QHSEOFFICE DNV-MANAGING-THE-RISKS-of-BLACKOUT
QHSEOFFICE DNV-MANAGING-THE-RISKS-of-BLACKOUT
QHSEOFFICE DNV-MANAGING-THE-RISKS-of-BLACKOUT
OF BLACKOUT
For passenger ship owners and operators
GUIDANCE PAP ER
MARITIME Managing the risks of blackout
Content
Time for a step change in safety 5 4.1 Apply the principles of human-centred design 33
Step 1: Increase understanding of blackout 6 4.3 Improved integration, testing and verification 35
1.1 Investigate the underlying causes of blackout 6 4.4 Design effective blackout-recovery systems 36
1.5 Recommendations and best practices 11 Step 5: Prioritize and implement cost-efficient
Step 3: Identify measures to ensure safe and Appendix B: Guidance for FMEA analysis 45
3.1 Implement robust operating modes 18 closed-bus operations and blackout recovery 46
3.2 Ensure safe and reliable closed-bus operations 19 Appendix D: Enhanced system integration and
3.4 Manage software and networks 25 Appendix F: Enhanced blackout recovery test 51
3.5 Provide training and decision support for crew 26
3.6. Implement enhanced blackout testing 27 Disclaimer: This document is not meant to replace any
rules, regulations or guidelines that are in existence. It is
3.7 Implement dynamic barrier monitoring 29
a compilation of experiences, practices and information
3.8 Recommendations and best practices 30 gathered from various sources in industry. It is expected
that compliance with applicable class rules and statutory
requirements will be ensured.
2
MARITIME Managing the risks of blackout
Editorial
Most operators of passenger ships occasionally experience
blackout with subsequent temporary loss of propulsion.
The complexity and level of system integra-
Fortunately, most incidents do not have significant conse-
quences, as they usually occur while in transit in open sea. tion challenges our ability to understand in
Still, more can be done to reduce the likelihood that such
depth how these systems work.
events occur, so that they do not happen in more high-risk
situations. There is also a need to ensure efficient restoration
of essential systems once a blackout and/or loss of propulsion To support owners and operators in ensuring the
has occurred. safe and reliable operation of their fleet, DNV devel-
oped a stepwise approach for managing the risks of
The underlying causes of blackouts can often be traced blackout and resulting loss of propulsion. This guid-
back to the operation of complex integrated systems. In ance paper provides recommendations and best
order to reduce the carbon footprint and utilize new tech- practices for fleets in operation as well as newbuilds.
nology in a cost-efficient way, the systems tend to become
more complex at an ever-increasing level of integration. We invite you to compare these best practices
Today, the complexity and level of system integration against your own operations. We want to offer
challenges our ability to understand in-depth how these inspiration on how to ensure more robust and fault
systems work. This has become an increasing concern for tolerant operations of your ships.
the whole industry.
We look forward to engaging in discussions and
receiving your feedback. Together, we can drive the
safety in your business forward.
DNV
3
MARITIME Managing the risks of blackout
4
MARITIME Managing the risks of blackout
FIGURE 1
Scope
This guidance paper is written to predominantly spark dis- Stepwise approach to managing the risks of blackout
cussions with passenger ship operators and owners, such
as cruise, RoPax, and expedition/exploration ships. Many
of the principles, however, may be extrapolated to other STEP
5
Prioritize and implement cost-efficient
statistics, performed literature reviews, conducted work- prevention and mitigation measures.
shops with key industry operators and collaborated with
expert resources to gain insight into:
5
MARITIME Managing the risks of blackout
Step 1:
Increase understanding of blackout
In order to achieve a step change in safety for loss of propulsion, it is necessary to gain an
overall understanding of causes of blackouts and the regulatory framework. A barrier-based
and holistic approach to managing risk offers practical tools and a helpful mindset.
FIGURE 2
Owner/operator’s
requirements Performance requirements
Statutory requirements
(e.g. SOLAS, ISM)
Mandatory
requirements
Main class
6
MARITIME Managing the risks of blackout
7
MARITIME Managing the risks of blackout
SOLAS requirements on emergency power systems ER – enhanced reliability of propulsion, steering and
The SOLAS requirements state that the main and emer- electrical power; minimizing the risk of functional loss and
gency power systems shall be mutually independent, also enabling quick restoration
with respect to blackout recovery. In case of blackout, the EMR – enhanced manoeuvring reliability, targeting the reli-
interconnecting feeder between the main and emergency ability of the manoeuvring thrusters and the DP system
switchboards shall be automatically disconnected, and the OP – operational flexibility and predictability during ma-
two systems shall recover from the blackout independent of chinery damage or maintenance
each other. If the emergency power source is a generator,
it shall be automatically started and supply the required Voluntary notations – Redundant propulsion (RP and RP+)
services within 45 seconds. The range of RP notations give additional requirements
to ensure that the propulsion and steering systems are
Blackout recovery of both the main and emergency power redundant and arranged so that after a single failure as
systems is tested on board both during the newbuilding specified in the rules, propulsion and steering can be
phase and annually when in service. The tests shall ensure recovered within a specified time. For the RP(2,x) notation,
that blackout recovery of the two systems are mutually the failure modes include component failure, while for the
independent. higher notation RP(3,x), the systems shall be arranged with
segregation to also cover incidents of fire or flooding. For
SOLAS requirements for Safe Return to Port (SRtP) both RP(2,x) and RP(3,x), an additional qualifier, +, can be
The SRtP regulations apply to passenger ships above a included to further reduce the risk of functional loss; the
certain size, and the overall intention is to increase the systems shall be designed for continuous availability.
safety level and reduce the likelihood of evacuation. This is
achieved through more redundant and segregated system Voluntary notations – Dynamic positioning (DYNPOS and
arrangements, providing increased robustness and fault DPS)
tolerance after incidents of fire or flooding. The range of class notations for dynamic positioning cover
all types of vessels engaged in any dynamic positioning op-
Although SRtP does not specifically address blackout eration. The requirements to availability, fault tolerance and
events, the SRtP regulations ensure redundancy and robustness in the dynamic positioning capabilities escalates
segregated machinery arrangements that, depending on with the higher level of the notations. For the highest level,
the operational configuration, increase the reliability of the DYNPOS (AUTRO) and DPS(3), the DP systems shall be de-
propulsion and steering function. signed with redundancy and arranged with segregation to
provide continuous availability also in the event of compo-
New class notation – Operational Reliability (OR) nent failure or incidents of fire or flooding.
A new additional class notation, OR, specifically targeting
operational reliability, blackout prevention and system Always be prepared for the unexpected
recovery in passenger ships was launched in 2021. The All owners and operators must have contingency planning
notation builds upon the general principles of the SRtP for shipboard emergencies (as part of the ISM Code) in
scheme and extends the requirements with key elements place that to some degree can manage the unexpected.
and practices from the dynamic positioning and redundant Always being prepared for the unexpected is applicable
propulsion class notations. The OR notation addresses three to all operations and to all types of ships. We cannot rule
main areas covered by different qualifiers: out the unexpected, but this guidance paper can help to
manage the expected.
