Relume FMEA

FMEA OF OSV "RELUME" FOR MENAS MAY 2013 24025-0912-16117 24025-0912-1 6117 | REVISION 9

Table of Contents 1.

SUMMARY SUMMA RY ................ ................................. .................................. ............................ ........... 1

2.

INTRODUCTION INTRODUCT ION ................ ................................. .................................. ................... .. 2 2.1

INSTRUCTIONS ........................................................................... 2 INSTRUCTIONS

2.2

VESSEL PARTICULARS PARTICULARS .............................................................. 3

2.3

DEFINITION OF DP CLASS 2 ....................................................... 4

3.

REDUNDANCY REDUNDA NCY CONCEPT OVERVIEW ................ ............ .... 6

4.

POWER GENERAT GENERATION ION ................................. ......................................... ........ 8 4.1

FUEL OIL SYSTEM SYSTEM ....................................................................... ....................................................................... 8

4.2

FO SYSTEM FAILURE MODES .................................................... 9

4.3

SEA WATER COOLING COOLING .............................................................. .............................................................. 12

4.4

SW COOLING SYSTEM FAILURE FAILURE MODES............................. .... 13

Document Details Report Title FMEA of OSV "RELUME"

Author AS/AFF GM Doc. No. 24025-0912-16117 | Revision 9 File Name GM 24025-0912-16117 FMEA OF OSV RELUME REV 8 Issue Record Date

Rev

Checked

Approved

08.10.04 21.10.04 29.10.04 05.04.05 20.03.06 11.10.12 3.01.13 28.01.13 30.05.13

1 2 3 4 5 6 7 8 9

CAJ NPC NPC JFD AJC AS AS AFF AFF

JFD JFD JFD CAJ CAJ JFD JFD AS AS

4.5

FRESH WATER COOLING SYSTEM ......................................... SYSTEM ......................................... 13

4.6

FW COOLING SYSTEM FAILURE MODES .................. ............... 15

4.7

L.O. SYSTEM .............................................................................. 16

4.8

LO COOLING SYSTEM FAILURE MODES ................................. 17

4.9

COMPRESSED AIR AIR .................................................................... .................................................................... 17

4.10

COMPRESSED AIR SYSTEM FAILURE MODES........................ 19

4.11

VENTILATION ............................................................................. 19

4.12

VENTILATION FAILURE MODES................... ..................... ........ 20

4.13

DIESEL GENERATOR ENGINES ............................................... ENGINES ............................................... 20

4.14

DIESEL GENERATOR ENGINES FAILURE MODES .................. 21

4.15

POWER MANAGEMENT SYSTEM ............................................ SYSTEM ............................................ 22

4.16

POWER BALANCE BALANCE ..................................................................... ..................................................................... 31

4.17

ENGINE ROOM FIRE FIRE ................................................................. 31

4.18

690V MAIN SWITCHBOARD SWITCHBOARD ...................................................... ...................................................... 32

4.19

690V MAIN SWITCHBOARD FAILURE FAILURE MODES ........................ . 34

4.20

440V SWITCHBOARD................................................................. 34

4.21

440V DISTRIBUTION FAILURE MODES ................... .................. 35

4.22

440V EMERGENCY SWITCHBOARD SWITCHBOARD ................................. ........ 36

4.23

440V EMERGENCY SWITCHBOARD FAILURE MODES............ 37

T +44 (0) 1224 625600 F +44 (0) 1224 624447

4.24

230V SWITCHBOARDS SWITCHBOARDS.............................................................. .............................................................. 38

www.globalmaritime.com

4.25

230V DISTRIBUTION FAILURE MODES ................... .................. 40

4.26

230V EMERGENCY SWITCHBOARD SWITCHBOARD ................................. ........ 40

4.27

230V EMERGENCY SWITCHBOARD FAILURE MODES............ 41

4.28

24V SYSTEMS SYSTEMS ............................................................................ ............................................................................ 41

Notes

© This document is the property of Global Maritime Scotland Ltd and is not to be copied, nor shown, to third parties without prior consent

. Global Maritime Scotland Ltd Johnstone House 50-54 Rose Street AB10 1UD Aberdeen Scotland

Registered in London No. 2912969

4.29

24VDC SYSTEMS FAILURE MODES .................... ..................... . 43

4.30

DP UPS ....................................................................................... 44

4.31

DP UPS FAILURE MODES.................. ...................... .................. 44

5.

THRUSTERS ............... ................................ .................................. ....................... ...... 45 5.1

DP CAPABILITY CAPABILITY.......................................................................... .......................................................................... 45

5.2

BOW THRUSTERS THRUSTERS ..................................................................... ..................................................................... 45

5.3

BOW THRUSTERS FAILURE MODES..................... MODES..................... .................. 45

5.4

AZIMUTH THRUSTERS THRUSTERS.............................................................. .............................................................. 47

5.5

AZIMUTH THRUSTERS FAILURE MODES .................. ............... 47

5.6

THRUSTERS EMERGENCY STOPS .......................................... 48

6.

DP CONTROL SYSTEMS ......... .................. ................... .................. ........ 49 6.1

DP21 COMPUTERS ................................................................... COMPUTERS ................................................................... 49

6.2

OPERATOR CONSOLES CONSOLES ........................................................... 50

6.3

DP CONTROL MODES FUNCTIONS FUNCTIONS ......................................... ......................................... 51

6.4

IJS SYSTEM ................................................................................ 52

6.5

MOTION SENSORS .................................................................... SENSORS .................................................................... 52

6.6

MRU FAILURE MODES .............................................................. MODES .............................................................. 52

6.7

GYRO COMPASSES COMPASSES .................................................................. 53

6.8

GYROS FAILURE MODES .......................................................... 53

6.9

WIND SENSORS SENSORS ........................................................................ 53

6.10

WIND SENSORS FAILURE MODES ........................................... 54

6.11

HYDRO ACOUSTIC POSITION REFERENCE (HPR) (HPR)................ ................ 54

6.12

HPR FAILURE MODES ............................................................... 55

6.13

DGPS .......................................................................................... 55 DGPS

6.14

DGPS FAILURE MODES MODES ............................................................ ............................................................ 56

6.15

FAN BEAM BEAM .................................................................................. 56

6.16

FAILURE MODES OF THE FANBEAM ...................... .................. 58

6.17

TAUT WIRE WIRE ................................................................................. ................................................................................. 59

6.18

TAUT WIRE FAILURE MODES ................................................... 60

6.19

POSITION POSITI ON REFEREN REFERENCES CES AN D WEIGHTING WEIGHTING.................. .................. ........ 60

7.

COMMUNICATIONS COMMUNICA TIONS ................. .................................. .......................... ......... 61 7.1

BRIDGE....................................................................................... BRIDGE ....................................................................................... 61

7.2

DP ALERT SYSTEM .................................................................... 61

8.

CONCLUSIONS ................................................... 62 8.1

9.

GENERAL ................................................................................... 62 GENERAL

RECOMMENDATIONS RECOMMENDA TIONS ...................... ............. ................... .................. ........ 63


9.1

“A” RECOMMENDATIONS – ESSENTIAL .................... ............... 63

9.2

“B” RECOMMENDATIONS FOR SERIOUS CONSIDERATION ... 63

9.3

“C” RECOMMENDATIONS- FOR FUTURE CONSIDERATION / GENERAL IMPROVEMENT ........................................................ 63

10.

TABULATED FAILURE MODES .................... .......... ............... ..... 30

Figures & Tables FIGURE 2-1: OSV RELUME PROFILE................... ...................... .................... 3 FIGURE 4-1: FUEL OIL SYSTEM (REF DRAWING NO 320.01) .................... ... 8 TABLE 4-1: FO SYSTEM FAILURE MODES ..................... ..................... ........ 10 FIGURE 4-2: SW COOLING SYSTEM (REF DRAWING 330.01)................... . 12 TABLE 4-2: SW SYSTEM FAILURE MODES ................................................. 13 FIGURE 4-3: FRESH WATER COOLING SYSTEM...................... .................. 14 TABLE 4-3: FW COOLING SYSTEM FAILURE MODES ................................ 15 FIGURE 4-4: ENGINE LO SYSTEM SCHEMATICS SCHEMATICS ................................... .... 16 FIGURE 4-5: COMPRESSED AIR SYSTEM LAYOUT ..................... ............... 18 TABLE 4-4: MAIN ENGINE WECS POWER SUPPLIES .................. ............... 21 TABLE 4-5: MAIN ENGINES FAILURE MODES .................... ..................... .... 22 TABLE 4-6: ALARM & CONTROL SYSTEM I/O UNITS ................... ............... 23 TABLE 4-7: ALARM & CONTROL SYSTEM NETWORK CONFIGURATION.. 24 TABLE 4-8: ALARM & CONTROL SYSTEM FAILURE MODES ..................... 25 FIGURE 4-6: PMS LAYOUT ........................................................................... 30 FIGURE 4-7: ELECTRICAL DISTRIBUTION SYSTEM (REF DRAWING 300144-400_000-GRS-001 300144-400_000-GRS -001 SINGLE LINE) ................... ..................... .... 32 TABLE 4-9: 440V MSB CONSUMERS ........................................................... 35 TABLE 4-10: 440V ESB CONSUMERS .......................................................... 37 TABLE 4-11: 230V MSB CONSUMERS ......................................................... 38 TABLE 4-12: ENSB PS AND SB CONSUMERS ................... ..................... .... 39 TABLE 4-13: 230V NSB CONSUMERS CONSUMERS ..................... ..................... ............... 39 TABLE 4-14: 230V EMERGENCY SWITCHBOARD CONSUMERS ............... 41 TABLE 4-15: 230V ESB FAILURE MODES .................................................... 41 TABLE 4-16: 24VDC DISTRIBUTION POWER SUPPLIES AND DISTRIBUTION PANELS ....................................................................... 42 TABLE 4-17: 24V DC CONSUMERS ..................... ...................... .................. 43 TABLE 4-18: DP UPS CONSUMERS ............................................................. 44 TABLE 5-1: TUNNEL THRUSTER FAILURE MODES .................................... 46


TABLE 5-2: AZIMUTH THRUSTER FAILURE MODES.................... ............... 48 FIGURE 6-1: FANBEAM SCAN SPEED SPEED .................... ..................... ............... 57 FIGURE 6-2 - FANBEAM CONFIGURATION .................... ..................... ........ 57


1.

SUMMARY In 2004, Global Maritime completed an FMEA of the systems directly and indirectly involved with keeping the vessel vessel on a wanted position or track. The work work was carried out from the study of drawings, specifications and meetings at Imtech with Owners and representatives from vendors, Damen Shipyard and Three Quays, the designers. The report was then updated after the annual trials to correct a few errors and add a third DGPS. In September 2012, Global Maritime Scotland Ltd was requested to revise and update the FMEA to incorporate incorporate any changes since last revision in 2006. In November 2012, the FMEA was again revised and updated to include the new Fanbeam unit installed at the request of the charterers. The vessel specification specification is DP class 2 (Lloyds (Lloyds D P AA notation) notation) so that the vessel can carry out offshore work where DP redundancy redundancy is required. The DP activities envisaged are ROV and dive support work, where the necessary equipment is provided by a contractor as a complete package on the after deck. The assumptions made during the study were verified during commissioning and DP Trials held in August and September 2004 and the annual trials carried out between 2006 to 2012. The vessel will be operated with the main switchboard breaker open (split configuration) and at least one diesel generator connected to each switchboard with the other generators in stand-by (depending on the load). The design worst case failure intent (DWCFI) is the t he loss of two t wo diesel generators caused by contamination of one FO service tank or short circuit in a main switchboard section. The effect effect of this is is the loss loss of two of the four thrusters. The FMEA is a living document and, as such, is discussed and reviewed during each annual trial by the Master and ship’s staff, the DP auditor, Kongsberg Kongsberg Maritime, Rolls Royce and any other attending third parties such as the Class Surveyor. Based on compliance with IMCA and IMO guidelines, the vessel meets the requirements for a Class 2 Dynamically Positioned vessel with the main switchboard bus tie open and is fit for carrying out DP operations within her design and operational limitations.

SUMMARY FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 1

2.

INTRODUCTION

2.1

Instructions

2.1.1

Global Maritime was instructed instructed by MENAS to carry out a full revision of the FMEA. The original report covered all the systems involved directly or indirectly with DP and DP operations a n d was completed in in 2004. The report was was updated after the first annual trials in February 2006. This revision was completed in October 2012.

2.1.2

This report was originally produced based on drawings and specifications specifications provided during the vessel construction, it was issued as the final report, verified by the commissioning and DP trials held in August and September 2004 and updated in r eport identifies all reasonably r easonably likely likel y March 2006 and again in October 2012. This report failure modes and their effects. As more information becomes available, it will be incorporated in the next revision of this report so that it serves as a source of information and and DP philosophy for f or key DP personn personnel el workin working g on the ves sel .

INTRODUCTION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 2

2.2

Vessel Particulars

Figure 2-1: OSV Relume Profile

2.2.1

The following are the general particulars of the vessel: The hull, machinery and electrical installations were built and installed under special survey in accordance with the Rules and Regulations of Lloyd’s Register of Shipping for notation: +100A1, +LMC, UMS, DP (AA), IBS - LIGHT TENDER/ OCCASIONAL OIL RECOVERY DUTIES The Vessel is registered in the Bahamas, port of registry Nassau and is designed to comply with the requirements of the U.K. Maritime & Coastguard Agency (MCA), the Flag Authority, for a Class VII vessel.


| 3

Length Overall Length Load Water W ater Line Length between Perpendiculars Breadth Moulded Depth Moulded to Main Deck Depth Moulded to Lower Deck Depth Moulded to Forecastle Deck Design Draft Moulded Draft Scantling Moulded

82.6 metre 78.2 metre 73.6 metre 16.5 metres 6.8 metres 4.0 metres 12.4 metres 4.0 metres 4.5 metres

2.3

Definition of DP Class 2

2.3.1

The following documents have been use as a reference in the construction constructio n of this report:• •

• • • •

• •

2.3.2

The basic requirements for LR Class notation DP (AA) are as follows: •

•

•

•

•

•

2.3.3

IMO MSC 645 Guidelines for vessels with dynamic positioning positioni ng IMCA M04/04 Methods of establishing the Safety and Reliability of Dynamic Positioning Systems IMCA M178 FMEA Management Guide IMCA M166 Guidance on Failure Modes Modes and Effects Analysis IMCA M103 The Design and Operation of DP Vessels IMCA M04/04 - Annex Methods of Establishing the Safety & Reliability Reliabilit y of DP Systems IMCA M154 Power Management System Study LR Class notation DP(AA) Rules

All systems necessary for the correct functioning of the t he DP system are to be configured such that a fault in any active component or system will not result in a loss of position. Passive components such as cables and pipes are to be located and protected such that the risk of fire or mechanical damage is minimized. No single fault in the generation and distribution systems is to result in the loss of more than 50 per cent of the generating capacity. Two independent automatic control systems are to be provided and arranged such that no single fault will cause loss of both systems, a fault in one causing automatic bumpless transfer to the backup system. At least three position reference systems incorporating at least two different measurement techniques are to be provided and are to be arranged so that a failure in one system will not render the other systems inoperative. At least three gyrocompasses and two vertical reference units, if necessary, are to be provided.

I.M.O 645 Section 3.2.3:


| 4

For equipment class 2, the power system should be divisible into two or more systems such that in the event of a failure of one system at least one other system will remain in operation. The power system may be run as one system during operation, but should be arranged by bus-tie breakers to separate automatically upon failures which could be transferred from one system to another, including overloading and short-circuits.

2.3.4

I.M.O 645 Section 3.2.3: For equipment class 2, a loss of position is not to occur in the event of a single fault in any active component or system. A single failure criterion includes any active component or system (generators, thrusters, switchboards, remote controlled valve etc.)


| 5

3.

REDUNDANCY CONCEPT OVERVIEW

3.1.1

The power system consists of four diesel generator sets, two 100 1000kW 0kW and two 130 1300k 0kW, W, and one main 690 690V V 60Hz switchboard split sp lit by a single s ingle bus-tie breaker. The Th e main switchboard will be operated in split mode for DP2 operations.

3.1.2

The 440V switchboards, 230V switchboards and emergency switchboards are to be operated in “split mode”, powered from their respective sides port and starboard for DP2 operations.

