load sharing scheme if the load sharing lines fail. Some manufactures offer dual load sharing lines backed up by default to droop mode on loss of communication or detection of significant load sharing imbalance. Although these features mitigate many of the risks associated with control system failures they do not provide comprehensive protection against a generator failing to full fuel and it is necessary to provide a supervisory protection scheme to monitor generator performance independently of the load sharing system and split the power system or trip a faulty generator before it can cause a blackout.

2.7.9 Master slave

2.7.9.1 Figure 2-37 shows a much simplified sketch of a master slave load sharing system. In this arrangement one generator is always the master. There are two main parts to the control system:-

1. Speed control

2. Load (real current) control

2.7.9.2 The speed control loop acts to keep the master generator running at set point speed, normally equivalent to 60Hz. The load controller then applies additional governor actuator command signal proportional to the load being carried by the generator, thus the combined signal is intended to ensure the generator carries the applied load at the required frequency. Only the master generator is under the control of its own speed control loop but it supplies its speed error signal to all the slave generators for combination with the signal from the real current sensor at each of the slave generator terminals. This system is not widely used in modern DP vessels.

IMCA GUIDANCE


W/S No: 55/130502 Page 59 of 194



Figure 2-37 Master slave load sharing system

2.7.10 Electronic governor - principle of operation

2.7.10.1 Figure 2-38 is a much simplified drawing of an electronic governor and its connections to a generator. Most electronic governors are capable of operating in droop mode or isochronous mode. The speed of the generator is monitored by the speed pick-up and compared with the speed set-point to create a speed error signal to drive the actuator. The speed error is modified by a signal from the real power transducer to create the required speed droop as generator load increases.

2.7.10.2 The real power transducer measures the generator’s terminal voltage and line current and calculates the three phase power being delivered in kW. The kW signal is applied to the load bridge which has different functions depending on whether the governor is in droop mode or isochronous mode.

2.7.10.3 In droop mode, one element of the bridge is imbalanced by adding R5 in parallel to create the required droop signal. Unbalancing the bridge in this way causes the V diff signal to increase as generator load rises as shown in Figure 2-39.

IMCA GUIDANCE


W/S No: 55/130502 Page 60 of 194



2.7.10.4 In isochronous operation, the load sharing lines are connected to the load bridges on all other online generators at the point of circuit breaker closure. Any difference in the load being carried by a generator will cause a current to circulate in the load sharing lines creating a voltage difference on the output from the bridge (Vdiff). This signal then modifies the speed error signal such that the signal to the actuator now admits fuel to correct for speed errors and load sharing imbalance.

2.7.10.5 Effects of power sensor failures in droop mode. If the real power transducer fails to ‘no output’, the generator’s speed and therefore the network frequency will rise to the no load speed. This has the effect of unloading all the generators operating in parallel which also run at their no load speed. If the total system load is greater than the rating of the faulty generator, it may trip on overload in which case the load will be thrown back on the generators operating in parallel. If the system load is less than the rating of the faulty generator the load sharing imbalance may stabilise with the faulty generator carrying the total system load and all other generators running at no load. However, if the no load set point of the faulty generator is higher than the setting of the healthy generators there is a risk that they will trip on reverse power. The exact outcome in this case depends on a number of different factors but blackout cannot be ruled out and protective functions should be provided to split the power system or trip the faulty generator.

2.7.10.6 Effects of power sensor or load sharing line failure in isochronous mode. If the real power sensor or load sharing lines fail in isochronous mode a similar effect occurs as there is no signal to modify the speed set point and balance out the error between the actual bus frequency and the speed set point. If the speed set point is lower than the actual bus frequency then the integral part of the speed controller will continue to admit more and more fuel in an attempt to reduce the speed to zero. However, this has the effect of unloading the other generators to the point where they may trip on reverse power. Experience of this fault in marine power system suggests the imbalance develops over a period of 5 to 10 minutes. A similar effect occurs if the load sharing lines break between groups of generators.

2.7.10.7 Effects of power supply failure. Most types of electronic governors with forward acting actuators fail to zero fuel if the supply voltage fails completely. However, certain models are known to fail to the full fuel condition when the 24Vdc supply voltage falls to around 18Vdc.

IMCA GUIDANCE


W/S No: 55/130502 Page 61 of 194



ALTERNATOR ENGINE

SPEED PICK UP

ACTUATOR

R

Y

B

FUEL RACK

SPEED AMP --+ PID

SPEED ERROROV

OV

24VDC

SPEED SETPOINT

SPEED

SPEED OFFSET (DROOP)

LOAD OFFSET (ISOCH)

R6

R5R3

R4

R1

R2

V DIFF

CLOSED FOR DROOP

OPEN FOR ISOCH

CLOSE

OPEN

R

Y

B

24VDC

GENERATOR CIRCUIT BREAKER

REAL POWER TRANSDUCER

kW

ISOCHDROOP

LOAD BRIDGE

LOAD SHARING LINES

V LOAD

Figure 2-38 Electronic governor

0 10 20 30 40 50 60 70 80 90 1000

0.5

1

1.5

2

2.5

3

Generator Load (%)

Spe

ed O

ffset

(%)

Figure 2-39 Speed offset signal

IMCA GUIDANCE


W/S No: 55/130502 Page 62 of 194



2.7.11 Modern digital governors

2.7.11.1 Modern digital governors monitor several engine parameters to optimise engine efficiency and reduced pollution. Vessel owners with identical engines having a mixture of analogue and digital governors report superior engine performance from the numerically (digitally) controlled engines. In particular, the load acceptance can be considerably improved.

2.7.11.2 Parameters monitored by digital governors include:-

1. Engine speed

2. Actuator travel

3. Turbocharger boost pressure

4. Jacket water temperature

5. Oil pressure

6. Engine load

2.7.11.3 Figure 2-40 shows the block diagram of a typical modern digital governor

MICRO PROCESSOR

ADDITIONAL PROCESSOR MEMORY

POWER AMPLIFIER CONVERTER

ACTUATOR

CONVERTER

MAGNETIC PICKUP

SETPOINT VALUES

BOOST PRESSURE

SENSOR

TEMPERATURE SENSOR

OIL PRESSURE SENSOR

REDUNDANT ENGINE SPEED SIGNAL

ENGINE STOP

DIGITAL INPUTS

CONVERTER

CAN-BUS

ENGINE SPEED ACTUATOR TRAVEL

ALARM

DIGITAL APPLICATION UNITSe.g. SYNCHRONIZER &

LOAD MEASURING UNIT

Figure 2-40 Modern digital governor

IMCA GUIDANCE


W/S No: 55/130502 Page 63 of 194



2.8 EXCITATION CONTROL

2.8.1 Excitation systems

2.8.1.1 The various type of excitation systems have already been discussed in Section 2.6.1.

2.8.2 Automatic voltage regulators

2.8.2.1 The automatic voltage regulator is responsible for maintaining the generator’s terminal voltage when the generator operates independently and maintaining the voltage and reactive power sharing when the generator operates in parallel with others. Figure 2-41 shows a much simplified schematic of a Thyristor Divert regulator that was popular on DP vessels.

Figure 2-41 Automatic Voltage Regulator - (Divert type)

2.8.2.2 The bridge rectifier has two sources of ac power. The normal source of supply is from the Red phase voltage by way of a choke. The alternative source of supply is via the two excitation CTs on the Red and Blue phases respectively. This supply provides power when the terminal voltage is low as in the case of a close short circuit fault. On the output from the DC bridge is the divert thyristor. This semiconductor is controlled to ‘divert’ current away from the generator field winding thus controlling the excitation level of the generator and thus the terminal voltage. The controller compares the generator’s R-Y line voltage against the voltage set point and alters the firing angle of the thyristor accordingly. If the thyristor fails to the open circuit condition, the field voltage current will go to maximum. Over excitation may cause the operating point of other machines operating in parallel to move into the ‘capacitive region’ and trip on their field failure protection. If the thyristor fails to the ‘on’ condition the faulty generator will be tripped by its field failure protection.

IMCA GUIDANCE


W/S No: 55/130502 Page 64 of 194



2.8.3 Reactive power sharing schemes

2.8.3.1 Much like load sharing schemes for governors there are three common types of reactive power sharing schemes for automatic voltage regulators. Most AVRs are capable of all three modes of control:-

1. Quadrature current compensation (reactive droop)

2. Compensated reactive droop

3. Cross current compensation

2.8.4 Quadrature current compensation

2.8.4.1 Quadrature Current Compensation (reactive droop) is added to the control scheme to allow stable sharing of reactive power when generators are operated in parallel. It is analogous to speed droop in governors. It is by far the most common form of reactive power sharing scheme for DP vessels.

2.8.4.2 In this form of reactive power sharing, the excitation level is allowed to fall slightly as the amount of lagging reactive current increases. This is achieved by adding a small voltage representing the reactive current being deliver to the sensed line voltage from the generator VT. This makes the sensed voltage appear greater than it actually is thus reducing the excitation to create the voltage droop. A signal related to the reactive current is obtained by measuring the blue line current with a CT. The current from the CT is used to develop a voltage across a potentiometer. The voltage is then added to the Red-Yellow line voltage before being applied to the controller as the ‘sensed’ voltage.

2.8.4.3 Figure 2-42 shows that the blue phase voltage is 90° displaced from the Red-Yellow line voltage. Thus the Blue line current will similarly be displaced by 90° plus how ever many degrees it lags the blue phase voltage. Thus by adding the signal derived from the blue line current CT (VIB) at 90° to the sensed voltage (VRY) as shown in Figure 2-43 the sensed voltage will increase and decrease with the power factor seen by the generator. Although the sensed voltage will be affected to some extent by both the active and reactive components of the blue line current the geometry is such that changes in the reactive component (inline with VRY) have much more effect on the length of the ‘sensed voltage’ vector than changes in the active component which is at 90° as shown in Figure 2-44. Most marine loads are inductive and thus the line current lags the phase voltage thus creating the required droop as it increases. However, if the line current is leading the excitation level will increase as the current increases.

IMCA GUIDANCE


W/S No: 55/130502 Page 65 of 194



Figure 2-42 Relationship of phase and line quantities

Figure 2-43 Voltage representing Blue line current is added to Red-Yellow Line voltage

Figure 2-44 Sense voltage increases as reactive component of current increases

IMCA GUIDANCE


W/S No: 55/130502 Page 66 of 194



2.8.5 Compensated reactive droop

2.8.5.1 In this form of reactive power sharing scheme the power management system adjusts the voltage set points of AVRs operating in reactive droop in much the same way as it adjusts the governor set points. Thus the PMS can trim the AVRs to maintain system voltage and balance reactive power sharing.

2.8.6 Cross current compensation (astatic loop)

2.8.6.1 This form of reactive power sharing is analogous to isochronous speed control. Just as isochronous control maintains the system frequency irrespective of load (no speed droop) so cross current compensation maintains the system voltage irrespective of the amount of reactive power being supplied (no voltage droop). Cross current compensation uses reactive power sharing lines in much the same way that an Isochronous load sharing scheme does.

2.8.6.2 Cross current compensation schemes makes use of the same droop CT and burden resistors as used in the Quadrature Current Compensation scheme with the addition of a loop connecting generators operating in parallel as shown in Figure 2-45.

CROSS CURRENT LOOP

AVR

G1

VL1

VR1

R1

DROOP CTIP1

AVR

G2

VL2

VR2

R2

DROOP CTIP2

Figure 2-45 Cross Current Compensation

IMCA GUIDANCE


W/S No: 55/130502 Page 67 of 194



2.8.6.3 The loop splits the current from the droop CTs with some passing through the burden resistor as before and the rest circulating in the loop. When the reactive power being delivered by the two generators is equal, the current circulating in the loop is equal and opposite to that circulating through the droop CTs with the effect that there is no voltage across the burden resisters R1 & R2. If one generator delivers more reactive power than the other for some reason, the current in the loop changes in such a way to create a positive voltage across the generator with too much excitation and a negative voltage across the generator with too little. This voltage difference across the resistors drives the two generators back into balance again and the voltage across the resistors returns to zero. So long as the voltage across the resistors is zero the sensed voltage will equal the actual terminal voltage of the generators thus the AVR will maintain the terminal volts at the set point regardless of the level of reactive power being delivered. Note that if the loop breaks, both generators return to sharing reactive power in droop mode. If the line short circuits then the resistors are effectively shorted out and one generator will take the entire reactive load.

2.8.6.4 If power system is using cross current compensation with more than two generators it is necessary to arrange for the loops to be created on either side of the busties so that the generators on each independent power system can share reactive power. This further complicates the switching arrangement required to break and terminate the cross current loop.

VR1

I1R1

DROOP CT G1

VR2

I2R2

DROOP CT G2

R1 = R2 = 1 Ω

I3

CROSS CURRENT LOOP

Figure 2-46 Cross current loop - voltage across resisters balances to zero

2.8.7 Diode failure detector

2.8.7.1 The shaft mounted diodes that rectify the ac power from the exciter for use in the stator field can fail. Some generator excitation systems have a diode failure detector. These detectors work on the principle that rectifiers produce a characteristic ripple in their DC voltage waveform and a faulty diode affects the frequency of this ripple. This effect can be used to activate an alarm or shut down a faulty generator. Diode failure may eventually lead to excitation system failure which can lead to blackout if suitable protection is not part of the generator protection scheme.

IMCA GUIDANCE


W/S No: 55/130502 Page 68 of 194



2.8.8 Excitation shutdown

2.8.8.1 Most AVRs or excitation systems will have some means of shutting down the generator field in response to an external request. A typical application for this feature is the differential protection used to detect a short circuit in the generator’s stator winding.

2.8.9 Digital AVRs

2.8.9.1 Analogue AVRs using the principles described above can be found on many DP vessels but are increasingly being replaced by digital AVRs using numerical techniques to achieve the same effects. These digital AVRs sometimes require a control power source independent of the generator such as a 24Vdc battery/ charger supply. The response of the AVR to failure of this supply needs to be considered in the redundancy concept.

2.9 MAIN SWITCHBOARDS AND MOTOR CONTROL CENTRES

2.9.1 Main switchboards

2.9.1.1 Main switchboards can be rated for HV or LV use and are generally of metal-enclosed construction. HV switchgear is generally designed to comply with standards such as IEC 60298, ‘A.C. metal-enclosed switchgear and control gear for rated voltages above 1kV and up to and including 52kV’. Switchboards have a voltage rating, a continuous current rating and a fault withstand current rating. The latter is intended to define the maximum fault current the switchboard can physically stand without suffering damage. In some vessel design the short circuit withstand rating limits the number of generators that can be connect to the main switchboard at one time. When all generators are connect the main bustie opens automatically to limit the fault current that can be experienced on each side.

2.9.1.2 Figure 2-47 shows a cross section of a typical marine switchboard consisting of steel panels arranged to carry a three-phase copper bus bar arrangement mounted on insulators within a common enclosure separated to divide the bus bar system from the cable compartments and the circuit breaker. Air is used as the insulating medium but some bus bars may be insulated along their length for additional protection. The circuit breaker can be withdrawn and is interchangeable with those in other circuits. A low voltage enclosure is provided for mounting instruments and control gear. Cable connects must be bottom entry for marine applications.

2.9.1.3 A system of mechanical interlocks and shutters prevents access to live parts of the switchgear when the circuit breaker is withdrawn and also prevents the carriage being withdrawn or engaged when the circuit breaker is closed. Closing the circuit to the load using the primary contacts of the circuit breaker when inserting the carriage with the circuit breaker closed can result in severe damage.

2.9.1.4 Some classification societies require an arc proof rating for the switchboard and a pressure relief duct be provided to vent arc products safely out of the enclosure in the event of a fault in the switchboard itself.

IMCA GUIDANCE


W/S No: 55/130502 Page 69 of 194



BUSBARS

WITHDRAWABLE VACUUM CIRCUIT

BREAKER

CABLES

VOLTAGE TRANSFORMER

EARTH SWITCH

CURRENT TRANSFORMER

PRESSURE RELIEF DUCT

INSTRUMENT ANDCONTROL CUBICLE

LOCAL CONTROLS

PRIMARY CONTACTS

Figure 2-47 Metal enclosed switchgear

2.9.2 Switchgear

2.9.2.1 Switchgear generally takes the form of circuit breakers or contactors. Circuit breakers for marine applications are generally three pole and designed to close onto a short circuit fault and open again without damage. Each circuit breaker has a continuous current rating and a making and breaking capacity which indicate the fault current it is capable of interrupting. Circuit breakers are generally capable of interrupting the current arcing across their open contacts within three to five cycles of the power frequency waveform. Current limiting circuit breakers are available for low voltage applications which operate quickly enough to prevent the fault current reaching its peak level.

2.9.2.2 Power for the circuit breaker’s closing mechanism is derived from a motor wound spring. The powerful spring which provides the force to open the contacts is charged by the action of closing the circuit breaker. The spring mechanism is recharged by the motorised spring winder every time the circuit breaker is closed. Enough energy is stored in the mechanism for an OPEN-CLOSE-OPEN cycle. Circuit breakers can have different types of insulating medium including:-

1. Air

2. Vacuum

3. SF6

4. Oil

IMCA GUIDANCE


W/S No: 55/130502 Page 70 of 194



2.9.2.3 Very few marine applications make use of oil filled circuit breakers but they found limited application in fixed offshore structures.

2.9.2.4 Contactors are electromagnetically operated switching devices. An AC or DC coil is used to pull the switching contacts together against the force of a spring. Loss of current to the coil will cause the contactor to open again. Some designs are mechanically latching. In this design, a pulse of current is sent to close the contactor and another to open it. This type of contactor remains ‘as set‘ on loss of control power. Contactors are only designed to handle load current not fault current and thus contactors must be paired with a suitable circuit breaker or fuses.

2.9.3 Motor control centres

2.9.3.1 Motor Control Centres (MCCs) contain groups of motor starters and may form a significant part of the low voltage distribution in a marine power system. A motor starter for an LV circuit typically contains a Moulded Case Circuit Breaker (MCCB), a contactor with thermal or magnetic overload protection and relay logic to allow remote starting and stopping of the motor. Modern motor control centres may be controlled by a dedicated communications network or by hardwired contacts to a local vessel management field station.

2.10 POWER SYSTEM FAULTS

2.10.1 Critical power system parameters

2.10.1.1 A power system can be said to be in a fault condition if any of its critical parameters are out of tolerance for more than an acceptable time period such as that associated with expected power system transients.

Quantities which must remain with tolerance include:-

1. Voltage

2. Current

3. Frequency

4. Levels of harmonic distortion

5. Line current balance

6. Phase voltage balance

IMCA GUIDANCE


W/S No: 55/130502 Page 71 of 194



2.10.2 Fault conditions on three phase system

1. Short circuit - one or more phases

2. Open circuit - one or more conductors

3. Earth fault

4. Over / under frequency

5. Over / under voltage

6. Over load – rating of engine exceeded

7. Over current – rating of alternator, busbar, cable, motor, transformer or other consumer exceeded

8. Severe active power sharing imbalance

9. Severe reactive power sharing imbalance

10. Excessive regeneration of power

11. Severe waveform distortion

12. Loss of synchronisation & crash synchronisation

2.11 OVERALL PROTECTION PHILOSOPHY

2.11.1 Purpose of electrical protection schemes

2.11.1.1 Electrical protection schemes are designed to prevent the uncontrolled release of energy associated with power system faults, thus protecting life and limiting damage to equipment. In the case of dynamically positioned vessel of DP Class 2 and DP Class 3 the power system protection scheme must also ensure continuity of supply to essential consumers such as thrusters and auxiliary systems. The protection scheme must be coordinated to ensure that faults are isolated as close to source as possible and that failure effects do not exceed the worst case failure design intent. The primary protection function in any electrical protection scheme is over current protection, which is intended to prevent excessively high currents causing cables to catch fire.

2.11.1.2 The overall electrical protection scheme can be broadly divided into the following sections:-

1. Generator protection

2. Bus bar protection

3. Feeder protection

2.11.1.3 Generator protection is provided to limit the effects of internal faults in the generator, to protect the generator from the effects of power system faults and protect the power system from the effects of generator faults. Generator protection is discussed in more detail in Section 2.12.

IMCA GUIDANCE


W/S No: 55/130502 Page 72 of 194



2.11.2 Protection relays

2.11.2.1 Modern protection schemes use digital protection relays to detect a large fault conditions and trip the appropriate circuit breakers to isolate the fault. The relays are usually mounted in the instrument and control cubicle of the switchboard and make measurements of the power system voltage and current from voltage and current transformers (VTs and CTs) connected to the bus bars and cable ways. Current transformers for protection duties require a special rating which indicates their ability to measure fault currents without saturation. Modern multi function relays can be programmed for many different protection tasks and can also be used as transducers to feed power system information to other systems for monitoring and display. However, care must be taken not to link control and protection functions in such a way that protection and control functions can be lost at the same time. Failure to separate control and protection functions may lead to a situation where a single failure causes machinery to adopt a dangerous condition and render the automatic protection inoperative at the same time.

2.11.2.2 Protection relays are programmed with the settings from the protection coordination study. Programming may be carried out by way of the front panel or by attaching a dedicated programming tool or laptop. Protection relays typically require 110Vdc power for operation which is supplied from a dedicated charger rectifier with battery bank.

2.11.3 Bus bar protection

2.11.3.1 Bus bar faults are the least likely failure in a marine power system but a great deal of time and cost is expended trying to ensure that a fault acting directly on the bus bars does not cause the worst case failure design intent to be exceeded. In fact bus bar faults are so unlikely that some vessel owners have successfully negotiated an exemption from Class for bus bar faults in relation determining the vessel’s worst case failure and therefore its post failure DP capability.

2.11.3.2 Bus bar protection is designed to isolate the effects of short circuit and earth faults acting directly on the bus bars or their connections. Bus bar protection can take the following forms depending on the number of bus sections that have to be protected:-

1. Over current protection

2. Differential protection

3. Directional over current protection

4. Optical arc detection

5. Pressure detection

6. Earth fault protection

IMCA GUIDANCE


W/S No: 55/130502 Page 73 of 194



2.11.4 Over current protection - Quick Trip

2.11.4.1 Figure 2-48 shows the most common arrangement for vessels with a simple two way split. In the event of a short circuit on either bus all connected generators will feed the fault. Each generator’s over current relay can trip the generator and one of the main busties. Time delays are arranged so that the busties open after 0.3s isolating the fault to one bus or the other. The generators on the healthy bus section will no longer see the fault and their over current relays will reset. Those on the faulty section will trip after 1.0s isolating the fault. A fault in a feeder is cleared by dedicated feeder over current protection within the 0.3s time delay. A fault on a generator is cleared near instantaneously by the generators differential protection. Thus the protection scheme is fully selective faults in any part of the power system. Some classification societies are considering introducing a requirement to trip the busties first for all faults no matter where they are in the system. Some vessel power plant designers have extended the Quick Trip principle to cover many other faults that might destabilise the power plant. Including but not limited to:-

1. Over / under voltage

2. Over/ under frequency

3. Over current

4. Current imbalance

Figure 2-48 Time graded over current protection

IMCA GUIDANCE


W/S No: 55/130502 Page 74 of 194



2.11.5 Differential protection

2.11.5.1 Figure 2-49 shows one of the popular solutions for bus bar protection in multi-split power distribution systems. The challenge for the protection scheme in a multi split system is to isolate only the faulty bus section leaving all others connected together. This is particularly important if some bus sections have no generator connected. Differential protection works on the principle of Kirchhoff’s current law which states that the sum of the currents entering a node must equal the sum of the currents leaving the node. The bus bars are considered to be the node and the currents being supplied or consumed by all the generators, feeders and busties are summed by the protection relay for that zone. The boundary created by the location of the current transformers used to measure the currents flowing in and out of the bus section is called the protection zone. For this reason differential protection is sometimes known as zone protection. If the bus bar is healthy the current measurements will sum to zero. If however, the bus bar is faulty there will be a current path within the zone which is not balanced out. This imbalance is detected by the protection relays and the bus section is isolated by tripping the busties at the end of the zone. In some schemes the generators in the faulty zone may also be tripped by this function. To ensure complete coverage it is common practice to overlap the CT’s for each zone. This does create a very small area common to two zones. A fault exactly at this point could cause two zones to trip exceeding the worst case failure design intent. Additional complexity can be added to overcome this but this may not be justified by the risk.

G3G2G1 G5G4

NC

G6

NC

NCNC

D

C

NCNC

A

B

Figure 2-49 Differential protection

IMCA GUIDANCE


W/S No: 55/130502 Page 75 of 194



2.11.5.2 Faults at A B C & D have the following effects

1. A fault at point A causes the LHS bus section to be isolated by the zone protection. The Centre and RHS bus sections remain connected.

2. A fault at point B will cause the tie line to be tripped trip leaving all other bus sections connected

3. A fault at point C will be detected by the generators differential protection. Only G4 will be tripped

4. A fault at point D will be detected by the thrusters’ over current protection. Only the thruster will be tripped

2.11.5.3 The number of CTs required to implement the scheme makes it more costly than the other solutions but it does allow the power system to be run as a closed ring and therefore allows complete flexibility in generator utilisation. There have been problems with spurious tripping of zones in response to large motor or transformer starting transients and the efficacy of differential protection schemes is related to the quality of the protection equipment specified.

2.11.6 Directional over current protection

2.11.6.1 Directional over current protection offers a slightly cheaper alternative with many but not all of the advantages of differential protection. Directional protection schemes are generally operated in split ring configuration to establish well defined fault current paths so there is no ambiguity about which circuit breakers should be blocked and which should be tripped. Figure 2-50 illustrates the general principle. Directional over current relays at each bustie are arranged to block the circuit breaker up stream of the fault from tripping thus only the circuit beakers closest to the fault trips. Because the ring is split there may be no current through some bustie circuit breakers. Generators left connected to the faulty bus section will trip on over current. In Figure 2-50 a fault at point A will cause the bustie circuit breaker at the left hand end of the G5, G6 bus section to trip. All upstream circuit breakers which see fault current are blocked.

Figure 2-50 Directional over current protection

IMCA GUIDANCE


W/S No: 55/130502 Page 76 of 194



2.11.6.2 Figure 2-51 illustrates one of the disadvantages of directional protection which is that if one of the bus sections has no generators connected then two bus sections will be lost if a fault occurs at Point A. Thus the vessel may lose more thrusters than desired. In some arrangements it may be possible to overcome this disadvantage by always running at least one generator on each bus or by changing the point at which the ring is split to ensure there are always generators at the extremities of the circuit. This would need careful coordination with the power management system running order selection.

