Guideline No.

E-16 (201510)

E-16 Main Engine Remote Control

System

Issued date: 20th October, 2015

© China Classification Society

Foreword

This Guideline is a part of CCS Rules, which contains technical requirements,

inspection and testing criteria related to classification and statutory survey of marine
products.

This Guideline is published and updated by CCS and can be found through
http://www.ccs.org.cn. Comments or suggestions can be sent by email to
[email protected].

Historical versions and release date:

Main changes and effective date:

 E-16 (201510) Main Engine Remote Control System

CONTENTS

1 Application ..................................................................................................................................... 4

2 Basis for approval and inspection .................................................................................................. 4

3 Terms and definitions..................................................................................................................... 4

4 Plans and documents ...................................................................................................................... 5

5 Design and technical requirements on products ............................................................................. 7

6 Type test ....................................................................................................................................... 13

7 Unit/batch inspection ................................................................................................................... 15

8 Onboard test ................................................................................................................................. 17

3 / 17
 E-16 (201510) Main Engine Remote Control System

Main Engine Remote Control System

1 Application

1.1 The Guideline applies to the remote control system with diesel engine as the propelling engine
used on ships and marine installations (excluding the electric propulsion remote control system
with electromotor as the propelling engine).

1.2 The Guideline applies to the electric-pneumatic main engine remote control system. For other
control modes, such as the electro-hydraulic type, full-pneumatic type, full-electric type, and
flexible shaft type, refer to relevant requirement of the Guideline.

2 Basis for approval and inspection

2.1 The approval and inspection bases adopted by the Guideline are as follows:

2.1.1 CCS Rules for Classification of Sea-Going Steel Ships

2.1.2 International Convention for Safety of Life at Sea (Solas)

2.1.3 IMO Resolution A.1021 (26) Code on Alerts and Indicators

2.1.4 IEC60092-504 Electrical Installations in Ships – Part 504: Special Features – Control and
Instrumentation

2.1.5 GD01-2006 “Guideline on Type Approval Test of Electric and Electronic Products”

3 Terms and definitions

3.1 Remote Control: The control that the operator at the control station where he/she cannot
directly check the equipment operation status uses to operate the equipment remotely via the
mechanical, electrical, electronic, pneumatic or hydraulic means or their combination.

3.2 Local control: The control that the operator near the equipment uses to conduct manual
operation on the equipment.

3.3 Control station: The place used to control the equipment. The control station in the Guideline
is classified into the following 4 types:

3.3.1 Navigation bridge control station: The control station set in the navigation bridge to control
the equipment;

3.3.2 Bridge wing control station: The control station set in the bridge wings at both ends of the
navigation bridge to control the equipment;

3.3.3 Centralized control station of the engine room: The control station set in the centralized
control station of the engine room to control the equipment;

4 / 17
 E-16 (201510) Main Engine Remote Control System

3.3.4 Local control station: The control station used for local control of the equipment;

3.4 Safety system: The system that enables the faulty equipment to take 3 types of protective
actions automatically as follows in case of a major failure endangering the essential equipment
(e.g. main engine):

3.4.1 Conduct immediate shutdown, and do not restart until manual restoration is conducted;

3.4.2 Operate at lower power, and make temporary adjustment until it works at the lowest
operating level.

3.4.3 Start and put the standby equipment into operation to restore the normal operation.

3.5 Alarm: The audio and visual signal sent when the equipment monitored exceeds the preset
parameter ranges.

3.6 Group alarm: Any public alarm sent via an alarm channel in case of any abnormality of the
equipment monitored.

3.7 Overriding: The special control measures for the skipping of a certain procedure or a certain
safeguard action so as to effect compulsory operation to the equipment for a short period to ensure
the safety of the ship.

4 Plans and documents

4.1 The following plans and documents should be submitted for review during product plan
approval:

(1) System instructions, including at least the detailed hardware configuration description,
system function description, data communication description, redundancy system
conversion description, system self-inspection description and data storage means.