3.1.3

The thrusters are powered from each switchboard so that the port azimuth thruster and the forward bow thruster are powered from the port main switchboard section and the starboard azimuth thruster and the aft bow thruster are powered from the starboard main switchboard s witchboard section. This T his arrangement provides the best all round round DP capability after the loss of one switchboard section and hence two thrusters.

3.1.4

For this power generation system operating in DP Class 2 the design worst-case failures is not to exceed: •

Two diesel engines

•

One high voltage switchboard section

•

Two thrusters

3.1.5

The FO system consists of two independent systems (port and starboard) with each system supplying fuel to two diesel generator engines. There are crossover lines fitted with isolation valves. These valves should be kept closed for DP2 operations so the two FO systems are independent from each other.

3.1.6

The SW system is a common system in terms of piping. However failure of pipes is not considered for DP2 vessels. Two SW pumps are installed so failure of one pump will cause the standby pump to autostart.

3.1.7

The FW system is also a common system in term of the pipe arrangement. However failure of pipes is not considered for DP2 vessels. Two FW pumps are installed so failure of one pump will cause the standby pump to autostart.

3.1.8

The starting start ing air system is also common with redundant active components and compressors. compr essors. There are two receivers. For loss of start starting ing air to be critical there has to be two failures namely, a loss of one or more diesel engines and a loss of starting air so that they cannot be restarted or another brought on line.

3.1.9

The vessel is fitted fitt ed with an “Alarm, Monitoring Monitor ing and Control System”. This system covers the requirements for an unmanned engine room, the remote monitoring starting and stopping of equipment, the audible and visual alarms and the power management. The whole system is integrated with data being transmitted over a redundant Ethernet network with two independent LAN connections. The operation of this redundant network is such that either the Main or Backup network can take control in case of any one failing.

3.1.10

Each diesel engine has has an individual PMS module (PS 3500), which is is linked by a dual redundant CAN-bus so that the loss of one link will cause an alarm but no loss of power management function.

REDUNDANCY CONCEPT OVERVIEW FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 6

3.1.11 3.1. 11

The DP control system is a Kongsberg duplex system with redundancy of all components. The DP has three DGPSs, one HiPaP, one Fanbeam (temporary reference) and one Taut Wire as position reference systems for the station keeping of the vessel, and two wind sensors, two MRUs and three gyro compasses as environmental sensors.

REDUNDANCY CONCEPT OVERVIEW FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 7

4.

POWER GENERATION

4.1

Fuel Oil System NC NC

Daily Service Tank 1

Daily Service Tank 2

NC NC

Fuel Settling Tank 1

Fuel Settling Tank 2

F#

F#

F#

F#

Fro! Fuel Trans P" Fro! #eak Oil Tank

To Fuel Trans P" FO Purifiers

F( Diesel Generator 1

F(

F#

F#

F(

F(

F#

F#

Diesel Generator 3

$e!ote o"erate% &C 'alve

Diesel Generator 2

F( FO Cooler

F#

Diesel Generator 4

Flo) *eter

FO Booster PPs

Figure 4-1: Fuel Oil System ( Ref drawing No 320.01)

POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 8

4.1.1

There are two service service fuel oil tanks (fitted with low level alarms); each tank supplies two of the four diesel engines via a single remote operated quick closing valve for each engine. So provided each tank is is available, DP class 2 can be achieved such that the worst-case failure failure can only cause the loss of two diesel generators. generator s. The effect of this failure is the loss of one switchboard and a nd two of the four thrusters. This is the design worst- case failure failure and DP capability capability for work like dive support is based on this.

4.1.2

The quick closing valves (QCV) are supplied to shut off the fuel flow in case of emergency. They are operated by hydraulic oil; each valve is fitted with an oil tank which is refilled by hand. There is a QCV activation lever for each tank so that in the event of accidental activation, only one FO tank will be affected and will not exceed the DWCF. The QCVs activating levers are not protected against accidental activation so it would be recommended that a protection device is put in place. Operation of the controls for quick-closing valves is from the Emergency Headquarters.

4.1.3

Operation of the quick closing valves has to be intentional i.e. failure of valve seals etc. will not cause the valves to close. Loss of oil will prevent the QCV from operating when required to do so.

4.1.4

Crossover lines are fitted between the two service tanks in the FO supply lines and FO return lines and fitted with normall y closed (NC) isolation valves. These valves are manually operated and should be kept closed fo r DP2 operations. This should be included in the Engine Room DP Check List.

4.1.5

The FO passes through a duplex filter alarmed for high differential pressure and a bypassable booster pump for each engine before entering the engine. Failure of the filter or the pump will only affect one engine. Power supply to the booster pumps are as follows: •

FO booster pump No. 1

MSB 440V PS GSP1 (Back up from ESB)

•


MSB 440V SB GSP2

•


MSB 440V PS GSP1

•


MSB 440V SB GSP2 (Back up from ESB)

4.1.6 4.1. 6

The FO return lines from each engine returns to the same service tank from where it was originally taken through a FO cooler, one for each engine. The FO is cooled by the FW system. The FO cooler is a shell and tube type cooler heat exchanger and contamination of the fuel by water is possible.

4.2

FO System Failure Modes

4.2.1

The design separation is not necessarily necessaril y adequate to ensure that a failure failur e with a greater effect than the design worst case is impossib i mpossible. le. Experience shows that it is always possible to blackout:


| 9

Failure Mode

Cause(s)

Effects

Mitigation

F.O. Starvation (two DG’s)

QCV operate Filter blocked Pumps fail Leakage Water in fuel Microbiological contamination

Unable to deliver demanded power

Other thruster compensates

Unable to deliver demanded power

Other thruster compensates

F.O. Contamination

Table 4-1: FO System Failure Modes

4.2.2

In the above circumstances, circumst ances, the power management system and DP control system system will not know the reason for the loss in power. power . If there there is under-voltage and underfrequency, the power will be cut back by the azimuth thruster frequency converter and there will be an increase in thrust and power on the healthy side of the switchboard. Thus, blackout and loss of position should shou ld be avoided. avoided. However, in the worst case there would be blackout on one side followed by a sudden step change in demand on the healthy side of the main switchboard. Provided the engines can deliver the power, negligible position excursion excursio n should occur. However if, if, after many hour hours s of running at low load, they are unable to deliver power as as expected, position will be lost. If the contamination is common to both fuel oil systems then blackout is possible even if the azimuth thruster’s power is reduced significantly significantly very very quickly. The loss of power and thrust in this way is not considered a single point failure provided planned maintenance makes sure fuel oil contamination etc. is very very unlikely and a nd the engines are tested regularly so that the chance of them not being able to deliver on demand is very small. In these circumstances blackout would have more than a single point cause.

4.2.3

Fuel contamination contaminati on can cause serious problems on a vessel. The detrimental effects of microbiological contamination of the fuel oil can be eliminated by removal of water in the fuel, testing the fuel for microbe contamination and treating the fuel with biocides if microbes are present. However, it is unlikely that microbe contamination will cause a sudden failure; its effects will generally be cumulative. Contamination will be detected by the decreased fuel filter cleaning interval indicating the build-up of microbes in the fuel system.

4.2.4

Water contamination in the fuel will result in erratic running with possible loss of engines. Fuel contamination will cause filter clogging and loss of generators. If the source of contamination is a service tank, both diesel generator engines might be affected at the same time. Prudent fuel treatment and fuel testing on new bunkers greatly reduces the risk of contamination. A regular fuel testing programme at bunkering using LR FOBAS is in place.

4.2.5

In order to mitigate the risk from fuel contamination, the fuel supply to the engines should remain split in the port and starboard configuration so that the worst case scenario, contamination of a service tank would result in the loss of two diesel generator engines.


| 10

4.2.6

Correct fuel management techniques, including correct operation of the fuel oil purifiers, purifier s, and regular draining of accumulated water from the fuel settling and service tanks, is essential to prevent water contamination affecting the operation of the diesel generator engines. In this vessel, procedures are in place for checking contamination of the FO service tanks.

4.2.7

Fuel flow meters are are installed. Care should be exercised exercised so that they cannot fail and cause fuel oil starvation from line blockage. blockage. In the event of fuel oil filter filter high differential the pressure in the fuel suction main will drop below alarm level. This will result in the fuel boost pump starting automatically to increase the fuel pressure. However if the problem is a blocked filter, the improvement provided by the boost pump will be short-lived.

4.2.8

Should fuel oil starvation take place, operators can quickly change filters or take other appropriate action, action, but care must be taken to prevent prevent diesel diesel engines tripping on overspeed because be cause the demand is at maximum (fuel rack is fully open). Care must also be taken to vent air out of the fuel oil system as this can cause unexpected tripping just tripping just after the situation has been ‘saved’.

4.2.9

Small pipe leakages should have little effect on the engine but greatly increases the risk of fire. Larger leaks, though of low probability, could result in loss of fuel to the engines, with the subsequent loss of the power generation and propulsion and ultimately loss of position. A leakage in a FO service tank will be alarmed by the service tank low level alarm. The failure of fuel lines is not normally considered in the FMEA; however the reliability of pipes and protection from damage should be well documented. A leakage in a FO pipe will be alarmed by a FO low pressure alarm. One of the most common causes of fire in engine rooms is a fine spray of fuel or oil that reaches hot surfaces such as exhaust gas or steam pipes; instrument lines and fittings becoming loose or breaking with vibrations can create this situation. This risk is reduced by proper insulation, screening, double piping, anti-spray tape and spray shields. This does not eliminate the problem but it helps to reduce it. Many safeguards are incorporated into modern engines such as those installed on OSV ‘Relume’.


| 11

4.3

Sea Water Cooling

Figure 4-2: SW Cooling System (Ref drawing 330.01)

4.3.1

One high sea-chest (port) and one low sea-chest (starboard) fitted with strainers supply water to a sea water main. Two sea water pumps take their suction from this main. The outlet from both pumps joins together in a common line before the SW enters to two plate central coolers (one online and one on standby). From the central coolers the SW is discharged overboard through a common line. Pipe segregation is not required for DP2 vessels (DP AA).

4.3.2

The vessel will normally operate with with one pump on line and one pump on autostandby. This has been confirmed by tests but relies on the stand by pump being available and not being unavailable due to a hidden failure. The standby pump function is is tested tested frequently frequently and pumps changed over on a regular basis. Seawater is only used for cooling the fresh water systems and provided it is reliable, this is acceptable for DP2.


| 12

4.3.3

Power supplies to the SW circulating pumps are as follows: •

SW circulating circulati ng pump No. 1

MSB 440V PS GSP1

•

SW circulating circulati ng pump No. 2

MSB 440V SB GSP2

4.4

SW Cooling System Failure Modes

4.4.1

The failure failur e modes that need to be considered are as follows: Failure Mode

Inadequate Flow

Cause(s) Pump failure Air in system Poor maintenance Leakage (Burst Plate Cooler) Blocked intake

Effects High FW Temperature

Mitigation Standby Pump Can isolate leak

Low Flow

Can use other suction

Table 4-2: SW System Failure Modes

4.4.2

There is a body of opinion that believes that plate coolers should be considered as active components so there is a requirement requirem ent to make sure they are kept reliable. If the system is reliable then there are only two failure modes that are potentially critical and could cause high temperature shut down of all the diesel engines and hence a loss of position. The first of these is failure of the duty pump when the standby is not available. available. This could happen if only one of the two pumps is on line and the stand-by fails to start. This can be avoided for critical DP work. The second is a build-up of air in the system such that an air lock occurs; however, on this vessel the sea suctions are vented to deck in order to prevent air locks in the system.

4.4.3

The sea water system system flow is determined determ ined by the pumps and the valve setting which is manual. It is anticipated anticipated that full flow will be the the norm and no active control will be used; temperat temperature ure control control is on the the fresh wate waterr side. If the the seaw a t e r inlet inlet becomes blocked (marine growth plus plastic bag for example) operators should have low-pressure low-pressure alarms and LT temperature alarms before FW high temperature so that the other sea suction can be used. During Dur ing sea trials, tri als, it was confirmed that under normal normal DP operational conditions condit ions the engines were able to operate for a considerable time before the engine HT temperature reaches the shutdown setting of 110C. Prior to shutdown, the LT temperature alarm, set at 45C, will activate, providing the watch keepers with adequate time to take preventive measures.

4.5

Fresh Water Cooling System Ref Dwg 330.02 Fresh Water Cooling System

4.5.1

The fresh water system is also common but there is an expansion tank and a buffer tank so that there will be two alarms if there is leakage in the system that might


| 13

threaten blackout from loss of cooling cooling to all diesel generators. generator s. The system system has two plate coolers and two 100% circulation pumps so the design philosophy is for one to be on line and one to be on auto-standby. This common common cooling system system supplies the the thruster coolers, the converter cooling sy s ystem, fuel oil coolers coolers and start start air compressor compressor cooling. 4.5.2

The bow thruster and azimuth thruster motors and azimuth thruster oil coolers are FW cooled but the converter coolers (fan/coil units) are part of the closed system for each converter. The FW system is the cooling medium used in their dedicated plate coolers.

Figure 4-3: Fresh Water Cooling System

4.5.3

The expansion expansio n tank is 1100-L 1100- L capacity and the buffer tank is 900-L capacity. The operator will know there is a significant leak (Red Alert) if both alarms take place in quick succession.

4.5.4

The fresh water temperature temperatu re control has two sets of of control loops, loops, one one for each diesel engine between HT and LT circuits and one for each plate heat exchanger. The HT circuit cools the cylinders and cylinder heads. The LT circuit consists of a charge air cooler and a lub oil cooler through which a pump circulates the water. The temperature


| 14

control valves are Amot (wax element) and once set up they should operate adequately. If there is a control problem, manual adjustment of the plate cooler thermostatic valves is possible. 4.5.5

Power supplies to the FW circulating pumps are as follo ws: •

FW circulating circulati ng pump No. 1

MSB 440V PS GSP1

•

FW circulating circulati ng pump No. 2

MSB 440V SB GSP2

4.6

FW Cooling System Failure Modes

4.6.1

Failure of one pump could be critical if the standby pump failed to start (hidden failure); however this risk is mitigated, in part, by regular testing and changeover of the running and standby pumps.

4.6.2

If leakage occurs, the header tank low-level alarms will activate before before any loss of pump pressure. During trials, with FW cooling system shutdown, shutdown, the thruster t hruster converters are o designed to alarm at 55 C and shutdown after 20 mins.

Failure Mode

Cause(s)

Effects

Inadequate Cooling

Temperature control valve fault Leakage from cooler Air in system

Alarms High D.G Temperatures Risk of blackout

Mitigation Early warning Isolation possible Temperature rise not instant Standby pump

Table 4-3: FW Cooling System Failure Modes

4.6. 4.6.3 3

The The syste system m is we wellll des designed igned and reli reliab ablle. The The risk risk of leakag eakage, e, i . e . f l e x i b l e p i p e , r u b b e r c o u p l i n g s , b e i n g e x c e s s i v e s o that isolation is not possible in good time is small. However leakage is not considered as a failure for DP2 vessels. The two pumps are powered from the split 440V switchboard. switchboard. If the stand-by is is unavailable then the vessel cannot be considered as working in the safest (Class 2) mode. The most likely likel y cause of the loss of cooling water is the failure of a flexible coupling at one of the four diesel generators. This can occur due to excessive engine vibration. Operators must pay close attention to these couplings and inspect them as a matter of routine maintenance.

4.6.4

More common failures of the FW cooling system are related to malfunction of one of the thermostatic valves which then fails to regulate the FW temperature and causes the shutdown of the engine for high temperature if the operator does not take action early enough. These are Amot Amot valves as mentioned above, normally with several elements per engine. These elements usually fail one at a time so the watchkeeper should be able to notice a failure of one of the elements and take remedial action. Failure of the wax element 3-way temperature control valve will cause temperature variations but should not cause an immediate shutdown of the engine.


| 15

4.7

L.O. System

Figure 4-4: Engine LO System Schematics

4.7.1

The engines are ‘wet sump’ i.e. the system oil is stored in an integral sump pan.