8
MARITIME Managing the risks of blackout
The management of major accident risk requires good Figure 3 shows a simplified bow-tie barrier diagram to
systems that capture the complexity and reduce the uncer- present the threats and barriers that contribute to increas-
tainty associated with major accidents. Barrier management ing/decreasing the likelihood of blackout and the mitigat-
is an approach that enables stakeholders to have a com- ing barriers to improve recovery. The bow tie is a generic
prehensive and common understanding – from design and aggregation of multiple Swiss Cheese models [13], each
throughout operation – of which barriers should be imple- presenting a single event trajectory.
mented to protect from hazards, and how these barriers
should be verified, monitored and maintained. The purpose of this generic bow tie is to be able to apply
it to any blackout incident to a) retrospectively understand
For the barriers to be successful in preventing hazards what may have gone wrong during an incident, and b) pro-
from developing into a major accident and in mitigating actively plan to improve the management of the relevant
the consequences of a major accident, barriers need to be barriers.
managed so that they perform as expected.
In Figure 3, power generation, power distribution and
Simplified bow tie for blackout electrical consumer failures (e.g. failures in pods) are threats
Bow tie is one of many barrier visualizations of risk models that may result in blackout (and loss of propulsion). In gen-
that are available to assist in the identification and man- eral, there are barriers to prevent electrical and mechanical
agement of risks. The benefits of using bow ties is that they failure, and barriers to prevent fault escalation, in case the
visualize the risk you are dealing with in just one, easy to first barrier fails.
understand diagram. The diagram is shaped like a bow
tie, creating a clear differentiation between preventive If the preventive safety barriers fail, it will lead to a blackout
measures (reducing frequency/probability) and mitigating and ultimately loss of propulsion. Mitigation barriers are
measures (reducing consequences). then intended to ensure automatic or manual recovery. The
objective of the barriers is to avoid sustained loss of propul-
sion, with potential consequences such as drift grounding,
an allision, collision or heavy rolling.
FIGURE 3
Drift
Power generation grounding
failure
Blackout
Power distribution (loss of Sustained blackout
(loss of propulsion) Collision
failure propulsion)
9
MARITIME Managing the risks of blackout
FIGURE 4
10
MARITIME Managing the risks of blackout
Systematically monitor trends in blackouts and propulsion losses, and report KPIs
(e.g. recovery time during a drill) to senior management.
Be familiar with the limitations of main class requirements regarding blackout and
loss of propulsion.
Understand
Understand the main differences between the various voluntary
the regulatory
notations.
framework
Be familiar with the vessel-specific systems and their limitations which can prevent
blackout and support recovery of propulsion.
Ensure that the interdependencies between the HOT elements are addressed in
strategies and operational plans for blackout prevention and recovery.
Communicate an aligned approach that accounts for each of the HOT elements in
preventing and mitigating loss of propulsion.
Establish a holistic
risk picture Create a low-hurdle infrastructure for all employees to communicate feedback on
the strategies and operational goals back to the organization.
11
MARITIME Managing the risks of blackout
Step 2:
Define the organization’s safety ambition and
manage conflicting goals
Setting an ambition for minimizing the risk for and mitigating the consequences of loss
of propulsion at an organizational level is the first step to ensuring safe and effective
operations. Owners and operators need to agree internally on their ambition, so that they do
not run the risk of prioritizing other organizational goals at the expense of safety.
• Reduce number of loss of propulsion incidents in critical operations to X events per year.
• Reduce number of blackouts / loss of propulsion incidents to X events per year.
• Zero blackouts / loss of propulsion incidents in critical operations.
• Recovery of propulsion within X minutes/seconds.
• Recover propulsion before losing steering speed.
• No single failure of a component shall have a greater effect on the vessel’s ability to maintain propulsion and steering
than the loss of X generators/thrusters on the same bus section. Such a failure represents loss of X% of power
capability.
12
MARITIME Managing the risks of blackout
Some transformations and conflicts that may influence how This strategy will likely call for widespread uptake of
management and crew operate ships today are: zero-carbon fuels, in addition to other energy efficiency
measures and new technologies. A natural way to save fuel
• The focus on lowering costs (both CAPEX and OPEX) and reduce emissions is to minimize the number of running
• Stricter rules, regulations and company policies for engines on board and operate with closed bustie, which
minimizing the carbon footprint may have an impact on the system reliability and opera-
• The expectation of increased connectivity tional risk, as explained in chapter 3.2. Other examples
• Inter-organizational goals are SECA regulations that set limits to SOx levels. If the
• Commercial pressures fuel switchover procedure is done faulty, engines may be
• Bonus scheme incentives affected and shut down.
13
MARITIME Managing the risk of blackout
Expectation towards increased connectivity especially if the ship has low par levels and there are dif-
Connectivity and digitalization are other significant techno- ficulties in recruiting competent workforce. This creates a
logical changes in shipping. Organizational goals related catch-22 situation where, despite maximum effort, crew can-
to digital business transformations are emerging. This not meet all expectations and receive negative feedback
concerns how data is being generated, shared, stored and (e.g. audit findings, negative appraisals) from stakeholders
analysed, at an increasing speed. Increased connectivi- in the organization whose requirements have not been met.
ty between vessels and shore may lead to an increased
exposure to cyber threats, and security measures should be Bonus scheme incentives
implemented as an inherent part of the change manage- Organizational goals like speed and production are often
ment process. reinforced by performance agreements or bonuses.
However, bonuses can have contradictory effects on the
Inter-organizational goals performance of a vessel in different situations. If a port call
Departments of many organizations tend to work in silos. is to be made, senior on-board officers can feel pressured
This practice is rooted in how organizations historically to do the call despite challenging circumstances, if they
developed to focus attention first on productivity, followed are incentivized by guest satisfaction comments which
in time by quality, safety and reliability. As such, each tend to be unfavourable for missed port calls. Similarly, if
department has goals to meet (higher revenue, lower cost, the ship must enter or depart from a port under challeng-
higher efficiency, highest reliability) which can be over- ing environmental conditions, then senior officers who
shadowed by risks that threaten the prosperity or survival are incentivized to minimize fuel consumption, could be
of the business. pressured into running fewer engines and compromise
safety during the operation.
Commercial pressures
The challenge for the workforce is that organizational goals These incentives should be reconsidered, because they can
may conflict with each other. To generate higher revenue, impede the organization’s ability to maintain safe operations
the ship must arrive in port on time and turnaround as soon and meet their safety goals [4]. The organization will be
as possible to reach the next destination as per customer better prepared to prevent and mitigate critical events, such
expectations. A demanding itinerary contributes to crew as loss of propulsion, if incentives are connected to leading
fatigue, which can affect quality and safety of operations, indicators such as how many corrective actions are reported.