Figure 2-51 Directional over current protection

2.11.7 Optical and pressure arc detection

2.11.7.1 This method of bus bar protection is based on an entirely different principle. Faults in switchgear are generally associated with arcing faults. Thus it is possible to create a protection system which will rapidly trip the bustie circuit breakers for the faulty bus section if the light from an arc is detected inside the bus bar chamber. Commercial systems use fibre optic cables to monitor the internal spaces of the switchboard. Systems based on detecting the pressure rise associated with arc products work on a similar principle. Some vessel power plant designers chose to use arc detection as the primary protection scheme which supports the vessel’s worst case failure design intent but provide more conventional over current protection as a backup. The over current protection is not sufficiently selective to prevent WCFDI being exceeded but it should prevent a fire if the optical system failed for any reason.

2.11.8 Earth fault protection and system earthling.

2.11.8.1 The type of earth fault protection specified for marines system is influenced to some extent by the size of the power distribution system and the maximum prospective earth fault current. Many LV marine power systems were designed as un-intentionally earthed systems where the power system has no direct connection or reference to earth (vessel’s hull). On these systems, earth faults were typically indicated by earth fault lamps connected from each line to earth. When one lamp goes dark and the other two go bright there is an earth fault on the line connected to the dark lamp. Earth insulation meters are the modern alternative. These devices can be connected to the alarm and monitoring systems

IMCA GUIDANCE


W/S No: 55/130502 Page 77 of 194



2.11.8.2 On HV systems, high resistance earthing of various types is generally employed. In high resistance earthing systems a high impedance path for earth fault currents is created by adding a resistor from the generator star point to the ship’s hull or by way of one of several types of neutral earthing transformer that can be connected to the bus. Earthing the power system by way of the generator star points causes the earth fault current to vary with the number of generators connected. Nevertheless, this continues to be a popular method of system earthing.

R

Y

B

SYSTEM CAPACITANCE

GENERATOR

+ + +

+ + +

OPEN DELTA NEUTRAL EARTHING

TRANSFORMER

ZIG-ZAG NEUTRAL EARTHING

TRANSFORMER

NEATRAL EARTHING RESISTOR

VCB

Figure 2-52 Methods of marine power system earthing

2.11.8.3 All power systems are referenced to earth by way of the distributed capacitance of cables and windings and a significant earth fault current can flow even in unintentionally earthed systems. The intentional earth impedance only adds to the system charging current when an earth fault occurs and is often sized to provide an earth fault current three times that which would flow as a result of the capacitive charging current. This provides well defined current paths for protection purposes.

2.11.8.4 Classification societies differ on the level of earth fault current that can be accepted without automatic isolation. Some vessel’s in service only have an alarm to indicate an earth fault on the HV power system others have fully selective earth fault protection schemes. The requirement for the voltage rating of HV cables differs for systems intended to operate continuously with an earth fault and those with automatic disconnection.

2.11.8.5 Earth fault protection for the main power system is sometimes based solely on time grading. The relay in the earthing resistor or earthing transformers for each bus will detect an earth fault at any point in the plant not isolated by a transformer.

IMCA GUIDANCE


W/S No: 55/130502 Page 78 of 194



2.11.8.6 Earth fault protection in the feeders will isolate a fault in a consumer. If the earth fault persists after the tripping time of the feeder the fault is assumed to be in the generators or on the bus bars itself. At this point the protection driven from the neutral earthing transformers will trip the main busties to limit the earth fault to one bus or the other. Whichever neutral earthing transformer continues to detect an earth fault will then trip all generators connected to that bus. As losing a whole bus because of an earth fault in one generator is unnecessarily severe some designers add restricted earth fault protection to the generators.

2.11.9 Feeder protection

2.11.9.1 Feeder protection is generally limited to over current and earth fault protection but specialist protection functions may be used to protect motors and transformers. In particular, protection functions for transformers may need to be desensitised to the inrush current transient that occurs when a large transformer is connected. In protection schemes where the generators are protected against the effects of unbalanced currents (sometimes referred to as Negative Sequence Protection - NPS) it may be prudent to include NPS protection in the feeder protection scheme and coordinate it with the NPS protection in the generators to prevent a large unbalance current originating in the distribution scheme causing all online generators to trip. Such faults are uncommon in marine power system but cannot be ruled out completely. NPS can also be used to trip the main busties as additional protection although this may only be suitable for power systems with a simple two way split.

2.11.9.2 Feeder circuit breakers for service transformers may be fitted with under voltage release to disconnect transformers on blackout. It is important that an under voltage trips have adequate time delays to prevent the trip operating on a voltage dip associated with a short circuit fault. If this is not the case, all marine auxiliary services may stop due to an unrelated fault somewhere in the power system.

2.11.10 Power system studies

2.11.10.1 Several studies may be commissioned to support the design of a marine power systems including:-

1. Short circuit calculations

2. Protection coordination study

3. Load balance

4. Harmonic analysis

5. Transient stability study

2.11.10.2 Short circuit calculations are performed to ensure the switchgear is able to withstand the forces generated by the worst case short circuit current. It is also used to ensure the circuit breakers are able to interrupt that level of fault current.

2.11.10.3 The protection coordination study (sometimes known as the discrimination or selectivity study) is carried out to determine the various protection settings necessary to ensure that faults are isolated as close to source as possible.

IMCA GUIDANCE


W/S No: 55/130502 Page 79 of 194



2.11.10.4 The load balance is used to show the power consumed under various operating conditions, which may included DP, transit, harbour with variations for summer and winter operation if appropriate.

2.11.10.5 The harmonic analysis is used to show that levels of harmonic distortion fall within acceptable levels under all expected operating conditions. Excessively high levels of harmonic distortion have been known to cause equipment malfunction exceeding worst case failure design intent.

2.11.10.6 The transient stability study identifies the ability of the generators in a power system to maintain synchronism when subjected to a severe transient disturbance such as a fault, sudden loss of generating capacity or large load rejection. This study is not considered to be necessary for most marine power system because of their compact nature but some of the more unusual designs do have additional impedance between generators.

2.12 GENERATOR PROTECTION PHILOSOPHY

2.12.1 Importance to redundancy concept

2.12.1.1 The range of protective functions applied to the generators is an important consideration in the design of any DP vessel power plant. However, in the case of vessels intending to operate with a common power system, the generator and bus bar protection is fundamental to ensuring fault tolerance and the integrity of the redundancy concept. It is important to understand the dual role of generator protection in a DP vessel application. The protection must provide the necessary level of safety but also ensure continuity of supply and limit the severity of the failure effect to within the worst case failure design intent. Adding inappropriate protective functions can be as damaging to the redundancy concept as having insufficient protective functions.

IMCA GUIDANCE


W/S No: 55/130502 Page 80 of 194



GENERATOR PROTECTION RELAY

GROUND CT

OPEN

RTDs STATORCB

STATUS

VCB

R

Y

B

SERIAL LINK TO ALARM

AND MONITORING

ALTERNATOR

VMWMVARH z4-20 mA

POWER 110Vdc

TO BUS TIE CONTROL CCT

TRIP BUSTIE

TRIP GEN CB

FROM AVR

FROM GOVERNOR

WITH TRIP COIL

SUPERVISION

ACTUATOR CURRENT

FIELD CURRENT

VTsCTs CTs

DIGITAL INPUTS

EXTERNAL PROTECTION

CB TRIP

EXTERNAL PROTECTION

TIE TRIPPMS

OPENPMS

ESTOP

START ALL

DIESELS

RELAYFAILURE

COMMONALARM

EXCITETRIP

TO PMS

Figure 2-53 Generator protection relay

2.12.2 Standard generator protection functions

2.12.2.1 Figure 2-53 shows a typical multifunction generator protection relay. All information regarding the health of generator is obtained from VTs, CTs and winding temperature sensors. Table 2-4 shows a typical list of protective functions that might be available within such a multifunction relay and the executive action that is taken on detection of each type of fault. It is important to note that this range of protective functions is not sufficient to ensure the fault tolerance of a common power system. Section 2.13 on Advanced Generator protection discusses the additional protection features required for fault tolerance.

2.12.2.2 From Table 2-4 it can be seen this protection relay can be programmed to:-

1. Trip the generator

2. Trip the bustie circuit breaker between the two main switchboards

3. Shut down the faulty generator’s excitation system

4. Signal the PMS to start another generator

5. Lockout the generator from reconnection

6. Activate an alarm.

IMCA GUIDANCE


W/S No: 55/130502 Page 81 of 194



Table 2-4 Generator Protective Functions

Function Generator Trip

Bustie

(Quick Trip)

Excitation trip

Start all generators

Gen Lockout Alarm

Phase differential X X X

Negative sequence X X

Under-voltage X X

Reactive power X X X

Over-voltage X X

Phase reversal X X X X X

Under frequency X X X

Loss of excitation X X X X X

Reverse power X X X

Phase over-current X X X X X

Over frequency X X

IAS/PMS E-Stop X X Y

IAS PMS CB open X X X X

High set over-current X X X X X

Trip coil monitor X X X X

VT Fuse failure X X X X

Diode failure X X X X

Gen winding RTD X X X X

Gen Bearing RTD X X X X X

Field current X X X X

Relay fault X X X X X

ESD X X X

Earth Fault X X

2.12.3 Phase current differential

2.12.3.1 This function uses current transformers located at both ends of the generator windings. Any fault path within the generator is seen as an imbalance by the protection relay. The function is only required on larger generators typically (1500kVA and above) and is designed to detect stator winding faults at a lower level of fault current than the phase over-current function. It will trip the affected generator very rapidly on detection of this fault.

IMCA GUIDANCE


W/S No: 55/130502 Page 82 of 194



2.12.4 Negative sequence

2.12.4.1 This function is designed to protect the generator from damage associated with a significant imbalance in the generator phase currents. However, a broken conductor on a generator, drive transformerorservice transformer feeder could have this affect. Such failures are very unlikely but if the overall protection scheme is not fully selective then all generators which see the fault may trip leading to blackout. Certain types of drives may draw unbalanced currents in certain failure modes without necessarily tripping immediately. It may be possible to configure this function as an alarm rather than a trip with the agreement of the generator manufacturer.

2.12.5 Under voltage

2.12.5.1 This function is commonly applied to generators and is a class requirement. It has no particular benefit for the redundancy concept except to ensure that the plant can be restarted after a blackout. One possible way in which an under voltage could occur is the voltage dip associated with short circuit faults. These faults should be cleared by the over-current scheme and the under voltage protection should have a suitable delay to prevent it reacting to this.

2.12.5.2 Under voltage could also be caused by the direct online starting of a large motor.

2.12.6 Reactive power

2.12.6.1 There are considered to be two ways in which generators could be called upon to supply too much reactive power to the system. The first is due to an excitation system fault in one generator. This fault affects the operation of generators running in parallel with the faulty machine. The second is for the reactive power demand of the drilling or propulsion system to exceed the capacity of the online generators. In general there needs to be other protective functions in place to prevent the power plant reaching this condition.

2.12.7 Over voltage

2.12.7.1 This condition might occur as the result of an AVR failure to full or over excitation. This function has very little benefit for the redundancy concept as it is not fully selective and cannot identify the source of the over voltage and disconnect it. Other protective functions need to be in place to prevent the power plant reaching this condition.

2.12.8 Phase reversal

2.12.8.1 This fault is unlikely to be present beyond the commissioning phase but could occur after repair.

2.12.9 Under frequency

2.12.9.1 This is a symptom of plant overload or a common speed control problem on all engines. The under frequency trip does very little for the redundancy concept because it is not fully selective. It is usually a classification society requirement. In general, other protective functions need to be present to prevent the power plant reaching this condition.

IMCA GUIDANCE


W/S No: 55/130502 Page 83 of 194



2.12.10 Loss of excitation

2.12.10.1 This function is designed to prevent the generator running asynchronously and also to prevent it becoming a significant VAr drain on the surviving generators which may cause them to trip on over current this function is usually fully selective and will only trip the faulty generator.

2.12.11 Reverse power

2.12.11.1 This function is designed to prevent a faulty generator engine being motored by the other online generators and becoming a significant kW load which may cause them to trip on over current.

2.12.12 Phase over-current

2.12.12.1 This function is designed to protect the generator from thermal damage associated with an over current condition. If the protective functions in the drives and power management system are working correctly, healthy generators will not be overloaded. In systems designed to operate at a high power factor, over-current and overload are almost the same condition.

2.12.13 Over frequency

2.12.13.1 This fault could occur as the result of a severe engine governor failure which could cause the entire bus frequency to rise to unacceptable levels. This function provides little benefit for the redundancy concept other than to limit the potential for damage and ensure that generators can be restarted after blackout.

2.12.14 High set over-current

2.12.14.1 This function is often used to trip the bustie breakers if a short circuit fault occurs on the main switchboard when the vessel is operating with busties closed.

2.12.15 Trip coil monitor

2.12.15.1 This function will alarm if a faulty trip coil is detected on a generator circuit breaker. This is a very useful function to prevent a hidden failure compounding another fault which could defeat the redundancy concept.

2.12.16 VT fuse failure

2.12.16.1 This function alarms if a faulty fuse is detected on a generator VT. It provides further confidence that the protection system is healthy. A faulty VT will also prevent a standby generator synchronising and may cause certain meters and PMS indications to be in error.

2.12.17 Diode failure

2.12.17.1 Loss of a single diode in an alternator is not usually fatal immediately but may reduce the effectiveness of the excitation system. In some protection schemes detection of a faulty rotating diode initiates an alarm and a start request for a standby generator to connect. In other schemes the faulty generator may be tripped.

IMCA GUIDANCE


W/S No: 55/130502 Page 84 of 194



2.12.18 Gen winding RTD

2.12.18.1 High stator winding temperatures are indicative of a fault which may be related to overload or a malfunction of the cooling system. In this protection scheme detection of high temperatures initiates an alarm and a start request for all standby sets to be connected.

2.12.19 Gen Bearing RTD

2.12.19.1 High bearing temperatures are indicative of a fault in the bearing lubrication or that the bearing itself is beginning to deteriorate. In this protection scheme detection of high bearing temperatures initiates an alarm and a request for standby sets to connect. As a faulty bearing can lead to seizure and loss of synchronism the faulty machine should be taken out of service as soon as possible.

2.12.20 Field current

2.12.20.1 This is similar to the loss of excitation trip but for a less critical condition, this initiates an alarm and a request for all standby sets to be connected.

2.12.21 Protection relay faulty

2.12.21.1 This alarm is initiated if the generator protection relay fails to pass its own internal diagnostic check. It is a useful feature which improves confidence that the relay is healthy and thus prevents hidden failures compounding a power system fault.

2.12.22 Lockout

2.12.22.1 This function acts to lockout generators from reconnection if they have tripped on a particular fault. Generators should only be locked out from reconnection if they are actually faulty. Care needs to be taken not to lock out generators for external faults otherwise the reliability and effectiveness of blackout recovery may be impaired.

2.12.23 Earth fault - sometimes called ‘zero sequence’

2.12.23.1 This function will alarm or trip the generator on detection of an internal earth fault. On high resistance earthed power system, the earth fault current may be too low to activate the differential protection. Therefore a more sensitive form of protection is required. Restricted or directional earth fault protection using ‘core balance’ CTs may be used. A core balance CT is a large current transformer which passes over all conductors in a three phase circuit. Care must be taken when terminating the screen of a cable protected by a core balance CT. The earthed screen must not pass through the CT.

IMCA GUIDANCE


W/S No: 55/130502 Page 85 of 194



2.12.24 Quick trip

2.12.24.1 This function is a combination of:

1. High set over current

2. Negative sequence

3. Under / over voltage

4. Under/over frequency

5. Any other non selective protective function

2.12.24.2 It is intended to open the bustie to separate the two halves of the power plant before these functions trip their respective generator circuit breakers. Although all generator protection relays will see the fault, only the protection relays on the side with the fault will trip leaving half the power system in operation. This function is only effective in splitting the plant. This is effective for a redundancy concept with a 50% split. It is more difficult to use this function effectively in a power system with a multi-way split.

2.13 ADVANCED GENERATOR PROTECTION

2.13.1 General

2.13.2 Very significant advances have been made in the area of marine power plant protection in recent years. Possibly the greatest improvement has come in the form of protection systems able to identify which generator is responsible for causing a severe active or reactive power sharing imbalance. Fuel control and excitation system faults are relatively common in marine power systems. When governor and AVRs fail to an inert state (no fuel or no excitation) the failure effects are relatively benign and will only result in the loss of the faulty generator, provided the system is properly protected by traditional generator protection. Unfortunately, traditional generator protection offers little if any protection against failures to an active state (typically excess fuel or excitation) which can both result in severe load sharing imbalance and blackout. In fact the incorrect response of traditional generator protection is usually responsible for causing the blackout.

2.13.3 In many cases the driving force for developing this improvement has come from vessel owners themselves, but protection systems are now available from several sources including some of the large electrical system supplier and vessel automation vendors. All systems offer certain core protection features but are also capable of being expanded to address many other less critical failure modes and provide a useful backup to the traditional generator protection.

2.13.4 Core protection functions

2.13.4.1 The two most important failure modes that must be protected against are ‘failure to excess fuel’ and ‘failure to excess excitation’. In the case of failure to full or excess fuel there is a risk in light load conditions that all healthy generators will trip on reverse power or over frequency. In the case of exaction faults the healthy generators may trip on their field failure protection or over voltage. In some cases the system may be left running on the faulty generator which subsequently trips.

IMCA GUIDANCE


W/S No: 55/130502 Page 86 of 194



2.13.5 Predecessors to modern AGP

2.13.5.1 A few vessels were fitted with bespoke protection systems of various degrees of sophistication and early examples can be found dating back over fifteen years.

2.13.5.2 Failure to excess fuel could be protected against by maintaining a base load in excess of the rating of the largest generator. This was easily achieved by vessels using thruster bias mode for DP control but was wasteful of fuel and not very environmentally friendly. In some cases this protection measure was inadvertently defeated by the power management system which was programmed to shed thruster bias and/or thruster load on detecting the overload of any single generator.

2.13.5.3 Other early attempts to provide protection included systems which would trip the bustie if two or more generators were simultaneously in the reverse power condition.

2.13.6 Principle of operation

2.13.6.1 There are two basic principles of operation for Advanced Generator Protection:-

1. Voting systems

2. Conformance to predicted generator behaviour

2.13.6.2 Protection systems based on voting functions tend to be centralised protection systems which collect and compare information on all online generators. They attempt to identify the faulty generator by observing that one generator may acquire all the system active or reactive power and other generators shed it. These systems assume the generator carrying all the load is the faulty generator. Great care must be taken in the design of the plant to ensure that this is the only failure mode that can have this effect otherwise the protection system may trip the wrong generator. For example, if there are three generators online and two of them shed load because they share a common faulty fuel system the generator left carrying the system load is the healthy generator. If the protection system assumes that the generator carrying all the load has taken it from the others it will trip the healthy generator leading to blackout. The security of voting systems can be improved by combining the power comparison function with bus frequency measurement. The principle of operation is that a generator that is taking the system load from others because it has failed to excess fuel will drive up the power system frequency. A generator which is taking load because others are shedding it will not do this and bus frequency may fall.

IMCA GUIDANCE


W/S No: 55/130502 Page 87 of 194



2.13.6.3 Protection systems based on conformance to predicted generator behaviour do not require information on the status or condition of other generators and can be designed such that there is an independent protection system for each generator. The power plant is operated in uncorrected speed and voltage droop mode so that the operating point of healthy generators can be predicted from the speed and voltage droop characteristics. Figure 2-54 shows how the protection function works in the case of two generators running in parallel. For as long as both generators are healthy, their operating points follow their respective speed and voltage droop lines. When G2 fails to full fuel it takes load from G1 and drives it into reverse power. However, because the speed (frequency) of both generators must remain the same, the operating point of G2 deviates from the droop line. The operating point of G1 on the other hand remains on the droop line. The protection function is therefore created by placing a window round the droop line and tripping any generator that strays outside it. Suitable delays are added to allow for system dynamics and the AGP must act to isolate the faulty generator before the traditional generator protection operates to trip the healthy ones.

Figure 2-54 Principle of AGP

IMCA GUIDANCE


W/S No: 55/130502 Page 88 of 194



3 POWER MANAGEMENT

3.1 REQUIREMENT FOR A POWER MANAGEMENT SYSTEM

3.1.1 International Maritime Organisation

3.1.1.1 IMO MSC 645 does not specifically require that a power management system is fitted only that it should be suitably reliable if it is.

3.1.1.2 Generally, power management systems should fail in such a way that:-

1. The power plant continues to run ‘as set’

2. Local control is still possible

3.1.2 Classification societies

3.1.2.1 Most classification societies require that DP Class 2 and DP Class 3 vessels are fitted with a power management system but the requirement to have such a system may be waived if the various functions provided by a basic power management system are located in other systems. Also, if there would be no significant advantage in having a power management systems such as in the case of a DP vessel using direct diesel driven thrusters.

3.1.3 Power management system principles

3.1.3.1 The primary objective of a power management system is to ensure continuity of the power supply to essential consumers under all defined operating conditions. In the event that it fails in this objective it may be programmed to restore power automatically.

3.2 POWER MANAGEMENT SYSTEM ARCHITECTURE

3.2.1 Centralised control systems

3.2.1.1 The older and more basic power management systems tend to be centralised control systems in which a single processor or master slave arrangement interface to the entire power plant from a single cabinet located in the engine control room. Such designs offer little in the way of redundancy and the need to bring large amounts of analogue control signals back to a single location can present difficulties for DP Class 3 designs. Variations on this design use remote stations to gather the information from the field by way of a data communications network but all the control algorithms reside in the central controller.

3.2.2 Distributed control systems

3.2.2.1 Distributed control systems have been used in DP vessels for over a decade now and are the preferred solution for larger more complex vessels. In distributed control systems the control algorithms reside in processors located out in the field and close to the machinery they control and monitor. Failures in these field stations generally affect only the machinery controlled by that field station but the effect of failures in field stations for power management functions may be more widespread as the actions of one field station may depend on receiving information from another.

IMCA GUIDANCE


W/S No: 55/130502 Page 89 of 194



3.2.3 Intelligent consumers

3.2.3.1 There is an increasing trend to move the intelligence and control algorithms even closer to the machinery they control. As many elements of the DP system such as engine and thrusters are now controlled by local PLCs it is possible to put much of the intelligence required to create an integrated propulsion system into the machinery itself. Features of such intelligent consumers include the ability to:-

1. Make the equipment ready for remote control independent of any other control system

2. Take direct action to relieve stress in the power system

3. Monitor their own condition and disconnect themselves if they consider themselves to be faulty

3.3 POWER MANAGEMENT SYSTEM HARDWARE

3.3.1 PMS as part of an integrated automation system

3.3.1.1 In large complex vessels, the power management system tends to be just another software module within the overall integrated automation systems which may include:-

1. Dynamic positioning

2. Vessel management

3. Power management

4. Engine control and protection

5. Vessel safety system

3.3.1.2 Figure 3-1 shows a few of the most significant interfaces between the IAS and the power plant.

IMCA GUIDANCE


W/S No: 55/130502 Page 90 of 194



Figure 3-1 Integrated Automation System

3.3.2 PMS as a standalone function

3.3.2.1 In less complex vessels there may be no integrated automation system and it is not unusual to find that the power management system is provided by a different vendor to the DP control system and vessel alarm system. The power management system may be separate from the control and alarm system or there may be a link to record PMS alarms. The PMS may only offer very basic functions and load sharing and engine control could be carried out by other standalone hardware as shown in Figure 3-2.

Figure 3-2 Standalone PMS

IMCA GUIDANCE


W/S No: 55/130502 Page 91 of 194



3.4 POWER MANAGEMENT FUNCTIONS

3.4.1 Range of available functions

3.4.1.1 The extent of control provided by the PMS varies significantly between installations. The types of functions considered to be power management functions also varies from system to system and the boundary between PMS and vessel control functions may be determined by the system architecture.

3.4.1.2 A large range of control options are available in the most sophisticated systems including:-

1. Engine control, monitoring and protection

2. Charge air temperature control

3. HT cooling water control

4. Turbocharger assist control

5. Remote start & stop - initiation of generator synchronising

6. Standby generator running order selection

7. Standby generator management - standby time limitations

8. Load sharing (kW)

9. Asymmetric or fixed target load sharing

10. Reactive power sharing (kVAr)

11. Frequency control

12. Voltage control

13. Synchronising

14. Load dependant start & stop

15. Reactive power dependent start

16. Current dependent starting

17. Alarm initiated starting

18. Start all

19. Consumer load application rate control

20. Control of multiple independent power systems

21. Control of regenerated power

22. Consumer priority (Drilling)

23. Control of heavy consumer starting - advanced power reservation

24. Blackout prevention - phase back (load shedding) of heavy consumers

25. Load shedding of non essential consumers

26. Blackout restart of generators

27. Blackout recovery of power plant

IMCA GUIDANCE


W/S No: 55/130502 Page 92 of 194



3.4.1.3 Very basic power management systems may offer little more than remote manual control of generator starting, standby running order selection and load dependent starting. In such installations it may be necessary to supplement the PMS functions with standalone protective functions to ensure the power plant is fully protected against blackout.

3.4.2 Synchronising and dead bus closing

3.4.2.1 This can be a PMS function or a switchboard function. Synchronisers are widely available from a range of sources including engine governor manufacturers. These devices control the engine speed to bring incoming alternators in to phase, voltage and frequency alignment (excitation control is not normally used in synchronisers for marine applications).

3.4.2.2 Classification societies usually require that these automatic synchronisers are backed up by a manual circuit breaker control and a synchroscope or synchronising lamps. Generators are normally connected to the bus while running very slightly above system frequency to ensure that reverse power protection does not immediately trip the generator off line. Synchronising may fail when attempting to connect generators during large load fluctuations. Such conditions may arise when several generators trip because of a common mode failure and blackout protection functions are actively shedding load to prevent remaining generators from tripping on overload. Thus it is clear that synchronisers may be under the most onerous duty just when standby generators are needed most.

3.4.2.3 Power management system interaction with the DP system could be used to freeze load for long enough to allow successful synchronisation however modern power system manufacturers questioned for this survey were confident of synchronising under all steady state and transient load conditions. Generally, system manufacturers recommend one synchroniser per generator for redundancy.

3.4.2.4 In modern power management systems it is possible to configure the function of a synchroniser in software and use the PMS I/O modules to control the generator’s speed and monitor generator and bus waveform alignment. The PMS sends the signal to close the generator circuit breaker directly rather than just initiating the operation of the external synchroniser.

3.4.2.5 Dead bus closing facility. Most synchronisers also have what is called a dead bus closing facility. This overrides the synchronising function if the bus is dead. Power management systems may have an additional feature designed to prevent two generators dead bus closing at the same time. This may be achieved by staggering the start of generators following blackout recovery or using a system which passes a token from one generator to the next over the vessel management system network. Only the generator holding the token can dead bus close.