4.7.2

There is no common lube oil system for the diesel generator generators, s, each each is independent with a motor driven pre-lube oil system and an engine driven circulation once the diesel generation is i s running. The lube oil to any one generator can be changed or filtered separately by using dedicated pumps, so the failure modes are reasonably limited to one engine.

4.7.3

The engine driven pump sucks oil from the engine oil sump and forces it t hrough the lubricating oil cooler equipped with an Amot thermostatic valve regulating the oil temperature, through the lubricating oil main filter to the main distribution channel in the engine block, and via side screw bores to t he main bearings. The oil cooler, thermostatic valve and the main filter are mounted on the engine. Part of the t he oil flows through the bores in the crankshaft to the big end bearings and further through th e connecting rod to the gudgeon pins, pi ston skirt lubricating and piston cooling spaces. Oil is led through separate pip es to other lubricating points, like camshaft bearing s and valve mechanism gear wheel bearings, and to oil nozzles for lubricating and cooling. The pressure in the distributing pi pe is regulated by a pressure control valve on the pump.


| 16

4.7.4

When the DG starts and the LO pressure reaches 2 bar, the pre-lub pump stops. If the pressure drops below 2 bar the pre-lub pump starts. If an engine stops and the pre-lub pump fails to start, the engi ne can be started again within t hree minutes.

4.7.5

Power supplies to the electric pre-lub pumps are as f ollows: •

Pre-lub pump No.1

MSB 440V PS GSP1 (Back up from ESB)

•

Pre-lub pump No.2

MSB 440V SB GSP2

•

Pre-lub pump No.3

MSB 440V PS GSP1

•

Pre-lub pump No.4

MSB 440V SB GSP2 (Back up from ESB)

4.8

LO Cooling System Failure Modes

4.8.1 4.8. 1

Any failure failur e in the LO system will affect one engine only. The failure failure modes that that can contribute to an effect greater than the loss of one diesel generator engine are generally concerned with a standby machine not starting and coming on line when neede needed d be becau cause se of a llube ube oil lowlow- p r e s s u r e sens sensor or faul faultt or the the pre-lu pre-lube be logic being faulty. These failure modes were tested during trials. trials. The pre-lube oil machines. The diesel generator engines pumps should be running on all standby machines. have a “blackout start” facility whereby they are allowed to within 5mins of blackout providing the LO priming pump was running prior to the blackout.

4.8.2

Pre-lube pump starts when DG engine stops, and stops when DG engine starts. Failure of the pre-lubricating pump will give a start block signal. A generator will not start if the pre-lub pump has not run in the previous 4 minutes.

4.8.3

Low LO pressure will raise an alarm. Lo w-low LO pressure will raise an alarm and the engine will shut down.

4.8.4

The LO alarm system for alternator bearings is critical. critical . The bearings are fitted with temperature sensors which provide an alarm at 110ºC and shutdown of the engine at 120ºC.

4.8.5

Lube oil contamination contamination microbiological or by fuel, oil is possible but this is unlikely to affect more than one diesel engine at any one time.

4.8.6

Failure of the wax element 3-way temperature temperat ure control valve will cause temperature variations but should not cause an immediate shutdown of the engine.

4.9

Compressed Air

4.9.1

The starting start ing air system is also common with redundant active components and compressors. compr essors. There are two t wo Main Air Receivers and one Control Air Receicver.

4.9.2

In addition to the start air compressors, compressors , there is a Control/Working Control/W orking air Compressor and an Intering Stabiliser Compressor. The working air compressor has a capacity of 66m3/hr. at 12bar. This compressor is fitted with an 800l receiver and filter/drier unit. Air from this system is used to supply the azimuth thruster header tanks and the taut wire unit. The intering stabiliser compressor has a capacity of 44m3/hr @ 12.3 bar and


| 17

a 500l integrated receiver. This compressor can be connected to the service air system if required.

Figure 4-5: Compressed Air System Layout

4.9.3

Each azimuth thruster has a pressurised hea header der tank tank a s there there is inadequate height at the stern above the thruster to accommodate the required head of oil. The tank is pressurised by service air that is reduced from 8 bar to 1.5 bar. The air is supplied to the header tanks via non-return valves and therefore loss of air will have no immediate effect. A back-up air supply is available from either the start air system or the secondary service air compressor with integral 250l receiver. The azimuth header tanks and the service air system are alarmed for low air pressure; hence, the hence, the operator will be informed infor med should should loss of air pressur pressure e occur. occur. A safety valve is fitted fi tted to the thruster air supply to prevent over-pressure. The pneumatic system is not supplied by Rolls Royce. Royce. Con Control trol air is also used for the thruster thruster i n p u t s h a f t brake brake bu butt this this is is only used when thruster maintenance is in progress and the thruster is not available.

4.9.4

Power supply to the air compressors is as follows:


| 18

•

Starting Air Compressor No. 1

MSB 440V PS GSP1

•

Starting Air Compressor No. 2

MSB 440V SB GSP2

•

Control Air Compressor

440V MSB PS

Intering Air compressor

•

PDP2 (440V MSB PS)

4.10

Compressed Air System Failure Modes

4.10.1

For loss loss of of starting starting air to be critical there has to be two failures namely, a loss of one or more diesel engines and a loss of starting air so that they cannot be restarted or another brought on line.

4.10.2

Failure of one starting air compressor will not affect the air supply as the second compressor will still be able to supply sufficient compressed compress ed air. If one of the two air receivers is kept filled and isolated, there will always be a full supply of air to start a main engine.

4.10.3

Loss of starting air will not have an effect effect on the running main engines.

4.10.4

Failure of the control air compressor will not affect the service air supply as there is a crossover from the start air system ensuring sufficient compressed air supply is maintained.

4.10.5

Loss of service air to the azimuth azimuth thruster header tank would result in an alarm but would have no immediate effect on the thrusters and hence DP.

4.11

Ventilation

4.11.1

The engine room has four fans, one supply/exhaust supply/exhaus t fan and one supply fan in the starboard side and supply/exhaust fan and one supply fan in the port side.

4.11.2

The bow thruster room has two ventilation fans, one supply and one exhaust fan.

4.11.3

The aft thruster room has one supply/exhaust fan and one supply fan.

4.11.4

The engine control room is supplied with its own separate AC unit which is fitted with two fans.

4.11.5

The bridge is equipped with an AC unit which has two fans. This also supplies the void space where some electrical and navigational DP equipment is located.

4.11.6

The alternators and and the diesel generator engines are FW cooled and the convertor drives are ventilated with water cooled fan assisted air cooling units.

4.11.7

Power supplies to the ventilation fans and AC units are specified in the ‘Power Distribution’ section. (See sections 4.20, 4.21)


| 19

4.12

Ventilation Ventilatio n failure Modes

4.12.1

In the event of failure of one ER fan, the speed of the remaining remaini ng fans is increased to to high speed, which has been proven to provide provide ample air for the engines. Failure of one side of the 440V board will also fail half the ventilation to the engine room, the azimuth thruster room and the bow thruster rooms. If the engines engines are still still running then a temperature rise may occur but the rise will be slow and there will be enough time to cease the work and reach a safe situation.

4.12.2 4.12 .2

Failure of an engine room ventilati ventilation on fan also causes the fire damper to close. Failure of a ventilation fan is alarmed to the operator.

4.12.3

The air conditioning systems critical to DP function, are located on the bridge bridge and ECR. The air-handling units for these systems are cooled by the three chiller plants located in the ER. Any one of the three chiller plants can be used for f or the bridge or ECR AC systems. Both Both units are fitted with spare fan motors and if the control system fails, manual operation of the control valves is possible. Disintegration of the fan would be a problem until it was replaced. To keep working a portable fan could be employed otherwise the work could be terminated until the repairs were made. There should always be time to safely terminate the work. A particular part icular failure mode that has been experienced in the past on some vessels is loss of AC followed by condensation condensation on cold surfaces of the DP control system, resulting in failure. Failure of the AC is alarmed and the motors for the system are supplied from both switchboards.

4.13

Diesel Generator Engines

4.13.1

The vessel has four diesel generator sets, two to port, one behind the other, and similarly arrang arranged ed to starboa starboard. rd. They are simila similarr Wärtsilä Wärtsilä engines engines ( 8 L 2 0 C 2 two similarly and 6L2 0C2 wi th tu rb oc ha rg er typ e) but of of each pair, one is a six cylin c ylinder, der, 1000kW uni t and the other is an eight eight cylinder 1300kW unit. The engine room is one space from a fire and flood perspective but there is a longitudinal acoustic bulkhead which provides acoustic separatio separation. n. There is one Caterpillar Emergency Emer gency Diesel generator set of 145kW.

4.13.2

For the vessel’s AA (DP2) notation the main switchboard will be split with one or two diesel generators generators on line line each side. side. The limits of operatin o perating g with just one diesel engine each side depends on which pair of engines is on line and the environmental conditions at the time but with a 1 + 1 arrangement the second DG should be on line as soon as the load reaches 50%, otherwise there will be a loss of position from the failure of one o ne DG.

4.13.3

The engines will shut down in the following events: •

LO pressure shutdown (below 2 bar)

•

High temperature shutdown (110º)

•

Main bearing shutdown (120º)

•

Overspeed shutdown (15% more than 900rpm)


| 20

4.13.4

The engines are fitted with LT and HT FW engine driven pumps, FO engine driven pumps and LO engine driven pump. They are not fitted with Oil Mist Detectors (OMD). The engine HP fuel pipes are dou ble skin pipes and protection covers are fitted to engine exhausts and fuel equipment to minimise the risk of fuel impingement on exposed hot surfaces.

4.13.5

There are two 1300kW/690V alternators type NIR 5670 A-8LW type and two 1000kW/690V alternators type NIR NIR 5656 A-8LW The alternators run at 900RPM and rated at 1625 kVA/1250kVA at 0.8 power factor, 3-phase, 690V, 60Hz. For cooling, the alternators have an air/FW cooling assembly that consist of recirculating air cooling channels within the alt ernator frame and the air/water exchanger.

4.13.6

The governors are Woodward Woodwar d 723 digital controller with hydraulic UG actuators with self-contained oil sump. The 723 controller is interfaced to the PMS for remote and automatic control. The actuator hydraulically converts the 4-20mA (0- 100% speed) input from the 723 governor into mechanical power to control the fuel rack. Speed feedback is input to the 723 governor by two magnetic pick up sensors installed by the flywheel. The Woodward 723 digital controller for the generator is supplied by local transformer rectifier units from the diesel generator, once it is running, via a 690/230V transformer.

4.13.7

Each engine engine is provided with a WECS (Wärtsilä Engine Control System) panel. The WECS system functions are: speed measuring system safety system display including all measuring instruments serial communication communicati on with the engine Data communication with external systems • • • • •

4.13.8

Power supply to the WECS is as follows:

Equipment

Main supply

Back up supply

WECS DG No. 1 PS Fwd.

DP 24V

MSB2 24V

WECS DG No. 2 SB Fwd.

MSB2 24V

DP 24V

WECS DG No. 3 PS Aft

DP 24V

MSB2 24V

WECS DG No. 4 SB Aft

MSB2 24V

DP 24V

Table 4-4: Main Engine WECS Power Supplies

4.14

Diesel Generator Engines Failure Modes

4.14.1

For the vessel’s AA (DP2) notation the main switchboard will be split with one or two diesel generators generators on line each side. side. In these circumstances, the worst- c a s e failure will be blackout on one side, port or starboard. However, However, there are several several failure modes that can cause the loss of one or two diesel engines. The fuel oil and


| 21

cooling water failures have already been discussed. The additional failure modes are as follows for cases where two diesel generators are on line each side: Failure Mode Excessive Excess ive vibration

Cause(s) Mechanical damage

Overspeed

Control fault

Instability

Control fault

Effects Reverse power trips Low F.O. pressure Low LO trip. High temp. trip One D.G. trips Other on reverse power Operator trips faulty machine (risk of stopping healthy healthy one by mistake)

Mitigation Other engines

Other engines Other engines

Table 4-5: Main Engines Failure Modes

4.14.2

The risk of mechanical damage is small. If an engine is not performing performi ng well this should be evident and the operator should initiate starting of the other engine (if not on line) and shut down prior to the engine engine tripping. This action should cause an amber alert and cause divers to return to a safe position if the vessel is engaged in diving support work.

4.14.3

For this vessel, mechanical mechanical damage to one one engine engine is unlikely to physically physically damage another but instability or overspeed of one could cause both to fail and the vessel to rely on the other engine(s) on o n the other side of the vessel. vessel. When Whe n the control of one engine causes instability, it is equally difficult for the t he operator, as the instrumentation and protection, do not identify which is the faulty machine and which machine is following. There have been instances where the operator has tripped the healthy engine and then the unhealthy engine also trips.

4.14.4

Failure of power supply to the Woodward governors will cause the engine to stop. Failure of one speed sensor will give a governor minor alarm and the en gine will still function with the other sensor. Failure of both should initiate a shutdown, the e ngine will trip and a standby generator will start and connect. The chance of both fail ing to give a similar incorrect non-zero reading is considered neglig ible.

4.14.5

Failure of the AVR may fail the excitation and/or cause the diesel generator to be

unstable and trip.

4.15

Power Management System

4.15.1

The vessel is fitted with an “Alarm, Monitoring Monitor ing and Control System”. This system covers the requirements for an unmanned engine room, the remote monitoring starting and stopping of equipment, the audible and visual alarms and the power management.

4.15.2

The whole whole system is integrated with data being transmitted over a redundant Ethernet network with two independent LAN connections. The main server is located in the engine control room and the back-up server on the bridge.


| 22

4.15.3

Each engine PMS unit has a direct supply from UPS port or starboard. The supplies are diode protected. A second supply is provided from the g enerator, via a transformer/rectifier, once the machine is on line.

4.15.4

There are Server and Client computers located in the ECR and on the bridge, under normal conditions the ECR Server is in control, in the event of it failing, control is taken by the Bridge Server. Access to the system from the ECR will then be via the client computer. Both servers are supplied from the Praxis UPS. The ECR client is supplied from NLDP4 and the bridge client from NLDP1. All workstations are also protected by a local dedicated UPS.

4.15.5

The system has 11 intelligent I/O cabinets: each has a 24V-dc power supply. The units and their function are shown the following table.

ID

DPU1

DPU2

DPU3

DPU4 DPU5 (XS316 XS317) DPU5 XS318 DPU7 DPU8

UNIT FUNCTIONS DG1, DG3, BT1, PS PM PS Tanks, Auxiliaries & SWBD DG2, DG4, BT2, SB PM SB Tanks, Auxiliaries & SWBD Thruster Control PS PM, Drive & Azimuth PS Tanks & Auxiliaries SB PM, Drive & Azimuth SB Tanks & Auxiliaries BT Alarms, ESB Monitoring & Auxiliaries BT2 Starting, Bridge Alarms SB PM Indication PS Pumps SB Pumps

LOCATION Engine Room PS Tween Deck Fr 71

Engine Room SB Tween Deck Fr 71

Carpenters Workshop Hold PS Tween Deck Fr 62

Bridge FWD Console PS Bridge FWD Console PS Group Starter Panel No. 1 Group Starter Panel No. 2

POWER

MODULES

PRAXIS UPS cct F11

13

PRAXIS UPS cct F12

10

PRAXIS UPS cct F13

10

PRAXIS UPS cct F14

7

PRAXIS UPS cct F23

6

MSB1 24V cct Q23

2

PRAXIS UPS cct F21 PRAXIS UPS cct F22

3 3

Table 4-6: Alarm & Control System I/O Units


| 23

4.15.6

All Server and Client Workstations Workstat ions are inter-connected via a redundant high-speed high-speed network and uses two coaxial cables, one for main link and one for back-up link.

4.15.7

The operation of this redundant network is such that either the Main or Backup network can take control in case of any the other failing. LAN network arrangements can be referred to in drawing 394-440-100-LDS-001 sheet 101 Rev 1.

4.15.8

The system has four dual dual field bus networks (CAN-bus). Number four is for watch keeping, (unmanned engine room) ro om) alarm alarm monitoring and calling. This does not concern operations in DP2 on the basis that the engine control room will be manned during operations. operat ions. The other three are configured as follows:

4.15.9

This shows that the port diesel engines and port thruster drive are contro controlled lled and monitored by No. 1 dual network while the others are on o n No. 2 dual network. The remainder remai nder are on field bus No. 3. Thus, port and starboard separation separ ation is achieved.