14
MARITIME Managing the risk of blackout
Management commitment is not only necessary to establish Management commitment is not only necessary
the organization’s direction to prevent blackout and loss
to establish the organization’s direction to pre-
of propulsion, it is equally important to set aside time and
resources to follow through on the organization’s ambition, vent blackout and loss of propulsion, it is equally
vision and goals. This means that the person who is put in
important to set aside time and resources to
charge of changing organizational practice should get time
to work on the task and resources to help perform the task follow through on the organization’s ambition,
and to share knowledge and insight into what steps should
vision and goals.
be taken to complete the task successfully.
15
MARITIME Managing the risks of blackout
Communicate the Establish a plan for communicating the ambition from one layer of the organ-
ambition ization to the next to ensure that a unified view is shared with all employees.
Give continuous Provide feedback on the organization’s safety ambition and on any misalign-
feedback to the ments between the organization’s ambitions and governance documen-
organization tation, rules, regulations and/or regular practice on board (e.g. company
ambition to prioritize safety versus unclear procedures, pressure to arrive on
time, lack of relevant training, distracting alarm management systems, and/
or missing protective equipment on board).
16
MARITIME Managing the risks of blackout
Step 3:
Identify measures to ensure safe and
reliable vessel operations
To meet both the expectations of stakeholders and the organization’s safety ambition,
it may be necessary to improve safety and reliability of the existing fleet. The challenge is
to establish cost-efficient measures to avoid blackout and loss of propulsion and to ensure
quick and reliable recovery. Step 3 points to operational and technical measures that can be
implemented by the organization.
FIGURE 5
UNDERSTANDING BLACKOUT AND OPERATING IN ACCORDANCE WITH A SAFETY AMBITION THAT HELPS TO
MANAGE CONFLICTING GOALS
A B C D
Preventive barriers Mitigating barriers
Power generation
failure
Blackout
Power distribution (loss of Sustained blackout
failure propulsion) (loss of propulsion)
17
MARITIME Managing the risks of blackout
18
MARITIME Managing the risks of blackout
FIGURE 6
G1 G2 G3 G4
Legend
P: Protection relay
D: Diesel engine
SB-A SB-B
G: Generator P1 P2 P3 P4
M: Motor
T: Transformer 11 KV Bus A 11 KV Bus B
SB: Switchboard
Gov: Govenor P7 P8 P5 P6 P9 P10
AVR: Automatic Voltage Bus tie
Regulator
T1 T3 T4 T2?
P11 P12
Thruster Control M1 T5 T6 M1
Computer
P17 P18
230 V
P19 P20
19
MARITIME Managing the risks of blackout
Advantages and disadvantages of operating with closed it might trip the load reduction functionality. The faulty
and open bus generator will force the healthy generators into reverse
Common practice in the industry is for vessels to operate power, and they will be tripped by the reverse power pro-
with P5 and P6 closed. There are several benefits of this tection. When the faulty generator is the only generator
configuration, such as: remaining at the switchboard, it will go into overspeed, be
tripped and create a blackout.
• Fewer running generating sets, less total fuel
consumption, less consumption of lube oil, improved The switchboard-breaker protections also need to be
maintenance intervals, fewer engine hours, less wear and coordinated to handle a short circuit ride through. The
tear on the engine. propulsion drives may trip on low voltage before the
• It is more likely that gensets run on optimal load – short circuit protection in the generator breakers and the
lower fuel consumption and emission, and reduced bus ties. This may, in turn, result in loss of propulsion and
environmental footprint. essential systems.
• Decreased risk of partial blackouts caused by loss of a
single generating set. Generator set failures
• Greater flexibility for preventive and corrective Failure modes that can propagate through systems (i.e. in
maintenance activities (depending on the power system closed-bus operations) are mostly associated with faulty
arrangement). fuel control systems on the engine or excitation control sys-
• Increased grid frequency and voltage stability, because tems on the alternator. These faults are not easily detected
more generating sets are connected to the common bus. by the protection relay of the faulty generator. It can lead to
a disconnection of any healthy unit which becomes over-
However, as pointed out in the previous section, certain loaded or starts to absorb power to maintain correct system
failures in a closed-bus configuration will lead to blackout, frequency and voltage.
even with multiple gensets online, unless additional techni-
cal measures are implemented. Therefore, good practice for the power systems operating
in closed-bus modes is to equip the protection scheme with
When operating with open bus, in other words redundant an additional safety barrier that supervises the generating
power systems are configured as independent systems (P5 set’s behaviour. This functionality should be realized by
and P6 open), the likelihood of full blackout is significantly independent control systems that have a dedicated set of
reduced, as no electrical failures in bus A may propagate via interfaces, or it should be executed via power management
the bus tie to bus B. However, this does not eliminate the risk systems with functionalities that extend to generator super-
for blackout completely, as there may be faults that can affect vision modules.
the expected independence. Examples of such faults are:
The benefit with this configuration is that it maintains avail- The supervising systems should be independent from the
ability of propulsion/thrusters during most failure modes, fuel control system and excitation control system so that
maintaining at least partial propulsion. However, the risk is there are no common mode failures which would influ-
that many failures can cause partial blackout incidents (i.e. ence the fuel/excitation control system and simultaneously
loss of one busbar), with consequential reduction in propul- disable or influence the supervising system functionality.
sion capability. In this guidance paper, such a system is referred to as
generator protection (GP).
The typical failure modes in closed-bus configurations for
diesel/gas-electric power plants are listed in Table 1. GP should detect the faulty generating set and issue
start command to standby generators. Sometimes, it is
Several protection systems and functionalities are distrib- enough to increase the number of generators to stabilize
uted throughout the power plant that are designed to the power system. If this does not help, and failure de-
handle one specific failure mode, such as load reduction, teriorates (or simply develops too fast), the GP should
overspeed of a generator and reverse power. If these trip the generator associated with the faulty control sys-
functionalities are not coordinated, they may work against tem. Usually, one more protective barrier is implemented
each other and escalate the failures. For example, if an en- as part of the algorithm, which causes a trip (opening) of
gine produces too much power due to a governor failure, the bus-tie breaker(s).
20
MARITIME Managing the risks of blackout
TABLE 1
Categorization of failure modes in closed-bus operations
Sudden trip of single generator set without prior warning, together with degraded perfor-
mance of PMS (i.e. not enough power limitation from preferential trip or load limitation on
drives), may potentially cause overload and underfrequency of remaining generator sets in
power plant, forming a common electrical system.
Internal failures in speed control (e.g. governor, actuator, speed pick-ups, load sharing lines)
leading to active power imbalance in a common electrical system. This may trip healthy gen-
erator sets on reverse power protection.
Generator set
Mechanical blockage of fuel rack following a load reduction demand resulting in inability to
reduce fuel to the engine. This may cause other generator sets to be offloaded and conse-
quently trip on their reverse power protection.
Loss of voltage sensing to automatic voltage regulator. This may lead to overexcitation and
significant reactive current in the power system. If not detected and isolated fast enough, it may
consequently result in tripping breakers on other healthy generator sets due to over/under-
voltage.