(2) Configuration block diagram of hardware and external equipment, indicating the internal
connection of the main unit/module of the system and interfaces with other systems;

(3) System wiring diagram;

(4) Power system diagram;

(5) Input and output equipment instructions;

(6) Software instructions, including at least the description on the software installed on each
hardware unit, as well as the communication software and application software installed on
each network node device.

(7) Software function block diagram;

5 / 17
 E-16 (201510) Main Engine Remote Control System

(8) List of technical hardware and external equipment specifications;

(9) Electrical schematic diagram (including power supply, emergency shutdown, and UPS);

(10) Equipment outline plan (including panel arrangement plan, control cabinet, and control
handle);

(11) Pneumatic control piping schematic diagram and valve box layout diagram (applicable to
equipment with pneumatic part);

(12) Test program: including type test and factory test. Test procedures should describe the test
configuration and analogy method. Each test should specify the initial status of the
equipment/system, test method, test result analysis and acceptance criterion, normal mode
and failure mode, as well as the power supply and communication failure mode.

(13) Operation manual (including troubleshooting instructions);

4.2 The approved plan/data should at least include the following contents:

(1) Factory overview: Factory name, address, production history, production capacity, technical
and inspection personnel, main products, affiliation, and product brand;

(2) Detailed list of products applied for approval;

(3) Main production equipment;

(4) Main test equipment;

(5) Brief manufacturing process of the product applied for approval;

(6) Quality management document;

(7) Enterprise registration certificate;

(8) Qualification certificate and / or production certificate;

(9) Sample of product quality certificate;

(10) Quality control plan (if applicable);

(11) Relevant documents to be submitted according to type-II computer specified in the list of
computer system test and inspection in 2.6.8.1 of Chapter 2 in PART SEVEN of the CCS
Rules for Classification of Sea-Going Steel Ships.

6 / 17
 E-16 (201510) Main Engine Remote Control System

5 Design and technical requirements on products

5.1 Environment and operating conditions

5.1.1 The main engine remote control system should work normally under the following ambient
and operating conditions:

(1) Ambient air temperature: 0~55℃.

(2) Relative humanity: 95%±3% (temperature at +45℃); 70%±3% (temperature at more than
+45℃).

(3) Vibration: Frequency of 2.0 Hz~13.2 Hz, amplitude of ±1 mm; frequency of 13.2 Hz~100
Hz, acceleration of ±0.7 g.

(4) Inclination and sway: Inclination and sway of 22.5° at all directions (period of 10 s) and
vertical linear acceleration of ±9.8 m/s2.

(5) Power supply fluctuation: During AC power supply, the steady-state voltage is +6%~-10%
of the rated value, and frequency is ±5% of the rated value; the transient voltage is ±20% of
the rated value, and the restoring time is 1.5 s; the frequency is ±10% of the rated value, and
the restoring time is 5 s. During battery power supply, the voltage connected to the battery
during charging is +30%~-25% of the rated value, and that not connected to the battery
during charging is +20%~-25% of the rated value. Voltage stabilizer should be adopted in
case of its failure to work in the above-mentioned power fluctuation range.

(6) Harmonic distortion: Not more than 5%.

(7) Pressure fluctuation rate of the pneumatic (hydraulic) power source: ±20% of the rated
value, and no damage occurs at 1.5 times the design pressure value.

(8) Electromagnetic compatibility: The facility should have necessary electromagnetic

compatibility and meet the test requirement specified in Table 3.1.2 (product category:
internal communication and signal processing equipment) of Chapter 3 of the Guideline on
Type Approval Test of Electric and Electronic Products (CCS GD01-2006).

5.2 General requirements

5.2.1 The main engine remote control system should include at least the remote control system,
safety system and alarm system. The remote control system should effectively control the steering
and speed of the main engine and realize interconversion between control stations, as well as the
startup and shutdown of the main engine (if applicable); in case of any major failure endangering
the main engine, the safety system should take protective actions automatically; the alarm system
should give an alarm indicating the major main engine failure (at least the shutdown and
decelerating alarm).