4.15.10 Each diesel engine has an individual PMS module (PS ( PS 3500), which is linked by a dual redundant CAN-bus so that the loss of one link will only cause an alarm but no power management malfunction. malfunction. If both are lost lost from one module, however however the t he PMS PMS can act to control contro l the machine independently independentl y of the others. The serial data bus is is used for load sharing and data transfer to the AMCS (Alarm, Monitoring and Control System). All four diesel diesel engines will run in droop mode but be adjusted by the PMS system to achieve load sharing. Each PMS module has a 60 Hz Hz reference and it is this that is used for load sharing. sharing. Each PMS module is powered by different internal feeders in the 690V main switchboard. switchboard. They are galvanically galvanically isolated by converters capable of withstanding spikes and interference from the main power cables and bus bars. FIELD BUS 1 2 1 2 3 3 3 3

DPUs 1 2 3 4 5 7 8 11-14

DATA DG’s 1 & 3 Port DGs 2 & 4 Starboard Thruster Drive Port Thruster Drive Starboard Wheelhouse Group Starter Panel 1 Group Starter Panel 2 HVAC

Table 4-7: Alarm & Control System Network Configuration

Note: DPU 6, 9 and 10 do not exist, these numbers are reserved for future developments . 4.15.11 When the main bus tiebreaker is open the port PMS modules and starboard PMS modules are made independent of each other by opening the hard-wired contact from the bus-tie breaker to each PMS module. In this this state, there is no communication between the two sides. 4.15.12 In general the PMS has two operating modes: •

OFF: in this case the PMS module (1 per generator) involved will be down.


| 24

•

•

MANUAL: in this case the operator gives commands for START/STOP, START/STOP, switching ON/OFF and RAISE/LOWER in order to synchronise and regulate load; commands can only be given on the switchboard PMS panel involved. AUTO: in this case the operator operator can gives commands for START/STOP the diesel generator set or tie breaker on/off, afterwards the automation starts, synchronise and switched on, shares the load over the remaining generators in parallel. Furthermore the PMS starts and stops diesel generator sets depending on load of generators. In Automatic mode the operator commands can be given on the switchboard switchboard (local) or via AMSC (Mimic). ( Mimic). General functions like synchro check, protection functions, (remote) signalling functions, etc. are available in both modes. Transitions between MANUAL or AUTO modes should not result in starting/stopping or switching ON/OFF without operator command.

4.15.13 On the diesel engine engine there is a LOCAL/REMOTE possibility possibilit y and START and STOP facilities. If switched to local, the PMS is forced to “MANUAL” mode and only control from diesel engine is possible. If switched to remote at diesel engine, control is only possible from PMS.

Failure Mode One PMS fail One PMS link fail Both PMS fail Loss of DPU 3 or DPU 4 Loss of DPU 1 or DPU 2 Loss of DPU 5 False bus-tie breaker status to PMS

Cause(s) Power loss or over voltage Wire break Non alarm on other Operator error Internal short Internal short Internal short Wire break Breaker fault

Effects One DG stops None DG independent Loss of azimuth thruster indication Loss of diesel Engines indication All engines still run

Mitigation Other engine Dual power Use other Alarm Other side OK Other OK Other OK Information only Should not cause tripping

Table 4-8: Alarm & Control System Failure Modes

4.15.14 Remote commands are possible from MIMIC via via AMCS. Starting, stopping, close, open control of the diesel generators breakers, 690V tiebreaker, shore breaker and nonessentials (only off) is possible. Local operation is also possible, for each generator a power management control panel is mounted in front of the respective generator field. 4.15.15 System functions of the Power Management System include: •

Manual and automatic start/stop start/st op

•

Automatic synchronising synchronisin g

•

Power measurement (3 phase)

•

Symmetric/asymmetric Symmetric/asymmetric load sharing


| 25

•

Load dependant start/stop

•

Blackout monitoring/start monitoring/ start

•

Stand-by selection

•

Continuous or periodic running of LO priming pumps

•

•

•

Monitoring of critical critica l parameter such as under voltage, over voltage, under under frequency, over frequency, overload Generator protection with circuit breaker trip in case of reverse power, short circuit and/or over current Engine shutdown on low LO pressure, high cooling water water temperature and overspeed

4.15.16 The following generator control and protection functions are integrated in the PMS: •

Reverse power trip

•

Short circuit trip

•

Over current trip

•

Overload alarm

•

Under and over voltage alarming

4.15.17 Shutdown of an engine and open circuit breaker will be activated in case of: Overspeed

•

•

LO low pressure

•

Cooling water temperature high

4.15.18 In automatic mode, the PMS controls the number of generators running in parallel depending on the actual load, and pre alarm signals of engines running. Operator defines priority of generators running. A diesel will start if the generator power (kW or kVA) reaches a pre-set limit of the generator power. This value is adjustable. At the PMS Mimic a stop blocking is available, to be ensured that there is enough generator power for manoeuvring. manoeuvring. 4.15.19 If the power demand decreases to a level which allows one alternator to be stopped without the system being on the power limit, then one set is to be shut down after a preselected time limit has elapsed. Indication is to be provided to the control, alarm and monitoring system if the load demand does not increase. After a predetermined period of between one and two minutes prior to shutdown an audible warning of shutdown is incorporated. Override or accept shutdown buttons are provided in wheelhouse for use in transitory load reduction cases. 4.15.20 In automatic mode, the PMS controls both frequency and power distribution of the generators. Load will be equally divided over parallel running generators with respect to the nominal power. In Manual mode operator commands “raise and lower” will control both frequency and power.


| 26

4.15.21 The diesel engines have their own own independent protection (Wärtsila). (Wärtsi la). The PMS receives a shutdown signal from the diesel engine. The PMS protects the generators from the following events: winding temperature too high (each winding) •

•

bearing temperature too high (each bearing).

4.15.22 An AMCS pre-alarm pre-alar m will be generated for the above-mentioned signals, for cooling air and water leakage. A pre-alarm will also start a stand-by diesel generator. The diesel generator with the pre-alarm will stop, when the stand-by one is running. If there is a lack of power, the diesel generator with a pre-alarm will not be stopped. A too high alarm will stop the diesel generator directly. 4.15.23 In case of a blackout (normally prevented by the PMS by limiting power) the selected stand-by diesel generator set will start to feed the MSB 690V. The diesel generator starting order can be selected via the Mimic parameters incorporated in the AMCS. Also the primary ship main service transformer circuit breakers and the tiebreaker will return to their state before the blackout. For example, if the operator has chosen to sail with an open 690V tiebreaker and one 690V transformer SB in service, and a blackout occurs, the situation before the blackout will be restored by the PMS. Thus only transformer SB breaker will be switched on (and all starters which were running). 4.15.24 To avoid unwanted load-steps each generator must be unloaded before switching off (in automatic mode), this means the load delivered by the generator must be automatically reduced to about zero before circuit breaker opens. This function is, of course, only possible if more than one generator is running in parallel and is done automatically. 4.15.25 The emergency generator is not a part of of the PMS. If a blackout occurs, the tie breaker to the MSB 440V will open, and the emergency generator starts to feed the Emergency Switch Board. Continuous parallel operation with the MSB 440V is not possible, but a bump less take over is possible in manual operation. Synchronizing is only possible over the tiebreaker at the ESB 440V. The operator has to synchronize with the speed buttons of the emergency generator to the MSB 440V, close the tiebreaker and stop the emergency generator. The generator breaker opens automatically when the tiebreaker closes. 4.15.26 The 440V MSB MSB bus-tie is normally “open” to prevent prevent parallel operation of the 690/440V transformers. The feeders of the bus bars (transformer and shore breakers) can be switched on to a dead bus only. Those breakers are equipped with independent under voltage release. When the transformer breakers are in “AUTO ON” position, the breakers are closed automatically, if the ship main service transformer 690/440V is energized. 4.15.27 In automatic mode synchronising is done by by the PMS PMS (also operator close /open is possible) to connect the PS and SB bus bar. In manual mode (pushbuttons on tiebreaker panel) closing is only possible with a dead bus PS or SB. Manual synchronizing is possible for all 690V generator breakers. 4.15.28 All 690V feeders breakers have an independent under voltage release, except for the bow thruster’s circuit breakers. There is no PMS control of those feeders except the primary ship main service transformer circuit breakers.


| 27

4.15.29 In blackout situations the PMS starts generators (in AUTO mode) in order to restore the voltage. Also the primary ships main service transformer circuit breakers and the tiebreaker 690V will return to their state before the blackout. The ships main service transformer circuit breakers PS/SB must be sequential switched on with a time interval of 2 sec. The PMS/AMCS also sequentially restarts starters, via the AMCS I/O, necessary to restore safe ship operation according to LRS. Hence, all items to restart must be remote controlled by AMCS. So all AMCS controlled starters can return to their state before the blackout. All outgoing feeders / groups of the MSB 440V and ESB 440V will return to their state before a blackout at the same time. 4.15.30 Due to high inrush current of the propulsion transformers transforme rs and bow thrusters there is a ‘start allowed’ signal for starting. Starting is only allowed when two generators are connected to the bus bar of the PS/SB propulsion drives or bow thrusters. These signals are relayed via local AMCS I/O, and generated by the PMS modules. The bow thrusters only send a ‘request for starting’. 4.15.31 There are three means of limiting the total amount of power. These are: switching off the non-essential consumers, limiting the speed/torque of the propulsion motors and reducing the pitch of the bow thrusters propellers. A safety factor of 0.95 (adjustable) is be used to calculate the maximum allowed power. This is necessary because the main diesels will not be able to produce the rated power of the generators at an Engine Room temperature of 55ºC. Also 200kW is reserved for load fluctuations in the 440V distribution. The generator power (kW and kVA) is measured and used as a reference. 4.15.32 In case of overload, the load shedding groups will be switched off by PMS in two stages. First, the PS 440V consumers will be switched off and afterwards the SB ones. The individual feeders must be switched on manually. The non-essential groups can be manually switched off (pulse 1 sec) via the PMS mimic. If there is diesel generator shutdown or breaker trip, load shedding (PS&SB) takes place immediately in case of a lack of power. In all other cases switching off is delayed (adjustable). This is because, first of all, the propulsion /bow thruster power will be limited. 4.15.33 An analogue (-60 to 120% of of nominal power 1500kW) and a digital signal will be sent to each propulsion drive, to limit the amount of power. The PMS will calculate the available power for each drive in respect to the power plant configuration. This analogue signal represents the maximum available (+ or -) power. Thus 0% (=9,3mA) means limiting the power and below 0% reducing the drive power. When there is for example 500kW running generator power left, the signal will be (500-200)*0.95/1500= +19% (=11mA). This means that the drives can use this power to speed up until actual power + 285kW. A power-limited lamp indicates to each control station that there is a lack of propulsion power. When a diesel generator trips, a fast digital signal (NC) will immediately reduce the drive power to 100kW for about 3 sec. The 100kW is based upon 400kW consumer power, 2x400kW bow thrusters and 150% short time overload capability of 1 diesel generator. When this digital signal is deactivated, the drive listens again to the speed set point limited by the stabilized analogue one. 4.15.34 Only a single analogue (0-120% of nominal power 515kW) will be sent to each bow thruster for limiting the power. In case of a lack of power on PS or SB, the thrusters will be reduced / limited. This is because the Rolls-Royce system will reduce the pitch when the signal is higher than 100% (17,3mA=515kW). If the signal is 120% big steps are taken and near 100% small steps. For example when only 2 diesel-generators of POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 28

1000kW are available the 690V tie breaker is closed and a total consumption of 1200kW, the limit value will be (800kW-200kW)*0.95 = 570kW. So the actual limit set points are: •

•

for the bow thrusters (1,00-570/515)*100=0%[between (1,00-570/515)* 100=0%[between 0-120%]; negative values equals 0% for the propulsion drives 570/1500*100=38%[bet 570/1500*100=38%[between ween –60- 120%].

Or in case of a lack of power of 10kW it will be (-10kW-200kW)/0.95=-221kW with the actual limit set points: for the bow thrusters (1,00- -221/515)*100=120%[between -221/515)*100= 120%[between 0-120%]; values above 120% equals 120% •

•

for the propulsion drives -221/1500*100=-14,7%[between -221/1500*10 0=-14,7%[between –60- 120%];reducing power with 221kW.

4.15.35 In DP mode, the status of of generator and bus-tie breakers and the generator load is sent to the DP controller which limits the set points, thruster speed and bowthruster pitch, depending on the input values. In all vessel operating modes, i.e. DP, DP Joystick, Manoeuvring and Transit, the PMS is active. 4.15.36 The Kongsberg DP control system power reduction limits (black out prevention) are set up as follows: •

Upper limit (cut in) set to generators 85% power

•

Lower limit (Cut out) set to generators 75% power

4.15.37 When operating in DP2 in open water water on two connected generators the bus tie must be open at all times with the auto start limit for the standby generators reduced to 50% full load to prevent overload of the system and this should be included in the DP check list. 4.15.38 Failure of synchronisation of two generators generator s will be alarmed to the operator. 4.15.39 Auto-start of a standby generator and connection to the board takes up to 45 sec. For the emergency diesel generator takes up to 30 seconds.


| 29

Figure 4-6: PMS Layout

POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 30

4.16

Power Balance

4.16.1

Generated power with all four diesel generators on line is 2300kW of power available for each side of of the main switchboard. Each bow thruster consumes 515kW at full power while each stern azimuth thruster can consume 1500kW. Thus if one side of the switchboard is lost and the thrusters were at 50% there is not enough power for one side, with both DG’s on line to supply the full DP load if allowances are made for the domestic load. This assumes that on the worst case failure the two remaining thrusters have to supply 100% thrust.

4.16.2

In practice, the thrust of the stern azimuth thrusters has to be limited so that overload is avoided. Calculations from the builders show that about 90% power would be available and that with an open bus-tie breaker it is quite straightforward to limit the power (DP control system) and cut back the power of the azimuth thrusters because they have frequency drives.

4.16.3

These arra arrangements ngements are satisfactory satisfacto ry provided there is no risk of incorrect incorrec t or missing data that can: •

Prevent a cut when when one is needed

•

Cause a cut when one is not needed

4.16.4

If operating with two DGs on line (1 + 1 open) and one thruster went to full power, there is a chance of overload and blackout on that side. The other side would have to recover the position and heading excursion, which would not be possible until the second DG, started and came on line and then it might be too late.

4.17

Engine Room Fire

4.17.1

DP Class 2 does not require separate engine rooms but the risk of an engine room fire is much higher than the risk of fire in other spaces and close attention is needed to ensure prevention, and prompt detection and extinguishing a fire in the event that one occurs.

4.17.2

The system on this vessel is designed so that no single fault can cause a false shutdown. The CO2 relay box has two independent power supplies and additional switches added to the release boxes power distribution.

4.17.3

A Hi-Fog system provides fire protection in five machinery space zones i.e. DG1, DG2, DG3, DG4 and purifier.


| 31

4.18

690V Main Switchboard

Figure 4-7: Electrical Distribution System (Ref drawing 300144-400_000-GRS-001 300144-400_000-GRS-001 Single Line)

4.18.1

The main switchboard is 690V 60Hz and can be split by a single bus-tie breaker and at least one generator running on each switchboard with the other generators in stand-by (depending on the load). This will be normally open for DP2 work so that any fault should be restricted to the failure of just the port or starboard side of the switchboard. There are many faults that can cause the loss of the switchboard and these are listed below: short circuit

•

•

loss of excitat excitation ion on one diesel generator

•

trip of one diesel generator and overload overload of second

•

trip of both diesel generators (fuel (fu el oil)

•

AVR fault with one diesel generator that causes loss of both


| 32

•

PMS fault with one diesel generator that causes loss of both.

4.18.2

The number of causes is not as important impor tant as the frequency of their occurrence. All of the above have have taken place in the past on other vessels. Only the first is an unavoidable blackout, the others should not occur even though the effect should only be the loss of half the power and thrust.

4.18.3

Configuration Configurati on of of Main Main Electrical Plant is controlled by the PMS, with the exception of the emergency generator and 440V tiebreaker. The PMS is incorporated in the MSB 690V and AMCS. Also the essential starters and non-essential consumers (load shedding) are controlled by the PMS.