IMCA GUIDANCE


W/S No: 55/130502 Page 93 of 194



3.4.2.6 It is important that dead bus detection is robust and cannot incorrectly indicate that the bus is dead when it is live. Dead bus connecting a generator when the bus is actually live can cause very severe power system transients leading to blackout. Some power management systems make use of several sources of information such as blackout relays and voltage transducers, but in many cases these sources are connected to the same bus VT and interface with the same I/O module and are not as independent as they appear. Such an arrangement is shown in Figure 3-3. Some power management systems also include the status of generator and bustie circuit breakers in the detection algorithm to improve confidence in bus bar status. Some designers use a second source of bus voltage data to confirm the bus VT signal. Even where multiple sources are used there is a risk of spuriously declaring a blackout if there is insufficient delay in the detection algorithm to cater for the effects of voltage dips associated with short circuit faults.

BLACKOUT WHEN K1-K3

CLOSED

VOLTAGE TRANSDUCER

BUS VT

K1

I/O MODULE

VOLTAGE

K2 K3

BUS

FREQUENCYVOLTAGE TRANSDUCER

K1K2

K3

Figure 3-3 Blackout detection from single source

IMCA GUIDANCE


W/S No: 55/130502 Page 94 of 194



3.4.3 Frequency Control

3.4.3.1 In control schemes where the PMS acts to alter the governor speed set point as a means of correcting droop, frequency control is the responsibility of the engine governor and the power management system. Typically, the PMS interfaces to the governor by two digital inputs, one for ‘raise’ speed set point and the other for ‘lower’ speed set point. This type of interface was originally developed to allow power management systems and remote manual controls to adjust the speed set points of mechanical governors by driving a ‘speeder’ or ‘pilot’ motor clockwise or anti clockwise. The speed set point will increment by a defined number of RPM/s during the time that the ‘raise’ or ‘lower’ contacts are closed. Thus, the speed set point is effectively adjusted by the time for which the control pulse is applied. This type of interface is still used on modern digital governors and is vulnerable to failures. Typical faults include broken wires disabling the ‘raise’ or ‘lower’ signal. A more dangerous fault is when the contacts for the set point ‘raise’ signal stick in the closed position driving up the load on the faulty generators and pushing the healthy generators towards the tripping point of their reverse power protection.

3.4.3.2 When the PMS is responsible for frequency control and load sharing, computations for how to adjust the governor to correct frequency and load sharing imbalance are carried out simultaneously. A composite time pulse is calculated for each governor that will simultaneously correct frequency and load sharing deviations.

3.4.4 Voltage Control

3.4.4.1 Voltage control by PMS is less common than frequency control. This is because several power management system providers choose to leave this function under the control of AVR’s operating in uncorrected droop mode. Other power system manufacturers choose to control AVR set points for voltage control and reactive power sharing in much the same way as generator speed control. There is little evidence to suggest that compensating for voltage droop offers any significant advantages for the redundancy concept. However, introducing additional complexity into the generator control system can also introduce additional failure modes.

3.4.5 Multiple independent power systems

3.4.5.1 This refers to the need for a power management system to be able to manage bus sections as separate power systems when opening and closing busties. Several classifications societies have requirements in their DP rules relating to the need for the PMS to be able to operate effectively when the power system is subdivided into smaller independent power systems.

3.4.6 Load Dependent Start/Stop

3.4.6.1 This function is universal amongst power management systems. Although the need for load dependent starting of standby generating sets is clear, vessel operators are divided as to the wisdom of allowing generators to be automatically stopped. Many vessel operators prefer to have the power management system alarm on light loading rather than act directly. Classification society rules may require that there is a facility to disable the load dependent stop function.

IMCA GUIDANCE


W/S No: 55/130502 Page 95 of 194



3.4.7 Blackout Restart

3.4.7.1 Blackout restart is an extremely important feature of any power management system but is generally only present in the more sophisticated systems. There are many older vessels in service where manual intervention is still required after a blackout. At least one classification society makes reference to the requirement for connection of a standby set and the sequential automatic reconnection of essential consumers within its DP rules.

3.4.7.2 A modern power management system should be able to re-establish limited propulsion capability rapidly and automatically without any human intervention. As a first step, a typical blackout recovery strategy will start all available generators. In some cases, the standby start matrix may be disregarded and the first generator to run successfully will be closed on to the dead busbars. The actions that follow may be highly vessel specific, but typically, the power management system will then close the HV and LV transformer feeder circuit breakers in order to restore essential services. This action will be followed by a sequential restart of services that were already running before blackout occurred. To prevent further problems, the power management system will not attempt to reconnect any generator to a switchboard that has tripped on a fault, or start generators that were withheld from the standby start matrix for any reason.

3.4.7.3 In some blackout recovery strategies, the first action of the PMS is to open all generator and bustie circuit breakers. Thus it is important that the method for detecting blackout is secure and reliable. In PMSs with this type of function, a false indication of blackout may actually create a blackout.

3.4.7.4 There are conflicting opinions on the wisdom of automatically restarting thrusters and assigning them to the DP system, due to the risk of repeating the fault that cause the power system to blackout out in the first place. However, vessel owners who have such functions have stated that the benefits of having the DP control system automatically arrest the drift-off outweigh the possible risk that the protection system fails to isolate and lock out the faulty consumer which caused the blackout.

3.4.8 Autonomous restart of thrusters

3.4.8.1 Possibly one of the greatest advances in recent years is in the ability of certain designs of thruster drive to make themselves ready for DP independently of any centralised control system. In the event of any significant disturbance or voltage dip which causes them to disconnect, these thrusters will monitor the condition of the main power systems and reconnect as soon as conditions permit. This makes blackout recovery of generators and thrusters a parallel operation rather than a sequential one, saving a considerable amount of time compared to conventional designs. System based on these principles can typically recover from blackout in several tens of seconds rather than minutes. When attempting to optimise blackout recovery times it is important to carefully consider the control sequences leading to generator and thruster connection. In particular, it is important to identify any unnecessary delays or permissive that might prevent a thruster connecting. For example it may be better to allow a thruster to start without its cooling fans running than lock it out from reconnection until the become available, particularly if the thruster will take many minutes to overheat without them, and there will be alarms to indicate the over temperature condition.

IMCA GUIDANCE


W/S No: 55/130502 Page 96 of 194



3.4.9 Start Prevention of Heavy Consumers

3.4.9.1 This is not a standard feature on every power management system but is common on more sophisticated systems. The additional load of, for example, a large deck crane may require a standby generator to be connected if kW or kVAr spinning reserve will be compromised or if the anticipated transient voltage dip threatens malfunction. A typical heavy consumer function will allow the start to proceed after connecting the required number of generators according to a look up table. As it is possible for multiple start requests to occur near simultaneously, the heavy consumer module needs to be able to treat each request separately.

3.4.10 Load Limitation / Load shedding - General

3.4.10.1 Load limitation / shedding may be carried out by several systems including:-

1. The DP control system

2. The power management system

3. The generator protection

4. The thruster pitch control system

5. The thruster speed control system in the variable speed drive

3.4.10.2 The DP control system is programmed to limit or reduce the thrust order if there is insufficient power available. In the event of a short fall in power, the DP control system will generally sacrifice position to maintain heading. The load reduction functions in the DP control systems are generally considered to be too slow to provide effective blackout protection so it is normal to supplement these with fast acting load reduction functions in the power management system. Such functions may also be included as part of the control system for variable speed drives or for generator protection and these are discussed in more detail in the sections that follow.

3.4.10.3 Care needs to be exercised in the design and tuning of load limitation and load shedding schemes as poorly designed systems can induce severe oscillations in the power systems which can escalate to blackout or prevent standby generators connecting.

3.4.10.4 Careful coordination is required to ensure that load reduction functions and load dependent start function are properly coordinated Load dependent start should be initiated at a power level below the point at which load reduction or load shedding measures are activated. Failure to arrange the levels correctly creates a condition where standby generators cannot start because the load is being maintained below the starting point. Such a condition will result in a drift off unless the engineers connect additional generators manually.

3.4.11 Load shedding - Power or Frequency

3.4.11.1 Load reduction systems may be based on:-

1. Available power

2. Power system frequency

IMCA GUIDANCE


W/S No: 55/130502 Page 97 of 194



3.4.11.2 Available power Load reduction systems based on available power monitor the power being supplied by the generators and status of generators (online or offline) to determine the level of available power. Such systems depend upon the generators being able to deliver rated power and are thus vulnerable to failures cause by conditions such as fuel starvation where the generators cannot deliver rated power. Care is required to ensure the power available calculation is robust and some PMS manufactures carry out confidence checks by comparing the power delivered by the generators to the load consumed - load reduction functions are suspended if a significant discrepancy is detected. On older vessels the power limitation signals connect the PMS field stations to the thruster or heavy consumer control system by way of dedicated analogue links. This arrangement ensures the necessary speed of load reduction but may introduce complications in DP Class 3 designs where the effects of fire on cable route must be considered. In more modern vessel the load reduction signal are carried by the dual redundant communications network.

3.4.11.3 Power system frequency Load reduction systems based on bus frequency simply reduce load to prevent unacceptable drops in bus frequency which indicate that the generators are unable to support the load. Such systems are not vulnerable to conditions which limit the power of the generators but care must be taken to ensure the frequency measuring scheme is robust and not likely to trigger a spurious load reduction due to erroneous frequency measurements. Detection of low frequency can also be used to open busties and trip non essential consumers.

3.4.12 Load shedding systems in variable speed drives

3.4.12.1 The control system for variable speed drives used for thrusters, cranes and pipe lay systems may also contain independent load reduction functions based on measuring the frequency at their power input. Because each drive makes its own frequency measurements, failures are generally limited to one consumer. Because this makes for a very robust system some vessel owners chose to base the entire load reduction system on this principle and have no other system based on centralised control and measurement other than the DP control system. Careful design and tuning of these functions is important to prevent unwanted oscillations. Some systems use a ‘fast-attack, slow-release’ function. In this type of function a very rapid power chop is initiated followed by a slow ramp up to the limit of the available power determined by the bus frequency.

3.4.13 Load limitation / shedding of variable speed drives based on available power

3.4.13.1 The speed with which variable speed drives can be controlled allows power management systems to use them for blackout prevention purposes. This form of control is often based on measurement of consumed power and estimates of available power based on generator rating.

3.4.13.2 The control lines for load limitation are usually a mixture of 4-20mA loops and Net I/O. In some cases analogue load limitation signals will connect PMS Field Stations directly to the variable speed drive control systems. In other cases the PMS field stations will communicate with the thruster or drive field station which will then pass the signal or (some derived signal) to the variable speed drive itself.

IMCA GUIDANCE


W/S No: 55/130502 Page 98 of 194



3.4.13.3 In properly designed systems the effect of PMS failure or control wiring failure on thrusters will be ‘fails to no limit’ with appropriate alarm. The failure modes for non DP consumers may be to ‘full limit’ or ‘no limit’ depending on what is considered to be the safest mode. Figure 3-4 shows the signals related to power limitation and control.

Figure 3-4 Signals relating to load reduction

3.4.14 Load Limitation and reduction functions

3.4.14.1 To ensure that available power is shared in an orderly manner amongst all the various consumers according to their importance, each consumer is sent a ‘power available’ signal that tells the drive how much power it can have at any instant in time. If the speed or torque command to that drive requires more power than the power available signal allows, the drive will set its ‘power limit active’ signal to advise the PMS and DP system that it has reached the power limit. The power available signal is recalculated each scan cycle of the PMS and can be visualised as a dynamic ceiling on the power that the drive can draw. When there is plenty spinning reserve, the power limit will be high and well above what the drive is actually consuming but as the spinning reserve is used up the ceiling will fall to just above what the drive is actually drawing. (The power available signal can be ‘absolute’, i.e. the total power that the drive can draw or ‘relative’, the amount by which it can increase its load. The example below shows a ‘relative’ figure for power available).

3.4.14.2 If the demand for power exceeds the power available signal, the effect is that the drive load ramps up by the value of the power available signal in each scan cycle until the desired load level is achieved or bus capacity limits further increase. In real systems it is possible to specify an additional ramp function to prevent significant dips in bus frequency and voltage or to prevent excessive torque in the drive train. It is also possible to specify a delay on reallocation of power after a power reduction is active (such features are not included in the discussion below).

3.4.14.3 To prevent an overload created by several systems each simultaneously grabbing all the spinning reserve, the power available calculation for each consumer includes coefficients reflecting the relative priority of consumers.

IMCA GUIDANCE


W/S No: 55/130502 Page 99 of 194



3.4.14.4 Two conditions are simultaneously monitored and controlled.

1. Consumer wishes to draw more power than has been allocated to it

2. Overload caused by sudden loss of generating capacity

3.4.15 Power available for load increase - Example System

3.4.15.1 The example in Figure 3-5 is a much simplified power system with two generators, one thruster, a crane and a fixed hotel load. There is no control over the hotel load but both the thruster and the crane can be controlled as described above.

3.4.15.2 The crane and the thruster are each allocated power according to the following functions:-

1. Power available to crane = crane allocation x (bus capacity x crane priority – bus load)

2. Power available to thruster = thruster allocation x (bus capacity x thruster priority – bus load)

3.4.15.3 The variables and coefficients are defined as follows:-

1. Bus capacity is equal to the sum of the ratings of the online generators.

2. Bus load is the total load on the bus.

3. Crane priority is 90% - The crane cannot raise the bus load to more than 90% capacity – If the bus load exceeds 90% the crane load will be reduced.

4. Thruster priority is 100% - The thruster can raise the bus load to 100% capacity and will force down the crane load to ensure it can access the power it needs to hold station.

5. Crane allocation is 40% - At any instant in time, the crane can increase its load by 40% of power available.

6. Thruster allocation is 60% - At any instant in time, the thruster can increase its load by 60% of power available.

3.4.15.4 Note that in commercially available power reduction schemes the control functions are more sophisticated with additional coefficients. This much simplified example is only intended to help the reader understand the concept.

3.4.16 Thruster priority

3.4.16.1 Because the thruster has a higher consumer priority than the crane it will continue to be assigned a power available figure which allows it to increase bus load over the crane priority. This has the effect of invoking the crane overload function which then ramps down the crane load incrementally as thruster load increases.

3.4.17 Consumer allocation

3.4.17.1 The effect of the consumer allocation is that whatever power is available for simultaneous load increase by thruster and crane, the crane can have 40% of it and the thruster can have 60%. The consumer priority and allocation can be set to suit a particular application.

IMCA GUIDANCE


W/S No: 55/130502 Page 100 of 194



3.4.18 Response to overload

3.4.18.1 In addition to managing the rate and percentage by which each consumer can increase its consumption, the PMS must respond rapidly to loss of generating capacity before the surviving generators trip on overload. Various schemes are possible but load shedding in response to bus overload and falling bus frequency are almost always included. Load shedding in response to individual generator overload may also be included but this needs careful scrutiny to make sure it will not compound a governor failure to excess fuel leading to blackout.

3.4.19 Load shedding in response to bus overload is performed using the following functions:-

1. Overload thrusters = bus load – thruster priority x bus capacity

2. Overload crane = bus load – crane priority x bus capacity

3.4.20 Actual vessel systems

3.4.20.1 Reference to philosophy documents for actual vessel systems will reveal more complex algorithms which allow the user to assign the percentage of available power that is allocated from each bus in a multi bus system and also to include a fixed power reserve for such things as active heave compensation but it may be useful to consider the simplified scheme in Figure 3-5 below prior to considering the effects of additional complexity.

3.4.21 Example power limitation and reduction scheme

3.4.21.1 Refer to Figure 3-5. In the example power system below, the generators are rated at 5MW each and the figures below each consumer are the power consumption used in the first example rather than their rating. Two examples are used to demonstrate how the load limitation and reduction systems respond to changes in the power system conditions to prevent blackout and drift off. The figures used are intended to help the reader understand the action of the power management system rather than represent realistic conditions.

IMCA GUIDANCE


W/S No: 55/130502 Page 101 of 194



Figure 3-5 Example Power System

3.4.22 Example 1 – Sudden loss of generating capacity

3.4.22.1 In the first example, the hotel load is 1MW and the thrusters are consuming about 3MW but this is varying up and down by about 1MW due to the environmental conditions as shown in Figure 3-6 such that the total bus load is peaking at 9MW or 90% of generating capacity. The crane is hosting at a rate that requires 4MW.

3.4.22.2 At 45s into Figure 3-7, one of the two 5MW generators trips on a fault. Immediately the thruster and crane loads are each reduced by the calculated overload, but are allowed to ramp up again. However, as the new generating capacity is not enough to support the original thruster and crane loads the crane is forced to slow down during the thruster power peaks. As Figure 3-8 shows, the crane and thruster Power Available (PA) figures fall almost to zero and the bus load is near to the remaining generating capacity of 5MW.

IMCA GUIDANCE


W/S No: 55/130502 Page 102 of 194



0 50 100 150

0

2

4

6

8

10 x 106 Thruster Load, Crane Load, Hotel Load

Time(s)

Pow

er (W

)

Total Bus LoadThruster LoadCrane LoadHotel Load

Figure 3-6 Initial Thruster, Crane and Hotel Loads

0 50 100 150

0

2

4

6

8


Time(s)

Pow

er (W

)

Thruster LoadCrane LoadBus Load

Figure 3-7 Thruster, Crane and Hotel Loads after Loss of one 5MW Generator

IMCA GUIDANCE


W/S No: 55/130502 Page 103 of 194



0 50 100 150

0

2

4

6

8

10 x 106 Bus Load, PA - Crane, PA - Thrusters

Time(s)

Pow

er (W

)Bus LoadPA CranePA Thrusters

Figure 3-8 Effect on Power Available Signals to Thruster and Crane

3.4.23 Example 2 – Sudden demand for thrust

3.4.23.1 In the second example, bus capacity is 10MW and the thrusters are idling at a steady 1.5MW, with the crane hoisting at rate which requires 4MW. The hotel load is 1MW. At 90s into Figure 3-9 there is a sudden demand for the thrusters to increase to 8MW. The power limitation functions limit the rate at which the thrusters can ramp up and the crane load is shed away such that the crane has to slow to a stop. Figure 3-10 shows how the bus load levels out at 9MW and the remaining power available to the thrusters is low. Although there is some bus capacity left this is not available to the crane as its priority level is 90%.

3.4.23.2 Had the thruster demand been 5MW instead of 8MW as shown in Figure 3-11 then 3MW would have been available to allow the crane to continue to hoist.

IMCA GUIDANCE


W/S No: 55/130502 Page 104 of 194



0 50 100 150

0

2

4

6

8


Time(s)

Pow

er (W

)

Thruster LoadCrane LoadHotel Load

Figure 3-9 Sudden Demand for Thrust

0 50 100 150

0

2

4

6

8

10 x 106 Bus Load, PA - Crane, PA - Thrusters

Time(s)

Pow

er (W

)

Bus LoadPA CranePA Thrusters

Figure 3-10 Bus Load and Power Available Following Large Demand for Thrust

IMCA GUIDANCE


W/S No: 55/130502 Page 105 of 194



0 50 100 150

0

2

4

6

8


Time(s)

Pow

er (W

)

Figure 3-11 Thruster Step Load of 5MW

3.4.24 Load Shedding - Preferential trips

3.4.24.1 This feature is universal within all the more sophisticated power management systems but may be provided by switchboard protection functions in some cases. The effectiveness of preferential tripping in some DP vessel types may be limited by the size of non-essential loads that can be made available for tripping.

3.4.24.2 Typical non essential loads include:-

1. Ventilation fans

2. HVAC

3. Galley services

4. Calorifiers

5. Water makers

6. Compressors

3.4.25 Drilling priority

3.4.25.1 In the case of vessels operating in deep water where the permissible position excursion is relatively large, some vessel owners have chosen to prioritise power to drilling and pipelay systems until a defined excursion is reached. At this point, priority for power is returned to the thrusters and the drift off will be halted. This small excursion is tolerated during the time that the power shortfall is made good by the connection of standby sets. This arrangement requires the DP control system to supply position information to the PMS so that it can reconfigure.

IMCA GUIDANCE


W/S No: 55/130502 Page 106 of 194



3.4.26 Active heave compensation reserve

3.4.26.1 More sophisticated power management systems offer a facility to cope with consumers that can vary their power demand over a very large range in a short period of time. Active heave compensation systems for drilling are typical of this type of consumer. In simple terms, a ‘false’ load figure equal to the expected peak power demand is added to the actual load to maintain a reserve and trigger load dependent starting to preserve it. Thrusters and other consumers cannot access this reserve until they are given power priority over the active heave compensation.

3.4.27 Harmonic filter control

3.4.27.1 Systems that employ harmonic filters can have these devices connected or disconnected by the power management system as conditions dictate. Filter disconnection may be desirable to improve power factor under certain running conditions or reduce power losses in conditions where they are not required. A complementary strategy offered by one manufacturer starts an additional generator when total harmonic distortion exceeds a certain level.

3.4.28 Derating

3.4.28.1 Derating is a useful but unusual power management system feature when a Diesel engine is no longer able to attain its rated power. This feature allows the operator to reassign a new maximum kW rating to one generator. The power management system will then use this new value to determine the division of load between generators.

3.4.29 Starting of standby generators on alarms from running generator

3.4.29.1 Connecting a replacement generator on detection of an alarm condition on a running generator is another standard feature of most PM systems. Users may have the choice of programming the automatic stopping of faulty sets depending upon the severity of the alarm. Some vessel owners prefer to have manual stopping of the faulty generator.

3.4.30 Remote Start Stop

3.4.30.1 Almost all power management systems offer this feature. How it is actually achieved may depend on the particular system configuration, for example, use of an engine manufacturer’s control system or direct control from the power management systems.

3.4.31 Standby Generator Selection

3.4.31.1 The standby starting matrix is another central component in most power management systems. This may be configured by the engineer to take account of ongoing maintenance. Several incidents have been recorded where failure of a standby generator start was due to improper setting of the starting order. Power management system manufacturers would claim that these problems have now been overcome. Even in the most modern systems it may be possible to select the same standby order number for more than one generator without any alarm on the power management system. The PMS will generally connect the generator with the lowest physical number. However this generator may be on a different switchboard to the one the operator intended to connect.

IMCA GUIDANCE


W/S No: 55/130502 Page 107 of 194



3.4.32 Circuit Breaker Open / Close

3.4.32.1 Circuit breaker open / close is a standard feature of many systems and a network mimic is often provided as an aid to correct selection. Interlocking of circuit breakers is normally hardwired. In some cases software interlock are used as a backup to the hardwired interlocks. Some power management systems offer a convenient feature that allows the power system to be configured for different types of operation.

3.4.33 Password Protection

3.4.33.1 Password protection on some system controls access to more advanced features. When a choice of settings is provided, some manufactures will ensure that it is not possible to inadvertently set parameters beyond reasonable limits.

IMCA GUIDANCE


W/S No: 55/130502 Page 108 of 194



4 POWER DISTRIBUTION

4.1 POWER DISTRIBUTION SCHEMES

4.1.1 General principles and influence on redundancy concept

4.1.1.1 The power distribution scheme of a DP Class 2 or DP Class 3 vessel forms the very heart of the vessel’s DP redundancy concept. How generators, thrusters and auxiliary services are divided into groups largely determines the vessel’s worst case failure and therefore its post failure DP capability. It is common practice to describe the electrical part of the redundancy concept in the form of an overall power system single line diagram.

4.1.2 Design methodology

4.1.2.1 There are several possible approaches to DP vessel design but two possibilities are outlined below.

1. If the intention is to build a vessel similar to a unit that already exists in the fleet then data on the station keeping capability of this vessel may serve as a guide or base line for development of the new vessel.

2. If the new vessel is significantly different, then the process leading to development of the redundancy concept follows the pattern below.

4.1.2.2 The hull form required for the application is chosen, typically ship-form, barge or semi submersible. Catamaran forms are now becoming popular for certain applications.

4.1.2.3 Established regional data on weather, sea state and tidal currents is consulted to further refine the choice of hull design and propulsion machinery.

4.1.2.4 For DP Class 2 and DP Class 3 vessels, the post worst case failure capability defines the environmental conditions in which the vessel can operate and this can be related to uptime by reference to the regional environmental data.

4.1.2.5 How the post worst case failure DP capability is achieved is determined by the redundancy concept and worst case failure design intent which are intimately linked to the arrangement of main and auxiliary switchboards. This will influence the type and rating of propulsion machinery along with estimates of power requirements for hotel and process loads such as drilling, pipelay, ROV support etc. An allowance for maintenance of major machinery may also be included.

4.1.2.6 The whole process may go through several iterations leading to the point where the DP Class, redundancy concept, operating configuration, WCFDI, single line power system diagram and the rating and type of the major propulsion machinery has been established.

IMCA GUIDANCE


W/S No: 55/130502 Page 109 of 194



4.1.3 Distribution system components

4.1.3.1 The power distribution scheme consists of:-

1. Switchboards - with switchgear, protection and control equipment

2. Service transformers

3. Distribution boards

4. Motor control centres

5. Cables - cable trays

4.1.3.2 The purpose of the power distribution scheme is to distribute power to consumers at the required voltage level.

4.1.4 Voltage distribution levels

4.1.4.1 There may be several voltage levels in a power distribution scheme to provide power at a voltage appropriate to the type and power rating of the consumer. As might be expected, low power consumers tend to be supplied at lower voltage levels than high power consumers. As power ratings increase, the rated voltage is increased to reduce the current and thus the cross section of the cables and windings required to supply the power. Increasing the voltage rating also reduces the maximum fault current. Low voltage supplies may be provided for safety reasons and because there are fewer restriction on the qualifications of maintenance personnel. In a large diesel electric vessel the distribution levels might be as listed in Table 4-1. Voltage distribution levels for smaller or less complex vessel are given in

4.1.4.2 Table 4-2. However, some quite large vessels are now using LV power generation.

Table 4-1 Voltage distribution levels - large vessels

Voltage level designation Typical voltage Use

HV 11kV 6.6kV Generators, thrusters, service transformers, drilling and pipe lay drives

LV 690V 480V 440V 380V

Pumps, fans, service transformers, HVAC, accommodation heating. Emergency services

Lighting and small power 220V 208V 110V Lighting, single phase motors

Battery systems 110Vdc 24Vdc Systems for navigation, DP vessel management, thruster drives, engines and switchboards

IMCA GUIDANCE


W/S No: 55/130502 Page 110 of 194



Table 4-2 Voltage distribution levels - Smaller vessels

Voltage level designation Typical voltage Use

Main generation level 690V Generators, thrusters, large pumps

Auxiliary system level 480V 440V 380V

Pumps, fans, service transformers, HVAC, accommodation heating. Emergency services

Lighting and small power 220V 208V 110V Lighting, single phase motors

Battery systems 110Vdc 24Vdc Systems for navigation, DP vessel management, thruster drives, engines and switchboards

4.1.5 Emergency generators

4.1.5.1 Vessels which fall under the SOLAS regulations must have an emergency source of power capable of supplying designated emergency consumers. In larger vessels this requirements is typically fulfilled by the provision of an emergency generator. This generator and its associated emergency switchboard form part of the vessel’s low voltage scheme but there are requirements for separation between the two systems. On smaller vessels the emergency generator may be 300kW but on larger vessels it is common to find generators of 1MW to 2MW rating.