Earth fault in outgoing feeder causing trip of generator sets. This may be caused by protec-
Switchboard and tion scheme against earth faults that has not been properly coordinated across breakers.
associated feeder line Short circuit in single outgoing feeder which has not been cleared out by dedicated breaker
due to mechanical failure. This may lead to trip of all generator sets from both power systems.
Faulty synchronization device or mechanical fault of generator breaker may lead to unintentional
System
connection of unsynchronized generator set (crash synchronization event) to common electrical
synchronization
system.
Calculation of power available signal by PMS is not fast enough to activate load limitation in
Power management
propulsion drives and consequently mitigate underfrequency effects in case of sudden shut-
system
down of on-line generating set.
Short circuit followed by transient voltage dip in common electrical power system. This may
Transient states in the
cause under-voltage trip of auxiliary machinery and consequently resulting in shutdown of
power system
running generator sets or propulsion.
21
MARITIME Managing the risks of blackout
Examples of typical features and failures in the PMS system Disturbance in power systems operating in closed-bus
that must be considered are: modes is seen throughout the entire power system. The
set points and protective functions in the PMS should be
• Failures in communication links aligned with possible power oscillations to avoid spurious
• Barriers against unintended operations activation of protective functions or spurious blackout de-
• Barriers against unintended automatic actions (e.g. tection. Also, all systems activating trip or load reduction of
actions which could result in unnecessary blackout, partial thrusters must be identified.
blackout or unintentional power reduction)
• Signal validation, faulty signal, loss of signal Transient states in the power system
Failure modes that could cause spurious tripping of running
One of the essential barriers in this regard is to implement machinery or the spurious opening of circuit breakers can-
a mechanism for the validation of feedback signals to the not be eliminated. Thus, power systems shall be optimized,
PMS to prevent: operated and tuned to be stabilized after a sudden loss of
power generation. Severe failures, which cannot be tested,
• Generator (or bus-tie) connection without synchronization might be analysed by transient state simulations.
• Unintended load reduction of thrusters
• A decrease in generator frequencies to a level that
increases the risk of automatic load reduction of drives
and/or tripping of drives
• An increase in frequency to a level that causes systems to trip
22
MARITIME Managing the risks of blackout
EXAMPLE EVENTS
• Clogged fuel filters: Fuel tanks can experience accumulation of sludge, water and deposits. In rough weather, the
accumulations can swirl up in all tanks simultaneously due to vessel motion and subsequently clog fuel filters.
• Loss of lube oil suction: The engine lube-oil system may also be subject to unexpected behaviour during rough
vessel motions, either by means of loss of oil suction or triggering of low-level alarm due to sloshing in the lube-oil
tanks. As these tanks might be of identical design on all engines, and at the same time be subject to identical motion,
it is possible that they will simultaneously experience the same kind of problem with the lube-oil system.
• Lack of fuel management: The quality of newly filled fuel can cause severe problems. This may particularly be the
case with compatibility with new, compliant fuels. New regulations introduce the need for frequent fuel changeovers
which increases these risks. Several blackouts have been caused by two different fuels that coagulated, where the
viscous fuel blocked the filters to the generators.
• Failure in common auxiliary systems: Redundant machinery systems arranged in separate engine rooms are normally
provided with separate auxiliary systems (cooling water, fuel-oil, lub-oil, ventilation, etc). However, these auxiliaries are
normally arranged with cross-over pipes/ducts to provide operational flexibility. Operating with common auxiliaries
may reduce the operational cost but will also expose the redundant machinery to common mode failures in the auxiliary
systems, potentially causing blackout.
23
MARITIME Managing the risks of blackout
EXAMPLE EVENTS
• Maintenance on multiple gensets: A failure is particularly critical when all DGs are subject to the same maintenance
operation. This may be the case when the wrong type of lube oil is filled in all DGs, when the torque of a big end
lower half is not sufficiently tightened, when a control valve is left in the wrong position for each engine after a regular
maintenance, or when a replaced part is not fit for purpose.
• Using grease that is not compatible: Some DGs have manual greasing intervals where a grease gun is used to press
new grease into the roller bearing. If grease is used that is not compatible with what is already used, a sudden loss of
lubricity with seizure as consequence may occur. If the greasing of the DG is done on all units at the same time as part
of a regular maintenance program, then the failure of the bearings can occur for all DGs in a short period of time.
• Fuel rack free movement: Fuel rack free movement and links to the governor actuators need frequent inspections
to ensure that they are in order and that the fuel racks are free to move. Similarly, fuel pump barrel and plunger
interaction should be checked frequently because they may influence the DG operation, especially when the need for
large load change appears.
• Fuel pump plunger-barrel: During operation, the clearance between the fuel pump plunger and the barrel increases
due to wear. If the fuel is changed to lower viscosity, this clearance might be too high for a stable operation of the
engine at low speed – and no indications were seen with the higher viscosity fuel.
• Maintenance of equipment during critical/high risk operations: Maintenance of equipment during critical operations
could reduce the system’s ability to handle peak loads and unforeseen situations.
Operational failures
Crew is responsible for optimizing the operation of the with reduced redundancy, for instance, might develop to a
ship systems. This includes starting and stopping different critical situation. It is essential that the risks involved in these
sub-systems and switching valves to have the best flow in operations are understood and that there is sufficient com-
fuel, air and cooling-water lines. Mistakes in these operations petence development, mentoring and supervision avail-
may create situations where the system is not capable of able to oversee the planning and performance of critical
handling the demand for power, and where an operation operational tasks
EXAMPLE EVENTS
• Fuel switchover: For the vessels where a fuel switchover is required to meet local regulations, the procedure for
ensuring a correct switchover is crucial. The switchover procedure is usually slow to avoid thermal shock and should
be done at low engine load. Failure to follow this procedure may result in seizure of the fuel pumps or other thermal
shock-related issues, affecting all DGs.
• Valve operations: If a valve that should be opened is not opened fully, it could restrict the flow of fuel to one or several
gensets. If, perhaps through an operational mistake, the load demand then increases, the flow could be insufficient and
eventually create a shutdown.
24
MARITIME Managing the risks of blackout
25
MARITIME Managing the risks of blackout
Enabling successful human intervention Mature company safety cultures promote safety rather
As emphasized by the IMO, the role of the human element than short-term profit objectives, encourage reporting as a
is “a complex multi-dimensional issue that affects maritime timely way to uncover problems, have standards, rules and
safety, security and marine environmental protection” [8]. procedures in place to prevent non-compliance, and have
Indeed, the human element is increasingly being recog- clear processes in place for communicating critical design
nized as an essential safeguard to maritime safety rather and operational factors [10]. In companies with a mature
than the main cause of accidents [9]. safety culture, operators are more inclined to raise a red flag
before starting or during an operation that they are not
For the vessel to recover as quickly as possible from loss comfortable with. These operators respond strongly to weak
of propulsion, operators need to be able to act swiftly and signals, which is a prerequisite for detecting and acting on a
appropriately. The probability that a person will correctly critical situation such as loss of propulsion.
perform some system-required activity during a given time
period (assuming time is a limiting factor) greatly depends Ensure support from shore organization
on the combined effects of factors that influence perfor- Adequate shore support is a manifestation of management
mance [10]. Examples of factors that directly influence oper- commitment to minimizing risk and optimizing performance.
ators are access to appropriate information in a user-friendly Adequate shore support means the shoreside organization
interface, local communication and collaboration practices, has identified who is responsible for addressing ship ques-
and operator’s skills and levels of experience. More latent tions about regular operations, for helping the ship during
factors include work processes in the company, company troubleshooting, and for offering practical and technical sup-
culture, as well as quality and accessibility of procedures and port in case of an emergency. This also includes offering man-
training. agement support to make decisions that come with a cost.