4.18.4

The 1000 kW generators do not have a differential protection device and are controlling the bus tie breaker via the PMS as well. The 1300kW generators are also controlling the transformer circuit breakers via the PMS.

4.18.5

The circuit breaker of the propulsion thrusters thruster s is only only controlled via the frequency drive to prevent damage to the frequency drive converter. Switching on is interlocked (in auto mode) when only one generator is in operation.

4.18.6

Starting of a bow thruster is interlocked (in auto mode) when only one generator is in operation.

4.18.7

The transformers are switched on via pre magnetizing resistors to prevent a high inrush current. If the selector switch is in auto position, the transformer circuit breaker will be controlled by the PMS (panel of the 1300kW generator or mimic).

4.18.8

The tie breaker panel, in local mode, switching on is only possible via a dead bus on PS or SB. The PMS (panel of the 1000kW generator or mimic) controls the system when in auto mode. The insulation monitoring devices are measuring stand-alone when the bus bars are split, and one is in charge when the bus bars are coupled.

4.18.9

Each PMS module can operate in 3 modes, Off / Auto / Manual. Manual. These modes depend on the following signals: Off: Engine in Local control; Manual: Selector switch on diesel engine control panel is in remote position and on PMS panel is Manual selected; Auto: Selector switch on diesel engine control panel panel is in remote position and on PMS panel is Auto selected. • •

•

4.18.10 Selection Auto / Manual is done via the PMS display panel or via the PMS graphic display. 4.18.11 If the selector switch on diesel engine control panel is in local position, the PMS is forced to Off mode, only the plant safeties are active. 4.18.12 If the selector switch on diesel engine control panel is in remote position the PMS starts start s in Manual mode and after this the operator can select Auto mode. 4.18.13 The bus-tie can be operated from the graphic or from display panel PMS-2 PMS-2 or PMS-3. The system will remember the last operator command and will recover to this state after a black out. The PMS only closes (synchronise) the bus-tie if both busses are healthy (generator in operation on each side). The tie breaker cannot be switched off in automatic mode to prevent a black out on a bus bar part. According to LROS the tie POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 33

breaker must be opened manually in case of DPAA sailing mode in order to increase safety. 4.18.14 The transformer breaker (PS/SB) can be operated from the graphic or from display panel PMS-1 (PS) or PMS-4 (SB). The system will remember the last operator command and will recover to this state after a black out (only if the selector switch on the transformer panel is in auto mode) The PS / SB transformer are interlock by the PMS so only 1 transformer can be closed. When sailing in DPAA mode the tie breaker in the 690V MSB as well as in the 440V MSB must be opened and both the circuit breakers of the transformers must be switched on in order to increase safety.

4.19

690V Main Switchboard Failure Modes

4.19.1

A switchboard could fail for various reasons, such as phase-to-phase fault, earth fault, and overload. The current design and and DP2 operating configuration will prevent a blackout; the remaining risk for the main switchboards comes from the incorrect settings of the systems relays, due to drift drift or initial commissioning engineer engineer mistakes. The protections are set to protect and discriminate between power system configurations. Even with this type of hidden failure the design worst case failure should not be exceeded; this relies on the remaining systems being able to deliver twice their previous load rapidly and the vessel being operated within its capability plot for design worst case failure. Failure of one main switchboard section will cause the loss of two thrusters, one bow thruster and one aft propulsion thruster.

4.20

440V Switchboard

4.20.1

The main 440V switchboard switchboa rd is also in two sections with a single bus-tie breaker that is normally normall y open whether whether the main switchboard switchbo ard is open or closed. Each side is powered via 1400kVA transformers.

4.20.2

The two transformer transform er circuit breakers and the tiebreaker are interlocked; interlocked ; only two of them can be closed to prevent paralleling of the 690/440V transformers. The breakers are manually controlled. If the selector switch is in auto position, the transformer circuit breaker will be switched on at the return of the secondary transformer voltage. If the tie breaker is open then both transformer circuit breakers will be switched on. In DP mode the tie breaker must be opened and both transformer circuit breakers closed.

4.20.3

The DP related consumers are listed in the table below: 440V Swbd PS Emergency provision to feed ESB 440V if failure MSB 440V SB with temporary cable HVAC CP AC2: Supply fan ER PS Supply/exhaust fan ER PS (backup supply from ESB)


440V Swbd SB Cooling water pre heating unit SB

PDP1 (Non DP critical consumers)

| 34

Chiller water unit 2 GPS 1 WS-PDP 1: Taut Wire electrical cabinet HVAC CP AC3: Supply fan BT room HVAC CP AC1 CP ventilation: Supply fan azimuth thr. room Supply fan HiPAP room

Service air compressor Reefer PDP 2 (Non DP critical consumers) Cooling water pre heating PS PDP 2: Cathodic protection impressed current ICCP Propulsion converter port (auxiliary supply) Compressorr Intering (GA7-FF-GS) Compresso PDP 1 Trafo 1 440/230V MSB 230V

PDP 4 (Non DP critical consumers) PDP 3 (Non DP critical consumers) Trafo 2 440/230V NSB WS-PDP 2 (Non DP critical consumers) HVAC CP AC 1 (back-up) HVAC CP Mech Ventilation: AC Chiller pump No.1 AC Chiller pump No.1 Supply fan ER SB Exhaust fan BT room Supply/exhaust fan ER SB (Back up supply from 440V ESB) Supply/exhaust azimuth thr room (Back up supply from 440V ESB) Fan No. 1 cooling unit ECR (Back up supply from 440V ESB) Fan No. 2 cooling unit ECR (Back up supply from 440V ESB) AC compressor chiller water unit 3 AC compressor chiller water unit 1 GSP 2 Emergency switchboard

Table 4-9: 440V MSB Consumers

4.21

440V Distribution Failure Modes

4.21.1

The consumers of each side of these two switchboard sections are primarily related to the port side or starboard side as appropriate. Exceptions occur for the air conditioning units and the third pump where a common stand-by is available for both port and and starboard sides. sides. The three seawa t e r pumps are cross-connected with manual manual valves valves in between. between. This arrangement arrangement is satisfactory provided the common stand-by is used when DP is not required (for example) so that the running hours and planned maintenance can function and leave the port and starboard units available for fo r important DP operations. AC1 is only for the Wheelhouse and the Bridge Void as the ECR has its own AC-unit.


| 35

4.21.2

The engine room is supplied by two, two speed fans. In normal normal operation, they are run at slow speed. In the event of failure of one, the speed of the remaining fan is increased to high speed, which has been proven to provide ample air for the engines. Failure of one side of the 440V board will also fail half the ventilation to the engine room, the azimuth thruster room and the the bow thruster thruster rooms. rooms. If the engines engines are still running then a temperature, rise may occur but the rise will be slow and there will be enough time to cease the work and reach a safe situation.

4.21.3

The air conditioning systems critical to DP function, are located on the bridge bridge and ECR. The air-handling units for these systems are cooled by the three chiller plants located in the ER. Any one of the three chiller plants can be used for f or the bridge or ECR AC systems. Both Both units are fitted with spare fan motors and if the control system fails, manual operation of the control valves is possible. Disintegration of the fan would be a problem until it was replaced. To keep working a portable fan could be employed otherwise the work could be terminated until the repairs were made. There should always be time to safely terminate the work. The particular particu lar failure mode that has been experienced on similar vessels is loss of AC followed by condensation condensation on cold surfaces surfaces of of the the DP cont control rol sys s ystems tems and and s ub seq ue nt failure. Failure of the AC is alarmed and the motors for the system are supplied from both switchboards.

4.21.4

On failure of the port 440V switchboar switchboard, d, the AC1 air handling motors can be switched over to be powered by the starboard switchboard but there would then be AC3. The cooling unit in the ECR is inadequate power to continue to run AC2 and AC3. powered from the starboard board normally so that would continue.

4.21.5

Should the starboard 440V switchboard switchboa rd fail the cooling unit in the ECR can be switched over to the Emergency Emergenc y Switchboard. However, as this is normally supplied by the starboard main switchboard it will rely on the Emergency Emergency Diesel G enerator starting and running to remain operational. AC2 and AC3 units units will fail anyway in this case because they are powered from this switchboard. These units supply the main deck and accommodation.

4.22

440V Emergency Switchboard

4.22.1

The emergency emergenc y generator is independent and supplies the emergency emergenc y 440V switchboard when the t he normal suppl supply y from the starboard 440V board board fails or is unavailab unavailable. le. The 440V emergency switchboard s witchboard supplies the following consumers:

440V Emergency swbd HVAC CP AC 2 (Back up supply) GSP 1 (Emergency supply): • •

Pre LO pump No. 1 (back up supply from ESB) LO starter thruster port (back up supply from ESB)


| 36

•

FO booster pump No. 1 (back up supply from ESB)

GSP 2 (Emergency supply): • • •

Pre LO pump No. 4 (back up supply from ESB) LO starter thruster SB (back up supply from ESB) FO booster pump No. 4 (back up supply from ESB)

Trafo 230V EPDP1: • •

Propulsion converter SB (Auxiliary supply) HiPAP system hoist control unit

HVAC CP MECH VENT (Back up supply) Steering pump SB 1 Steering pump SB 2 Em. Fire pump Bilge Ballast pump MSB 1 24V Battery Charger Bridge Void alternative supply MSB 2 24V Battery Charger ER preferred supply Table 4-10: 440V ESB Consumers

4.23

440V Emergency Switchboard Failure Modes

4.23.1

The primary effect effect of loss of the 440V ac emergency switchboard switchboar d will be the loss of the starboard azimuth thruster due to the loss of the auxiliary power supply.

4.23.2

The secondary effect of of a loss of this switchboard will be the loss of of the supply to the 230V emergency switchboard which is discussed in 4.6.

4.23.3

The emergency 440V switchboard has a primary supply from the 440V stbd switchboard and the secondary supply from the emergency generator which starts and connects automatically in the event of black-out.


| 37

4.24

230V Switchboards

4.24.1

There are two 230V switchboards supplied by the main 440V switchboard, MSB 230V on the port side and NSB 230V on the stbd side. In the event of failure of the stbd switchboard, the NSB can be supplied from MSB 230V by manual changeover.

4.24.2

The MSB MSB 230V supplies two further significant significa nt 230V distribution distributi on boards ENSB ENSB PS and ENSB SB. These supplies automatically change to ESB 230V if power is lost on the port switchboard.

4.24.3

In principle, the consumers are split in line with the port and starboard starbo ard separation for engines, thrusters thruster s and DP in general. The distribution distrib ution panels of interest are listed below: 230V MSB NLDP 3: HVAC CP AC 3 - 230V section • Bow thr fwd electronic cabinet (main supply) Bow thr aft electronic cabinet (main supply) AC heating bow thr aft • • •

NLDP 4: ECR console (additional power supply) MSB 690V AC heating MSB 440V AC heating GSP 2 AC heating PRAXIS AMCS Client (ECR_UPS) DPU 2 cabinet light and fan Cathodic protection 690V/440V transformer No.1 AC heating • 690V/440V transformer No.2 AC heating • • • • • • •

•

NLDP 5: AC heating azimuth thruster PS AC heating azimuth thruster SB Ventilation control panel Propulsion converter PS (Heater supply) Propulsion converter SB (Heater supply) • • • • •

WS-PDP 2 SDP 230V via Transformer ENSB 230V PS (Main supply) ENSB 230V SB (Main supply) Table 4-11: 230V MSB Consumers POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 38

4.24.4

The gyros and the forward and aft bow thrusters electronic cabinets have also 24Vdc backup power supply.

4.24.5

The distributions ENSB PS and ENSB SP can be powered from the 230V port switchboard or from the 230V emergency switchboard (changeover).

ENSB 230V PS NDP 1 (DP console PS) Fire detection panel Gyro repeater 851 E018 DP Console PS DP JC-11 single controller joystick DP UPS No. 1 Anemometer PS aft display

ENSB 230V SB NDP 2 (DP Console SB) NDP 4 (Docking console SB) NDP 6 (Aft centre console) DP UPS No. 2 Gyro No. 3 Gyro repeater 851 E025 DP console SB Anemometer SB aft display

Table 4-12: ENSB PS and SB Consumers Consumers

4.24.6 4.24.6

The NSB 230V distribution distri bution is powered from the starboard starboar d 440V via transformer transfor mer and can also be powered fr om MSB 230V in the event of NSB transformer failure. The consumers of the NSB 230V distribution are listed in the table below:

NSB 230V NLDP1: •

VHF Radio charger (Bridge)

•

PRAXIS AMCS Client 2 (Bridge)

NLDP2: • • • • • •

Telephone exchange HVAC CP AC 2 (230V section) HVAC CP Mech ventilation (Heater supply) AC heating MSB 690V AC heating ESB 440V AC heating GSP 1

WS-PDP1 Table 4-13: 230V NSB Consumers Consumers


| 39

4.25

230V Distribution Failure Modes

4.25.1

Loss of any 230V distribution panel will have no immediate effect on DP as as most of the DP related consumers have other power supply available.

4.25.2

The DP UPS can run on batteries for a minimum of 30 minutes and the gyros have 24Vdc back up power supply.

4.26

230V Emergency Switchboard

4.26.1

The emergency 230V board is supplied from the emergency 440V via transformer transform er and supplies the following consumers: 230V Emergency Switchboard Supply from 70kVA transformer Emerg. Gen. Room ENSB 230V PS ( In the event of the loss of the MSB 230V the supply will automatically change over to ESB 230V) : • • • • • •

NDP 1 (DP console PS) Fire detection panel Gyro repeater 851 E018 DP Console PS DP JC-11 single controller joystick DP UPS No. 1 Anemometer PS aft display

ELDP1: • •

Fire dampers (AC1 AHU fire dampers) HVAC CP AC1 - 230V section

ELDP2: • •

Fire dampers (AC2 AHU) Fire dampers (AC2 ventilation fans)

ELDP3: • •

Fire dampers (AC3 AHU) Fire dampers AC3 ventilation fans

ELDP4: • • • • •

DPU 1 cabinet light and fan Valve control fuel system Service air receiver Starting air drier DP warning system traffic lights

ELDP5


| 40

ENSB 230V SB (In the event of the loss of the MSB 230V the supply will automatically change over to ESB 230V): • • • • • • •

NDP 2 (DP Console SB) NDP 4 (Docking console SB) NDP 6 (Aft centre console) DP UPS No. 2 Gyro No. 3 Gyro repeater 851 E025 DP console SB Anemometer SB aft display

Battery Charger PA System UPS A&M Table 4-14: 230V Emergency Switchboard Consumers

4.27

230V Emergency Switchboard failure Modes

Failure Mode Loss of 230V ESB

Cause(s) 440V/230V transformer 440V ESB power 690/440V transformer short circuit 440V short 230V operator error

Effects One JS supply lost.

Comment ENSB PS & ENSB SB normally supplied from MSB 220V.

Table 4-15: 230V ESB Failure Modes

4.27.1

Several of the critical items of equipment not only have UPS supplies but also have separate 24V back up supplies so if the UPS batteries are found to be inadequate when the charger fails power will not be lost. (See 4.28.3)

4.28

24V Systems

4.28.1

There are two separate 24V DC supply systems, MSB1 located in the bridge void space and MSB2 located in the engine room. These supply two further 24V distribution distributio n panels. Both switchboards have a manual changeover switch allowing supply to be taken from either the port port or starboard 440V MSB. MSB. These switches are clearly marked to avoid the possibility of the two systems being supplied from the same switchboard.

4.28.2

The PMS units however are also supplied by local transformer rectifier units from the diesel generator, once it is running, via a 690/230V transformer. This also supplies the Woodward 723 digital controller for the generator. When the generator is not


| 41

running, the system system is powered from the 24V board. The board is diode protected from the generator supply. The board is normally powered from the bridge charger rectifier and/or batteries located on the bridge. The charger is powered powered by b y the emergency 440V switchboard with a changeover to port.

24V Switchboard

Supply

Distribution Panels

MSB1 (bridge)

PDP1 Q1 (normal)

DP24V (engine room)

ESB 440V

TLDP1 (bridge void)

GSP1

TLDP2 (O/S Galley)

ESB 440V (normal)

TLDP3 (hold fwd.)