7 / 17
 E-16 (201510) Main Engine Remote Control System

5.2.2 The main engine remote control system should control the rotation direction and speed via
simple operation means, such as the control handle and joystick.

5.2.3 The control of the main engine remote control system over the main engine is one to one
generally, i.e. to control certain main engine separately. The failure of the main engine or main
engine remote control system should not affect the normal operation of other main engine or main
engine remote control system.

5.2.4 The main engine remote control system should guarantee the main engine will not be subject
to unexpected mechanical load and thermal load under any control status.

5.3 Fail-safe principle, system independence and redundancy setting

5.3.1 The main engine remote control system should be designed according to the fail-safe
principle. It should give an alarm signal in case of any system failure. In this case, the rotation
speed and steering of the propeller should be maintained as far as practicable till the local control
is available. Especially when the power source (electric power, pneumatic power, or hydraulic
power) is interrupted or control is transferred, the output power or steering should not be changed
significantly or suddenly.

5.3.2 The control system, safety system and alarm system should be independent of each other,
and certain system (in case of any failure) should not affect the normal operation of other systems.

5.3.3 The main engine remote control system should be designed in such a way that one failure
occurred during operation should not cause other failures, and the danger generated should be
minimized.

5.3.4 The redundancy design should be adopted for the safety system as far as practicable.

5.4 Power supply

5.4.1 The power of the main engine remote control system should be supplied at least by the main
power supply and backup UPS, and the backup power supply should be enabled automatically if
the main power supply fails. The capacity of the backup power supply should be available for
supplying power continuously for at least 30 min.

5.4.2 Failure monitoring means should be provided for the main power supply, so as to give an
audible and visual alarm in case of any failure.

5.5 Control station function

5.5.1 Each control station should be provided as least with the following control functions:

(1) Navigation bridge control station: It should effectively control the rotation direction and
speed of the main engine and realize the startup and shutdown of the main engine (if
applicable);

8 / 17
 E-16 (201510) Main Engine Remote Control System

(2) Bridge wing control station: It should effectively control the steering and speed of the main
engine, and acts as the auxiliary control station of the navigation bridge control station; (if
applicable)

(3) Centralized control station of the engine room: It should effectively control the steering and
speed of the main engine, and realize the startup and shutdown of the main engine (if
applicable);

(4) Local control station: In case of any system failure, it should guarantee that such operations
as manual startup, shutdown, steering and rotary speed control on the main engine can be
conducted locally at the control station.

5.6 Startup

5.6.1 The main engine remote control system should be provided with necessary starting interlock,
so as to avoid any major damage due to maloperation. The main engine cannot be started in the
following circumstance:

(1) Jacking engine engaging;

(2) Low lubricating oil pressure.

5.6.2 If the main engine remote control system is designed to be started automatically, the time (s)
for continuous main engine starting should not exceed 3. When the third starting fails, the startup
operation should be stopped, and audible and visual alarm signal should be sent out. Such single
alarm signal should be extended to the navigation bridge control station. For the marine main
engine remote control system applying for additional AUT-0 automation notation should be
provided with the automatic starting function.

5.6.3 If the main engine is started via the compressed air, corresponding control station should be
provided with alarm device displaying a low starting pressure. The alarm value should be set to
the critical value which the min. starting pressure of the main engine reaches.

5.7 Speed governing

5.7.1 The rotation speed change instruction sent by the remote control device can be graded or
continuous, but the actual rotation speed of the main engine should not be changed suddenly.

5.7.2 The rotation speed of the main engine should cross the critical speed zone automatically and
quickly during speed governing. Meanwhile, the critical speed zone should be marked in red on
the main engine tachometer after being installed on the ship.

5.7.3 In emergency, the main engine should be capable of conversion from max. forward speed to
full astern, and the automatic sequence control should be completed within the time interval
allowed by the main engine.

5.8 Transfer of control

9 / 17
 E-16 (201510) Main Engine Remote Control System

5.8.1 Transfer of control should be realized between control stations in case of main engine
shutdown, failure or during normal operation. During such conversion, the main engine operation
status should not be changed significantly.