26
MARITIME Managing the risks of blackout
Perceived support from shore is an important factor that can Training for competence and experience development
reduce crew workload during an emergency, which in turn Crews should regularly be trained and mentored on the
helps them in their ability to make decisions and act appro- operation of systems and handling of emergency cases
priately. A common criticism from ships to their shoreside such as local operation of the essential functions in the
organization is that crew perceive employees in the office power system (e.g. manual synchronization and load con-
as lacking the maritime knowledge and/or updated experi- trol). The objective of the training should be for crew to be
ence that is necessary to provide ships with the support they able to recognize and demonstrate their understanding of
need in their day-to-day and exceptional operations. situations where damage to or maintenance on redundant
components can result in reduced fault tolerance.
For ships to quickly recover from a loss of propulsion
situation, they need to get prompt access to the required Crews are essential barriers for preventing the escalation
support. The best-in class operators support their fleet in of situations where power and propulsion systems do not
areas of: recover automatically. Therefore, it is essential that crews
know exactly what to do when such a situation arises.
• Ship nautical operations: voyage planning, weather This requires crews to be familiar with the vessel-specific
routing, port calls, etc. systems, and equally important, the limitations of these sys-
• Technical operations: Equipment and system malfunction tems. The expected response to a blackout situation should
• Emergency operations: casualty/damage assessment, also be part of the familiarization and handover procedures.
damage stability and residual strength calculations,
contingency plans, 3rd party emergency services, etc.
27
MARITIME Managing the risks of blackout
• Set-up for power system describing operating mode during the test, how many DGs are running, how the
switchboards are assigned to redundancy groups, and which equipment is running prior to the test, etc.
• Typically, the power system shall be configured as during the regular operation.
• This part might also describe the specific loading condition for the power plant.
• Expected results describing how the power system shall prevent and/or recover from blackout, how the power
system shall split and what the expected time for:
• Power generation start-up
• Power generation connection to main switchboards and synchronization with system (if necessary)
• Propulsion recovery
• Results found describing the real results. If the results found deviate from results expected, this shall be described,
explained and concluded for acceptance or rejection.
28
MARITIME Managing the risks of blackout
FIGURE 7
29
MARITIME Managing the risks of blackout
Ensure that procedures for power system and propulsion arrangement (e.g. green,
yellow, red modes) are based on operational exposure, e.g. weather states (Beau-
fort level), distance to shoreline, traffic density and operational status of the vessel .
As part of the procedures, define the vessel’s critical/high risk operations and cor-
Implement robust responding ‘safest mode of operation’.
operating modes
Clarify what is expected from the crew in different operation modes.
Implement more advanced protection measures to ensure fuel and voltage control
of gensets (e.g. generator protection [GP]).
Ensure that desktop studies (e.g. FMEA) are supported by dynamic computer
simulations. Simulations should address failures that cannot be tested and cannot
be concluded on during a regular desktop exercise such as in FMEAs (e.g. transient
states and “ride through" verification).
Ensure that procedures address common failure modes and maintenance operations
that could potentially result in reduced fault tolerance.
Ensure correct Ensure that no simultaneous maintenance and upgrade of similar equipment is
maintenance performed and identify where equpment maintenance should be avoided.
and operation of
machinery Ensure that overhauled or upgraded equipment is thoroughly tested before sailing.
Ensure that newly filled fuel is not used and mixed with other fuel before the test
results confirm compatibility.
30
MARITIME Managing the risks of blackout
The operator should also ask for records that show that the suppliers have indeed
performed sufficient verification activities on the software.
Ensure that the crew understands and recognizes situations where damage to or
maintenance on redundant components can result in reduced fault tolerance.
Provide training Perform a human-reliability analysis (HRA) to verify that the system provides the
and decision necessary support for users to timely act on threats to and escalations following
support for crew loss of propulsion.
Include progress of the continuous and iterative improvement process of the alert
management system in the safety management system (SMS).
Study the organizational structure of dedicated resources who can assist during
troubleshooting and emergency situations.
Consider recommendations and best practices for blackout prevention test and black-
out recovery test provided in Appendices E and F, respectively.
Apply dynamic
Use dynamic-barrier models as decision support tools in daily operations and in-
barrier reporting
clude barrier condition reporting in vessel manager inspection reporting
and monitoring
31
MARITIME Managing the risks of blackout
Step 4:
Identify measures to ensure safe and
reliable newbuilds
To meet the expectations of stakeholders and the organization’s safety ambition, it may be
necessary to improve safety and reliability of newbuilds. The challenge is to establish cost-
efficient measures to avoid loss of propulsion and to ensure quick and reliable recovery.
Step 4 points to technical measures that can be implemented by the organization.
FIGURE 8
UNDERSTANDING BLACKOUT AND OPERATING IN ACCORDANCE WITH A SAFETY AMBITION THAT HELPS TO
MANAGE CONFLICTING GOALS
A B C D
Preventive barriers Mitigating barriers
Power generation
failure
Blackout
Power distribution (loss of Sustained blackout
failure propulsion) (loss of propulsion)
32
MARITIME Managing the risks of blackout
33
MARITIME Managing the risks of blackout
Presenting what is most relevant to the end-user tegration, meaning that the roles and responsibilities of the
The maritime industry should expand its view on an alarm stakeholders involved in alarm management system design
management system from a traditional view of a system for are defined, that the number of alarms that have access
logging events (mostly of interest to an engineer) to a more to the end-user are reduced, and that the presentation of
user-centered definition (i.e. presenting that what is most alarms is improved [7] (see also chapter 4.3).
relevant to the end-user). This requires improved system in-
• Alarms should direct the operator’s attention towards vessel conditions requiring timely assessment or action.
• Every alarm should be useful and relevant to the operator and have a defined response.
• Alarm levels should be set such that the operators have enough time to carry out their defined response before the
situation escalates.
34
MARITIME Managing the risks of blackout
Testing and verification of the robustness and functionality The PLCs in the different redundancy groups may be
of integrated systems is essential for the shipowner to rule connected. This might lead to the spreading of a failure to
out failures during operation. Too often, issues come up several redundancy groups, such as in a network storm.
after vessel delivery. Thoroughly tested and verified safety
critical systems during early newbuild phase will lead to The topology (design) of the network also determines its
both cost efficiencies for yards during commissioning and robustness in case of failures and network storms. Ring, bus,
sea trials, and for more robust and reliable systems during mesh and star topologies are common topology variants
operation for the ship operators. that show different tolerances for and behaviours during
individual failure scenarios. It is also common to apply
Detailed recommendations and best practices for en- double network (e.g. double ring) for critical systems to
hanced integration and verification during newbuilding increase robustness towards failures. However, this requires
processes are provided in Appendix C. more cables and configuration and may lead to unexpected
behaviours.