4.1.5.2 It is sometimes possible for DP vessels to obtain an exemption from having an emergency generator if they meet certain requirements in addition to their power system redundancy. However, the emergency generator has so many useful functions related to black starting the vessel, providing an alternative source of power and providing long term backup to battery systems that most DP vessel power plant designers choose to incorporate an emergency generator in their design. Some even elect to have a full sized main generator as the emergency set.

4.1.5.3 SOLAS and classification society rules influence the way in which the emergency generator is used for non emergency functions. Generally, it is accepted that the emergency generator can act as a harbour set for short periods of time. This is useful if the harbour load is very small in relation to the load at sea as it may help to prevent a large main engine running at low load for an extended period.

4.1.5.4 Some classification societies interpret SOLAS requirements as:-

1. Normal operation of the vessel shall be possible with the complete emergency electrical power supply system out of operation.

2. All consumers that support functions required to be available in normal operation, shall be supplied from distribution systems independent of the emergency electrical power supply system.

3. All consumers required to be available in emergency operation shall be supplied from distribution systems independent of the main electric power supply system.

IMCA GUIDANCE


W/S No: 55/130502 Page 111 of 194



4. Consumers required to have both main and emergency supply shall be supplied as required by relevant rules applicable for these consumers. The primary supply shall be from the main system. Upon failure of any of the required power supplies, an alarm shall be initiated.

4.1.5.5 This last clause is generally interpreted to mean that mains power for UPSs and battery systems required to support DP essential consumers should be supplied from the same side of the main power distribution system as the equipment they support but can have a back up supply from the emergency power distribution. Under no circumstances should all DP UPSs and battery systems have a sole source of power from the emergency switchboard. Although this arrangement was once popular.

4.1.6 Service transformers

4.1.6.1 Service transformers are provided to transform power from one voltage level to another. They are typically a three phase two winding transformer with a delta / delta or delta / star arrangement with or without an earthed star point as shown in Figure 4-1. Occasionally a three phase transformer is constructed from three single phase transformers and a fourth single phase transformer is provided as a spare winding.

Figure 4-1 Service transformers

4.1.6.2 The voltage at a transformer secondary winding can be predicted from a knowledge of its primary voltage V1 and turns ratio N1/N2 according to Equation 4-1

1

2

2

1

2

1

II

NN

VV

==

Equation 4-1 Transformer formula

IMCA GUIDANCE


W/S No: 55/130502 Page 112 of 194



4.1.7 Service transformers can be water cooled or air cooled. Air cooled transformers can be convection (naturally) cooled or forced cooled using fans. Some transformers may be arranged to trip on over temperature and others may only have an alarm. It is not uncommon in older DP Class 2 design to find all the vessel’s service transformers in a single compartment. This is acceptable but the provision of ventilation supplies and fire dampers may need careful consideration.

4.1.8 Some classification societies may require over voltage protection on the transformer secondary in view of the risk of an over voltage being coupled through from the primary side although an earthed screen between primary and secondary windings may be accepted in mitigation. Where an earthed neutral is provide on the secondary side it may be necessary to have only one service transformer earthed at any one time to prevent circulating currents.

4.1.8.1 Service transformers can have an unexpected influence on the redundancy concept of a DP vessel particularly when they have cooling or other auxiliary functions which are powered from sources other than the distribution systems they feed. Such arrangements are surprisingly common and can cause distribution system failure effects to be more severe than would otherwise be expected if not identified in the DP system FMEA.

4.1.8.2 Where the secondary side of two service transformers can be connected by a tie line connecting their respective LV switchboards both transformers will be able to contribute current to any fault. In some distribution systems the LV switchboards are not rated for this level of fault current and interlocks are provided to prevent the parallel operation of the service transformers. Short term paralleling may be arranged to allow bumpless transfer of the load from one service transformer to the other.

4.1.8.3 Large service transformers may have a significant inrush current at the point of connection which is capable of tripping over current protection. This can have a distinct disadvantage for blackout recovery as it may be necessary to wait for two generators to connect before the service transformers can be energised.

4.1.8.4 The inrush current transient is cause by the action of synchronising the magnetic core of the transformer with the applied voltage at the time of connection which may drive the core into saturation initially.

4.1.8.5 This effect can be prevented by using a pre magnetising transformer. This is a small LV transformer which is used to back feed the large service transformer from its secondary side before the primary side of the service transformer is connected. Thus the magnetic core is already in synchronism with the primary side supply when the transformer is connected.

4.1.9 Phase shifting transformers

4.1.9.1 Phase shifting transformers are normally used in marine power plant applications for harmonic cancellation. Excessive levels of low order harmonic distortion are associated with equipment malfunction, unwanted heating, audible noise, lighting failures and other faults.

IMCA GUIDANCE


W/S No: 55/130502 Page 113 of 194



4.1.9.2 The idea that a distorted waveform can be represented by a series of sinusoidal waveforms is credited to Joseph Fourier an 18th century French mathematician. The frequency of each harmonic component is a multiple of the fundamental frequency which is typically 60Hz in marine power systems.

4.1.9.3 Classification societies set various limits for Total Harmonic Distortion (THD) but figures of 5% for THD and 3% for the maximum contribution of any one harmonic are not uncommon.

4.1.9.4 In marine applications the primary sources of harmonics are from AC and DC variable speed drives used for thrusters and drilling equipment. Figure 4-2 shows the distortion in the red - yellow line voltage of a large DP vessel using 12 pulse thruster drives.

4.1.9.5 Variable speed drives using three phase bridge rectifier front ends are still popular for thruster drives and drilling equipment. These drives draw non linear current with significant quantities of 5th and 7th order harmonics. The level of low order harmonics can be reduced by using two 6 pulse rectifiers supplied from a single three winding transformer with a delta primary and two secondary windings. One secondary is a delta and the other a star. This arrangement introduces a 30 degree phase shift between the current pulses drawn by the two 6 pulse rectifiers and the dual rectifier drive is referred to as a 12 pulse drive. Figure 4-3 shows the harmonic analysis of the waveform in Figure 4-2. Although it still contains significant quantities of 11th and 13th harmonic the 5th and 7th order harmonics have almost been eliminated.

4.1.9.6 The increasing use of drives with Active Front End (AFE) rectifiers has removed the need for phase shifting transformers but an isolation transformer is still required.

Timed event at 14/02/01 12:57:36.000

CHA Volts 12:57:36.000 12:57:36.005 12:57:36.010 12:57:36.015 12:57:36.020

Volts

-10000

-7500

-5000

-2500

0

2500

5000

7500

10000

Figure 4-2 Harmonics distortion from 12 pulse drives on 6.6kV marine power systems

IMCA GUIDANCE


W/S No: 55/130502 Page 114 of 194



Total RMS: 6609.47 VoltsDC Level : 4.64 Volts

Fundamental(H1) RMS: 6602.38 VoltsTotal Harmonic Distortion (H02-H50):4.48 % of FNDEven contribution (H02-H50): 0.18 % of FNDOdd contribution (H03-H49): 4.48 % of FND

Timed event at 14/02/01 12:57:36.000

CHA Volts Thd H10 H20 H30 H40 H50

% of FND

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

Figure 4-3 Harmonic content of 6.6kV voltage waveform

4.1.9.7 It is possible to create transformers with other phase shifts to further reduce the harmonic contribution from drives. The International Electrotechnical Commission (IEC) devised the concept of the transformer vector group code to indicate the internal connections of transformer windings. The vector group takes the form of a three element code such as Dy11.

1. D indicates the HV winding is a delta

2. Y indicated the LV winding is a wye (star)

3. 11 indicates the voltage of the LV winding leads the HV winding by 30° (by reference to a clock face) - In a Dy1 transformer the phase shift would be 30° lag.

4.1.9.8 Note the IEC standard refers to HV and LV windings not primary and secondary windings. Transformers built to ANSI standards may have a vector diagram rather than a vector group code on their nameplate.

IMCA GUIDANCE


W/S No: 55/130502 Page 115 of 194



4.1.10 Protection for LV distribution

4.1.10.1 Protection system for LV distribution (where it is not the main power generation level) tend to be limited to :-

1. Over current (short circuit)

2. Overload for motors

3. Under voltage trip for service transformer feeders - with suitable delay

4. Earth fault alarm

4.1.10.2 At the lowest power distribution levels such as 120V or 24Vdc it is not uncommon to find that distribution boards are populated with miniature circuit breakers. The selectivity provided by these devices needs very careful scrutiny particularly if the redundancy concept depends on their correct operation.

4.1.11 Interlocks

4.1.11.1 Interlocks in power distribution systems are necessary to prevent the plant entering a dangerous condition or configuration. Hardwired interlocks are required to prevent such things as:-

1. Switchboards being configured in such a way that their short circuit rating is exceeded

2. Bus sections being connected when not in synchronism

3. Generators being connected when not in synchronism

4. Circuit breakers being withdrawn or engaged when closed

5. Generators being started or exciting when earth switches are engaged

6. To prevent a variable speed drive being connected without pre charging its DC link

7. To prevent all generators connecting to a switchboard at the same time if these would exceed the short circuit rating.

4.1.11.2 Interlocks are also used to restrict access to live parts when maintenance is being carried out. Specialised key type interlocks are used to ensure that:-

1. The switchboard earth switch cannot be engaged unless all generator and bustie circuit breakers are in the open position.

2. Cabinet doors for dual fed consumers cannot be opened unless both sources of power are isolated.

4.1.11.3 Key type Interlocks may have a mechanical part and an electrical part. The mechanical part may be intended to physically lock the circuit breaker in the open position and the electrical part will interrupt the closing circuit and apply a trip signal to open the circuit breaker if for any reason the circuit breaker is closed.

IMCA GUIDANCE


W/S No: 55/130502 Page 116 of 194



4.1.11.4 Some interlocking schemes include inter trips. An inter trip is a signal sent to one circuit breaker from another. Typical uses of inter trips are:-

1. To open the HV bustie if the LV bustie trip, in power system that run with service transformer in parallel as shown in Figure 4-4

2. To open the primary side circuit breaker of a service transformer if the secondary side trips on a fault as shown in Figure 4-5

3. To prevent service transformers being operated in parallel as shown in Figure 4-5

4. To prevent the shore supply being paralleled with the vessel’s generators or to disconnect all the service transformers from the LV power system if the shore supply is connected as shown in Figure 4-6.

4.1.11.5 Care must be taken in the design of interlocks and inter trips not to create single point failures that can cause a blackout. As the electrical part of interlocks and inter trips often form a common point between redundant parts of the power system there may be a possibility that faults on the interlocking lines affect both power systems. In particular, the effects of fire and flooding on interlocking lines needs to be considered.

GGG

HV

G

LV

TRIPS HV BUSTIE IF LV BUSTIE OPENS.PREVENTS LV BUSTIE CLOSING IF HV BUSTIE IS OPEN.

Figure 4-4 Inter trip for parallel service transformers

IMCA GUIDANCE


W/S No: 55/130502 Page 117 of 194



Figure 4-5 Interlocks to prevent parallel service transformer operation

Figure 4-6 Shore supply interlock

4.2 POWER PLANT CONFIGURATIONS

4.2.1 Power plant topologies

4.2.1.1 There are a huge number of variations in the design of diesel electric power plant for DP vessels although many designs are variations on a smaller number of basic designs and some use elements from several different design concepts. All the examples which follow can be built as DP class 2 or DP Class 3 designs and can be operated as common or independent power systems with suitable protection schemes.

IMCA GUIDANCE


W/S No: 55/130502 Page 118 of 194



Figure 4-7 Asymmetric two way split

4.2.1.2 Figure 4-7 shows one of the most basic arrangements. Each of the two main switchboards connects to the same number of generators and thrusters but because of the arrangement of thrusters in the hull, each main switchboard supplies different numbers of bow and stern thrusters. Although very popular, this design does not make optimum use of the available machinery because the worst case failure effect is loss of 50% of the generating capacity. The worst case failure also leaves only one bow thruster operating which results in a poor post failure DP capability.

4.2.1.3 Figure 4-8 shows another popular arrangement. This design is based on a three way split. Provided the power system is properly designed and protected, the worst case failure is now reduced to 33% of the power generating capacity and there should always be two bow thrusters available after any single failure.

Figure 4-8 Three-way split

Figure 4-9 Transferable or dual fed thrusters

IMCA GUIDANCE


W/S No: 55/130502 Page 119 of 194



4.2.1.4 Figure 4-9 shows another alternative. In this arrangement the power generation and distribution system is arranged as a two way split but two of the thrusters can be powered from either main switchboard. The worst case failure is loss of 50% of the power generating capacity but it should be possible to have two bow thrusters available after any single failure. It is possible to provide every thruster with a dual feed such that the worst case loss of thrusters is reduced to a single thruster. The transfer or dual feed mechanism introduces additional complexity and bring with it additional scrutiny from regulators but provided this is properly managed the design is a useful way of enhancing the post failure capability of the simple two way split.

4.2.1.5 The four way split is also been popular and is better suited to the thruster arrangement of semi-submersible than monohulls. There are a large number of variations on this design. In some arrangement the power distribution is arranged to ensure that there is always at least one thruster operating in each corner following a single failure. In other arrangements the design accepts loss of thrust in one corner. Figure 4-10 shows one possible variation on this theme.

Figure 4-10 Four way split for semi-submersible

4.2.1.6 In all designs it can be beneficial to closely associate the power supplies for thruster auxiliary systems with the supply to the main motor itself. Some designers chose to derive the auxiliary supply from the drive transformer by way of a fused isolator while others provide a dedicated step down transformer from the main power system. The latter arrangement may be preferred if the drive auxiliaries must be energised from the main power system before starting the drive as the drive circuit breaker will be closed by the drive itself after pre charging.

4.2.2 Innovations

4.2.2.1 There have been several innovative designs for improving redundancy and fault tolerance in diesel electric systems some dating back to the early nineteen eighties, long before the DP rules and guidelines were established. Others have been made possible by advances in power electronic converters and their control systems. It is interesting that the impetus for many innovations originates with vessel owners seeking to improve reliability. A few of these innovative designs are discussed in the sections that follow.

IMCA GUIDANCE


W/S No: 55/130502 Page 120 of 194



4.2.3 Split reactor

4.2.3.1 It has long been recognised that one of the greatest challenges in the design of fault tolerant diesel electric power systems is to ensure that consumers can survive the severe voltage dip associated with clearing a short circuit fault anywhere on the main power distribution system.

4.2.3.2 In the early nineteen eighties one of the classification societies developed a power plant design for low voltage diesel electric systems which allowed all generators to supply power to all thrusters while at the same time protecting the surviving thruster motors against the severe voltage dip associated with a fault on one of the two main switchboards. Figure 4-11 shows the overall single line diagram.

4.2.3.3 In a conventional diesel electric power system with a two way split operating as a common power system a short circuit anywhere on the main power distribution system can pull the system voltage down to zero until it is cleared by the over current protection. The resulting disruption can cause thruster and auxiliary system motors to trip. In the split reactor system each generator supplies both main switchboards by way of a split reactor and there is no direct connection between the two switchboards as in a conventional power plant. If a fault occurs on one main switchboard (Point A) it will cause the voltage at the generator terminals to fall, but the voltage drop across the split reactor is coupled across to the healthy switchboard and used to maintain the system voltage until the fault is cleared. All generators are left connected to the healthy switchboard. The split reactor system also significantly reduces the magnitude of the fault current allowing all generators to be connected to one switchboard and reducing the need for a switchboard with a high short circuit current rating. In conventional low voltage power systems it is sometimes necessary to open the bustie when the fourth generator connects to limit the fault current that can be experienced by each main switchboard. During normal operation the split reactor system has no core losses provided the thruster loads are reasonably well balanced.

IMCA GUIDANCE


W/S No: 55/130502 Page 121 of 194



Figure 4-11 Split reactor power plant

4.2.4 Phase shifted power systems

4.2.4.1 One marine power system provider developed a method to reduce the electrical losses (wasted power) associated with the phase shifting transformers required for harmonic cancellation in propulsion systems utilising variable speed drives. Figure 4-12 illustrates the general principle of operation. Rather than provide a phase shifting transformer for each thruster drive, two phase shifting transformers (one for each half of the power plant) are used to phase shift the generators connected to the two main busses with respect to each other. One of the two rectifiers for each thruster drive is connected to each bus and thus the drives draw power directly from the generators with the correct phase shift for harmonic cancellation.

IMCA GUIDANCE


W/S No: 55/130502 Page 122 of 194



Figure 4-12 Phase shifted power system

4.2.5 Grid interconnector

4.2.5.1 One vessel owner’s design initiative led to the development of a new type of power system for large vessels which can be applied to DP Class 2 and DP Class 3 designs. In this design, grid interconnector technology is used to provide each thruster variable speed drive with a continuous dual feed from both main switchboards as shown in Figure 4-13. Each thruster is designed to be independent of the others and thus the worst case failure is limited to loss of a single thruster. In addition to supplying the thruster drives from a dual source, the thruster auxiliaries are also supplied in this way as shown in Figure 4-14. The thruster auxiliary system can be powered from a large battery bank for a short period of time and from the emergency generator if required. The battery bank allows the thrusters to be made ready for DP independently of the generators and thus thruster and generator recovery become parallel activities, rather than sequential ones, saving time in the recovery sequence.

Figure 4-13 Grid interconnector based power system

IMCA GUIDANCE


W/S No: 55/130502 Page 123 of 194



480V BUS E 11 kV BUS B

AUXILIARY CONVERTER

1 kVdc

MAIN CONVERTER

THRUSTER AUXILIARYPUMPS AND FANS

1.8 kVdc

THRUSTER

11 kV BUS A

Figure 4-14 Power supplies to thrusters and their auxiliary systems

4.3 OPERATIONAL CONFIGURATION

4.3.1 Choice of operational configuration

4.3.1.1 All DP Class 2 and DP Class 3 power plants are intended to be fully fault tolerant when operated in one of the configurations analysed in the vessel’s approved DP FMEA.

4.3.1.2 Conventional diesel electric power plants can usually be operated in one of two configurations. Either as a single ‘common’ power system capable of automatic subdivision in response to a fault or as two or more independent power systems. These modes of operation are sometimes referred to as ‘busties closed’ and ‘busties open’ respectively.

4.3.1.3 Much debate in the DP community has centred on the relative advantages and disadvantages of these two modes of operation but one thing is certain, neither configuration guarantees station keeping integrity on its own and the whole issue of ‘DP safety and reliability’ is far more complex than choosing one power plant configuration or the other.

IMCA GUIDANCE


W/S No: 55/130502 Page 124 of 194



4.3.1.4 The issue is not whether one power plant configuration is safer than another but rather whether each chosen configuration is adequately safe given the consequences of loss of position, i.e. an absolute test rather than a relative one. IMCA document M191, ‘Analysis of Station Keeping Incident Data’ 1994 to 2003’ presents some interesting conclusions of the subject of open and closed busties for those readers who wish to know more.

4.3.2 Common power system

4.3.3 The greater the number of generators connected to a power system, the more robust is that power system because it becomes increasingly difficult for a single generator to vary the power system voltage and frequency. Common power systems allow greater flexibility in generator utilisation which translates to lower fuel consumption, less pollution and reduced maintenance.

4.3.4 Marine power systems are relatively small and DP vessels operating with a common power system are heavily dependent on a wide range of protective functions for fault tolerance. They are also heavily dependent on the voltage dip ride through capability of all generators and consumers connected to that power system. Neither of these features is fully tested at sea trials and therefore much depends on the quality of the power system studies on which the protection schemes are based and on the commissioning of the protective functions themselves. At least one of the major classification societies does carry out live short circuit testing of power systems for redundant propulsion systems and such tests do reveal inadequate protection schemes and poor fault ride through capability.

4.3.5 Independent power systems

4.3.5.1 When diesel electric systems are designed to operate as two or more independent power systems each power system may consist of only one or two generators and the ratio of generator rating to system load is greater than in the common power system case. That is to say the system load is smaller as it is divided amongst several independent power systems. Thus, it is easier for a faulty generator to force healthy generators to trip.

4.3.5.2 In order to run all the thrusters there must be at least one generator running on each power system. Thus in light load conditions the reliability of the power system and thus the thrusters is heavily influenced by the reliability of a single diesel engine which is relatively low. Thus, there may be a more frequent occurrence of partial blackout and loss of thrusters. Provided the vessel is being operated within its post failure DP capability for that power plant configuration, there should be no significant position excursion but this will increase the number of times that the remaining generators and thrusters are called upon to compensate rapidly for the loss of one power system. Thus it can be argued that, in practical terms, although common power systems are vulnerable to the hidden failure of protective functions. Multiple Independent power systems are vulnerable to failure of redundant elements to achieve their rated capacity. This includes equipment such as cooling systems as well as thrusters and generators.

IMCA GUIDANCE


W/S No: 55/130502 Page 125 of 194



4.4 TRANSFERABLE AND DUAL FED CONSUMERS

4.4.1 General

4.4.1.1 Providing means by which a thruster or generator can connect to more than one main switchboard is a way of reducing the permanent impact of the vessel’s worst case failure without further subdivision of the power plant. However, the redundancy concept and therefore the vessel’s post failure DP capability is dependent upon successfully restarting the transferable generator or thruster on the healthy side of the power plant. The transfer must be carried out fairly rapidly to limit the position excursion and figures of 10s or less are often specified. Note that the views of classification societies differ on whether or not transferable generators and thrusters can be considered to contribute to redundancy. It is highly advisable to consult Class at an early point in the development of the basic design if considering having transferable or dual fed equipment as part of the redundancy concept.

4.4.2 Generators

4.4.2.1 Some classification societies will accept transferable generators as contributing to the vessel’s post failure DP capability and others may not accept such features or only for certain notations. However, even those classification societies that require redundancy to be based on ‘running machinery’ will generally allow such features to be included in the design even though they are not part of the redundancy concept. Some vessel designers add transferable generators as a means of recovering power for process activities such as drilling or pipe laying and not for station keeping.

4.4.3 Thrusters

4.4.3.1 In the last ten years there have been significant changes in attitudes towards transferable thrusters. Originally, all the major classification societies were prepared to accept thrusters with automatic changeover as contributing to the vessels’ post failure DP capability. Opinions then changed and it became difficult to have any type of changeover thruster accepted by some classification societies. However, designs which transferred the thruster supply without the thruster stopping or dropping out of DP were viewed more favourably than others. More recently opinions have changed again with the availability of power electronic changeovers and true dual feed arrangements such that these types of features can be accepted as contributing to post failure capability on DP Class 2 and DP Class 3 designs. However, particular attention must be paid to eliminating the possibility of a fault in one power system or the thruster being transferred to the other power system. It is also very important to reduce the risk of hidden failures which may prevent the transferable thruster connecting successfully to its alternate source of power. Careful consideration should be given to alarms and monitoring, internal diagnostics and test facilities to give a high degree of confidence that the changeover will operate successfully on demand.

IMCA GUIDANCE


W/S No: 55/130502 Page 126 of 194



4.4.4 Essential services switchboards

4.4.4.1 Some vessel designers elect to provide motor control centres for essential engine room services with two sources of power. The normal supply is typically the LV distribution associated with the generators in that engine room. The alternate source of power is usually the emergency switchboard. Note that this arrangement is only practical if the vessel has a large emergency generator. The essential services switchboards for each engine room will typically supply such things as:-

1. Electric fuel pumps

2. FW cooling pumps

3. SW pumps

4. Starting air compressors

5. Combustion air fans

6. Engine jacket water pre-heaters

7. Pre lube oil pumps

4.4.4.2 Note that some classification societies will not accept that the essential services switch automatically to the emergency switchboard as this may compromise the availability of the emergency generator. Therefore it is often necessary to ensure that blackout recovery is possible with none of the essential services available at least in the short term. Making blackout recovery independent of the emergency generator is good practice in any case.

4.4.4.3 Some designers have chosen to install an essential services generator for this purpose rather than use the emergency generator, and then seek exemption from having an emergency generator, on the basis of having a fully redundant power system. Note that some fairly onerous conditions may be applied to such an exemption.

4.4.5 Transfer of fault

4.4.5.1 In all cases where one power system or one control system is connected to another by shared equipment such as a thruster or generator there is a risk of transferring a fault from one system to the other. In general, transferable or dual fed equipment must be provided with a comprehensive range of protective function to prevent or limit the effects of faults that could transfer in this way.

4.5 BATTERY SYSTEMS

4.5.1 General

4.5.1.1 IMCA document M196, ‘Guidance on the design, selection, Installation and use of uninterruptible power supplies onboard vessels’, April 2009 provides information on how UPSs and DC power supplies can be integrated into the redundancy concept.

IMCA GUIDANCE


W/S No: 55/130502 Page 127 of 194



4.5.2 DC supplies for switchboard and generator controls

4.5.2.1 DC supplies with battery backup are used for switchboard controls, governors, AVRs, thruster control and navigation equipment etc. Typical voltages are 125Vdc, 110Vdc and 24Vdc. In the absence of any other requirement, the battery endurance for generator and switchboard related equipment is typically sized to allow 30 minutes operation, but it is prudent to size battery banks with a generous margin to allow for aging.

4.5.2.2 As the power consumption of a switchboard control system increases greatly when the circuit breakers are being opened and closed it may be appropriate to consider the need to manoeuvre the switchboards during blackout in addition to the static control load. It may also be prudent to provide separate battery supplies for spring winders and control supplies to prevent a voltage dip associated with multiple simultaneous operations of spring winders adversely affecting the control voltage.

4.5.2.3 Loads such as space heating should be separated from control supplies.

4.5.2.4 It is beneficial to provide all battery systems with a normal supply from the main power distribution and a backup supply from the emergency power distribution.

4.5.3 UPSs

4.5.3.1 Modern DP vessels make extensive use of UPSs to supply equipment such as:-

1. DP control system

2. Vessel management system operator stations and field stations

3. Network hubs and switches

4. Power management system

5. Thruster controls

6. Pre-charge and ride-through supplies for UPSs

4.5.3.2 Figure 4-15 Shows the schematic of a double conversion UPS. In this design the load is normally supplied by way of the battery charger and inverter. The bypass is only used for battery maintenance purposes or if the inverter fails. This is the most popular UPS for marine applications and the type recommended for DP vessels. Other designs are available such as ‘line interactive’ types. In this design the load is normally fed from the bypass and is only switched to the inverter when the main supply fails. There have been cases of this type of UPS switching to the inverter on detection of low power quality which is common in some vessel power plants. This happened so frequently that the battery was almost depleted when needed.