MSB2 (engine room)

Table 4-16: 24Vdc Distribution Power Supplies and Distribution Panels

4.28.3

There is adequate redundancy in supply but nevertheless a risk of a mistake exists because both systems could be powered from the same switchboard (port or emergency) so that if the switchboard fails it would leave much equipment on batteries. batteri es. The use of DP checklists prior to commencing operations will ensure that the systems are properly configured.

4.28.4

The following is a list of 24V consumers and their associated power supplies:

EQUIPMENT

SUPPLY 1

SUPPLY 2

Gyro No. 1

MSB1 24V

DP UPS No. 1

Gyro No. 2

MSB1 24V

DP UPS No. 2

Gyro No. 3

MSB1 24V

ENSB SB

DGPS 3 (C-NAV 3050)

MSB1 24V

DG1 PMS (PS FWD)

DP24V

Local when DG Running

DG2 PMS (SB FWD)

MSB2 24V


DG3 PMS (PS AFT)

DP24V


DG4 PMS (SB AFT)

MSB2 24V


WECS DG No.1 PORT FWD

DP24V

MSB2 24V


| 42

WECS DG No.2 STBD FWD

MSB2 24V

DP24V

WECS DG No.3 PORT AFT

DP24V

MSB2 24V

WECS DG No.4 STBD AFT

MSB2 24V

DP24V

BT1 Electronic Cabinet

NLDP3

DP 24V

BT1 Alarm Unit

DP 24V

BT2 Electronic Cabinet

NLDP3

BT2 Alarm Unit

TLDP2

Azimuth Thruster BCU Master

TLDP1

Azimuth Thruster BCU Slave

TLDP2

PS Azimuth Thruster ACU

MSB1 24V

SB Azimuth Thruster ACU

TLDP3

ECR Azimuth Control Unit

TLDP2

AIS Control unit

MSB1 24V

PRAXIS DPU 5 XS318 BRIDGE

MSB1 24V

ECR Console

MSB2 24V

Talkback unit

TLDP1

Gyro switchover unit

TLDP1

TLDP2

Table 4-17: 24V DC Consumers Consumers

4.29

24Vdc Systems Failure Modes

4.29.1

Failure of power supply to a 24VDC charger rectifiers will result in a changeover to the battery supply. An alarm occurs and the system is supplied from the batteries which are designed to support systems and services for 30 minutes duration.

4.29.2

Failure of a 24V DC distribution panel will fail the corresponding correspondi ng consumers, however the majority of the consumers related to DP have other power supply available and no loss of thrusters will occur.. Loss of MSB 1 24V will result in loss of DGPS3 which has a single power supply.


| 43

4.30

DP UPS

4.30.1

There are two DP UPSs installed on board. The DP UPS 1 is powered from the ENSB PS and the DP UPS No. 2 is powered from the ENSB SB.

4.30.2 4.30.2

The consumers of each DP UPS are are listed in the table below: DP UPS No. 1

DP UPS No. 2

DPC 21 A

DPC 21 B

DP OS No.1

DP OS No.2

Fanbeam supply

DP Hard copy printer socket (Isolated)

DGPS 1 - VERIPOS system

APC 10 - HIPAP PC

DP alarm printer socket (Isolated)

DP OS No.3

Gyro No. 1

HiPAP transducer

Taut Wire control

Gyro No. 2

Anemometer PS fwd display and NMEA buffer (DP wind 2)

Anemometer SB fwd display and NMEA buffer (DP wind 1) MRU No. 2 (MRU5)

Table 4-18: DP UPS Consumers

4.31

DP UPS Failure Modes

4.31.1

Loss of the output from one UPS will fail the corresponding consumers. The equipment remaining on the other UPS should be sufficient to maintain position depending on operating parameters.

4.31.2

Loss of mains input to a UPS will result in the UPS running on battery power and supplying the load for a period in excess of 30 minutes. An alarm on the DP control system alerts the operator to the loss of mains input.


| 44

5.

THRUSTERS

5.1

DP Capability

5.1.1

The generator capacity shows that the stern azimuth thrusters might not be able to work at full power when one side of the power plant fails. This limitation however may have very little impact on the DP capability because the vessel is unlikely to work in weather conditions that require full thrust on one stern azimuth thruster. The DP capability will be controlled by the bow thrusters. If the vessel is working head to weather then the loss of the forward bow thruster will be very limiting. limiti ng. The vessel will have a better DP capability stern ster n on to the weather but this might make the after deck too wet. When the weather is from more than 30° on the bow the power in the thrusters aft cannot be used. However, significant project equipment on the after deck is also unlikely to reduce DP capability significantly.

5.2

Bow Thrusters

5.2.1

The bow thrusters thruster s are supplied by Rolls Royce (type TT1660 DPNCP) and and are driven by 690V AC motors at 1800 rpm. They are are controllable pitch with hydraulic hydraulic power po wer packs to change the angle of the blades from full starboard to full port in 18 seconds. The propeller speed is 374 rpm and the calculated thrust is 85kN each. They have radial lip seals of the 3-ring type, which enables pressure control, and drain connection/leakage detection, detectio n, which which is very impor important tant for thruster management. The seal material is ‘Viton Super lip’ running running on a ceramic-coated stainless steel liner. liner. A rope guard is mounted on the gear housing to protect the seal.

5.2.2

The hydraulic power pack comprises a tank, filter, cooler and two pumps; one duty and one stand by with an automatic change over if one fails or if there is low pressure. Loss of pressure will cause loss of control and the drive motor should trip. There is also a gravity tank that provides the positive pressure against against the seawater the other side of the propeller seal. This pressure should account account for static head at the maximum plus a margin for motion. motion. The filling of the system is important so that air is not trapped in the system and the required system head is maintained.

5.3

Bow Thrusters Failure Modes

5.3.1

One bow thruster can fail from a number of causes as shown below but the effect should always be acceptable if the vessel’s capability was not being exceeded. The assessment of the safe working limit will always be for the operator to decide because the consequence analysis warning may well come several minutes after the limit has been exceeded. The normal feature of DP control systems for mono-hulled vessels is for the bow thrusters to be used together and for high levels of pitch to be used for short periods to counter the effect waves have on heading. This feature called ‘heading priority priorit y is very necessary necessar y so heading is not lost los t say 10° and is then not recoverable recoverabl e

THRUSTERS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 45

because of the sequence of waters waters experienced. Therefore, the thrust demands of the two bow thrusters could be at 100% for brief and isolated periods and at 20-30% otherwise. In these circumstances, it is difficult to assess whether it is safe to continue operations, however normal DP practice would be to alter the heading to reduce thruster demand or consider stopping DP operations when the thrust demand from the bow thrusters exceeds 80% for more than brief or isolated periods.

Failure Mode Loss of one BT

Bow thruster to full pitch Unstable pitch

Cause(s) Electrical fault Hydraulic fault Overcurrent (motor) Low oil pressure Wire rope in tunnel Mechanical damage Control fault Feedback fault Valve stick Control fault Control fault - pot - amp - earth

Effects Stop

Comment Other BT

Operator must stop if no overcurrent

Critical to DP

Degraded performance

Difficult to detect

Table 5-1: Tunnel Thruster Failure Modes

5.3.2

The worst failure mode is is failure to full pitch especially if this happens happens on the forward of the two bow thrusters because all the thrust of the after unit will be consumed to counter the turning moment unsuccessfully. unsuccessfull y. The causes are electronic, mechanical or hydraulic. Some vessels use two feedback potentiometers and freeze pitch if there is a difference. differenc e. Pitch can also be frozen if the pitch movement does not follow as expected but there is is always a delay in such checks checks and it is better to have no thrust than unwanted thrust.

5.3.3

In a 1 + 1 DG arrangement, one bow thruster thruster moving to full power risks overload to the one diesel generator unless reduction can be made on the stern azimuth thruster fast enough. This may release enough power p ower to trip the bow thruster on overcurrent. However, the remaining healthy bow thruster will then be at full pitch to recover the loss in heading.

5.3.4

If the feedback linkage linkage breaks or a hydraulic hydraulic valve sticks sticks that, the resultant full full pitch pitch will cause overcurrent overcurr ent and the tripping of the drive motor. This is satisfactor y. If the pitch freezes and the alarm is given on the DP, the operator should stop the thruster motor completely and not just deselect it from DP. This is because the thruster, even though deselected from the DP, continues to run, resulting in loss of heading even when the command signal is zero

5.3.5

Unstable pitch can occur from worn parts parts or maladjusted maladjusted potentiometers. Similarly, poor adjustment adjustm ent of the zero pitch can make starting currents much higher. The start system is interlocked so that two generators must be running and fans running on high


| 46

speed before the bowthruster can be started. As mentioned previously, previ ously, the DP capability is not degraded much (in practical working terms) from the loss of one azimuth thruster but is from the loss of one bow thruster.

5.4

Azimuth Thrusters

5.4.1

The stern thrusters are not CPP but fixed pitch with variable speed frequency drives. The propeller and azimuth controls are supplied by Rolls Royce, as are the bridge and engine room panels. Two electric-driven steering motors (independently fan-cooled) provide azimuth control. The steering motors serve to rotate the azimuth thruster to the required heading. Failure of the feedback signals can be detected and alarmed before serious misalignment takes place however, a misalignment of up to 45deg is possible which causes a position excursion until the thruster is stopped or the error is compensated for by the integral integral term of the DP controller. There is only one feedback to the DP control system and a separate feedback to the Aquamaster Aquamaster control unit. The feedbacks are sin and cos.

5.4.2

The azimuth thrusters thrus ters can be used for steering (auto track and autopilot) either together or individually. individuall y. When in DP there should be restricted zones so that they are efficient and do not interface with each other. Maladjustment Maladjustm ent of these zones can cause position instability particularly particularly in rough weather. weather. The DP control control system will generally always rotate these thrusters to use ahead thrust but when a rapid change of thrust direction is needed, needed, they may rotate astern. The logic used was tested on trials to show that it is optimised for DP and crash stops and found to be satisfactory.

5.5

Azimuth Thrusters Failure Modes

5.5.1

Failure of one azimuth thruster when when on DP is not critical. There are alarms for all the parameters of interest like water temperature for the water/water heat exchangers (from the vessel’s fresh water cooling system) and water leakage within the converter cooling system and water flow and and pressure. There are indications and alarms for winding temperatures, motor current, power and control system faults. However, the items that are important to DP control are those used for control because it is essential that unwanted thrust is not developed.

5.5.2

The speed demand from the DP (or RR panel) is sent to the azimuth thruster converter’s PLC, which executes the command and receives the feedback from the motor from the incremental increment al pulse tacho. It is essential essential that this feedback does not fail or give incorrect data as unwanted thrust and/or a position excursion could occur.

5.5.3

The other failure mode that is potentially critical is the power limitation to prevent blackout should a diesel generator trip tr ip for example. example. The PMS has serial communications with the drive converter PLC but the critical speed signal is hardwired and there is an analogue back up. When power limitation limitation is is calculated to be necessary (true or false diesel generator trip signal) a single contact opens and the output power of the thruster drive is reduced to 100kW for 3 seconds irrespective irrespecti ve of speed.


| 47

Failure Mode Drive motor trip

Converter trip

Speed control fault Lube oil pump fail Azimuth motor fail Azimuth feedback fault Unwanted power drop Loss of control air Power Limitation too late

Cause(s) Mechanical fault Electrical fault Lack of cooling Mechanical fault Electrical fault Lack of cooling Wire break

Effects

Electrical fault Mechanical fault Electrical fault Mechanical fault Wire break

Alarm only

Wire break

Small position excu excursion rsion

Leak or reducer fault Hardware or software fault

Possible reduced seal pressure Blackout one 690V board

Comment

Reduced DP capability


Unwanted thrust

Reduction rotation speed Thrust in unwanted direction

Small position excursion if stopped quickly

Azimuth feedback difference alarm Alarm and operator operator can decide Alarm and operator operator can decide No immediate effect Small position excursion if safe Limits not exceeded

Table 5-2: Azimuth Thruster Failure Modes

5.5.4

The azimuth thrusters thruster s have several control contro l locations. locatio ns. They each have local controls, there is a control board in the engine control room plus aquapilot control panels and there are control units, interface units and three control lever panels on the bridge plus the DP and autopilot. The independence of these units was verified verif ied on trials, confirming that when in DP none of them should be active and no single fault or act of maloperation should make them so. The interpretation interpr etation of the latter point has to be reasonable. This means that maloperation has to be a mistake rather than an action to cause a problem deliberately and this is unlikely, as the permit to work system does not allow any work to be undertaken on critical systems during DP operations. Simple faults can include wire break, shorts and earth faults.

5.6

Thrusters Emergency Stops

5.6.1

The thruster emergency stops are located on each control panel and are connected directly to the main drive motor starters. They are independent of the control system and will shut down the main motor.

5.6.2

The emergency stops circuits are NC circuit. In case of a wire break / open circuit in a thruster emergency stop the thruster will stop. The thrusters emergency stops are are within reach of the DP Operator and protected against accidental activation.


| 48

6.

DP CONTROL SYSTEMS

6.1

DP21 Computers

6.1.1

There are two independent but linked microprocessors microproce ssors (Single Board Computer – SBC based on Intel 960 RISC processor) which take the input data received from a range of sensors using a master/slave relationship and generate the signals to the thrusters required for position and heading control. The system for the console computers is a Windows TM NT – 32-bit operating system but this is just used for display purposes. purposes. The actual control is executed by the computers (SBC’s) in the Kongsberg computer cabinet located in the void space beneath the bridge.

6.1.2

The two (DPC) computers operate in parallel each individually receiving input from sensors, reference systems, thrusters and the operator and performing the necessary calculations. calculatio ns. However, only the on-line computer (master) controls controls the thrusters. Switchover between the computers (master/slave) may be either automatic or manual. It is automatic if failure failur e is detected in the on-line computer. Continuous comparison tests are performed to check that the two computers read the same inputs and give the same outputs. output s. If a difference differe nce occurs, warnings and and alarms are reported from each computer. The weak point in a dual redundant system is the ability to determine which computer is wrong. The operator operator therefore therefore could choose the wrong one. In practice, this difference is rare.

6.1.3

To meet DP Equipment class 2 at least least three position position references references must be available, whereby the system can exclude a failed or degraded position reference and still keep position. This vessel is configured with four different different position references i.e. DGPS, DGPS , HPR (Simrad HiPAP), a taut wire and an MDL Fan Beam. During the DP trials, the fan beam was not available, but it had had been commissioned commission ed earlier during customer acceptance acceptance trials. tr ials. It will only be hired on a project project basis. The Consequence Analysis warning does not take position references or sensors into account but reacts purely on low power availability or insufficient thrust (thrusters and generators).

6.1.4

Both computers and all interface boards are located in the upper cabinet cabinet whereas power supplies are sited in the lower cabinet. Although the CPU’s and the power supplies are separated, the interface boards are serial linked with both computers connected to each board. There are analogue boards for the thruster, MRU signals and digital boards for other data. There are two separate cards, one to handle all inputs and one to handle all outputs. outpu ts. Each will have galvanic isolation so no single fault can degrade more than one system.

6.1.5

Two i nt e r n a l Power Power Supply Units (PSUs) (PSUs) are mounted to the computer cabinet. cabinet. Their function is to generate a stable reference voltage for the potentiometers used for the feedback signals.

6.1.6

A ‘redundant’ ‘redunda nt’ Ethernet is installed between both computers comput ers and the operator stations. In case network A fails, B will take over and vice versa. However, each has the same data and same software so if the on-line net is overloaded so too will be the backup. It is important that this cannot happen.

DP CONTROL SYSTEMS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 49

6.1.7

The SDP system system has has only very very basic basic features for hardware error detection of the interface interfa ce and the network hardwar hardware. e. The operator operator has to be extremely experienced in order to identify the problem when an error occurs and take the necessary corrective actions in time.

6.1.8

To take command of the thruster in DP a changeo ver switch is located on the forward bridge. It is directly hardwired to each thruster controller and a single failure of the switch should not be able to disconnect more than one thruster from DP.

6.2

Operator Consoles

Courtesy: Kongsberg Simrad 6.2.1

Three operator stations (OS) with similar consoles are installed on the bridge brid ge and they all have the same functionality functionalit y including a joystick. OS1 is located on the bridge forward midships, while while the t he other units are located on the bridge aft, to port and starboard.