Maintaining integrity in computer networks
The main challenge with computer networks in a power It is important that the consequences of high-load and
generation and distribution system is that it may not be clear failure scenarios for the actual network design are exam-
who is responsible for the totality of the network and its ined and understood. Even in the simple example shown
performance. Even if the network design from the individual in Figure 9, at least three different computer networks are
suppliers has been through testing as a part of the class present. These may again be connected to an engineering
approval process, there may be a challenge to get all parts station or shore to allow for maintenance and trouble-
working together as whole. Not all companies have dedicat- shooting. The networks may also contain different kinds of
ed OT operators and rely on their IT department to cover all network switches and routers.
issues concerning network machinery and automation.
FIGURE 9
Ring topology
P1 P2 P3 P4
P5 P6
Thruster Thruster
Thruster Control
Computer
Drive A Drive B
Point-to-point topology
M1 M1
35
MARITIME Managing the risks of blackout
• Interlocks that may not have been properly evaluated and tested may delay or fail blackout recovery on every level
of the power system.
• The complexity in interfaces and the high number of permissions and blocking signals increase the risk of failure.
• Failure mechanisms which led to the blackout incident may trigger safety functions that disable machinery start-
up or set HV breakers to trip and block a position. The system needs to be intelligent enough to move to the next
separate system or start this system up at the same time.
• Automated blackout recovery requires detailed tuning to coordinate signals exchange between the power
management system, HV system, drives, and other control systems. Even minor changes in logic, during the
maintenance or service activities, can disable the recovery process. Any change creates a recovery situation which
requires appropriate procedures and permissions.
36
MARITIME Managing the risks of blackout
Improve human Ensure close cooperation between designers and employees with recent operational
performance experience (the end-user).
through human- Actively be a part of defining the system’s design criteria and apply the principles of
centred system user-centred design in the procurement process.
design Cooperate with competence and experience in operations to set the requirements for the
technical functionality and interface of equipment.
Rationalize the alarms and improve the quality of alarm texts through a process of hu-
man-centred design.
Continuous Provide feedback to the company about improving the alarm management system (e.g.
feedback to the alert texts, alert priorities). The company should explicitly encourage crew to provide
organization feedback on improving the alarm management system (e.g. alert texts, alert priorities).
Engage a system integrator that takes a central role in the design process from the
earliest stages of the project.
Perform early-phase assessments by reviewing documentation of the vessel and by per-
forming a Hazard Identification (HAZID) study of automation integration.
Apply a change management procedure for key parameters and system configurations.
Consider relevant voluntary class notations and guidance (e.g. RP, RP+, HIL and ISDS).
Perform a network-failure analysis, network tests and manage the network configura-
tions as key system parameters.
Ensure robust design for closed-bus operations. See list of recommendations in Appen-
dix C.
Robust design
Design effective blackout recovery systems. See list of recommendations in Appendix C.
for closed-bus
operations Consider using batteries as effective barriers to prevent blackouts. Consider the best
practices and recommendations in Appendix D, to mitigate the increased complexity of
systems and integration that batteries can contribute to.
37
MARITIME Managing the risks of blackout
Step 5:
Prioritize and implement cost-efficient
prevention and mitigation measures
The implementation of preventive and/or mitigating measures should be based on cost-
benefit evaluations that compare the monetary value of benefits against cost. The challenge,
however, is how to assess and monetize the impact of different measures on safety.
• Should we invest in additional safety measures for our The previous chapters of this guidance paper provide
existing fleet? What measures should be implemented? owners and operators with recommendations for how to
• What types of safety features should be specified for our reduce the risk of blackout based on best practice. As such,
newbuilds? it covers measures related to updating procedures, change
• What class notations should be selected to support our management, safety and failure mode assessments, installing
ambition? equipment and systems, verification and testing. Before im-
• Whether a type of ship which has suffered many accidents plementing new measures, you need to consider the impact
should be modified, and if so to what standard, and should it will have on safety and associated implementation costs.
the whole fleet then be modified?
Cost-benefit evaluation
To answer such questions, the decision-maker must have Cost-benefit evaluations help to assess the benefit of the
criteria at hand to be able to decide when the newbuilds proposed safety measure, in terms of the risk that would be
and existing fleet can be considered safe enough. This averted against the cost of implementing the measure. The
requires the decision-maker to look at the organization’s evaluation has two main objectives:
38
MARITIME Managing the risks of blackout
• To determine if an investment in an additional safety during testing. Often, it is not the test itself that may be time
measure should be initiated and assess by how much its consuming or costly; it is the afterwork that may be need-
benefits outweigh its costs. ed if things do not go according to plan. Again, planning,
• To provide a basis for comparing safety measures and competence and contingency measures are essential for
comparing the total expected cost of each measure relatively low cost compared to benefit.
against its total expected benefits.
When 1+1=3: adding value through a combination of
Cost-benefit analyses may have different outcomes for measures
different shipping companies, at different times and for dif- It is the combined effect of measures that will have the
ferent vessels. This is because the operational and technical greatest impact on safety. For example, setting up robust
context of each vessel will determine what may be con- modes of operation in combination with more sophisticated
sidered too high cost and how much a vessel will benefit protective functions in software and hardware. Combining
from one measure compared to another. Vessel managers this with regular testing and verification will undoubted-
should therefore start a cost-benefit evaluation by setting ly have significant positive impacts on vessel safety and
criteria for determining cost-benefits that are relevant to the reliability.
vessel’s and company’s situation.
Passenger ship owners and operators should also ensure
Investments do not necessarily need to be significant. Up- that their strategies and additional measures for blackout
dating procedures and crew training may have a significant prevention and recovery address the interdependencies
impact on safety, while the associated cost may be less than between human (H), organizational (O) and technical (T) ele-
an investment in system retrofits. Testing is also a low-cost ments that influence the risk of blackout. This HOT approach
measure, provided it does not impact operating schedule should be an integral part of the risk management process,
(e.g. testing in-between operations) and that the test is supporting the identification of effective recommendations
properly planned to avoid surprises and system damages and measures to improve safety and system reliability.
Use insight from internal and external blackout statistics and root cause analyses to
identify which measures will have greatest impact.
Ensure measures address the interdependencies between the human (H), organiza-
Perform tional (O) and technical (T) elements (the HOT approach).
cost-benefit
Consider a combination of measures to ensure greatest effect on vessel safety and
analyses
reliability.
Introduce discussions about cost for preventive and mitigating measures early in the
procurement process with vendors.