IMCA GUIDANCE


W/S No: 55/130502 Page 128 of 194



Figure 4-15 Double conversion or online UPS

4.5.3.3 It is beneficial to provide all UPSs with a normal supply from the main power distribution and a backup supply from the emergency power distribution.

4.5.3.4 The ability of UPSs to supply sufficient fault current to operate over current protection selectively needs careful consideration in any application where redundancy depends upon the selectivity of circuit breakers or fuses.

4.5.3.5 There are several strategies for providing UPS power to the various consumers and these are discussed in detail in IMCA M196 but the two extremes are-

1. Two large centralised UPSs

2. Distributed UPSs for each piece of equipment

4.5.3.6 Both methods have their advantages and disadvantages but it can be difficult to overcome problems associated with transfer of fault and poor selectivity in the centralised arrangement particularly for DP Class 3 designs.

4.6 SEPARATION OF REDUNDANT ELEMENTS FOR FIRE AND FLOOD

4.6.1 Requirements for physical separation

4.6.1.1 Although the requirements for physical separation of redundant equipment are focused on DP Class 3 designs there are requirements to consider the possibility of mechanical damage and fire in DP Class 2 designs. Even though DP Class 2 designs may have a single engine room, common cable routes serving redundant equipment may not be accepted if they pass through high risk areas. In general it is consider good practice to separate cables for thrusters and controls systems as far as practical even in DP Class 2 designs.

IMCA GUIDANCE


W/S No: 55/130502 Page 129 of 194



4.6.2 Cable and pipe routes

4.6.2.1 Physical separation of cable and pipe routes serving redundant equipment is required for all DP Class 3 designs. Rules and guidelines vary on what level of separation should be provided. IMO MSC 645 requires that cables and pipes serving equipment intended to provide redundancy should be separated by bulkheads of A60 classification. Cables may pass through the same compartment in ducts of A60 rating if the only fire risk within the duct comes from the cables themselves. Similarly for pipe work. Most classification societies will accept cross over pipe work connecting redundant system in DP Class 3 designs provided it can be isolated on either side of the bulkheads providing physical separation. Without such isolation facilities it may be necessary to allow a compartment to continue to flood so that cooling of other systems can continue (in the case of seawater cooling systems).

4.6.3 Fire subdivisions

4.6.3.1 Some classifications societies only require that redundant equipment and cables are in separate compartments. No mention is made of the rating of bulkheads or deck heads. Other classification societies require A60 classification but will accept two A0 bulkheads as satisfying the requirements for physical separation provided the space between them is a low fire risk.

4.6.4 Watertight compartments

4.6.4.1 IMO MSC 645 requires physical separation of equipment installed below the operational water line. Equipment intended to provide redundancy must be located in watertight compartments complying with requirements for fire protection. Some classification societies make reference to the damaged water line and at least one classification society requires that every thruster is in its own A60, watertight compartment. Others may accept that thrusters are grouped in compartments reflecting the overall split in the redundancy concept. Watertight fire dampers may be arranged to prevent down flooding and the failure modes of these devices need to be considered in the redundancy concept.

IMCA GUIDANCE


W/S No: 55/130502 Page 130 of 194



5 VESSEL MANAGEMENT SYSTEMS

5.1 GENERAL DESCRIPTION

5.1.1 Distributed Control System

5.1.1.1 The Vessel Management System will manage the functions of control, monitoring and alarm management of vital machinery required to control the vessel including engine and propulsion auxiliary systems, fluid and cargo systems and other ancillary systems. A modern vessel management system will utilise a distributed control system to perform these functions.

5.1.1.2 As the name implies a distributed control system does not concentrate control of all processes at a central location, rather it ‘distributes’ the control of tasks to different nodes (PLCs or RCUs). These nodes will normally be housed close to the plant they are controlling, thereby cutting down on wiring. Suitable communication networks will link all aspects of the system together.

5.1.1.3 DCS architecture generally consists of one or more HMI, PLCs or RCUs, I/O modules and a data communication highway linking the PLCs to the HMI and vice versa. The IO modules within the controller nodes will use appropriate communication for the plant it is controlling. This could be analogue or digital IO as required. The diagram below shows a basic DCS with A60 compartment separation to allow some continued operation following the loss of any compartment to fire or flood etc.

Figure 5-1 Basic Distributed Control System

5.1.1.4 In reality it can be argued that current systems are a SCADA/DCS hybrid in as much as the software within the HMIs will monitor aspects of the plant, alarm when an event is detected and carry out some supervisory action such as starting a standby pump.

IMCA GUIDANCE


W/S No: 55/130502 Page 131 of 194



5.1.1.5 This is the basis of a SCADA system where data gathering is the prime objective and actions are event driven. A DCS is usually accepted as being process driven, meaning that all tasks allocated to a node are normally run sequentially, usually within a ladder program of a PLC, and mismatch alarms etc. are not generated until the process looking at that particular IO is run.

5.1.2 Industrial Networks

5.1.2.1 Industrial Networks is a general term given to any type of communication connecting devices for process control applications. Industrial networks can be divided into several types.

1. Control Networks

2. Fieldbus Networks

3. Sensor Networks

5.1.2.2 Control Network: Sometimes called the Process Network, this is the high level network used to transmit instructions and data between the HMI and the PLCs which control the plant. Different technologies and protocols have been used over the years but the preferred solution used by most companies at this time is Ethernet/IP, where the IP stands for ‘Industrial Protocol’.

5.1.2.3 It has been argued that Ethernet/IP is a non deterministic protocol and when the system is using network hubs, half duplex, CSMA/CD architecture this is true to some extent, depending on overall bandwidth usage. However with newer installations, where data switches are used in place of hubs, and full duplex 100M networks are in use, the network can be considered deterministic for all practical purposes. The use of switches also allows additional Quality of Standard (QoS) rules to be implemented i.e. the switches can assign higher priorities to specific traffic.

5.1.2.4 Fieldbus Network: The origin of the ‘fieldbus’ was to replace hard wired connections between complicated field devices and their controllers by a single digital link where all data could be transmitted in a serial string. To accommodate information from several sources the data is time multiplexed.

Figure 5-2 Fieldbus Communications using Profibus DP Protocol

IMCA GUIDANCE


W/S No: 55/130502 Page 132 of 194



5.1.2.5 With all devices or equipments that support the Profibus DP protocol, a General System Data (GSD) file (text file) should be supplied by the manufacturer. This GSD file contains general information about the device; type of device, supported baud rates, a summary of functions supported within the protocol, and all cyclic data (data that is exchanged every bus scan with the master).

5.1.2.6 Figure 5-2 above shows how this operates in practice. The PLC will have the MCC as one of the devices it must interrogate and control during its scan. Data recovered from the MCC will be repackaged and sent to the HMI on the Control Network.

5.1.2.7 Sensor Network: This is the most basic network and works by detecting the status of a sensor and transmitting this information as a discrete ‘1’ or a ‘0’ to the PLC. This might be the position of a valve (open or closed) or the state of switch.

5.1.3 Network Topologies

5.1.3.1 With different types of networks as described above there are different network topologies. Historically, these were designated as star, bus and ring, however as technology has progressed these have changed somewhat from their original design and a more correct name for each one is now:

1. Physical Star Logical Bus

2. Physical Bus Logical Ring

3. Physical Ring Logical Ring

5.1.3.2 Physical Star Logical Bus Topology: In its simplest form a star network consists of a single device connected to each node by a separate cable. In earlier fieldbus iterations this would have been all field devices possibly connecting to a single main frame computer in the control room. All control functions would be sent to the field devices using point-to-point hardwired connections. This was a ‘true’ star topology as all data would flow back through the mainframe. The system was expensive due to the amount of wiring involved, complex to configure and difficult to maintain. In addition the lack of effective standards led to expensive upgrades when new technology was introduced.

Figure 5-3 Star Topology

IMCA GUIDANCE


W/S No: 55/130502 Page 133 of 194



5.1.3.3 With the introduction of distributed control and agreements on standards for industrial data communications new models were required. Figure 5-4 shows a small network with three switches and twelve nodes. Although each switch may physically look as though it is the centre of a star, internally each switch has a linear bus as a backbone. Making this a ‘physical star logical bus’ topology.

Figure 5-4 Physical Star Logical Bus

5.1.3.4 Some of the main advantages of this network are scalability with no disruptions to the network when adding or removing devices and easy fault detection. In addition, the failure of a node will have no effect on the rest of the network. With the use of switches and 100M full duplex communication a node communicates with any other node using point-to-point communications. Each node believes it has total use of the bandwidth, so no collisions occur and retransmitting of data is not required.

5.1.3.5 In addition to contributing to the advantages of this topology, the switches can be seen as the main disadvantage. Failure of a switch will mean any nodes connected to it will be unreachable. As discussed above each node believes it has total use of the bandwidth, therefore although the bandwidth used between nodes in point-to-point communications may be low, if several nodes are communicating simultaneously the cabling between the switches may become a bottleneck. This is usually overcome by using fibre optic cabling between switches connected to Gigabit uplink modules within the switches. As modern switches normally have a Gigabit backbone this effectively means the network can accommodate 10 x 100M individual networks.

5.1.3.6 The disadvantages discussed above are overcome by utilising a dual network, nominally called Net A and Net B. Figure 5-5 illustrates this configuration. The two networks are completely independent with separate switches, separate cabling and dual isolated network adapters within the network nodes. Separately sourced power supplies are also provided for switches on the different networks. All data is transmitted on both networks simultaneously with the same time stamp. Only one message is processed and the other one is dropped with no further action being carried out.

5.1.3.7 This dual redundant topology is ideal for Ethernet connections and is used extensively for Control Networks i.e. between the HMIs and the RCUs etc.

IMCA GUIDANCE


W/S No: 55/130502 Page 134 of 194



Figure 5-5 Dual Redundant Star Topology

5.1.3.8 Physical Bus Logical Ring Topology: In this topology all nodes are connected to a shared backbone using multidrop lines connected to medium access units (MAU). The MAU devices ensure the connected node is ready for network traffic before it is allowed onto the bus. Data placed on the bus is propagated to all operating nodes and is therefore sometimes described as a broadcast system. A terminating load (resistor) is fitted at each end. This is required to optimise signal quality and prevent signal reflection. Incorrect termination can make a bus unusable especially at high transmission speeds.

Figure 5-6 Bus Topology

5.1.3.9 This topology greatly reduces cabling costs when compared to a star network. It is easy to implement and fault finding is relatively easy. Failure of a node should have minimal effect on the rest of the network.

5.1.3.10 There are several disadvantages of this basic system, the main one being that as a single backbone is used only one data packet can be transmitted at any time. All transmissions must therefore be carefully controlled by some arbitration system. This explains why most industrial bus systems use some type of token passing system.

IMCA GUIDANCE


W/S No: 55/130502 Page 135 of 194



5.1.3.11 A basic token passing system would consist of a data object that is passed around the nodes in a ring. When a node receives the ‘token’ it has a finite time (token hold time) to take control of the bus, to either send data or receive data. It will send any high priority packets first and if any time is left will send any low priority packets. Once the token hold time has expired the next lowest addressed node receives the token and the cycle continues.

5.1.3.12 The token passing protocol is easy to implement in software, in addition when adding new nodes to the network the ring is reinitialised and the ‘target token rotation time’ (time for a complete cycle around the bus) is recomputed.

5.1.3.13 The token-passing bus is a physical bus but a logical ring, in other words once the token has been passed to node 12 on our diagram it is then handed to node 1, thereby completing the ring. Figure 5-7 illustrates this setup below.

Figure 5-7 Physical Bus Logical Ring

5.1.3.14 Physical Ring Topology: Figure 5-8 shows a basic ring network where each node connects to the nodes directly adjacent to it on both sides forming a single continuous route around the ring. Data travels in one direction with each node regenerating the network packets and forwarding them to the next node. A token passing system is used as discussed above, except that the token is passed to the next physical node as opposed to logical node as seen in the physical bus logical ring topology. If any node is not switched on, electronics within the MAUs ensure data is still forwarded to the next node.

Figure 5-8 Physical Ring Topology

5.1.3.15 Advantages of this arrangement are that data transmission is structured with every node having access to the token for a specific time. Large networks can be configured without complex mapping being required.

IMCA GUIDANCE


W/S No: 55/130502 Page 136 of 194



5.1.3.16 Historically, logical and physical ring token passing networks performed better than star networks at heavy network loads due to the complexities and time delays introduced by the retransmissions of data caused by the CSMA/CD aspect of a star network. However this advantage has been negated by the use of full duplex point-to-point operations as discussed above. Typical ring transmission rates are 4M or 16M which means they are considerably slower than a star/bus topology using Fast Ethernet which will operate at 100M.

5.1.3.17 Because the basic ring topology is uni-directional a failure of a single cable, multidrop link or node, could cause severe disruption to network traffic. To overcome this problem it is now common practice to install a counter-rotating ring to provide a redundant topology. Until recently this was commercially unfeasible due to the cost (and perhaps weight) of the additional cabling. With the introduction of cheap fibre cabling more vendors are offering this solution as an alternative to the star/bus system, arguing that it is a more deterministic solution.

Figure 5-9 Dual Ring Topology

5.2 NETWORK TECHNOLOGY

5.2.1 General

5.2.1.1 There are many vendors offering electrical, power and control systems, and there are as many different network technologies on offer. A vessel management system will have several networks installed, perhaps an Ethernet control network, a Profibus DP fieldbus network and a Modbus RTU sensor network. Gone are the turnkey solutions of the past where the owner was tied into a particular vendor for the life of the vessel.

5.2.1.2 Standards based solutions have allowed several network protocols to come to the fore. This section discusses several of the most popular technologies in use and examines some of the advantages and disadvantages of each. Before discussing the differences, it is useful to consider what each of the networks have in common, that allows them to be used extensively in an industrial environment.

IMCA GUIDANCE


W/S No: 55/130502 Page 137 of 194



5.2.1.3 Offshore industrial network systems are subject to environmental factors and other design requirements not normally included in the design of an office network. Some of these are:

1. Predictability

2. Reliability in a harsh environment

3. Minimum down time

4. Ease of maintenance / repair

5.2.1.4 Predictability: The system must have some degree of determinism. As systems operate in a real time environment any failure or alarm must be reported and acted on quickly enough to prevent any knock on effect further affecting the system. The network topology plays a part in this determinism. Token ring networks and star / bus networks operating in full duplex can be considered deterministic.

5.2.1.5 Reliability in a harsh environment: Offshore environmental factors including, vibration, heat, salt laden atmosphere, electrical noise, etc must be taken into account when designing the network system.

5.2.1.6 Minimum downtime: If a network is unavailable, some systems / devices may stop communicating. At a minimum this will mean redundancy is compromised. The network system should have been in service long enough for any inherent design flaws to come to the fore or been stress tested to ensure mean time between failures is acceptable.

5.2.1.7 Ease of maintenance / repair: A well designed system should have built in diagnostics that enable the electrical or instrument technicians to quickly pin point where system failures have occurred. Most vendors now provide some type of ‘Net Status’ page or mimic on the HMI to assist fault finding. Where possible, modules should be designed to allow them to be swapped out either without switching off the rest of the network, or by isolating just the faulty section.

5.2.1.8 Other issues which may influence the choice of a particular network include cost effectiveness, whether it complies with relevant standards, scalability and ease of use. These are more ‘budgetary’ considerations and are not considered further here.

5.2.2 Introduction to Network Protocols

5.2.2.1 It’s not possible to discuss network protocols without mentioning the Open Systems Interconnection (OSI) reference model. This is a seven layer model developed in the 1970s to attempt to standardise network communications.

5.2.2.2 Network protocol describes the functions that happen within these SEVEN layers. The following discussion is a very broad description of the functions of each layer of the model with Figure 5-10 illustrating a typical transfer of data between two operator stations.

IMCA GUIDANCE


W/S No: 55/130502 Page 138 of 194



Figure 5-10 OSI Network Model

5.2.2.3 Physical Layer: Provides the connection to the media, electrical and physical. This layer also provides the Data Link layer with the means to transmit a serial bit stream onto the media. This might be RS232, RS485 or transmissions from/to a Network Interface Card.

5.2.2.4 Data Link Layer: Defines the network topology to be used. Chops the data into byte size packets and wraps them for transmission by adding frame headers and footers. Unwraps and reassembles packets coming back in before passing them up to the Network Layer. The Data Link Layer is also responsible for the first line of error checking and retransmission of missed packets.

5.2.2.5 Network Layer: Primarily used for routing, it takes the data from the layer above (Transport Layer) and adds the network address of the destination. Passes it down to the Data Link Layer. Removes superfluous information on packets received from the Data Link Layer before passing up the chain.

5.2.2.6 Transport Layer: Responsible for reliable end to end user communications. Typical functions include flow control (ensuring a reliable connection has been established between devices) and multiplexing or slotting data from several applications into a single packet. On receipt of the packets from the Network Layer removes any remaining bits relating to data communications and formats the messages into a language which is not protocol dependent.

5.2.2.7 Session Layer: Establishes, maintains and terminates network sessions by allocating system resources as required. Will provide error reporting for the Application and Presentation Layers.

5.2.2.8 Presentation Layer: If required, translates the incoming data sent to the Application Layer into a format it will understand. For example if the data is a text message to be displayed on the screen the Presentation Layer may ensure the output is sent as an ASCII character. If it is a diagram, it may send as a GIF or a JPG.

5.2.2.9 Application Layer: This is basically the user interface, if the command sent from the operator was to start a pump this is the instruction sent to the controller, RCU or PLC.

IMCA GUIDANCE


W/S No: 55/130502 Page 139 of 194



5.2.2.10 It is worth noting at this point that most industrial networks do not implement all seven layers and actually use a 3-Layer model. Layer 3 (Network) is normally not implemented as no routing to external networks is required. Layer 4 (Transport) is not needed as the Data Link Layer (Level 2) carries out similar packet sequencing functions, which is adequate for the complexity of these networks. Level 5 (Session) is not required as high level software (e.g. token passing system) can be used to control session lengths etc. Level 6 (Presentation) layer is not required as all devices and nodes will be communicating in the same language.

5.2.3 Ethernet/IP

5.2.3.1 Ethernet/IP is the preferred option at this time for the Control Network; Ethernet/IP implements Layer 1, 2, 3 and 7 of the OSI model. Current systems utilise a full duplex industrial Ethernet network operating at 100MHz. The protocol used is TCP/IP.

5.2.3.2 The purpose of the Ethernet/IP network is to transmit control data between the units comprising the Vessel Management System. All operator stations (HMI) and field stations are referred to as data terminating equipment (DTE). Each DTE has one or more network interface adapter. Each node has a unique static Internet Protocol address allocated when the interface card is installed. The use of IP addressing requires the inclusion of Layer 3 (Network) in this model.

5.2.3.3 Operation: Data on an Ethernet network is transmitted across the medium in serial using a non-return-to-zero signal. The encoding scheme is differential Manchester code. The concepts and description of how Manchester code operates is beyond the scope of this document.

5.2.3.4 The network interface card acts as a transceiver. The transceivers within each node provide the following:

1. A medium access control (MAC) unit, which is responsible for frame wrapping /unwrapping and error detection (OSI Layer 2).

2. A RAM module to allow the medium access control unit to talk to both the network cable and the host computer at a high bit rate (OSI Layer 2).

3. Electrical isolation between the cabling and the interface electronics. (OSI Layer 1).

4. Protection of the network from malfunctions in the transceiver (OSI Layer 1).

5.2.3.5 This last function is also referred to as jabber control since without the appropriate protection electronics, if a fault develops, a faulty transceiver may continuously transmit random data (jabber) onto the network and inhibit or corrupt all other transmissions. This has great significance for DP control systems and most system providers now implement measures to prevent this.

5.2.3.6 Network collisions are avoided by utilising fast Ethernet in full duplex mode for network data transmissions. Fast Ethernet utilises two pairs of wire from CAT 7 shielded twisted pair (STP) cabling. In older systems with half duplex mode, one pair of wires is used to send or receive data, and the other pair is used to listen on the network for other nodes transmitting. (Collision detection). In full duplex mode one pair of wires is used to transmit and one to receive.

IMCA GUIDANCE


W/S No: 55/130502 Page 140 of 194



5.2.3.7 The use of network switches ensures the network packet is only sent to the correct address. When a switch is first connected to the network it builds up a routing table. When messages are received on a particular port the ‘from’ address is noted in the routing table, the switch will initially forward this message to all ports except the port the message was received on. Only the destination port will acknowledge receipt of the message so the switch can further build up the routing table. Eventually all ports will have entries in the routing table and the data through the switch will be effectively point to point.

5.2.3.8 CRC and other validation checks are carried out. These include checking the frame is neither too short nor too long. If any of these checks fail the frame is discarded and an error status sent to a higher level and eventually to some type of ‘Net Status’ page. Assuming no frame errors the destination address field is processed.

5.2.3.9 Some data is still required to be sent to several or all units. This can be done by sending a ‘broadcast’ packet. During normal operations broadcast packets will be forwarded to all ports, however if the number of packets exceeds a preset threshold in a preset time, packets will be discarded for a set time. When this time has passed the adapter will resume accepting packets until the time threshold is exceeded again.

5.2.3.10 All correctly addressed messages are processed at the Network layer and if it is determined the data is for the current node the frame is passed to Layer 7 for further processing.

5.2.4 Profibus

5.2.4.1 Profibus provides three different versions of the communication protocol: factory message specification (FMS), decentralised peripherals (DP) and process automation (PA). A brief description of each is given below, however only the operation of Profibus DP is described in any detail.

5.2.4.2 Profibus FMS: In this model Layers 1, 2 and 7 are implemented. FMS was developed as a multi peer network for communications between PLCs, HMI and field devices. This general purpose solution could therefore be used in Control Networks, fieldbus networks and sensor networks. Due to several factors, including the limited baud rate not being able to supply the required refresh rates for modern HMI, it is not being implemented in new Control Networks. In addition the newer Profibus DP uses a similar transmission medium so FMS is now mainly used to support legacy equipment

5.2.4.3 Profibus DP: Implemented at Layers 1 and Layers 2 and optimised for high speed, this version was designed especially for fieldbus operations and is used extensively in modern vessel systems.

5.2.4.4 Profibus PA: Profibus PA is designed for the sensor networks to connect sensors, relays, actuators etc. to a common fieldbus. Implemented at Layers 1 and Layers 2, Profibus PA transmission techniques are in accordance with standards to ensure intrinsic safety and bus powering of field devices even in potentially explosive areas.

IMCA GUIDANCE


W/S No: 55/130502 Page 141 of 194



5.2.4.5 Operation: Profibus DP can operate in a mono-master or multi-master mode depending on configuration. Basically one or more ‘master’ (active node) controls a number of slave devices (passive node) and polls them as required. Although the Profibus protocol includes token-passing software Profibus DP only uses this if it is configured in multi-master mode. The token is only passed between the masters, not the slaves. The procedure for token passing is discussed above in bus topologies. Once an active node receives the token it communicates with the passive nodes using a master-slave setup.

5.2.4.6 Profibus DP normally operates using a cyclic transfer of data between master and slaves on an RS485 network. The master-slave procedure permits the master to periodically poll each node assigned to it. All data communication between a master and slave originate from the master device. Each slave is assigned to one master and only that master may write output data to that slave. Profibus DP is most often set up as a single mono-master configuration, however, in a multi-master configuration any master may read information from any slave, but masters can only write data to their own assigned slaves.

5.2.4.7 The RS 485 specification for Profibus is based on semi-duplex, asynchronous transmission. The transmission medium can be shielded twisted pair (STP) or fibre optic cabling. When using STP the maximum line length is determined by transmission speed.

Table 5-1 Profibus Maximum Segment Length

Baud Rate (kbit/s) 9.6 to 187.5 500 15,000 12,000

Segment Length (m) 1,000 400 200 100

5.2.4.8 Data is transmitted in an 11-bit character frame in non return to zero (NRZ) differential Manchester code similar to Ethernet. As each slave is polled cyclically there are no collisions and large amounts of data can be transferred in single telegrams.

390Ω

390Ω

390Ω

390Ω

220Ω

220Ω

Figure 5-11 RS 485 Bus Segment

IMCA GUIDANCE


W/S No: 55/130502 Page 142 of 194



5.2.4.9 In Figure 5.11 above, the bus line is a shielded twisted pair cable which is terminated at both ends. A maximum of 32 nodes can be connected to any segment. Line B high / Line A low indicates a binary ‘1’. The start bit is always a ‘low’ and the stop bit and any idle bits are always a ‘high’.

5.2.4.10 Data transferred between the master and slave is formatted according to the generic station description (GSD) file for the particular master or slave device. GSDs files must be provided by the device vendor to meet Profibus standards; however Profibus International has also defined GSDs for many standard devices.

5.2.4.11 Advantages of Profibus: Profibus is the most widely accepted and installed industrial network for fieldbus applications and is supported almost universally by all vendors. It was developed in 1989 and has a stable architecture. Platform independence means any number of master and slave devices are available off the shelf. The polling nature of Profibus means it is a truly deterministic network. The FMS, DP and PA versions cover all aspects of the industrial network.

5.2.4.12 Disadvantages of Profibus: When only transferring small amounts of data there is a high overhead and it has slightly higher installation costs than some other networks. The main Profibus version (DP) has no power on the bus. Due to the requirements for termination resistors the bus topology used is sensitive to wiring problems and installation problems when upgrading. However with the increased acceptance of ProfiNet, basically an Ethernet version of Profibus-DP most if not all of these disadvantages will be overcome.

5.2.5 Modbus

5.2.5.1 Modbus is briefly discussed here as it is used by most PLC manufacturers in addition to their own proprietary language. Modbus is an application layer (Layer 7) messaging protocol. Communication is based on a query-response protocol where there is one master and one or more slaves. Modbus was originally created as a way for main frame computers to gather information and control the operation of the PLCs connected to them, a basic SCADA system.

5.2.5.2 Although not all Modbus slave devices are PLCs, they are still composed of two basic components. These are the central processing unit (CPU) and the I/O system interface. The CPU section is designed to carry out a programmed set of instructions in a pre determined order. This program will normally be stored as a ladder diagram within a memory map and the PLC will ‘descend’ the ladder one rung at a time. Information will be sent to or requested from the field equipment.

5.2.5.3 The I/O system is the interface between the field equipment and the controller. Incoming signals from limit switches, relays, pumps etc are wired to terminals of the input interfaces, where if required they are passed through analogue to digital converters, and the resultant data is stored in 16-bit unsigned (positive integer) addressable registers until the CPU via the ladder program requests the data.

5.2.5.4 16-bit unsigned addressable registers are also used to store the information for devices to be controlled, when the PLC ladder program instructs the control signals to be output, the data is connected to the terminals of the output modules, this time through a digital to analogue converter if required.