6.2.2

The 230V power supply to the consoles OS #1 and OS #2 comes from UPS UPS 1 and UPS 2 respectively. respect ively. Each OS is also supplied with 24V. The 24V is fed from the 230V via a 230V /24V converter. converter. The screen of each console is divided divided into one large area on the right and two smaller areas on the left and the size of these areas cannot be changed. Each of the areas can display a separate page of information, which can be selected by the operator.

6.2.3

Alarms are displayed when the “Alarm” button on the keypad is pushed. All the alarms are presented on an overlapping window on the screen of the console where the button is pushed. When an operator has to input information this is also done using overlapping windows, which always show up at the same location on the screen. The cursor is positioned directly on the input window. The pointer can be moved using a trackball and selections are made using one of the three buttons in front of the trackball.

6.2.4

Colours can be selected from t w o palettes (e.g. Daylight Daylight and Night). The ‘Night’ palette has different colours and easy to split information and commands can also


| 50

be made using the push buttons but they all look alike. No colours are used to distinguish functions but they do have text and when a button is pushed an indicator light will illuminate showing the function function has been selected. Critical buttons buttons are double push non-critical buttons are single push. Therefore, surge, sway and yaw for example are double push.

6.3

DP Control Modes Functions

Courtesy: Kongsberg Simrad 6.3.1

The standard DP control modes are implemented which are standby, manual (joystick) and auto position. Mixed modes between manual and auto give automatic control of heading, X-axis and Y-axis either separately or combined. When all three are selected an automatic switch to auto auto mode is made. The system has in addition ‘High Precision Control’, ‘Relaxed Control’ and ‘Green Control’.

6.3.2

In principle, these modes are promoted to reduce thruster wear and use less fuel. Generally, operators experiment with modes and gains and then use only a few combinations. combination s. Other modes include Auto track (low speed & high speed) and fixed and variable azimuth mode.

6.3.3

The wind, gyro and VRS/MRU sensors used by the DP system cannot be directly selected from the keypad. Instead, a dialogue box on the screen is used where the sensors have to be enabled enabled and the preferred sensor has to be selected. selected. On the keypad, a button only controls whether the gyro, VRS/MRU and wind inputs are made available to the DP control system.

6.3.4

The management of position references is of primary primar y importance impor tance because the DP control system acts immediately on position error and, for good position performance, needs new data at one-sec ond intervals. intervals. Clearly, there is a need need to: filter noise

•

determine the relative weight of each

•

•

6.3.5

correct for vessel vessel motion (roll and pitch)

To help the above process a Kalman Filter uses the mathematical mathemat ical model of the vessel to predict the position excursions of the vessel that are reasonably reasonably possible p ossible in the conditions sensed over o ver the last 10 or 20 minutes. It is self-adaptive self-adapt ive so reducing the noise of the the position (and heading) heading) inputs. It can increase increase reliance on


| 51

the model when the position references are poor. It can also provide ‘dead reckoning’ when there are no positi position on referen reference ces s accepte accepted d an d cal ibrat ed t hu s providing a “fill-in” while another position reference is made available. It is essential essential that the tuning of the Kalman filter is correct so that it improves performance in all conditions not just some environmental conditions. It is most useful when the conditions are marginal and these conditions are really needed for the trials. 6.3.6

DP consequence analysis must be selected when undertaking undertak ing DP 2 work. work. The analysis provides a warning to the DPO. Checklists should be used to ensure the analysis is running when undertaking undertakin g DP critical work. The analysis however should should not be relied upon because it takes three consecutive calculations over three minutes all to say ‘failed’ before befor e a warning is given. So safe working limits can be exceeded for some time, time, even 15 minutes before the operator is warned; a good operator is therefore better than this analysis. The facility facility works well when there there is a steady steady increase of environmental load from current. It does not work well in squalls.

6.4

IJS System

6.4.1

An independent joystick (IJS), is situated on the Bridge. The IJS utilizes a totally independent hardwired interface to each individual. The IJS is therefore considered as the last resort should there be a total network failure.

6.4.2

The IJS controller is powered from the 230V ENSB PS.

6.5

Motion Sensors

6.5.1

There are two motion sensors of the type Seatex on on board, one MRU-H (MRU1) and one MRU-5 MRU- 5 (MRU2). (MRU2). Both MRUs are ar e used as sensors to t o the SDP. MRU 2 is also directly direct ly used for the HiPAP and connected to the MBES MBES (EM3000). MRU1 is connected to the EA600 echosounder and can be connected to the HiPap if MRU 2 fails. The MRU system uses solid-state solid -state device device to measure the roll, pitch and heave rate. Integrating these signals gives the roll, pitch and heave measurements.

6.5.2

The MRUs MRUs are powered from the DP system. MRU1 is supplied from the DPC and MRU2 is supplied from UPS2. The MRU data is fed as ± 10V dc signals. Loss of these signals from these inputs will cause an alarm in the DP consoles once failure failur e is detected but this is difficult diffic ult if there is little motion and the vessel is not inclined.

6.6

MRU Failure Modes

6.6.1

When the measured antenna or transponder position is corrected erroneously with wrong inclination inclinat ion data, the DP system will react and degrade the station statio n keeping. A slow drift of the input is dangerous because b ecause itit will not be immediately immediately detected. When the difference between the two units exceeds a pre-set limit (1deg), an alarm is given and it is up to the operator which VRS to select as input to the DP system.


| 52

6.6.2

The HPR default setting is MRU 2 so if this unit has a fault so does the position data from the HPR. If MRU 2 is also selected as “preferred” then all position references will have a fault: the effect of this is a degraded position performance at best and a drive off position at worse. However, there is a way of switching over to MRU 1 in the software by means of manual selection. It is still advisable the Checklist should make MRU1 preferred so that the DGPS and Fanbeam (when fitted) are corrected by a different MRU (MRU1) to HPR (MRU2).

6.7

Gyro Compasses

6.7.1

The vessel is is equipped with three gyros; all three are the same t yp e (Navigat (Navi gat X MK1, MK1, Mod 10-4914). The gyros are located in the void space beneath the bridge. All of the gyros are interfaced to the SDP 21 and the operator must select the preferred gyro. No.1 gyro is used by the HPR. In this case, another gyro must be selected selected as preferred because the fan beam and DGPS may not be given a unique gyro input and will provide relative fixes to the DP control system.

6.8

Gyros Failure Modes

6.8.1

The gyros are treated in a similar way to the position references but because they are the same their characteristics will be similar and the identification of a rogue gyro more easy. The chances of a common fault failing all three gyros is negligible: they all have separate power supplies.

6.8.2

The difference alarm should be set at 2 deg. The output from these these gyros is also quite secure (serial line NMEA-0183) and loss of this connection is immediately alarmed. Only the slow drifting of the preferred gyro when only two are available presents a DP hazard but the vessel is no longer DP2 in this condition.

6.8.3

Single point gyro failures can occur due to corrupt latitude and speed correction data from DGPS. It is imperative that these corrections are set to “manual” during DP Operations.

6.9

Wind Sensors

6.9.1

The vessel is equipped with two analogue wind sensors, both manufactured by RM Young. Both wind sensors measure the wind speed and direction, which is used in the DP mathematical model to calculate the thrust needed to balance this force. This is added to the thruster allocation logic immediately to compensate for the calculated wind force (wind feed forward).

6.9.2

Both wind sensors are placed on the navigation mast (forward & aft positions) above the main bridge. Both units are supplied from UPSs (wind sensor 1 UPS2 F8 and wind sensor 2 UPS1 F9) and both should be enabled whenever possible.


| 53

6.10

Wind Sensors Failure Modes

6.10.1

When both units are enabled difference, difference, alarms are generated for wind speed and direction to alert the operator of a mismatch. This feature can be a nuisance at times but it is better than having just one selected because a failure in speed or direction can cause a position excursion and degrade the DP mathematical model.

6.10.2

Complete loss of the wind speed signal (RM Young wind sensors) when there is some wind, > 5 knots will cause an alarm. However, loss of the direction feedback can cause an acceptable (to the DP) shift and a sudden unwanted increase in thrust.

6.11

Hydro Acoustic Position Reference (HPR)

6.11.1

The HPR system is named “HiPAP” (“High Precision Acoustic Positioning”) and is designed for water depths from very shallow to deep-water (2000m) looking straight down with a standard unit. The transducer extends below the hull through a gate valve and comprises a semi-spherical semi-spheri cal transducer with over 220 elements. Electronic controls nearby within the vessel enable beam directional transmission and focused reception in the direction of the transponder, thus improving the signal to noise ratio. This is important because the base line is very short (only the distance of the head itself).

6.11.2

The system calculates the subsea position of a transponder relative to the vessel mounted transducer transducer unit. The directional stability stability of the unit is obtained by firstly fixing fixing the transponder location by a wide beam and subsequently narrowing the reception beam towards the transponder. The system uses a digital beam form, which takes its input from all the transducer elements. The system controls the beam dynamically so it is always pointing towards the target, roll, pitch and yaw is input to the tracking algorithm to direct the beam in the correct direction thus enabling the correction for these motions to be effectively applied continuously.

6.11.3

The system calculates a variance for its measurements, determines the system accuracy and standard deviation. The HiPAP has a built-in Kalman filter, which improves the stability and accuracy of the initial narrow beam optimisation but does not interfere with raw data being sent to the DP control computers. Raw data should be used because filtering causes a lag, which can cause instability.

6.11.4

The transducer is directly hardwired hardwired to the HiPAP OS. The system is supplied 230V from UPS-2 and the transducer hoist system is powered by 440V AC from EDDP1 for safe recovery in blackout scenarios and is supported by emergency generator changeover.

6.11.5

The performance of HiPAP is also dependent on the gyrocompass and the MRU. This is a weak point, as the reference is dependent on both the MRU MRU and gyro. The HiPAP is, however, a single reference in a vessel with four position references and a backup DGPS.


| 54

6.12

HPR Failure Modes

6.12.1

There are many failure modes of this system but the majority are detectable either by the system itself or by the DP control system. Failure Modes that are a risk because they are not detected are: •

reduced performance performance (failure (failure of some of the heads)

lost transponder(s)

•

•

•

dragged transponders transponder s when tethered on wire or rope loss of signal and/or refraction noise from thrusters and/or other vessels.

6.12.2

The performance perform ance was bench marked on trials so that an initial value was established establis hed and can be verified several several times on an opportunitybasis opportunity basis so that any reduction in performance can be quantified.

6.12.3

All vessels vess els approaching should be warned war ned if acoustics are being bei ng used. They should switch off echo sounders if they operate close to the frequency being used by deployed transponders.

6.12.4

Noise interference is also a problem when working in heavy weather; noise turbulence and vibrations will cause occasional signal loss. The extent to which this is a problem will depend on the machinery noise and current. If operating with only DGPS and acoustics, failure of the DGPS can cause increased thruster activity that in turn causes loss of the acoustics and a loss of position to take place.

6.12.5

Transponder battery failure can also be experienced at any moment. If only one transponder is deployed, a single failure will disable the HiPAP. Again, on this class of vessel, this failure is not dramatic assuming good quality satellite reference and fan beam data are available. A log of transponder battery use should be carefully kept.

6.12.6

Online help is provided within the HiPAP software and the Operator can access this valuable feature whilst in operation. The help format follows similarly from that provided in the SDP software, being indexed alphabetically or in groups. Help for both HiPAP and SDP follows the Microsoft Windows conventional interface and is simple to operate.

6.13

DGPS

6.13.1

The vessel is fitted with with four DGPS, three of which are dedicated for DP use only. DP DGPS No.1 is a Subsea 7 Veripos system receiving differential corrections simultaneously from Spotbeam and Inmarsat communications satellite. DP DGPS No.2 is a Litton MX420/8 receiving differential corrections from coastal MF stations. DP DGPS No.3 is a C-NAV 3050 receiving differential corrections corr ections from Spotbeam. All these three DGPS are interfaced with SDP21 system using NMEA-0183 serial line. The fourth DGPS is a Litton LMX420/AIS and is used for navigation systems and not connected to the DP.

6.13.2

The Global Positioning System (GPS) is a highly accurate, satellite based navigational system, which permits a land based object to fix its geographic position using Doppler phase shift techniques. In order for the Earth station to calculate the fix position, a


| 55

minimum of four transmitting satellites (above its radio horizon) is required. The DP system is set to reject the DGPS if less than five satellites are available. 6.13.3

By calculating the naturally naturally occurring error at a known location, it is possible to obtain a differential correction figure, which can be applied to mobile offshore stations using the GPS system. This technique, known as Differential GPS (DGPS), enables the precise fixing of a vessel’s position with sufficient frequency for it to be used as a position reference for DP operations. This technique improves the position accuracy of the GPS system to within metre accuracy.

6.13.4

The antennas for the GPS system and the differential differentia l corrections correctio ns are distributed to different locations on the wheelhouse roof. The difference in antenna locations is to ensure that they will operate with different satellite constellations. constellat ions. The DP operator will need to ensure that they operate with different correction signals. The differential signals should be input into the DGPS from two different sources.

6.14

DGPS Failure Modes

6.14.1

Possible failure modes for the DGPS are: •

•

•

•

GPS signals blocked by structure Reception of reflected signals causing range jump Reflected signals may combine combi ne with direct signals and and cause fading fading or signal loss Loss of correction signal.

6.14.2

The performance was bench marked on trials and it was confirmed that no shadow areas existed. When the vessel vessel is operating operating within the 500m zone zone of a large large installation this will need to be verified.

6.15

Fan Beam

6.15.1

The vessel has an interface for an MDL fan beam. beam. A Fanbeam Mk4 was fitted and commissioned in Nov 2012 for a ne w vessel contract and is a temporary additional relative reference system. The Fanbeam is a laser based position reference system, which can input the vessel’s relative position from a fixed structure, into the DP system, to be used in conjunction with other position reference systems. This system is fed directly from 230VAC UPS 2 (PDU 2).

6.15.2

The system uses the principle of laser range finding by measuring the time taken for a pulse of laser light to travel from the laser source to a target and back to the detector. The requirement to have an accurately pointed laser transmitted from a moving platform to a stationary target is achieved by using special laser optics, which transmits a laser beam in a 20° vertical fan. By scanning this fan horizontally, horizontall y, the target can be accurately tracked and have its bearing relative to the vessel’s heading and range determined. This information is then inputted into the DP system.


| 56

6.15.3

A pulse generator drives the infrared semiconductor laser diode at at a rate of 7500Hz to produce the 20° laser fan. These light impulses impul ses are adjusted for the line of sight and emitted by the transmitting lens to produce a vertically diverging and horizontally parallel beam. The reflected beam is picked up by the receiving lens and converted to an electrical signal by a photo diode. The time interval measured between the transmitting and receiving of the beam is used to compute the range.

6.15.4

The accuracy of the horizontal angle is achieved achieved by detecting every echo from the laser and reading the echo for each echo. Once the laser has passed over the target, the angles are averaged, providing an angle to the centre of the target. Therefore, accuracy is not dependant on target size. The echo signals are averaged to increase the range accuracy. To achieve a range accuracy of +/-20cm at least five echoes are required from the target. t arget.

6.15.5

The scanner is mounted on a rotating table which is driven by a stepper motor and a precision worm and wheel that results in a resolution of 0.01°. A high accuracy optical encoder mounted directly on the laser shaft measures the angular position of the laser.

6.15.6

The scan speed is automatically automatical ly controlled controlle d by the system software according to the target range with parameters seen in the table below: Target range (m) <100 100>250 250>500

Fanbe am Speed Fanbeam Spee d ( °/sec /sec)) 50 30 15 Figure 6-1: Fanbeam Scan Speed

6.15.7

The Fanbeam is only effective as a position reference system within approx. 250 250 metres range of the target.

6.15.8

The equipment configuration can be seen below.

Figure 6-2 - Fanbeam Configuration


| 57

6.15.9

The scanner is located in such a position that it allows a clear line of sight in all directions where the targets are to be installed.