39
MARITIME Managing the risks of blackout
Conclusion
To support owners and operators in ensuring the safe and reliable operation of their fleet, DNV developed a stepwise
approach for managing the risks of blackout and resulting loss of propulsion. Through implementing the best practices and
recommendations from this guidance paper, the industry should succeed in reducing the risk.
The five steps and the key elements in each step are summarized below.
To challenge the status quo within organizations and to initiate a discussion on blackout prevention and recovery, owners
and operators are encouraged to use the “Blackout Preparedness – Self Assessment” in Appendix A. This assessment is a
set of questions that is intended to raise awareness about blackout and what can trigger escalation after a blackout.
STEP Increase understanding STEP Define safety ambitions and STEP Identify measures to ensure
1 of blackout
2 manage conflicting goals
3 safe and reliable vessel
operations
In order to achieve a step change in safe- Setting an ambition for minimizing the risk To meet the expectations of stakeholders
ty for loss of propulsion, it is necessary to for and mitigating the consequences of and the organization’s safety ambition, it
gain an overall understanding of causes loss of propulsion at an organizational level may be necessary to improve reliability
of blackouts and the regulatory frame- is the first progression towards ensuring on the existing fleet of vessels. Step 3
work. Increasing understanding of black- safe and effective operations. Owner and points to operational and technical mea-
out requires that organizations investigate operators need to agree internally on their sures that can be implemented by the
the underlying causes of blackout and ambition, so that they don’t run the risk of organization. These include:
that they understand the regulatory prioritizing other organizational goals at
framework. A barrier-based and holistic the expense of safety. • Implementing robust operating modes
approach to managing risk offers practical based on sound procedures that offer
tools and a helpful mindset. Managing conflicting goals implies also decision support
that organizations are ready to set aside • Taking measures to ensure fault tolerant
time and resources to operationalize their operations through safe and reliable
commitment to change. closed-bus operations
• Maintenance and operation of
machinery to tackle common mode
failures
• Managing software and networks
• Providing training and decision support
for crew
• Implementing enhanced blackout testing
• Implementing dynamic-barrier monitoring
40
MARITIME Managing the risks of blackout
41
MARITIME Managing the risks of blackout
42
MARITIME Managing the risks of blackout
Blackout: Blackout situation occurs when there is a sudden loss of electric power in the main distribution
system and remains until the main source of power feeds the system. All means of starting by stored
energy are available (DNV Rules for Ships, Part 4, Chapter 8, January 2018).
Busbar: Low-impedance conductor to which several electric circuits can be separately connected
(IEC 61439-1).
Circuit breaker: Mechanical switching device, capable of making, carrying and breaking currents under normal
circuit conditions and also making, carrying for a specific time and breaking currents under
specified abnormal conditions such as those of short circuit (IEC 60947).
Common cause/ Failures of multiple items, which would otherwise be considered independent of one another,
mode failure: resulting from a single cause. Common cause failures can also be common mode failures.
Components that fail due to a shared cause normally fail in the same functional mode. The term
common mode is therefore sometimes used. It is, however, not considered to be a precise term for
communicating the characteristics that describe a common cause failure (ISO 14224).
Failure (of an item): Loss of ability to perform as required. A failure of an item is an event, as distinct from a fault of an
item, which is a state (ISO 14224).
Failure mode: The effect by which a failure is observed on the failed item [12].
(Single) Fault tolerance: (Single) fault tolerance is the ability of a system to function without interruption after a
single failure [11].
Hidden failure: A failure that is not immediately evident to operations and maintenance personnel.
Modes: The vessel operational mode specifies the high-level system set-up and redundancy design
intention for a specified set of vessel operations. Examples of vessel operations are transit,
positioning keeping, manoeuvring, etc.
Reliability: The probability that an item can perform a required function under given conditions for a given time
interval [11].
Redundancy: The existence of more than one means of performing a required function [11].
Separation: With reference to systems or equipment intended to provide redundancy. Reduce the number
of connections between systems to reduce the risk that failure effects may propagate from one
redundant system to the other [11].
Switchboard: A main switchboard is a switchboard directly supplied by the main source of electrical power or
power transformer and intended to distribute electrical energy to the vessel’s services (DNV Rules
for Ships, Part 4, Chapter 8, January 2018). An emergency switchboard is a switchboard, which in the
event of failure of the main electrical power supply system, is directly supplied by the emergency
source of electrical power and/or the transitional source of emergency power and is intended to
distribute electrical energy to the emergency power consumers (DNV Rules for Ships, Part 4, Chap-
ter 8, January 2018).
43
MARITIME Managing the risks of blackout
Appendix A:
Self-Assessment for blackout preparedness
a. Are you familiar with what failures may cause blackout?
Are you familiar with the minimum regulatory requirements for blackout prevention and recovery (e.g. class,
b.
statutory)?
c. Are you familiar with how additional class notations may help to prevent blackout and ensure efficient recovery?
d. Do you know what the typical duration of blackout is before full propulsion is restored?
a. Has your organization defined a safety ambition for blackout or loss of propulsion?
c. Do you have additional protection measures implemented for closed bus-tie operations in critical operations?
Do your organization’s procedures support Master’s decision regarding critical operations (e.g. severe weather,
d.
close to shore)?
Is your crew familiar with the limitations of their systems and what to do in case manual blackout recovery is
e.
needed?
f. Do you have sufficient onshore technical expertise and support to assist in emergency situations on board?
a. Is integration testing of automation and software systems done during newbuilding process?
c. Do you consider blackout recovery system functionality during newbuild specifications?
Do you apply principles of human-centred design for the design of man-machine interfaces and alarm manage-
d.
ment systems?
44
MARITIME Managing the risks of blackout
Appendix B:
Guidance for FMEA/FMECA analysis
• Active power load sharing failure (e.g. caused by governor • Generator protection
failure, insufficient, excess or unstable active power, fuel- • PMS upgrade
rack failure, active-power or frequency sensor failures, signal
Active and reactive failures, load-sharing line failures)
load sharing • Reactive power-load sharing failure (e.g. caused by AVR failure,
insufficient, excess or unstable reactive power, reactive power-
sensor failures, voltage-sensor failures, signal failures)
• Detection methods and actions to bring the system to a safe
state with conditions and time responses
• Reference to analysis of worst-case voltage dip (depth and • System optimization and
duration) on healthy bus after short circuit on other bus (in tuning for entire protection
Consequences of closed tie-breaker operation) strategy (HV, LV, GP, PMS,
voltage transients • Document adequate voltage dip “ride-through” capability load reduction functionality
of necessary systems to remain in position: thruster drives, inside converters)
computer systems, networks, contactors, pumps, ventilation,
and other axillaries.