IMCA GUIDANCE


W/S No: 55/130502 Page 143 of 194



5.2.5.5 The Modbus protocol was designed to provide a way to transfer the contents of these registers to another PLC or a host PC. Serial Modbus connections use two basic protocols these are Modbus ASCII and Modbus RTU. Both methods use Layer 1, 2 and 7 of the OSI model.

5.2.5.6 Modbus ASCII: When using Modbus ASCII, all messages are coded in hexadecimal values, represented with readable ASCII characters. For every byte of information, two communication-bytes are needed, because every communication-byte can only define 4 bits in the hexadecimal. As discussed above the protocol was designed to pass 16-bit register values, so it can be represented as 4 hexadecimal numbers each made up of 4 bits of data.

5.2.5.7 The data is then sent for framing using a process called ASCII encoding. A colon (:) character begins the message frame and a carriage return / line feed signifies the end of the message. A longitudinal redundancy check (LRC) and a parity bit provides assurance that the data is not corrupted in transmission.

5.2.5.8 Modbus RTU: The RTU model was developed to provide faster transfer of data. When using Modbus ASCII the messages are encoded in hexadecimal. When using RTU the data is exchanged in binary making the transfer more efficient. In addition better error checking is carried out with RTU as CRC checking is carried out instead of LRC. The table below lists the properties of the two protocols.

Table 5-2 Modbus ASCII and RTU Properties

Modbus ASCII Modbus RTU

Characters ASCII 0-9 and A-F Binary 0...255

Error Checking LRC Longitudinal Redundancy CRC Cyclic Redundancy

Start Frame “:” (colon) >28 bits idle time

End Frame CR/LF >28 bits idle time

Fragment Error 1 second / no data 12 bits / no data

Start Bit 1 1

Data 7 8

Parity even/odd none even/odd none

Stop Bit 1 2 1 2

Medium RS232 / RS422 / RS485 RS232 / RS422 / RS485

5.2.5.9 Modbus RTU messages are framed differently to ASCII messages. Each message is preceded and ended by a time gap >28 bits. If a receiver detects a gap of at least 12 bits during a transmission this is assumed to be an error and the receive buffer is cleared in preparation for a new message.

5.2.5.10 Although both protocols use the same medium (RS232/RS422/RS485) it is not possible to mix Modbus ASCII and Modbus RTU on the same wire. It should also be noted that although both ASCII and RTU support RS232 and RS422, if these mediums are used only point to point communication can be established, i.e. only one slave device can be connected. To allow multiple slaves RS 485 is required.

IMCA GUIDANCE


W/S No: 55/130502 Page 144 of 194



5.2.5.11 Modbus also has a TCP/IP version which is essentially binary data (RTU) packaged within the TCP/IP protocol. This allows for faster data over greater distances; however it is not used to any extent in offshore systems at this time.

5.2.5.12 The main advantages of Modbus is its easy deployment, and simple configuration, allowing legacy equipment to be easily interfaced with newer technologies. Its universal acceptance by vendors in all regions of the globe means Modbus RTU along with Profibus-DP and Ethernet/IP are seen as the de facto standards for industrial networks.

5.2.6 WorldFIP

5.2.6.1 WorldFIP is the protocol from which the original Fieldbus standards were developed. The protocol is based on a producer/distributor/consumer (PDC) model with distributed arbitration, rather than the master / slave or token passing systems discussed earlier. The WorldFIP protocol like the majority of the other protocols is a 3-layer model operating at Layers 1, 2 and 7 of the OSI model.

5.2.6.2 The WorldFIP physical layer ensures the transfer of information on the bus. The transmission medium is either shielded twisted pair or optical fiber. The network topology is a physical bus, which means all devices are attached to the same line. Data is transmitted using differential Manchester code and transmission speed is 31.25Kbps, 1Meg, 2.5Meg and 5Meg (fibre only).

5.2.6.3 There are two types of node in the WorldFIP network. These are the ‘Bus Arbitrating’ nodes and the ‘Producer/Consumer’ nodes. The Bus Arbitration (BA) node, controls accessibility to the bus and signals to the other nodes when they can communicate and is the ‘Distributor’ in this model. At any instant in time a subscriber can be either a “Producer” or a “Consumer”. If a “Producer” it is placing data on the network to be picked up or consumed by other subscribers on the network. If a “Consumer” the controller listens on the networks and receives the data.

5.2.6.4 For redundancy purposes it’s common practice to configure several nodes to perform the task of Bus Arbiter, however only one BA can be active at any time. Normally the bus arbiter is selected arbitrarily - the first controller capable of being a bus arbiter that ascertains that the network has no bus arbiter will assume the role. Once the system is operational and a BA has been identified it commences a bus scan. A scan involves the constant repetition of the FIP macrocycle. The macrocycle contains a scanning table, a list of identifiers to scan and the periodicity associated with each identifier.

5.2.6.5 The BA runs through the scanning table sequentially. It broadcasts the name of the identifier on the network. One and only one PLC recognises itself as the ‘producer’ of the identifier. One or more PLC recognises they are ‘consumers’ of the variable to be transmitted. The producer then broadcasts the value of the identifier and all consuming stations simultaneously capture the variable.

IMCA GUIDANCE


W/S No: 55/130502 Page 145 of 194



Figure 5-12 FIP Network Configuration

5.2.6.6 Figure 5-12 above describes the BA putting identifier 1 on the bus. Node 01 recognises this as a variable within his databanks and prepares to puts this on the bus as the ‘producer’. Nodes 3 and 4 identify themselves as consumers and ready themselves to accept the variable. The BA waits the correct amount of time to allow the transactions to occur and then places the next identifier on the network. This scanning table is read through and then the operation is repeated.

5.2.6.7 This type of transmission is classed as periodic transfer, in addition to this, at preconfigured time slots within the macrocycle time may be allocated to allow subscribers to transfer aperiodic data, making this both a process driven and event driven protocol.

5.2.6.8 It appears from recent designs that the WorldFIP protocol is being used less and less in offshore installations, but is considered here due to the legacy equipment still in use.

5.2.7 CANbus

5.2.7.1 Another producer/consumer network that is gaining popularity, particularly in engine monitoring systems and with some control system vendors, is CANbus (Controller Area Network). CANbus uses Layer 1 and Layer 2 of the OSI model and was originally developed in the late 1980s to simplify the design of wiring harnesses within automobiles by moving from point-to-point connections to using a multidrop bus topology. Since then several industrial fieldbuses have been developed using CAN as their underlying technology, these include DeviceNet, ControlNet, CANopen and CAN Kingdom. The fieldbuses mentioned are not compatible with each other and the following description is of the messaging protocol within the basic CAN network.

IMCA GUIDANCE


W/S No: 55/130502 Page 146 of 194



5.2.7.2 Unlike most other protocols, in basic CAN the data packets do not contain either a transmitting or receiving node address. Instead each message contains a unique identifier based on the content of the message and its priority. This identifier is assigned during system design. Parameters might be RPM, temperature, frequency etc, it is expected that some parameters will change more rapidly than others and therefore need to be transmitted more frequently; these will be allocated the higher priority. The identifiers allocated the lowest physical values (binary) have the highest priority.

5.2.7.3 A node with data to transmit will place it onto the bus, it’s possible that more than one node will attempt to transmit simultaneously, therefore some type of arbitration is required. The method used is a version of CSMA/CD similar to half duplex Ethernet, except that where Ethernet uses destructive bus arbitration, CANbus uses non-destructive bitwise arbitration.

5.2.7.4 With Ethernet, on detection of collision all parties retreat from the bus for a random amount of time and retransmit, hoping the bus will be free. With CANbus any bus conflicts are resolved with the identifier with the lowest value transmitting, and all other nodes halting transmission. A wired-and mechanism (collector dotting) is used to determine the message with the lowest identifier, where the dominant state (logic 0) overwrites the recessive state (logic 1). Nodes not transmitting, or with a recessive transmission, automatically become receivers of the transmission. The message is transmitted as a broadcast with all receivers interrogating the message and using the data as required.

5.2.7.5 The drawing at Figure 5-13 illustrates the wired-and non destructive arbitration in operation. Nodes A-D are transmitting simultaneously, arbitration is necessary and the signals are wired-anded. The first node to pull back and cease transmitting is Node C, followed by Node B then Node D. Node A continues transmitting and the bus output reflects this.

Figure 5-13 CANbus Arbitration

IMCA GUIDANCE


W/S No: 55/130502 Page 147 of 194



5.2.7.6 One advantage of this system is that bus allocation is determined by need and negotiated only between the messages attempting to transmit. As there is no requirement for silence on the bus as with Ethernet CSMA/CD, or the time scheduling required with token passing, this non-destructive bitwise arbitration usually ensures no bandwidth is utilised without the transmission of useful data.

5.2.7.7 CANbus has been around for over 15 years and a perceived disadvantage was the limited data transfer rate, however with the number of fieldbuses developing this technology it is now possible to achieve data transfer up to 5 Mps. As all identifiers are allocated a physical number during the design phase, it may be expensive to scale the system up during mid life upgrades.

5.3 REDUNDANCY

5.3.1 Introduction

5.3.1.1 As control systems have become more complex the number of installed devices has multiplied, with each device potentially affecting the overall reliability of the system. System failures, whether due to hardware or software problems may cause downtime or compromise safety. To minimise downtime vendors have developed products and solutions to provide fault tolerant systems by the use of redundant hardware or software.

5.3.1.2 Hardware solutions include the use of redundant power supplies, redundant processors, redundant IO modules, multiple HMIs and redundant cabling. Software solutions might include using separate servers to install supposedly identical software or using different versions of software in master and slave controllers or PLCs. The figure below illustrates a typical distributed field station with redundancy built in, and the discussion below describes the different ways redundancy can be achieved.

IMCA GUIDANCE


W/S No: 55/130502 Page 148 of 194



Figure 5-14 Typical Redundant Field Station

5.3.1.3 Power supply redundancy: In the illustration above each PSU is fed from a different UPS. These UPS would normally be configured in a redundant fashion with each one being supplied from different sides of the bus. Each PSU is feeding separate PLCs and IO Racks providing complete isolation of supply. One disadvantage of this setup is that the failure of a PSU will cause loss of a PLC and an IO Rack. An alternative power distribution configuration would be to feed the output of both power supplies to each module using decoupling diodes as shown in Figure 5-15 to prevent a short circuit in one PSU affecting the other. The diodes must be tested periodically to ensure a hidden failure does not compromise redundancy.

Figure 5-15 Redundant Power Supplies

IMCA GUIDANCE


W/S No: 55/130502 Page 149 of 194



5.3.1.4 PLC redundancy: This can be designed in several ways. The most common way is in a master/slave or ‘hot standby’ arrangement where status is continuously monitored and data is synchronised between both controllers. On a failure of the ‘master’ there will be a bumpless transfer to the ‘slave’. Only one controller actually outputs to the IO modules. An alternative way is to allow both processors to act as peers and with both controllers outputting data to the IO modules, voting is carried out using software algorithms and one or other of the signals is used.

5.3.1.5 IO module redundancy: Identical racks can be configured to ensure each line of field IO is duplicated, in this way the total failure of a single rack will not affect the operation. Although this may give excellent fault tolerance it is expensive and somewhat complicated to implement. A more usual configuration is to split the IO logically between the racks or IO modules. Loss of a rack or power supply to a rack may have an effect on the redundancy of the system, and some field IO will be lost, but the correct mapping of the IO will ensure fault tolerance is maintained. For example, from the diagram at Figure 5-14 above, if pumps are operating in a duty / standby configuration, control of one pump will be by IO Rack 1 and the other pump by IO Rack 2. Although loss of IO Rack 1 will cause loss of communication with the ‘duty’ pump, the system can still start the ‘standby’ pump as a precaution if required. Fail ‘as set’ is the preferred failure mode for most propulsion related equipment such as pumps and cooling water valves. Some classifications societies require a pulse-to-start, pulse-to-stop control strategy.

5.3.1.6 Sensor redundancy: Some critical systems may have twin sensors located close together, or even as part of the same unit. When the same action is carried out if either or both sensors register a signal, the sensors can be considered part of the redundancy system. Once again it enhances redundancy if the outputs from the sensors are mapped to different IO modules.

5.3.1.7 Data communication redundancy: Data communication redundancy was discussed in the section on network topologies. The favoured solution at this time for the control network is Ethernet in a star/bus topology. It is normally installed as a dual independent system nominally Net A and Net B. All aspects of the network are duplicated including cabling, switches, Ethernet adapters, network interface cards (NIC). The drawing at Figure 5-14 illustrates this by showing separate Net A and Net B cabling to each of the PLCs. Within the communication module on the PLC there will be individual Ethernet interface adapters.

5.3.1.8 The drawing at Figure 5-16 shows a typical DP/VMS control network. The network switches and any medium converters (STP to Fiber) are housed in network distribution units (NDU). It can be seen that losing any single node on the network or any active component (like a switch) will not affect the operation of the overall system as communication is still operational on the alternative network.

IMCA GUIDANCE


W/S No: 55/130502 Page 150 of 194



NDU-A2NDU-A1

Aux FSFS 43FS 44

PMS FSFS 41FS 42

DP ControlDPC

DP OS1DP OS2

VMS OSOS31OS32

History Station

Thruster FSFS 31FS 32FS 33

NET B

VMS OSOS34OS35

Thruster FSFS 34FS 35FS 36

NDU-B1 NDU-B2

NET A

NDU – Network Distribution UnitVMS – Vessel Management SystemOS – Operator Station Thruster FS – Thruster Field StationAux FS – Auxiliary Field StationPMS FS – Power Management Field StationDPC – Dynamic Positioning Controller

Figure 5-16 Typical Control Network

5.3.1.9 Normally there is no redundant cabling to the field IO or even between field stations and main units like the generator control panels or MCCs. Communication is normally via a single Modbus or Profibus connection. However on safety critical systems such as fire and gas, where a fieldbus connects the vendor specific equipment to the VMS system for activation of CO2, closing of dampers and ventilation etc. it is normal to have a dual Profibus link for redundancy purposes.

5.3.2 Alarm and Monitoring

5.3.2.1 Most DCS vendors provide an Alarm and Monitoring System as an integral part of their delivery, if not it will be available as an optional extra. The main purpose of the alarm and monitoring system is to give the operators the basic alarm and status information they require to maintain safe and efficient operation of the plant. Information relating to power management, propulsion, ballast control, HVAC, safety systems etc. should all be available. To provide this data the distributed control system processes information from a multitude of different sources. It’s not unusual for a system to interrogate over 2000 separate IO devices and large vessels may have upwards of 5000 IO.

5.3.2.2 Alarms: Built-in diagnostics ensure inconsistencies in expected results will be detected and reported. These inconsistencies may be due to faulty field equipment, faulty wiring, logic errors, incorrect configuration etc. The operator is made aware of these anomalies by the use of audio and visual alarms. The audio alarms are normally buzzers at the VMS Operator Stations (OS). This is usually a generic alarm that the operator will silence locally at one of the HMI. The audio alarm is accompanied by a visual alarm on a reserved part of the screen of the operator station.

IMCA GUIDANCE


W/S No: 55/130502 Page 151 of 194



5.3.2.3 As all operator stations are peers, the visual alarm will show at each station. This is normally a banner alarm with a brief description of the fault and the tag number or IO module generating the fault. Although different vendors have different systems the alarm is normally colour coded with separate colours for severity of fault (yellow or red). Safety critical faults may have a different coloured banner.

5.3.2.4 Alarm printers are provided to give immediate hard copy reports on alarms and incidents. Historically these were parallel port dot matrix printers with a continuous form feed output. In new or upgraded systems these are being superseded by network fed single sheet feed laser printers. This network is usually an Ethernet network connecting each HMI to the printer. This is a separate network from Net A and Net B discussed earlier in the Control Network and is normally referred to as Net C or the ‘admin net’. There is no requirement for redundancy in this network as there are no control functions involved.

5.3.2.5 Monitoring: Continuous monitoring of control functions is carried out by the alarm and monitoring system with all alarms and process events stored in a database within each operator station. Relevant parts of this history log can be called up within user defined time slices and all alarms and events displayed. The operator can then use a search string to retrieve specific information.

5.3.2.6 To assist in fault analysis a history station can be provided, where in addition to alarms and process events, selectable vessel management parameters are recorded for a length of time decided by the operator. Information can then be offloaded to external media for in-depth analysis offsite, or fed into a simulator to recreate a specific situation. Software within the operator stations also allow real time trending to be carried out for most power management and propulsion parameters.

Figure 5-17 Typical Line Monitoring Circuit

5.3.2.7 Further monitoring is carried out including line monitoring of discrete inputs. The simple drawing above at Figure 5.16 shows a basic line monitoring circuit with a single field input to redundant RCUs. The line to the switch is active at 24V. With the switch open the current in the circuit will be 6mA, with the switch closed the current will be 19mA. Any other signal on the line will be incorrect and raise an alarm. It should be noted this circuit is for illustration of the principle only. In a real situation the resistor values would be different to take the resistance of the wire and impedance matching etc. into consideration.

IMCA GUIDANCE


W/S No: 55/130502 Page 152 of 194



6 THRUSTERS, DRIVES AND CONTROLS

6.1 GENERAL PROPULSION PRINCIPLES

6.1.1 The origins of the propeller

6.1.1.1 The Archimedes’ screw was used to move water as part of irrigation schemes in the 3rd century BC, but the first use of a screw as a means of propulsion occurs much later in history.

1. James Watt said “Have you considered a Spiral oar?” (1770)

2. Joseph Bramah patented a “screw” propeller but never developed it practically (1785)

3. Joseph Ressel is credited as the inventor by Austria (patent 1827)

4. Richard Trevithick described one in an 1815 patent

5. John Swan is heralded as the practical inventor, using one in 1824

6.1.2 Relationship between propeller power, thrust and RPM

6.1.2.1 Sir Isaac Newton’s third law of motion states that each action has an equal and opposite reaction. A propeller develops thrust by accelerating water to a given velocity. The water velocity V is proportional to the speed of the propeller (RPM).

From 221 MVF = it can be said that:-

2RPMThrust ∝ or 21

ThrustRPM ∝ .

The power to develop this thrust follows the relationship:-

VelocityThrustPower ×= Therefore:-

3RPMPower ∝ or 23

ThrustPower ∝

6.1.2.2 Figure 6-1 shows the relationship between power and thrust for an actual azimuthing thruster in bollard pull conditions. The figure was plotted using data supplied by the manufacture. DP thrusters only operate in ‘bollard pull’ conditions when the sea current is zero. When the current is non zero there may be water flow into the thruster even though the vessel is stationary.

IMCA GUIDANCE


W/S No: 55/130502 Page 153 of 194



0 10 20 30 40 50 60 70 80 90 1000

10

20

30

40

50

60

70

80

90

100Power Against Thrust Typical FP Thruster (Bollard Pull)

Perc

enta

ge P

ower

(%)

Percentage Thrust (%)

Figure 6-1 Relationship between power and thrust

6.2 THRUSTER FAILURE MODES

6.2.1 Thruster failure modes

6.2.1.1 Some DP rules and guidelines have specific requirements that thrusters should fail safe and not go to uncontrolled thrust or change direction with thrust applied as the result of a single failure. Fail safe conditions are generally considered to be:-

1. Fail as set

2. Fail to zero thrust

3. Motor stop

4. Uncontrolled change in thrust direction may be accepted provided thrust goes to zero.

6.2.1.2 Fail ‘as set’ may not be a good choice in some situations.

IMCA GUIDANCE


W/S No: 55/130502 Page 154 of 194



6.2.2 Thruster types

6.2.2.1 There are several different types of thruster:-

1. Propeller with high lift rudder

2. Gill Jet

3. Voith Schneider

4. Tunnel Thruster

5. Azimuth thruster (Several forms)

6.2.2.2 Propellers can be of fixed pitch or variable (controllable) pitch

6.2.2.3 Propeller: This is a component part of many thrusters as well as the most common form of propulsion. The propeller can be of fixed pitch or variable pitch. The pitch of a propeller is the theoretical distance moved through the water for one revolution, but due to slippage this is never achieved. One way to visualise this is to consider the axial distance moved when a wood screw is turned through one revolution in a piece of wood. Propeller efficiency is an important consideration as; if the propeller is not correctly matched to the vessel then it will never perform to expectations. This is not only an important consideration for operational costs but also for the environmental emissions.

6.2.2.4 The high lift rudder can be connected to a DP control system and may be accepted as contributing to athwart-ship’s thrust in certain conditions.

6.2.2.5 Gill jet: This system is not as common now as it was in the past. The thruster consists of an axial flow pump delivering water across a grill with angled plates (gills) in the bottom of the vessel to direct the thrust in the required direction. The “gill” plate is circular and can be rotated through 360° to provide a multidirectional thrust capability.

6.2.2.6 Voith Schneider unit: This type of unit is capable of thrust delivery in any direction. When used as a means of propulsion it does not need a rudder. The blades are attached at right angles to the rotor casing and rotate around a vertical axis. Each blade performs an oscillatory motion around its own axis. This is superimposed on the uniform rotary action of the entire unit. When the unit is fitted in the hull, only the blades protrude from the hull as shown in Figure 6-2 below.

Figure 6-2 Voith Schneider propeller

IMCA GUIDANCE


W/S No: 55/130502 Page 155 of 194



6.2.2.7 Tunnel thruster: The tunnel thruster requires a tubular water passage running athwart-ships with the unit placed at its centre. This allows for the thrust to be directed in either port or starboard directions by reversing propeller pitch or direction of rotation. The limitations of this type of thruster are the length of tunnel in which it is situated and the distance it is located from the bow or stern. The longer the tunnel the greater the possibility of cavitation at high loads as the water flow may become restricted. The further from the bow or stern the less the turning moment created about the vessel’s centre of rotation.

6.2.2.8 Tunnel thrusters located at the stern may also be susceptible to aeration of the water caused by the main drive propellers. There are no protrusions from the hull when tunnel thrusters are used.

6.2.2.9 Rim drive thrusters are a relatively recent innovation which essentially removes the need for a gearbox as the rotating element is the propeller which sits inside the stator of the motor. This has the advantage of reducing the central body of the propeller thus aiding the flow of water.

Figure 6-3 Tunnel thruster

6.2.2.10 Azimuth thrusters: The azimuth thruster is mechanically similar to the tunnel thruster; it has the advantage, however of being able to direct the thrust in any direction as opposed to port and starboard only. It also operates in open water which has fewer problems in relation to the dynamics of flow as compared to the tunnel thruster.

IMCA GUIDANCE


W/S No: 55/130502 Page 156 of 194



Figure 6-4 Azimuthing thruster

6.2.2.11 Propulsion thruster: This is used in the same manner as the conventional shafted propeller system with steering being achieved by rotating the thruster rather than operating a rudder. It also forms part of the station keeping system when operating in DP. On some types of vessel, all the thrusters are of this type and are designed to be removed without the need to put the vessel in drydock. Class may apply elements of steering gear rules to designated propulsion thrusters.

6.2.2.12 Retractable azimuth thruster: This is similar to the propulsion thruster but it can be withdrawn into the hull of the vessel in order that it does not create extra drag while the vessel is in transit. For short transit distances, the thrusters may be left deployed and under power. For long transit distances, the increase in speed achieved by their use is not justified normally due to the high additional operating cost incurred.

6.2.2.13 Combined retractable thruster and tunnel thruster: Theoretically, this provides the advantages of both types but as with any multifunctional system it is a compromise which may be suitable for some situations but not for all. As the hull has less material, the possibility of structural deformation as a result of the forces developed increases; therefore the hull has to be considerably strengthened to compensate for this loss of strength. The increase in weight created may be detrimental to the vessel or the thruster power may need to be decreased to accommodate it adequately. It also has to be drawn further into the vessel thus increasing the use of internal space.

6.2.2.14 Contra rotating azimuth thruster: Thrusters with contra-rotating propellers offer higher efficiencies of between 10-15 per cent because the “aft” propeller regains some of the energy losses in the stream as well as rotational losses. Contra-rotating propeller thrusters also have low noise and vibration, and for the same power have propeller diameters 20 per cent smaller than single screw units, giving a shallower draught. The unit requires a variable speed drive as there is no option for a CP Propeller. There are also more complex sealing and thrust containment systems to consider.

IMCA GUIDANCE


W/S No: 55/130502 Page 157 of 194



6.2.2.15 Podded azimuth thruster: The podded drive provides the means to deliver greater power than previously possible with a geared azimuth thruster by eliminating the gear train in the thruster as shown in Figure 6-5. The shaft of the thruster is also the motor rotor with the pod casing being the stator. The seal arrangement becomes much more critical as there is now the possibility of electrical failures occurring as a result of seawater ingress. There is also a bilge arrangement to remove any leakage into the pod itself and provides a means to assess if there is excessive leakage taking place. Power can be of the order of 2 to 25 MW.

Figure 6-5 Podded thruster

6.2.2.16 Azipull thruster This appears to be a back to front azimuth thruster but there are advantages in this design. A pulling propeller (CPP or FPP) is mounted ahead of the leg, which is a streamlined unit incorporating the gear house and a lower fin. The leg/housing/fin combination recovers swirl energy from the propeller slipstream which would normally be wasted, converting it into additional forward thrust. At the same time the underwater unit has more rudder effect than a conventional azimuth thruster, improving the steering ability of many hull forms. The disadvantage is that it is primarily a propulsion / DP thruster as it could be problematic trying to accommodate a retractable unit.

6.2.2.17 Portable thruster: At least on manufacture now offers hydraulically driven swing down thrusters which are largely independent in terms of power and control and can be added to a dumb barge to provide a DP capability with relatively little effort compared to a conventional unit.

IMCA GUIDANCE


W/S No: 55/130502 Page 158 of 194



6.2.3 Choice of thruster

6.2.3.1 In any DP Class 2 or 3 new building or conversion project, the choice of which thrusters to use is often made at an early stage in the basic design process due to the long manufacturing lead times for such units. In addition to lead time, there are many other factors to consider when choosing a thruster for a particular application such as:-

1. Thruster type – tunnel or azimuthing

2. Thrust capability

3. Physical size – headroom under deck head etc

4. Fixed or retractable

5. Variable speed, variable pitch or combinator

6. Electrical drive, direct diesel drive

7. Reliability

8. Maintainability

9. Availability of service engineers

6.2.3.2 One of the most important points to consider is:-

‘How will the choice of thruster influence the development of the redundancy concept?’

6.2.3.3 The choice of thruster type will significantly influence the redundancy concept and it is important to ensure that the redundancy concept incorporates the necessary features to support that particular choice.