6.15.10 The scanner head h ead can rotate through t hrough 360° and has vertical vertic al adjustment of +/- 15° in 5° steps, which allows for large variations between the height of the vessel and target. 6.15.11 The quality and type of material used for reflectors reflector s are critical to the reliable operation of the Fanbeam. Good quality reflective tape can be used on a cylindrical mounting of no less than 150mm and no more than 250mm diameter and 100mm in length. This will give a good target up to 150m, (depending on conditions). conditions) . Retro Prism will give good accuracy between 150 and 1000metres, (depending on conditions), as they can reflect the laser beam +/- 30° from the prism centre line. For accuracy between 1000 and 2000m, a stack of six prisms is required. 6.15.12 It is essential that the targets are mounted in areas that are clear of obstructions and away from lights and other surfaces containing reflective material, (e.g. life rafts or lifeboats). They should also also not be located close to walkways where reflective strips on coveralls or jackets may cause confusion regarding which target the Fanbeam is tracking. 6.15.13 The system is interfaced to the SDP-21 via the universal control unit (UCU); the data is also displayed on a monitor. The target is passive, consisting of a simple reflective item installed on a nearby installation. 6.15.14 Disadvantages are inoperability inoperabilit y in bright sunshine or with heavy rain and fog, bright bright lights near the target or other reflective items. Power loss will require resetting of the system. The assembly has to be installed in a protected location as rain and salt spray might obscure the lenses and affect the operations (see IMCA report M 131, “Review of the use of the Fanbeam laser system for dynamic positioning”). As the maximum range of the system is, 2000 meters it can be used only when operating near an installation.

6.16

Failure modes of the Fanbeam

6.16.1

The possible failure failur e modes of the Fanbeam are: • • • • • • • • • • •

6.16.2

Signals can be blocked by dirty transmitting, receiving lenses or physical obstacle. The acquisition of false targets, e.g. reflective tape on working gear, lifeboats etc. Signals can be distorted by a low rising or setting sun. Inclement weather, e.g. heavy rain, snow or fog can reduce system efficiency. Frozen range or bearing. Jump in range or bearing. Intermittent Intermitt ent signal. Loss of power supply. Loss of serial line to DP control system or Fanbeam processor failure. Loss of encoder feedback. Seizure or malfunction malfunctio n of scanner head.

Signal blocking will will not occur due to a dirty lens provided the Fanbeam recommendations recommendatio ns for regular cleaning are followed. Signal blocking by other means must be avoided by careful placement of the reflector and following operational


| 58

procedures. However if blocking occurs, the Fanbeam will be rejected by the DP control system and an alarm given. 6.16.3

Intermittent Intermitt ent signal blocking might occur during heavy precipitation precipita tion or fog. This would affect the DP if there is not a clear failure, however, the Fanbeam’s range checks will detect this and reject the target. Also the target can be lost if it is obscured by dust, fog or smoke.

6.16.4

Fanbeams have been known to lock onto false targets such as reflective jackets, etc. on personnel. The DP control system’s median check will will reject a false target, as it will cause the Fanbeam to diverge from the other reference systems.

6.16.5

Low sun or bright lights can affect the Fanbeam; their effects though will be noticed by the level checks of the Fanbeam and the target rejected. Alongside a platform, low sun is unlikely to be a problem as the target will be masked from the sun by the platform and the vessel. Bright lights on the platform could present a problem and the operator will be aware of this.

6.16.6

Loss of power to the Fanbeam, loss of the serial line to DP control system or Fanbeam processor failure, will result in the DP timing out the Fanbeam, alarming and rejecting it.

6.16.7

Loss of control of the scanner will mean that the target will be lost or at least move outside the Fanbeam window check. It will therefore be rejected by the DP system and and alarmed. The Fanbeam can be affected by a number of factors, but as long as it is carefully monitored by the operator, it can provide an invaluable and highly accurate reference.

6.16.8

It is very difficult to find an ideal location for the scanner unit, as there are always competing claims for the highest, clearest position. The scanner is likely to have a number of blind spots caused by aerials and the mast itself.

6.17

Taut Wire

6.17.1

The vessel has a Bandak LWTW LWTW (light weight taut wire) Mk Mk 14B installed as a position reference for shallow water. This system is an electro-hydraulic-p electro-hydraulic-pneumatic neumatic system that requires a 440V, three phase power supply and compressed air between 6 and 10 bars. The instrumentation uses a 230V single-phase supply. The taut wire wire is, as the name suggests a tensioned wire that in this case is held in constant tension by a weight on the seabed and a winch and servo system on the surface. The tension compensating system is pneumatic with air cylinders controlled by a pressure regulator. The length of of the wire and the alongships and athwartships angles are measured and used for the calculation calculatio n of position. position. Therefore, the position of the seabed weight is the position of the wire suspension point adjusted for by the wire wire angle and the vessel motion. The position of the vessel is determined from this after allowing for the offsets of the taut wire head position.

6.17.2

The taut wire has its own control system (Telemecanique (Telemecaniq ue TSX Micro PLC system) and local and remote control panels. The weight should initially be deployed locally but one deployed and the “mooring” is on operations of re plumbing can be executed from the bridge.


| 59

6.18

Taut Wire Failure Modes

6.18.1

The failure modes of the taut wire are therefore as follows: • • •

• • • • •

• • • •

Drag of the weight from poor tension control or operator error Snagging of the wire/weight by objects / ROV on the seabed Tension too low and poor position data Air failure 440V failure (will prevent recovery only) 230V failure PLC fault Wire against ship’s hull and no change in position positio n given when position is being lost Broken wire and loss of data Error in one pot meter or broken wire wire of one No or wrong motion corrections Incorrect Incorrec t wire length (water depth) giving wrong position positio n change data.

6.18.2

All the above failure modes are detectable if three different position references are on line but if only two are in use a drive off is possible from a single taut wire failure. The hardest for the DP control system to detect is the failure or fault in one potentiometer as the position itself will show change but the failure in one axis might be missed and the weighting kept high. Zero change in both pots will cause immediate rejection as will a wire break. break. The set- up of the taut wire wire should always always give an alarm before the ship’s side is touched but sometimes this alarm is not adjusted for a list angle.

6.19

Position Positi on Refe Referenc rences es a n d Weighting

6.19.1

The vessel is provided with a wide range of position references to provide the operator with various options to ensure accurate tracking of position, regardless of exterior factors. When preparing to operate on DP it is essential, that due regard is taken of factors, which can influence the different systems.

6.19.2

The weighting weighting assigned to each sensor within the DP system is determined by the operator. It is essential that that three separate systems operating on different different principles are employed, such as LTW, DGPS and HPR. In this way, failure of any one system will leave the two remaining units uninterrupted and the system in error will be outvoted.

6.19.3

When multiple units of sensor types are available, it is important that they are not given a disproportionate weighting, which could lead to a drive off.


| 60

7.

COMMUNICATIONS

7.1

Bridge

7.1.1

The bridge is fitted with the following follo wing shipboard communication systems: Auto telephone Talkback Dive Alert System VHF PA.

• • •

• •

7.1.2

The telephone system communicates with the engine room, all offices, cabins and internal work areas of the vessel.

7.1.3

The talkback system allows communication communicat ion from the bridge to the engine control room and thruster rooms.

7.1.4

The dive alert system is fitted to the bridge, engine control room and the cabins of of the Master, Chief Engineer and Dive Supervisor. In addition, a portable alarm panel, on a 20-metre cable is provided in the Buoy Workshop.

7.1.5

The VHF system communicates with the handsets provided to all duty officers.

7.1.6

The PA system has four operational zones being: •

Technical spaces

•

Accomodation

•

Open decks

•

Loudhailer

7.2

DP Alert System

7.2.1

The vessel is fitted with with a DP alert system with with repeaters in the following locations: Bridge

•

ECR

•

7.2.2

•

Diving area

•

Captain cabin

•

CE cabin

•

Operational Manager cabin

The DP alert system is powered from the 230V ELDP4.

COMMUNICATIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 61

8.

CONCLUSIONS

8.1

General

8.1.1

The Relume is designed to be operated with split systems so that the worst case failure is loss of one bow thruster and one propulsion thruster. This leaves the vessel with two thrusters operational, one bow and one propulsion thruster.

8.1.2

During DP 2 operations the vessel will operate with the bus-ties open.

CONCLUSIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 62

9.

RECOMMENDATIONS

9.1

“A” Recommendati Recommendations ons – Essential None.

9.2

“B” Recommendations for serious consideration

9.2.1

None.

9.3

“C” Recommendations Recommendations-- For future consideration / general improvement

9.3.1

None

RECOMMENDATIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

| 63

10.

TABULATED FAILURE MODES

Power Generation Failure Modes Failure Mode

Loss of one pair of engines

Mechanical Failure

Cause(s)

Probability

Local Effect

Fuel failure due to Fuel starvation Fuel contamination

Low

Engine stoppage

Catastrophic engine failure

Very low

Failure of engine (piston, piston piston rod, cylinder relief v/v, crankcase explosion, governor failure

Low

Mechanical failure of shaft between engine and generator

Low

TABULATED FAILURE MODES FMEA OF OSV "RELUME" GLOBAL MARITIME MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

Final Effect

Loss of 50% of generation capacity

Criticality

Remarks

Minor

Other two engines supplied from separate fuel tanks, will provide adequate power to maintain DP and position.

Two engines shut down

Increased load on Loss of power from remaining Minor one engine generators, vessel maintains position

| 30

Minimised by good maintenance & procedures. Catastrophic engine failure could cause loss of whole engine room


Electrical Failure

Cause(s)

Probability

Local Effect

Final Effect

Criticality

Remarks

Minor

Alternate engine room will provide adequate power to maintain DP and allow the vessel reach a safe situation.

Generator failure (windings, (windings, stators et c.)

Low

Loss of power from one engine

Possible failure of other engine on the same switchboard on reverse power

Generator failure (AVR)

Low

Defective generator will be tripped

Running generator take additional load

Loss of power to fuel injection system

Low

Engine shuts down

Possible loss of Minor other engine if it is unable to take sudden load


| 31

Alternate engine room will provide adequate power to maintain DP and allow the vessel reach a safe situation. (see also power management)


Cause(s)

Probability

Local Effect

Final Effect

Criticality

Remarks

Pump failure Air in the system Inadequate flow of sea water

Poor maintenance

Remaining central cooler has 100% capacity for all engines

Low

High FW temperature

Loss of one central Minor cooler

Medium

Low pressure alarm start standby

None

Minor

Low

High diesel generator temperature

Engine S/D

Minor if problem isolated

None

Minor

Standby compressor available

Partial loss of engine start capability

Minor

Split system

Leakage

Remaining cooler takes suction from the other side of the vessel

Blocked intake Pump Failure

Relies on stand-by starting

Faulty control valve Inadequate cooling

Leakage from cooler Air in system

Early warning possible Temperature rise is not sudden

Failure of flexible coupling Compressor failure

Low Loss of engine start capability

Loss of start air Leakage


Low

| 32


Loss of service air

Cause(s)

Probability

Local Effect

Final Effect

Criticality

Remarks

Compressor failure

Low

Reduction in air pressure

Loss of air to header tank

Minor

Back-up supply available from main starting air system via reducer

Drier failure

Low

Moisture in system syste m

Erratic operation of pneumatics


| 33

Minor

Diesel Generator Failure Modes Failure Mode

Cause(s)

Probability

Local Effect

Final Effect

Criticality

Reverse power trip

Excessive Excessi ve vibration

Mechanical Mechanic al damage

Low

Generator S/D

Low FO pressure

Other engine Minor

Second generator s/d on reverse power Control Fault

Low

Generator S/D

Power loss

Low

PMS Failure

Faulty bus tie status to PMS

Other engine Minor

Operator may shut down healthy machine in error

Instability

Voltage loss

Low

Wire break

Low

Defective breaker


Loss of voltage control on generator

Generator S/D

Tripping of breaker

Loss of one engine

Split switchboard Engines running on low load

Low LO pressure

Overspeed

Remarks

Split switchboard Engines running on low load

Minor

Other engine Split switchboard

Low

| 34

Minor

Engines running on low load

Diesel Generator Failure Modes Failure Mode

Cause(s)

Probability

Local Effect

Final Effect

Criticality

Low

Loss of thruster


Minor


Minor

Remarks

Mechanical fault Drive motor trip

Electrical fault

Other thrus t hrusters ters Low load

Loss of cooling Electrical fault Converter fault

Low

Generator Generat or S/D

Loss of cooling

Other thrus t hrusters ters Low load

Speed control fault

Wire break

Low

Overspeed

Unwanted thrust

Minor

Lube oil pump failure

Mechanical

Low

Minor

Low

Auto start of standby pump

Alarm

Electrical Mechanical

Low Loss of thruster


Minor

Electric motor fail

Small position excursion if stopped

Other thrus t hrusters ters

Electrical

Low

Azimuth feedback failure

Wire break

Low

Loss of control

Thrust in an unwanted direction

Minor

Alarm & operator to decide shut down

Unwanted power chop

Wire break

Low

Reduction Reducti on in thrust


Minor

Other thrusters available

Hardware fault

Low Excessive thru t hrust st

Blackout of one 690V board

Major

Power Power chop too t oo late Software fault

Low


| 35

Low load

Split switchboard Thrusters on 50%

Network Failure Modes Failure Mode

One PMS fail

Cause(s)

Power loss or overvoltage

Probability

Local Effect

Final Effect

Criticality

Low

Generator S/D

One PMS link fail Wire break

Low

None

Both PMS link fail Wire break

Low

DG operate independently

Failure of U42 analogue board

Low

Loss of board and Loss of T1 and T3 Major feedback

Internal short circuit

Possible reverse Minor power trip of other engine

Alarm

Remarks

Split switchboard

Minor Vessel remains on DP Position loss possible depending on weather conditions

Failure of U51 analogue board

Internal short circuit

Low

Loss of T2 & T4

Major

Vessel remains on DP Position loss possible depending on weather conditions

Loss of DPU 3 or DPU 4 Loss of DPU 1 or DPU 2

Internal short circuit Internal short circuit

Low

Loss of one DG

Loss of one engine Minor

Split switchboard

Low

Loss of info on 2 DG

No effect

Others only


Minor

| 36

Network Failure Modes Failure Mode

Cause(s)

Loss of DPU 5

Internal short circuit circ uit


Probability

Local Effect

Final Effect

Criticality

Loss of info on bow thrusters

Thrusters continue to operate

Minor

| 37

Remarks

DP Control System Failure Modes Failure Mode

Loss of UPS 1

Cause(s)

Failure Fail ure of unit

Probability

Low

Local Effect

Loss of output

Final Effect

Loss of:

Criticality

Minor

DPC – 21 A(PU1) SPP OS1

Remarks

Other DPC – 21 B takes control

Fan Beam Loss of UPS 2

Failure Fail ure of unit

Low

Loss of output

Loss of:

Minor

DPC – 21 B (PU 2) SDP OS2 HIPAP Loss of HPR

Loss of wind sensor

Input failure

Medium

Power failure

Low

Input failure

Medium

Power failure

Low

Inadequate Poor geometry and Medium satellite coverage shielding from platform


Prediction error, HPR

Other HPR(s) functioning

Minor

Prediction error, wind sensor manually deselected DGPS rejected if other position references

Other wind sensor(s)

Minor

functioning Loss or degradation of position if only DGPS on line

| 38

Minor (Major if only Relies on good DGPS procedures used)

DP Control System Failure Modes Failure Mode

Cause(s)

Probability

Local Effect

Final Effect

Criticality

Remarks

Power failure DGPS 1 failure

Correction signal failure

Medium

No/failed input to Other reference DP, DGPS systems available rejected

Minor

Medium

No/failed input to Other reference DP, DGPS systems available rejected

Minor

Medium

Sensor out of range

Masking Configuration Power failure Correction signal failure DGPS 2 failure Masking Configuration Loss of vertical reference

Fan Beam Failure

Loss of target / false target Loss of serial link to DP

Sensor deselected Minor

At least two other sensor types should be in use

Loss of 24V Potentiometer meter fault Low Taut Wire failure fail ure Potentiometer (see others in report) TABULATED FAILURE MODES FMEA OF OSV "RELUME" GLOBAL MARITIME MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

No data or wrong Rejection by DP data in one axis control

| 39

Minor

Major if not detected or wrong

APPENDICES

TYPE APPENDIX NAME

TYPE APPENDIX DESCRIPTION

TYPE APPENDIX NAME - TYPE APPENDIX DESCRIPTION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

Relume FMEA

Recommend Documents