• Are there built-in protections in thruster variable speed drives • System optimization and
that cause trip or load reduction? If yes, how is it ensured that tuning for entire protection
not all thrusters are lost at the same time by the same trigger? strategy (HV, LV, GP, PMS,
Risk for simultaneous Examples of such protection can be high/low voltage and/or load reduction functionality
trip or load reduction frequency. inside converters)
of all thrusters • Are there situations where all thrusters will reduce their • All protective functions
power simultaneously to such a level that position cannot be included in the coordination
maintained? Such as built-in load reduction functionality in study and mapped with the
drives that may reduce power to zero if one diesel engine fails to computer model used for
full speed. transient state simulation
Ensure that no hid- • Does the PMS have direct HW open command signals to both • Redundant open command
den failure renders it tie-breakers? signals
impossible to open • Is it sufficiently ensured that tie-breaker is not in local mode • Fail safe system that trips
tie-breaker from during operation (e.g. clear indication of local/remote status on breaker on wire break on
PMS or other protec- PMS GUI)? open command signal
tion devices • Include check of tie-breaker operability in procedures • Signal monitoring
• How is it ensured that a single feedback failure to PMS does not • I/O mapping fitted to
cause the PMS to carry out actions that result in loss of position? nodes / field stations to
• Can, for instance, a single failure on feedback signal to PMS cause: define possible common
• PMS to connect generator (or bus-tie) without mode failures
synchronization? • PMS response during ride
• Force full load reduction to all running thrusters through, e.g. short circuits
simultaneously? • Protective function which
• PMS to decrease generator frequencies to a level that causes results in feeder trip / bus-tie
Fault tolerance in breaker trip
risk of automatic load reduction of drives / tripping of drives?
PMS system
• PMS to increase frequency to a level that causes systems
to trip?
• PMS to jump to manual mode?
• Can single PMS operator failure cause blackout?
• Can one single PMS unit trip all generator breakers?
• Failure to start and connect
• Crash synchronization on connect
• Connection of a stopped generator
45
MARITIME Managing the risks of blackout
Appendix C:
Enhanced protection measures for closed-bus operations and
blackout recovery
46
MARITIME Managing the risks of blackout
47
MARITIME Managing the risks of blackout
Evaluate severe failures which could be considered as initial conditions prior the blackout incidents in terms of
b.
protective functions that are implemented to the entire protection strategy system.
This typically means that safety functions which are implemented in HV relays, control and safety in power
generation sets, propulsion drives, other drives implemented in the system should be evaluated and conclud-
c. ed if might set the system to “trip and block” position and be source of recovery failure. For power systems
operating in closed-bus modes, such condition would disable the blackout recovery sequence throughout the
redundant groups.
d. Ensure that systems that are blocked upon consecutive starts are not used for critical equipment
Implement an override functionality (preferably external) that disables the interlocks that prevent blackout
e.
recovery for the scenarios where power systems cannot promptly be recovered.
f. Reduce the need for manual actions that could delay the recovery process.
g. See checklist in Appendix F for full blackout recovery test.
Appendix D:
Enhanced system integration and verification for newbuilds
Recommendations and best practices for improving human performance through human-centred system design
Ensure human-centred system design
Ensure that the design process of setting requirements to technical functionalities and creating human-machine
a. interfaces adheres to the principles of human-centred design and that the result is compatible with basic human
capabilities (ref ISO 9241-210:2010).
b. Ensure close cooperation between designers and employees with recent operational experience.
Actively be a part of defining the system’s design criteria and apply the principles of user-centred design in the
c. procurement process. This includes updating the safety management system (SMS) with the continuous and
iterative improvement process of the alert management system.
Cooperate with competence and experience in operations (HSEQ and Masters) to set the requirements for the
d.
technical functionality and interface of equipment.
e. Rationalize the alarms and improve the quality of alarm texts through a process of human-centred design.
48
MARITIME Managing the risks of blackout
Recommendations and best practices for improved integration, testing and verification
1. Engage a system integrator
Ensure that the system integrator is responsible for integrating all components of the system, applying and
a. advocating the principles of human-centred design, being a driver for reducing the number of alerts and being
responsible for managing the improvement process of the alarm management system during operations.
The equipment manufacturer should deliver equipment in accordance with the requirements that are set by the
b.
system integrator and the system logic.
5. Apply a change management procedure for key parameters and system configurations
Identify the key parameters:
a.
The key parameters of the system should be identified and agreed.
Analyse key parameters before changes are made:
b Some parameters may affect the performance of the whole system and should not be changed until the change
has been agreed between the owner/operator and the supplier in question.
Verify key parameters after software changes:
After a software update has been performed, the key parameters should be verified before the system is
c.
brought back into operation. If the update introduces or removes parameters, the list of key parameters should
be revised.
Implement changes to software between FAT and vessel delivery under strict change management:
d. After FAT, the software should be under version control. Both supplier and system integrator should have full
transparency into the changes being made.
49
MARITIME Managing the risks of blackout
Appendix E:
Enhanced blackout prevention test
1. Set up the power system with two DGs, for instance, operating with typical and realistic
Power system load. Power system should be set up according to operating profile, e.g. closed bus.
disturbance caused 2. Set remining DGs to standby start.
by loss of one diesel 3. Trip one DG and verify safety functions like load shedding, load reduction, phase back system.
generator (DG). 4. Verify that remaining DG can withstand load increase with no spurious trip of tie-breakers
or loss of essential and important consumers.
1. Set up the power system with two DGs, for instance, operating with highest possible load
Power system (i.e. slightly below stand-by start setpoint). Power system should be set up according to oper-
disturbance followed ating profile, e.g. closed bus.
by loss of big consumer. 2. Load the power system as much as possible and trip a large consumer (e.g. propulsion).
3. Verify that speed and frequency increase does not cause spurious trip of DGs.
Test of voltage ride through capabilities (i.e. power system response to voltage dip caused by short circuit)
Note: Most systems will have equipment which will have problems to ride through a short period with a reduced voltage
level, e.g. frequency converters, motor starters, circuit breakers with undervoltage protections, power supplies, any PLC
system without battery backup, changeover system, etc.
Note that quick opening and closing of feeder or tie-breakers might be interlocked and not easily accessible in the HV systems.
Expected voltage dip time applicable in the system shall be verified prior to the test.
Consequence of a short
Test can be conducted in different ways, such as:
circuit at a high level in
Quickly opening and closing feeder breakers to an essential consumer (e.g. propulsion thruster)
the power system will
Opening and closing bus ties to switchboard sections without generators connected
be a voltage dip.
Opening one generator breaker and quickly closing another
• Below tests should be arranged in the closed-bus mode. This is to verify the impact of power imbalance on redundant systems.
• Tests should be arranged with the minimum operating set-up, which is typically two DGs online (connected to
redundant systems).
• Power system set-up shall be agreed prior the test. Test shall be document by plots, records and any other means which
allows to verify the results and reproduce the failure mechanism (if test fails).
50
MARITIME Managing the risks of blackout
Appendix F:
Enhanced blackout recovery test
51
ABOUT DNV
We are the independent expert in risk management and quality assurance.
Driven by our purpose, to safeguard life, property and the environment,
we empower our customers and their stakeholders with facts and reliable
insights so that critical decisions can be made with confidence. As a trusted
voice for many of the world’s most successful organizations, we use our
knowledge to advance safety and performance, set industry benchmarks,
and inspire and invent solutions to tackle global transformations.