6.2.4 Physical constraints

6.2.4.1 Fixed pitch thrusters driven by variable speed AC drives are very popular but it is not always appreciated how much space and weight can be taken up by the drive and its related support equipment such as drive cabinets, phase shifting transformers, de-ionized cooling water units, UPSs, pre-charge units etc. There will also be a need to provide connections to FW cooling systems, HVAC and electrical supplies for all these units.

6.2.4.2 Although the variable pitch propeller may have some perceived disadvantages in terms of increased maintenance requirements and lower reliability due to its mechanical complexity, it can be packaged into a very compact arrangement at low and medium power levels, and requires very little in the way of ancillary equipment and support services. This might be an important consideration in small and medium sized DP vessels.

IMCA GUIDANCE


W/S No: 55/130502 Page 159 of 194



6.2.5 Low load performance and related issues

6.2.5.1 The advantages of the fixed pitch, variable speed thruster are its mechanical simplicity and low power consumption at low propeller speed. Many DP vessels spend only a fraction of their working life operating in conditions close to their maximum post failure capability and therefore thrust demand levels can be very low much of the time. The result is that the vessel has to operate with a few lightly loaded generators online which can be an uncomfortable condition both in terms of power plant stability and running conditions for diesel engines, which need to be well loaded to prevent carbon build-up reducing performance.

6.2.5.2 Vessels with variable pitch thrusters can depend on a guaranteed based load from each thruster of around 20% but this is not the case with variable speed drives. The solution for vessels employing variable speed drives is to use the thrusters in bias mode (fixed azimuth with opposing thrust vectors to create the desired resultant force) and apply significant amounts of force bias to increase the load on the generators by having the thrusters work against each other. This method works well and has advantages of improved station keeping stability in benign environmental conditions and reduced wear and tear on thruster steering gear. However, the need to manage this force bias correctly following a power plant failure was not fully understood in some early applications. In particular, it was not always properly controlled by the power management system, particularly if the PMS was a standalone unit not supplied by the DP control system provider. Two issues associated with early implementations were the need to shed the bias load before initiating overall thrust reduction as a means of blackout prevention and also the need to shed bias in such away that the desired thrust vector is maintained, otherwise a drive off will result.

6.2.5.3 Provided the sum of the base load provided by the variable pitch thrusters and the hotel load is larger than the rating of the largest generator on the vessel, the power plant is relatively immune to ‘failure to excess fuel’ generator faults. In this type of failure one faulty generator takes the entire load and others trip on reverse power leading to cascade failure and blackout. With fixed pitch, variable speed propellers there may be times when the total system load falls within the rating of one generator leaving the system vulnerable to this type of failure.

6.2.6 Effect of propeller law and power factor on post failure capability

6.2.6.1 Because the relationship between propeller thrust and power is a not a straight line, as shown in Figure 6-1, a vessel which is holding position with all thrusters available may need significantly more power to hold station in the same conditions following a failure that leads to loss of some thrusters. Thruster tripping was (and still is) a popular, ‘last resort’, load-shedding feature on vessels with variable pitch thrusters. The poor low load power factor of large asynchronous motors means that more generators have to be online even at relatively low load, thus tripping thrusters reduces the total current demand even if the power demand increases. On vessels with fixed pitch thrusters, which tend to have a high power factor throughout their operating range, the advantage lies in keeping as many thrusters running as possible following a failure as it is more efficient to divide the available power between them than to have a few thrusters working hard. In reality the advantage may be quite small and each case needs to be considered on its merits, taking into account the power savings associated with thruster auxiliaries which can also be tripped.

IMCA GUIDANCE


W/S No: 55/130502 Page 160 of 194



6.2.7 Regenerated power

6.2.7.1 Other issues associated with the use of large power electronic variable speed drives are the need to manage power regenerated by braking action. This is not usually an issue for DP but more for transit and vessel manoeuvring when much higher levels of power can be returned to the power plant. Some types of drives are not capable of regenerating power. With this type of drive, care must be taken when using speed control not to reduce the speed command set point at a rate faster than the propeller will naturally decelerate otherwise the inverter part of the drive will attempt to return power. Because power cannot be transmitted beyond the drive to the power plant the drive will only succeed in storing the energy within itself to the point where it will be tripped by its own over voltage protection. It can be very alarming for the DPO or helmsman to suddenly have all the thrusters’ trip off line simply because the manual thruster control levers were pulled back to zero too quickly.

6.2.7.2 Where drives are designed to return power to the power generation system or to dynamic breaking resisters, care must be taken to manage the return of this power in such a way that generators are not tripped on reverse power or braking resistors overloaded.

6.2.7.3 This problem is often eliminated when variable speed drives are designed for ‘true’ torque control rather ran speed control.

6.2.8 Effect of harmonics

6.2.8.1 Power system harmonics have already been discussed in relation to phase shifting transformers in 4.1.9. All variable speed drives produce harmonics of one form or another. Generally, the more sophisticated the drive, the smaller are the levels of harmonic distortion produced. However, this is another area where the choice of thruster type can influence the redundancy concept. If it is necessary to add harmonic filters to deal with the effects of harmonics then it is necessary to consider the effect of these on DP redundancy.

6.2.8.2 It is notoriously difficult to specify a passive harmonic filter that will be effective in all power plant configurations. The additional capacitance these filters add to the system may also affect the power factor to the point where there are restrictions on the number of generators that can be run with certain combinations of filters. If harmonic filters are to be part of a DP redundancy concept then a very careful study of their failure effects needs to be carried out to ensure they do not create undesirable operational restrictions.

6.2.8.3 More recently there is a trend to use variable speed drives with so called active front ends. These are generally advertised as a solution to the problems of harmonic distortion associated with older 6 and 12 pulse drives. These modern drives make use of individual filters at the thruster rather than attempting to correct the entire power system. However, even with these modern devices there have been concerns about system resonance. It is also necessary to consider whether failure of the filter will lead to equipment malfunction elsewhere in the plant, and studies backed up by suitable testing should be carried out to establish this.

IMCA GUIDANCE


W/S No: 55/130502 Page 161 of 194



6.2.9 Starting transients and inrush current

6.2.9.1 Before solid state power electronic frequency converters of large power rating were available, dc drives were the most popular method of obtaining speed control of motor loads. Since this time, power electronics have advanced to the point where frequency converters of very high power rating are available. Two device types dominate the market, the gate turn off thyristor (GTO) and the insulated gate bipolar transistor (IGBT). The advantages of fixed pitch propellers using variable speed drives are higher efficiency under all operating conditions (typically in excess of 90% at full load), mechanical simplicity, improved control and negligible starting transients. The reduction of starting transients is a significant advantage as many motor failures can be linked to excessive heating and the large electromagnetic forces generated by starting currents. Many motor manufacturers impose limits on the number of starts per hour to control the thermal effects associated with direct on line starting of large motors. It should be noted that some classification societies specify that there should be no restriction on thruster starting intervals.

6.2.9.2 When variable speed drives were first introduced, one of their advantages was the ability to soft start large motors. Prior to the application of power electronic technology this was achieved through the use of reduced voltage starting techniques such as star-delta and Korndorffer starters, both of which have a significant degree of mechanical complexity.

6.2.9.3 It is entirely fair to say that variable speed drives do remove the large starting current transient of thruster motors when the thruster is started. This effect is achieved by ramping the speed order up from zero to the desired speed. What is not so obvious is that there is still a large inrush current associated with connecting the drive’s phase shifting or isolation transformer. The problem has therefore been shifted from normal starting and stopping of the thruster to blackout recovery when it is arguably more important to be able to start thrusters with as few generators as possible. Because of the transformer inrush current it is still possible to trip a generator if too many thrusters are started too early. An obvious solution is to add ‘heavy consumer start blocking’ but this delays the point at which thrust can be applied until sufficient generators are online to connect the drive transformers safely. Pre magnetising of transformers has been effectively used to remove inrush transients. Pre-magnetizing can be carried out by using a small transformer to back feed the main drive transformer or by using the drive its self powered from a large UPS or battery bank.

6.2.10 Thruster restart

6.2.10.1 Other factors to be considered when specifying a thruster driven by a variable speed drive is whether or not it can start the motor while it is still turning or decelerating, sometimes called ‘restart on the fly’, and also whether it can start a thruster that is not stationary because of inflow from sea current or adjacent thrusters. If the drive trips prior to restart it will have to go through a pre-charge routine which can take up to 10s to make the drive available again provided it is programmed to restart automatically. All these issues can be successfully addressed in modern drive systems but it may be more cost effective to enquire about this feature at the time the specification is being prepared than after the thruster is installed.

IMCA GUIDANCE


W/S No: 55/130502 Page 162 of 194



6.2.10.2 Large modern variable speed drives now offer sophisticated control systems which can include a customer application element such that they can be used to start and stop their own auxiliary systems such as pumps and cooling fans. This can be usefully employed to give a thruster drive a great deal of autonomy to make itself ready for operation in receipt of a simple request to start the thruster. Care must be taken to ensure that such control systems are protected by a UPS with sufficient duration to keep the drive controls available during blackout recovery. It is also worth ensuring that the ‘ride through’ of auxiliary systems such as cooling pumps matches that of the drive. In the worst case there is little point having a sophisticated drive designed to ride through a voltage dip if it is tripped on loss of cooling water flow because the contactor for its cooling water pump dropped out due to the same voltage dip.

6.2.11 Diesel driven thrusters

6.2.11.1 Even thrusters which are directly driven by Diesel engines are not without issues that can influence the redundancy concept. Fixed pitch variable speed units often have clutches to disconnect the propeller from the engine for starting. These clutches can be operated by an engine driven hydraulic pump but can also be operated from an electric pump. Some designs require pressure to keep the clutch engaged and should have their own accumulator to allow for auto changeover of the pump to a standby unit. However, there have been designs where this has not been the case and many thrusters dropped out of DP simply because one switchboard supplying several pumps blacked out. The standby pumps powered from the other side of the switchboard started immediately, but too late to keep the thruster from dropping out of DP and going to idle. In such designs, what should have been a ‘cast iron’ redundancy concept employing direct diesel driven thrusters has been compromised by failing to understand the importance of maintaining clutch pressure during auto-changeover of pump supply.

6.2.12 Variable pitch thrusters (Controllable pitch propellers)

6.2.12.1 Variable pitch thrusters also have features that will influence the redundancy concept including:-

1. The pitch must be brought back to zero before the unit can be started

2. Many designs will trip on loss of hydraulic pressure requiring that there be a suitable delay on tripping during standby pump changeovers etc

3. Large motors will require some form of soft starting as already discussed star-delta units, Korndorffer starters or even power electronic soft starts are possible

6.2.12.2 A failure mode that is sometimes overlooked is what happens to the power system if one of the large motors starts direct and goes online without going through the star-delta sequence. This is known to have happened in at least one case causing a very severe voltage dip which affected the performance of other parts of the DP system leading to drift off.

IMCA GUIDANCE


W/S No: 55/130502 Page 163 of 194



6.2.12.3 The standard arrangement for fixed speed thrusters uses an induction motor to drive a controllable pitch propeller (CPP). Selectable speed motors are also available which will normally have two separate windings, one for high speed and one for low speed. Speed selection in this type of machine is achieved by altering the number of poles.

6.2.12.4 Traditional methods for large high voltage machines include autotransformer and Korndorffer starting. The high starting currents also require a substantial spinning reserve of reactive power to restart propulsion motors. There has been at least one incident where motors could not be restarted after a partial blackout because of the lack of spinning reserve, in spite of the fact that there was adequate power to maintain the on line thrusters at full power. The problem was worsened by the vessel operating in ‘open bustie’ configuration.

6.3 THRUSTER AUXILIARY SYSTEMS

6.3.1 General

6.3.1.1 Thrusters need various support services including:-

1. Hydraulic power packs for blade pitch control

2. Hydraulic power packs for steering of azimuth thrusters

3. Hydraulic power pumps for retraction

4. Lubricating pumps

5. FW and de-ionised water cooling units for motors, transformers and drives

6. Ventilation

7. UPSs for control, pre-charge and ride through

6.3.1.2 There are several strategies for providing power for thruster auxiliary systems. Arguably the most secure is to closely associate the power supply for the auxiliary systems with the supply to the thruster main motor itself. However, many vessels were, and continue to be, designed with thruster auxiliary system powered from the main LV distribution. Where a thruster has a duty and standby pump for a particular service, one will be supplied from the port LV switchboard and the other from the starboard LV switchboard. This is not necessarily the best arrangement however as it introduces vulnerability to standby start failure and certain restriction on pump utilisation and maintenance. If the reason for providing dual pumps is to mitigate the low reliability of the pump and not its source of supply then there is no significant disadvantage to powering both the duty and the standby pump from the same LV switchboard. This arrangement allows any pump to be withdrawn from service for maintenance with no significant impact on the redundancy concept.

IMCA GUIDANCE


W/S No: 55/130502 Page 164 of 194



6.3.2 Hydraulic power packs

6.3.2.1 Hydraulic power packs typically consist of two or three electrically driven pumps in a duty standby arrangement. Where the thruster requires more than one pump for normal operation the action of pitch or steering control can become slower if operation is reduced to one pump. This needs to be considered in the design of any protective functions based on steering or pitch control speed particularly if a single distribution fault can fail one pump on each thruster. As with any essential consumer, voltage dip ride-through needs to be considered. Figure 6-6 shows the schematic of a typical hydraulic steering system for a large azimuthing thruster.

6.3.3 Thruster prediction errors

6.3.3.1 Most DP control system are arranged to provide a ‘prediction error if the thrust magnitude or direction is not as expected. Prediction errors may occur if hydraulic systems are not capable of turning the thruster or changing blade pitch in the expected time.

Figure 6-6 Thruster hydraulic system

IMCA GUIDANCE


W/S No: 55/130502 Page 165 of 194



6.3.4 Thruster lubrication

6.3.4.1 Figure 6-7 shows a typical thruster lubrication system for a large azimuthing thruster. Many thrusters of this type can operate for an extended period without forced lubrication. Some designs of thruster impose a maximum load under these conditions. Where such restrictions are applied automatically, the DP control system must be advised that the thruster is no longer capable of its full capacity.

6.3.4.2 Many types of thruster depend upon compressed air to provide positive pressure on shaft seals to prevent seawater ingress and contamination of the oil. Compressed air systems are often common to all forward or all aft thruster such that failure of the service air system leads to a loss of seal pressure on all forward or all aft thrusters.

Figure 6-7 Thruster lubrication system

IMCA GUIDANCE


W/S No: 55/130502 Page 166 of 194



6.3.5 Thruster cooling

6.3.5.1 Many thrusters require some form of fresh water cooling for things such as:-

1. Phase shifting transformers

2. Motors

3. Variable speed drives

4. HPUs

5. Lube oil coolers

6. HVAC

6.3.5.2 In the case of high voltage variable speed drives, there may be a need for an intermediate cooling system using de-ionised freshwater. Figure 6-8 shows a typical thruster FW cooling system for a single thruster. In general, thrusters should be designed to be as independent of each other as practical even if the redundancy concept accepts that more than one thruster can fail due to loss of a main switchboard. Some classification societies require independent cooling systems all equipment intended to provide redundancy and independent cooling system for thrusters are considered to be good practice in view of the risk of losing multiple thrusters due to leaks or maintenance related activities. If there are concerns about the ability to carry out maintenance on freshwater cooling systems then each thruster should be provided with a second pump and cooler rather than create commonality.

Figure 6-8 Thruster cooling water unit

IMCA GUIDANCE


W/S No: 55/130502 Page 167 of 194



6.4 THRUSTER MOTORS

6.4.1 DC motors

6.4.1.1 DC motors come in several winding configurations. DC motors for speed control are generally separately excited machines with separate controlled rectifiers for the field winding and armature winding. DC motors for thrusters are generally rated at 600V and power ratings of a few hundred kW to 1MW. For larger power outputs it is common to find tandem motors arranged to drive a common shaft. Commutators and brushes are sued to make the main power connection to the armature winding and these introduce maintenance issues. DP vessels are still being built using Dc motors and modern DC drives.

6.4.2 Asynchronous motors

6.4.2.1 Asynchronous motors, also known as induction motors, are by far the most common type of motor for fixed speed and variable speed drives. This type of motor has a squirrel cage rotor and a three phase stator winding. Large motors for fixed speed drives are generally rated at 6.6kV or 11kV and power ratings up to 3MW (typical marine application). Asynchronous motors for use with variable speed drives may be typically rated at lower voltages such as 1270V, 2.2kV or 3.3kV and power ratings up to 5MW are not untypical in marine applications although much larger drives can be found in other applications. A typical motor speed range is 0 to 750 rpm but higher speeds can be found.

6.4.3 Synchronous motors

6.4.3.1 Synchronous motors are very similar to synchronous generators in so far as they have an AC stator winding and a DC rotor winding. They found specialist application in the ‘Synchrodrive’ which was fitted to some types of podded drive and are still specified in some higher power applications. They were also used as synchronous condensers in some vessel to correct low power factor.

6.5 VARIABLE SPEED DRIVES

6.5.1 General

6.5.1.1 Several types of power electronic variable speed drive are available for propulsion drives. By far the most popular is the multi level Pulse Width Modulation (PWM) inverter but other types of drive are specified for some applications.

6.5.2 Cycloconverter Drive

6.5.2.1 The cycloconverter drives offer very high torque at low speed; typical applications include icebreakers and large ships. Disadvantages include poor speed range. Figure 6-9 shows the power component layout of a basic cycloconverter drive. Note: In practice, there are several different forms of cycloconverter.

IMCA GUIDANCE


W/S No: 55/130502 Page 168 of 194



Figure 6-9 Cycloconverter Drive

6.5.3 Synchroconverter drive

6.5.3.1 The synchroconverter drive is a current-source Load-Commutated Inverter (LCI) connected to a synchronous motor. This type of inverter is available to power ratings in excess of 50MW. The synchroconverter drive has the advantage of being electrically and mechanically simple. Characteristics include high starting torque, good voltage dip ride through and wide speed range. Figure 6-10 gives the basic power component layout of a LCI driver.

INPUT TRANSFORMER

M

SYNCHRONOUS MOTOR

SMOOTHING INDUCTOR

THYRISTOR CONVERTERS

FORCED COMMUTATION FOR STARTING, NATURAL COMMUTATION WHEN RUNNING

Figure 6-10 Synchroconverter drive

6.5.3.2 Note that good voltage dip ride through depends on the drive controls being well protected by UPS

IMCA GUIDANCE


W/S No: 55/130502 Page 169 of 194



6.5.4 Voltage source PWM Drives

6.5.4.1 Multilevel Pulse Width Modulation (PWM) drives are now the industry standard for most electric propulsion applications. Figure 6-11 show the basic power components of a PWM drive. Pulse width modulation was developed to improve upon the current harmonics of six and twelve pulse fully controlled bridge output stages. Although the drive output voltage of simple PWM schemes is still a square wave, the mark space ratio is altered to simulate the effective area under an equivalent sinusoid. The effect is a near sinusoidal motor line current waveform with considerably fewer low order harmonics. Higher order harmonics may be increased but these are more easily filtered.

6.5.4.2 Lower harmonics in motor line current means smooth, quiet operation and a reduction in unwanted heating effects. Although the line current waveform of PWM drives is a major improvement the voltage waveform is still essentially a square wave, More advanced PWM drives use multiple step levels combined with pulse width modulation to improve the voltage waveform. When these drive output voltage waveforms are filtered, the result is a near sinusoidal voltage and current waveform.

6.5.4.3 Major drive manufactures claim an overall efficiency of the order of 96% including the output filter. PWM drives offer many other advantages such as near constant power factor throughout the operating range; values in the region of 0.9 are typical. Many drives also offer sophisticated motor control algorithms, some of which used mathematical models of the motor. From a system protection standpoint, drive manufacturers offer short circuit proof drive output converters which means that a thruster failure is handled at the drive itself and the upstream protection need not operate for this type of fault. Earth fault, thermal, over current and over voltage may also be offered as standards.

6.5.4.4 Wear and tear on circuit breakers may be reduced as motor starting and stopping is handled by the drive. Reduced arcing can also be expected.

6.5.4.5 All power electronic drives create harmonics on the system to which they are connected. Generally speaking, the higher the order of harmonics, the more easily they are dealt with and much may depend on the type of input stage specified. Six-pulse input rectifiers offer low cost with a penalty in terms of harmonic performance. Twelve-pulse rectifiers, supplied by drive transformers with star and delta secondary windings, are a standard way of improving upon this. Even better performance can be obtained by increasing the pulse number yet further. However, a cost penalty has to be accepted. Several manufacturers also offer drives with an active front end as another way of reducing supply side harmonics.

IMCA GUIDANCE


W/S No: 55/130502 Page 170 of 194



Figure 6-11 Voltage source PWM drive

6.5.5 Ride through performance

6.5.5.1 Although power electronic variable speed drives have been in use in DP vessels for more than ten years, the significance of some of their features and flaws is only now being understood by the DP community, often as the results of investigations into DP incidents. In many cases these features were well understood by the drive manufacturers but for some unknown reason the significance of these flaws and features was not communicated to the designers of the DP redundancy concept. One such feature is the ability (or lack of ability) of the variable speed drive to ride through a power system transient caused by the effect of clearing a fault elsewhere in the distribution system. This issue is also of great importance in the process and chemical industries where plant operators do not want critical parts of the process to trip every time there is dip in grid voltage.

6.5.5.2 Figure 6-12 shows a much simplified schematic of a variable speed AC thruster drive. Voltage source drives such as this will trip on severe voltage dips to protect themselves from the inrush current that follows power restoration. In recent years, drive manufacturers have addressed this issue by using the power of fast control systems to stop the drive consuming power during the voltage dip thus preventing its own internal voltage falling to dangerously low levels. However, these features are often not tested in practice and therefore the first real test is usually when the feature is called upon to operate in service. Had vessel owners and designers been more aware of these flaws and features, the arguments surrounding operation with busties open or closed may have been very different.

IMCA GUIDANCE


W/S No: 55/130502 Page 171 of 194



Figure 6-12 Variable speed thruster drive

6.5.5.3 Some designers back up the voltage dip ride through capability of the drive by providing automatic reconnection and restart. If the drive detects a significant power system disturbance (over/under voltage, over/under frequency) it will be disconnected but will continue to monitor the power supply until it determines that it is safe to automatically reconnect.

6.6 THRUSTER CONTROL SYSTEMS

6.6.1 Thruster manufacturer’s control systems

6.6.1.1 Most thruster manufacturers provide a closed loop control system for their thrusters. For azimuthing thrusters with controllable pitch propellers the closed loop control system will accept both steering and pitch commands from the DP control system and operate the hydraulic control system to achieve the desired blade pitch and steering angles. In the case of azimuthing thrusters with fixed pitch propellers, the closed loop control of propeller speed is provided within the variable speed drive. Only the closed loop steering control is provided by the thruster control unit.

6.6.1.2 Figure 6-14 shows a typical thruster control unit for a fixed pitch azimuthing thruster. The unit accepts steering commands from the DP control system in the form of an analogue 4-20mA loop representing the required angle. The control unit then interprets the command and operates the clockwise CW and counter clockwise CCW solenoid valves to bring the thruster azimuth to the required angle by the shortest possible route. The hydraulic system is typically capable of turning the thruster at 2 rpm.

IMCA GUIDANCE


W/S No: 55/130502 Page 172 of 194



6.6.1.3 There are three angle measuring devices mounted on the thrusters. One device provides feedback to the control unit for closed loop control, the other provides feedback direct to the DP control system and the third is used for indication at the manual thruster control levers. The closed loop feedback device may be a shaft encored in some applications. Feedback to the DP control system is usually provided by a sine / Cosine potentiometer driven from an ±10V supply as shown in Figure 6-13. This device has resistance elements which produce a sinusoidal distribution of voltage. Wipers displaced by 90° allow a cosine voltage to be produced. The angle of the thruster is then computed from :-

1. if V_sin > 0 and V_cos > 0 angle = arctan(V_sin/V_cos/ (2*pi) * 360°

2. if V_cos = 0 and V_sin > 0 angle = 90°

3. if V_cos < 0 angle = 180° + arctan(V sin/V_cos)/ (2*pi) * 360°

4. if V_cos = 0 and V_sin < 0 angle = 270°

5. if V_cos > 0 and V_sin < 0 angle = 360 + arctan(V_sin/V_cos)/ (2*pi) * 360°

6.6.1.4 In other devices a 4-20mA interface is used to indicate the sine and cosine feedback. Loop monitoring is provided to indicate that one channel has failed. Some control system supplier also carry out a check that Sin2 A+Cos2 A = 1.

Figure 6-13 Sine / cosine potentiometer

6.6.1.5 Although the DP control system only provides open loop control of the thruster (closed by vessel position) it does monitor the thruster speed and azimuth and will issue a prediction error if either variable deviates from the required value by more than a defined amount in a specified time. Note that at least one type of thruster has a single mechanical drive for all three angle indicators. If this drive slips, the thruster may be pointing in the wrong direction with no indication that this is the case.

IMCA GUIDANCE


W/S No: 55/130502 Page 173 of 194



6.6.1.6 The thruster control unit provides one of several inputs to the DP control signal. This signal indicates to the DP system that the thruster is ready for DP commands. Other inputs may include the variable speed drive indicating that it is ready for speed or torque commands. Some thruster failures will cause the DP ready signal to indicate ‘not ready’. As soon as the DP control system detects the change in status it will automatically deselect the thruster and reduce the command to zero.

6.6.1.7 The thruster control unit will also provide some of the interlocks and protection associated with the thruster. Typical interfaces for this purpose include:-

1. Shaft brake applied

2. Air pressure available

3. HPU pressure

4. Main and backup power supply present

5. Lube oil pressure

6. Thruster control unit healthy - warning / fault

7. DP ready

8. Local / remote

9. Main motor start allowed

10. Main motor running / stopped

11. Stop main motor

IMCA GUIDANCE


W/S No: 55/130502 Page 174 of 194



BRAKE

CW

CCW

LOCAL / REMOTE

DP READY

WARNING

FAULT

SHUTDOWN MOTOR

PROP SPEED FEEDBACK

AZIMUTH FEEDBACK TO THRUSTER CONTROL UNIT

AZIMUTH FEEDBACK TO DP

SINE / COSINE

START ALLOWED

UPS POWER INTHRUSTER CONTROL UNIT

AZI CMD 4-20mA

MOTOR STOPPED

PROP SPEED

LUBE OIL PRESSURE

HPU PRESSURE

SHAFT LOCK OPEN

SHAFT BRAKE OPEN

DRIVE

VESSEL AUTOMATION

SYSTEMS

THRUSTER

BACKUP DC SUPPLY

HYDRAULIC PUMP RUNNING (RETRACTABLE

AZIMUTH THRUSTER ONLY)

Figure 6-14 Thruster control unit

6.6.2 Direct control by vessel automation system

6.6.2.1 In some applications there is no thruster manufacturers control unit and the hydraulics are interfaced directly to a vessel management system field station. The thruster control algorithms for steering and pitch control reside within the field station. This is a popular solution for vessel upgrades where the thruster mechanical part is to be retained but the obsolete control system is absorbed into a new vessel automation system.

IMCA GUIDANCE


W/S No: 55/130502 Page 175 of 194



6.6.3 Thruster emergency stops - line monitoring

6.6.3.1 Classification societies normally require that remote thruster emergency stops are located at the main DP station. Emergency stops for safety purposes may be located at other points in the thruster or drive machinery space. The thruster emergency stop must be independent of the normal drive control system. Ideally the emergency stop would act directly on the drive main circuit breaker but very few variable speed manufactures adopt this because shutting down the drive in this way carries a significant risk of damage. Therefore most emergency stop functions act on the drive control system in some way, usually as an input to the safety shutdown chain part of the drive controller electronics. An alternative scheme has been proposed in which the drive will be shut down gracefully by the initial action of the E stop, with a time delay circuit to open the drive circuit breaker directly if the drive controller fails to open it in a few seconds.

6.6.3.2 DP rules and guidelines require that thrusters fail safe but there will always be some circumstances where the DPO needs to shut down a thruster quickly using a control other than the normal stop function. In the case of a run-away thruster it may be difficult to tell which thruster is faulty as all thrusters may load up to oppose the faulty one. Prediction alarms or other alarms indicting thruster faults may help to identify the faulty unit.

6.6.3.3 Classification society requirements vary but for DP Class 2 it is not unusual to require that all propulsion related emergency stops use normally open contacts to prevent spurious loss of a thruster. At least one classification society requires line monitoring to prevent shutdown of the thruster on emergency stop cable faults such as open circuit or short circuit. To achieve this, isolated switch amplifiers are used in combination with stop buttons having the necessary series and parallel resistors as shown in Figure 6-15. The amplifiers will only respond to the correct change in line current caused by closing the stop button across the parallel resistor. Alarms are provided to indicate a cable fault or loss of the E-stop power supply.

Figure 6-15 Thruster emergency stops

IMCA GUIDANCE


W/S No: 55/130502 Page 176 of 194



6.6.3.4 In DP class 3 vessels, the thruster emergency stops may form a common point connecting all thrusters, which must be taken into account when the effects of fire are considered. Line monitoring is generally accepted as mitigation of this potential failure. Other methods have been accepted as reducing the risk of thrusters responding to E-stop cable faults. One possible alternative is to arrange the E-stop with two control circuits one using normally open contacts and the other using normally closed. The thruster will only shut down if both circuit change state. Alarm will be given if the two circuits ever indicate the same status. This arrangement is similar to the logic used in the DP control system’s ‘fire back-up’ switch for DP class 3 vessels.

6.6.3.5 To provide more information on the nature of a fault, the alarms for E stop cable faults should reset automatically at the switch amplifier if the fault clears. However, the vessel management system will retain the alarm until acknowledged so that the fault can be investigated.

IMCA GUIDANCE


W/S No: 55/130502 Page 177 of 194



7 SAFETY SYSTEMS

7.1 GENERAL PRINCIPALS OF SAFETY SYSTEMS

7.1.1 Purpose

7.1.1.1 Safety Systems are designed and installed to protect personnel, environment and assets from the consequences of abnormal and hazardous situations, and to allow a safe evacuation of personnel within a reasonable time frame. The hazards that are considered include fire and the presence of inflammable gas from drilling operation, onboard hydrocarbon processing or nearby installations.

7.1.1.2 The safety systems are designed to allow for the shutdown of main power plant, thrusters, ventilation systems and fuel and lube oil pumps. For fire incidents there may also be systems to trigger injection of fire suppression mediums. When fire suppression systems are used these will require ventilation shutdowns for the associated spaces.

7.1.2 Application

7.1.2.1 For installations covered by MODU and vessels such as FPSOs a shutdown system will be required to make safe the processing plant. This system may be integrated with a common ESD or may be a separate system.

7.1.2.2 The ESD System is used to provide a safe and rapid shutdown of systems and equipment. The ESD System processes input signals from manual pushbuttons and selected F&G signals.

7.1.2.3 When designing these systems associated with a dynamic positioning system the design must consider possible impact of the Safety Systems on the DP system, including the effects of the failure modes or acts of maloperation.

7.1.2.4 The designer of the safety systems may prioritise the reliable operation of shutdowns to ensure faults do not prevent a shutdown being carried out. The designers of the DP system are more interested in ensuring that faults in the safety systems do not compromise station keeping integrity. This section is mainly concerned with resolving that apparent conflict.

7.2 REGULATIONS RELATING TO SHUTDOWN SYSTEMS

7.2.1 Regulations for shutdown systems are almost entirely written from the point of view of ensuring safety rather than minimising the risks of faults in safety systems affecting the DP system. However, there is some recognition that the risk of “unintentional stoppages” should be minimised. See (MODU Code 6.5.3, DNV-OS-A101 SAFETY PRINCIPLES AND ARRANGEMENTS Section 5 “Table C1 - Safest conditions and corresponding output circuit configuration” )

IMCA GUIDANCE


W/S No: 55/130502 Page 178 of 194



7.2.2 A comprehensive treatment of ESD systems and Fail Safe Functionality is given in DNV-OS-A101 SAFETY PRINCIPLES AND ARRANGEMENTS Section 5. This describes how systems should be “designed so that risks of un-intentional shutdown caused by malfunction or inadvertent operation is minimised.” However there is no cross reference to the sort of redundancy requirements that are now commonplace in vessel management systems.

7.2.3 Classification Society rules require ventilation stops outside machinery spaces to be used in the event of a fire but make no mention, directly, to the consequences of any failure in the stop system.

7.2.4 As discussed earlier the DP system will be affected by failures of the auxiliary systems. For DP class 2 that will include any failure in the shut down systems and for DP class 3 systems it will include the effect of fire on associated cabling in any compartment. Rules also require the consideration of any reasonable act of maloperation. These requirements should mean that the shutdown and safety systems are treated in the same way as any other part of the vessel’s control system meet the same redundancy requirements, and have their failure modes analysed in the DP system FMEA.

7.3 ESD SYSTEMS AND DP REDUNDANCY

7.3.1 There are numerous ways to arrange emergency shutdown systems and Fire and Gas detection. Some of these are illustrated in the diagrams below.

PLC or Relay Cabinet

Fire and Gas Alarm

Mimic Diagram

Gas Detection

Emergency Stop Panel with

Group Stops on Mimic Diagram

Fixed Fire Suppression System Operating Cabinets

Outputs to Ventilation Fans, Ventilation Flaps, Fuel Pumps, Lub Oil Pumps etc.

Push Button Signals

Fire Detection

Figure 7-1 Simple Centralise Emergency Stop System

IMCA GUIDANCE


W/S No: 55/130502 Page 179 of 194



7.3.2 In Figure 7-1 fire and gas detection is displayed on a mimic diagram above another mimic with group and individual stop buttons. The stops are implemented via a central PLC cabinet. The main issues here for effects on the DP system are failure effects due to hardware or power failures in the PLC cabinet. Although the PLC may be designed so that no shutdowns occur when power fails it would be preferable to use separate PLCs with redundant power sources split to match the redundancy concept.

7.3.3 The same issues, of the system not being split to match the redundancy concept, also apply to the more sophisticated system shown in Figure 7-2. Here although the F&G system uses four field stations the ESD system only uses two. If such an arrangement is used on a system with a four way redundancy split the ESD system might cause the failure of half the systems which may be worse than the WCFDI. To make this arrangement acceptable, the system must be designed to fail safe. Arranging circuits such that they do not trip on power failure greatly reduces the risk. Class may require that this is demonstrated at FMEA proving trials for DP vessels.

Fire and Gas System based on Four VMS Field

Stations

Fire Detection

Fire Detectors

Manual Call Points

Gas Detectors

Push Buttons

Fire Pumps

Fire Fighting Systems

ESD and F&G Matrixes Incorporating ESD 1 and ESD 0 buttons.

Located in Bridge and ECR

ESD System Based on two VMS Field Stations

VMS System Based on Field Stations and Redundant

Network for Control of Power System, Auxiliaries and DP.

Uses separate Field stations for each Thruster and Each

Switchboard.

Redundant Data/Network Links

ESD Level 0 Pushbuttons at Lifeboat Muster Stations

Fire Dampers

Ventilation Fans

Valves

Equipment Shut Down

ESD 0 Abandon Platform Shutdown

ESD 1 Preparation to Abandon

ESD 2 Local ESD F&G Pushbuttons

Local Emergency Stop Buttons in Machinery Spaces (ESD 2)

Figure 7-2 ESD and F&G System Integrated into VMS

7.3.4 An ESD 0 as shown in Figure 7-2 causes a total shutdown of all systems. Some would consider such an arrangement an unacceptable risk and have a policy to not implement ESD 0.

IMCA GUIDANCE


W/S No: 55/130502 Page 180 of 194



7.3.4.1 Measures that may be included in such a system to reduce risk include:-

1. Additional subdivision of hardware to operate all stop functions along the lines of the redundancy concept

2. Use of two buttons to avoid accidental operation

3. Use of covered type buttons

4. Use of an enable keyswitch which can be in the off position during DP operations

5. ESD set to manual activation only during DP Operations

6. Field station outputs fail safe on power loss to prevent tripping of DP critical items

7.3.5 An arrangement split along the lines of the redundancy concept (in this case a four way split) is shown in Figure 7-3. Here any fault in the ESD should only affect one of the four switchboards.

7.3.6 The ESD system shown in Figure 7-3 is divided into four, along the lines of the redundancy concept. This means that the worst failure that is likely to occur would be a spurious shutdown of 25 % of the power and thruster systems. There is a small risk that a severe event affecting one of the lifeboat stations could affect all engine rooms. This risk could be minimised by operating the system inhibits on the bridge during DP operations. Providing alarm and delay on ESD 0 to allow the control room operators or DPOs to cancel the shutdown has also been implemented in some applications.

7.3.7 Note that the system is provided with a separate disable facility to each controller on the bridge (Bridge Enable Control). This is a recently introduced safety measure required to enhance security.

7.3.8 The difficulties with the design of ESD 0 when applied to dynamically positioned drilling units arise because the rules were written for moored units and thus station keeping was of little concern. A moored unit will not drift off on loss of power but blackout of a DP MODU (because of a gas cloud) means that the vessel drifts downwind remaining in the gas cloud.

7.3.9 In the design of an ESD system there may be a risk of a blackout due to a wiring fault. These risks can be minimised by using:-

1. Line monitoring

2. Dual circuits with NO & NC contacts which must change state together

3. Voting systems

4. Ensuring that trips do not occur if power is lost to the controllers or field stations.

IMCA GUIDANCE


W/S No: 55/130502 Page 181 of 194



10 c

ESD HVA ENABLE

ESD BVB ENABLE

ESD HVC ENABLE

ESD HVD ENABLE

Bridge Enable Control

LQ Vent Shutdown ESD-LQ-PB

Bridge Control Panel

MS Vent Shutdown A

ESD-MS-PBA

MS Vent Shutdown C

ESD-MS-PBC

MS Vent Shutdown B

ESD-MS-PBB

Main DP/Back-UP DP Alt. Vent S/D

ESD-PB-DP

11 kV Swbd

MS Vent Shutdown D

ESD-MS-PBD

E-GEN Room Vent Shutdown

VESD-EGEN-PBD

480 SWBD RM A11KV SWGR RM A

VMUPS1

10 c

11 kV Swbd480 SWBD RM C 11KV SWGR RM C

VMUPS3

10 c

11 kV Swbd480 SWBD RM D

11KV SWGR RM D

VMUPSD

10 c11 kV Swbd

480 SWBD RM B 11KV SWGR RM B

VMUPS2

24V PSU FS08

24V PSU FS07

24V PSU FS06

24V PSU FS05

Water Mist Valve Operation Panel in ECR Stbd Pump Rooms, Engine Rooms 1 – 4,

Thruster Rms 1, 3, 5 and 7

To CPA

To CPA, CPB, CPC and CPD

To CPA

To CPB

To CPC

To CPD

To CPD

To CPA

To CPB

To CPC

To CPD

ESD HVA PB-2

ESD BVB PB-2

ESD HVC PB-2

ESD HVD PB-2

AFT Lifeboat Station

To CPA

To CPB

To CPC

To CPD

Trip Signals to 440V ac Consumers




ESD HVA Controller

CPA

ESD HVB Controller

CPB

ESD HVC Controller

CPC

ESD HVD Controller

CPD

To CPD

To CPA

To CPB

To CPC

To CPD

ESD HVA PB-2

ESD HVC PB-2

ESD HVD PB-2

FWD Lifeboat Station

To CPA, CPB, CPC and CPD.

VESD-DF-PB1

Drill Cabin

Water Mist Valve Operation Panel in ECR Stbd Pump Rooms, Engine Rooms 1 and 2,


Water Mist Valve Operation Panel in ECR Port Pump Rooms, Engine Rooms 1 – 4,


Water Mist Valve Operation Panel in ECR Port Pump Rooms, Engine Rooms 1 – 4,


To CPB

To CPC

To CPD

ESD HVBPB-2

Figure 7-3 ESD 0 Split to Match Redundancy Concept

7.4 ACTIVE FIRE PROTECTION

7.4.1 Design considerations

7.4.1.1 Active fire suppression systems include fire suppression gases and water mist systems. These are usually activated from individual control panels mounted immediately outside the space covered. These panels are in turn linked to some arrangement that will shut off the ventilation and close ventilation flaps (fire dampers) related to the area containing the fire. With this design, any fault in these panels should only affect the ventilation for one space. However, if a central relay panel is used, the failure effects from that panel may affect more than one space if not carefully designed. When designing these systems it is important to consider the effect on DP related systems caused by intentional operation and by system failure.

IMCA GUIDANCE


W/S No: 55/130502 Page 182 of 194



7.4.1.2 For DP Class 2 vessels it is generally accepted that failure of the fire-fighting system must not lead to a failure effect exceeding the worst case failure design intent even if intentional operation will have that effect. However, it is good practice to split fire fighting systems and their controls along the lines of the redundancy concept. This is particularly valid in the case of DP Class 2 vessels with more than one engine room. DP Class 3 vessels are designed to withstand the effects of fire in any one compartment and fire fighting systems should be designed in a manner that supports the redundancy concept.

7.4.2 Typical system

7.4.2.1 Figure 7-4 shows a typical CO2 system for a large DP Class 2 vessel with two enginerooms. The operating philosophy outlined below describes some of the features used to help ensure the correct space is flooded and prevent unintentional actions such as:-

1. Stop of fans

2. Closing of dampers

3. CO2 discharge

7.4.2.2 In this example the starboard engineroom requires 44 CO2 cylinders and the port generator engineroom requires 47 CO2 cylinders. One control valve cabinet is allocated to each engineroom and each cabinet houses two manually operated valves. One of the two valves valve directs gas from the pilot bottles to activate all the cylinders downstream of the CO2 control line through a pneumatic timer. The other valve directs pilot gas to keep the main stop valve in the open position. A limit switch on the main stop valve will indicate to the F&G system that the valve has been opened.

7.4.2.3 The pilot cylinders are located in the cylinder control cabinet, accessed by a key. On a confirmed fire in a CO2 protected space, a red light will be illuminated on the corresponding control valve cabinet to direct the operator to the correct cabinet. Ventilation shutdown and alarms are initiated by limit switches on the cabinet doors.

7.4.2.4 Opening the control valve cabinets for the port or starboard enginerooms is detected by two limit switches to reduce the risk of spurious operation, this triggers the following actions:-

1. A CO2 release column light alarm will be activate in the associated space

2. The bridge will receive audible and visual alarms on the F&G system

7.4.2.5 Opening the cylinder control cabinet activates a third limit switch which initiates:-

1. CO2 release alert on the F&G system

2. Trip of ventilation fans and closure of fire dampers (provided all three limit switches are activated)

7.4.2.6 More advanced features can be included such as linking initiation of the CO2 release process to the power management system which will start standby generators in the unaffected engineroom and open the bustie when the process is complete. Thus reducing the risk of a fire affecting both power systems.

IMCA GUIDANCE


W/S No: 55/130502 Page 183 of 194



Figure 7-4 Typical CO2 fire fighting systems for large vessel

7.5 EFFECTS OF VENTILATION SYSTEM SHUTDOWN

7.5.1 Machinery Spaces

7.5.2 In spaces such as thruster rooms and auxiliary machinery spaces there should not be an immediate effect on systems due to a spurious shutdown of ventilation but this should be confirmed during FMEA proving trials.

7.5.3 Measures to mitigate the longer term effects can include alarms for unscheduled fan stops, temperature monitoring of machinery and room temperature sensors. Trials should check that the measures used give a reliable and timely warning of ventilation failure well before machinery must be shut down to avoid damage.

7.5.4 Enginerooms

7.5.5 See also Section 2.3.6 for a discussion of engineroom ventilation shutdown. Restriction of air flow into the engineroom can have a more serious effect on engine operation and can also represent a safety hazard in relation to slamming of doors etc.

7.5.6 Figure 7-5 shows a typical fire damper system for a large DP Class 2 vessel with two enginerooms. The fire dampers are pneumatically controlled using two independent sources of air. The dampers for each space are controlled by dedicated F&G process stations. Due to the importance of maintaining combustion air to the engines, the fire dampers for the enginerooms are arranged to fail to the open position on loss of air supply or control signal. The fire dampers for other spaces fail to the closed position.

IMCA GUIDANCE


W/S No: 55/130502 Page 184 of 194



Figure 7-5 Fire damper controls

7.6 GROUP STOPS

7.6.1 Group Stops are used to simplify operation of multiple functions to shut down equipment for an area. These should be split along the lines of the redundancy concept with respect to both to the initiating buttons and the hardware (cables, cable routes, relays, PLCs, field stations etc) used to act on the stop command. The type of shutdown circuit used may be determined by class requirements including the provision of line monitoring.

7.7 CONTROL ROOM LAYOUTS

7.7.1 Modern DP and vessel management systems have tended to locate the main operator stations on the bridge, it is therefore sensible to install the matrix panels and the controls for emergency shutdowns, fire and gas detection etc. at the same location. This allows senior personnel to control and monitor all aspects of an ongoing incident from one position. The ergonomics of this arrangement are important to reduce the risks of shutting down the wrong systems. These facilities will usually be duplicated in the ECR (Engine Control Room) where such a location exists.

7.7.1.1 The arrangement of the VMS control may be set such that acknowledging engineering alarms is the responsibility of personnel in the ECR and all safety related (e.g. Fire and Gas alarms), DP and ballast control alarms are to be the responsibility of the bridge, with two DPOs manning the DP and VMS desks .

IMCA GUIDANCE


W/S No: 55/130502 Page 185 of 194



ES

D M

atrix

and

Sa

fety

Pan

els

Figure 7-6 Positioning of ESD/Safety Systems

7.7.2 In the example above, the ESD Matrix and Safety system has been positioned so that senior personnel in control of an emergency situation on the bridge can best control the situation. Also routine false alarms, zone isolations etc can be dealt with and monitored by the DP operators easily.

7.7.2.1 VMS system operations dealing with F&G alarms, hot work isolations, ballast control etc. can be a full time task on a large rig therefore positioning the VMS desks near to F&G / ESD panels makes this task easier.

IMCA GUIDANCE


W/S No: 55/130502 Page 186 of 194



This report is intended for the sole use of the person or

company to whom it is addressed and no liability of any nature

whatsoever shall be assumed to any other party in respect

of its contents. As to the addressee, neither the Company

nor the undersigned shall (save as provided in the Company's

Conditions of Business dated 1st October 2005) be liable

for any loss or damage whatsoever suffered by virtue of any act,

omission or default (whether arising by negligence or otherwise)

by the undersigned, the Company or any of its servants.

GL NOBLE DENTON

Signed:

Steven Cargill

DP Technical Authority

Countersigned: Bill Ireland

Assistant DP Operations Manager

Dated: Aberdeen, March 2010

IMCA GUIDANCE


W/S No: 55/130502 Page 187 of 194



APPENDICES

IMCA GUIDANCE


W/S No: 55/130502 Page 188 of 194



APPENDIX A LIST OF ABBREVIATIONS

IMCA GUIDANCE


W/S No: 55/130502 Page 189 of 194



Master Abbreviations List A

ABS American Bureau of Shipping

AC Alternating Current

ACB Air Circuit Breaker

ACCU Automatic Control Centralised Unmanned

AHU Air Handling Unit

AHV Anchor Handling Vessel

AMOT Name of valve manufacturer

AVR Automatic Voltage Regulator B

BA Bus Arbiter

BTT Bow Tunnel Thruster C

CA Certifying Authority

CB Circuit Breaker/Control Breaker

CCW Counter Clockwise

CD Carrier Detect/Collision Detect

CO2 Carbon Dioxide

CoS Chamber of Shipping

CPP Controlled Pitch Propeller

CPU Central Processing Unit

CR Close Relay

CRC Cyclic Redundancy Check

CSMA Carrier Sense Multiple Access

CT Current Transformer

CW Clockwise D

DBR Dead Bus Relay

DBSR Dead Bus Slave Relay

DC Direct Current (dc in text - do not expand)

DCS Distributed Control System

DDC Deck Decompression Chamber

DG Diesel Generator

DGS Diesel Generator Set

DGPS Differential Global Positioning System

IMCA GUIDANCE


W/S No: 55/130502 Page 190 of 194



DI Digital Input

DNV Det Norske Veritas

DO Diesel Oil

DP Dynamic Positioning

DPC Dynamic Positioning Console/Cabinet

DPO Dynamic Positioning Officer

DPS Dynamic Positioning System

DTE Data Terminating Equipment E

ECR Engine Control Room

EG Emergency Generator

EGB Electric Governor – Backup

EPD Electrical Power Distribution

ER Engineroom

ESD Emergency Shut Down F

F&G Fire and Gas

FIP Factory Interface Protocol

FMEA Failure Mode and Effect Analysis

FMECA Failure Modes and Effects Criticality Analysis

FO Fuel Oil

FS Field Station

FW Fresh Water

FWC Fresh Water Cooling

Fwd Forward G

GPS Global Positioning System

GSD Generic Station Description H

HF High Frequency

HFO Heavy Fuel Oil

HMI Human Machine Interface

HO Heavy Oil

HP High Pressure

HPP Hydraulic Power Pack

HPR Hydro-acoustic Position Reference

IMCA GUIDANCE


W/S No: 55/130502 Page 191 of 194



HPU Hydraulic Power Unit

HT High Temperature

HTFW High Temperature Fresh Water

HV High Voltage

HVAC Heating, Ventilation and Air Conditioning

Hz Hertz I

I/O Input/Output

IAS Integrated Automation System

ICMS Integrated Control and Monitoring System

ICS Integrated Control System

IMCA International Marine Contractors Association

IMO International Maritime Organisation

IP Internet Protocol

IP Industrial Protocol

ISM International Safety Management

ISO International Standards Organisation J

JB Junction Box K

kN Kilo Newton

kV Kilo Volt

kVA Kilo Volt Ampere

kVAr Kilo Volt Ampere Reactive

kW Kilowatt L

LAL Low Level Alarms

LCR Inductance, Capacitance, Resistance

LED Light Emitting Diode

LHS Left Hand Side

LO Lube Oil

LOA Length Over All

LR Lloyds Register

LRC Longitudinal Redundancy Check

LS Load Sharing

LT Low Temperature

IMCA GUIDANCE


W/S No: 55/130502 Page 192 of 194



LTFW Low Temperature Fresh Water

LV Low Voltage M

mA milliAmps

MAC Medium Access Control

MAP Main Alarm Panel

MARPOL Merchant Shipping (Prevention of Oil Pollution) Regulations

MAU Media Access Unit

MBC Micro Biological Contamination

MCB Miniature Circuit Breaker

MCC Motor Control Centre

MCCB Moulded Case Current Breaker

MCOS Manual Changeover System

MCR Maximum Continuous Rating

MDO Marine Diesel Oil

MFR Multi Function Relay

MGE Main Generator Engine

MGP Multi Generator Protection

MMI Man Machine Interface

MMS Marine Management System

MODU Mobile Offshore Drilling Unit

MRU Motion Reference Unit

MS Main Switchboard

MSB Main Switchboard

MSC Maritime Safety Committee

MTC Manual Thruster Controls

MUX Multiplexer

MVA Mega Volt Ampere

MVAr Mega Volt Ampere Reactive

MVR Manual Voltage Regulator

MW Megawatt N

NDE Non Drive End

NDU Network Distribution Unit

NIC Network Interface Connector/Card

NPS Negative Phase Sequence

IMCA GUIDANCE


W/S No: 55/130502 Page 193 of 194



O

O2 Oxygen

O/C Open Circuit

OIM Offshore Installation Manager

OLE Object Linking and Embedding

OLM Optical Link Module

OPC Object Linking and Embedding for Process Control

OPLS Oil Pressure Low Shutdown

OS Operator Station/Outstation

OSV Offshore Supply Vessel

OT Operator Terminal P

PA Power Available

PC Personal Computer

PCU Process Control Unit

PLC Programmable Logic Controller

PMG Permanent Magnet Generator

PMS Power Management System

PS Process Station

psi Pounds per Square Inch

PSU Power Supply Unit

PWM Pulse Width Modulation Q

QC Quick Closing

QCV Quick Closing Valve

QoS Quality of Service R

RAM Random Access Memory

RCS Remote Control System

RCU Remote Control Unit

RHS Right Hand Side

RMS Route Mean Squared

ROV Remotely Operated Vehicle

RP Reverse Power

RPM Revolutions Per Minute

RTD Resistance Temperature Device

IMCA GUIDANCE


W/S No: 55/130502 Page 194 of 194



S

S Second(s)

S/C Short circuit

SCADA Supervision Control And Data Acquisition

SCR Silicon Control Rectifier

SLD Single Line Diagram

SMS Safety Management System

Stbd Starboard

STP Shielded Twisted Pair

SW Sea Water

SWBD Switchboard

SWG Standard Wire Gauge T

TC Thruster Controller

TCP/IP Transmission Control Protocol/Internet Protocol

TDAVR Thyristor Divert Automatic Voltage Regulator

THD Total Harmonic Distortion

TMS Thruster Management System

TW Taut Wire U

UHF Ultra High Frequency

UMS Unattended Machinery Space

UPS Uninterruptible Power Supply V

VAr Volt Ampere Reactive

VAS Vessel Automation System

VCB Vacuum Circuit Breakers

VDU Visual Display Unit

VHF Very High Frequency

VFD Variable Frequency Drive

VMS Vessel Management System

VSD Variable Speed Drive

VT Voltage Transformer W

WCFDI Worst Case Failure Design Intent

A7043-B IMCA Guidance DP Electrical Power and Control

Documents