5.8.2 Each control station should be provided with interlock on the main engine, namely, only one
control station can be activated for control at one time.

5.8.3 The control station activated should be displayed at all control stations.

5.8.4 The priority (from high to low) of control stations is the local control station, centralized
control station of the engine room, navigation bridge control station, and bridge wing control
station. The transfer of control between control stations should be realized only between those
with high priority, namely, the transfer of control between the centralized control station of the
engine room and navigation bridge control station can only be conducted at the centralized control
station of the engine room; the transfer of control between the local control station and the
centralized control station of the engine room or the navigation bridge control station can only be
conducted at the local control station.

5.8.5 For transfer from high-level control station to low-level one, the confirmation form the low
level one must be obtained first before transfer. The low-level control station may be provided
with a device to ask for control from the high-level one, and conversion can be conducted only
after the request is responded. Such confirmation is not necessary in case of conversion to local
control.

5.9 Emergency shutdown

Each control station should be provided with emergency shutdown device independent of the
control system, which is used to shut down the main engine manually in emergency. Generally,
such emergency shutdown device is used to cut off the fuel supply of the main engine, and its
arrangement and structure should be designed in such a way that it will not be touched
unexpectedly, for example, use the button with a protective cover. During emergency shutdown,
indication and audible and visual alarm should be provided.

5.10 Safety system

5.10.1 In case of any major failure endangering the main engine, the safety system should take 3
types of protective actions automatically described in 3 (4) of the Guideline, and give an alarm at
relevant control station. Single alarm signal should be displayed at the centralized control station
of the engine room, and group alarm signal for special safety systems should be displayed at other
relevant control stations. However, the group alarm on shutdown, speed reduction and automatic
backup pump startup should be distinguished.

5.10.2 The main engine shut down due to the action of the safety system should not be put into
operation until manual restoration is conducted; For example, only when the remote control
handle is set to the “Shutdown” position, can the main engine restored be restarted.

5.11 Overriding

10 / 17
 E-16 (201510) Main Engine Remote Control System

5.11.1 When the safety system mentioned in 5.11 is to take type-a or type-b actions, the navigation
bridge control station should give an audible and visual pre-alarm to indicate that the safety
system is to take action, and inform the driver on duty in time to evaluate the navigation condition
in emergency, so as to determine whether to allow the main engine to take the above-mentioned
action. The time for evaluating the navigation condition is suggested to be set to 5 s, and the
bearing duration of the main engine should also be taken into consideration.

5.11.2 The navigation bridge should be provided with the overriding device for preventing the
safety system mentioned in 5.11 from taking type-a or type-b action. If it is triggered during
pre-alarm, the safety protection action will be canceled (excluding the circumstance that the main
engine will be damaged thoroughly in a short time, for example, overspeed).

5.11.3 Each control station should give an audible and visual alarm signal when the overriding
device is put into operation.

5.11.4 The design, arrange and structure of the overriding device should avoid unexpected touch.

5.12 Main control station display and alarm items

5.12.1 The navigation bridge control station and the main control station should be provided with
the following indication instrument and audible and visual alarm:

(1) Main engine tachometer (if the main engine remote control system is provided with a
tachometer);

(2) Clutch and shaft brake status (if applicable);

(3) The control station activated;

(4) Alarm on low startup pressure of the main engine;

(5) Pre-alarm and alarm of safety system main engine speed reduction and shutdown;

(6) Overriding alarm;

(7) Starting failure alarm;

(8) Control power supply failure alarm;

(9) Remote Control system failure alarm.

5.13 Functional alarm requirement

5.13.1 All the alarms should be sent out with both the audible and visual alarm signals. Generally,
the colors for major failures and common ones are red and yellow respectively, and the audio
signal should be loud enough.

11 / 17
 E-16 (201510) Main Engine Remote Control System

5.13.2 The alarm system should give an alarm signal for all failures occurred at the same time.
The alarm and /or alarm response of certain failure should not hamper those of other failures
occurred at the same time. The partial elimination of audio alarm signal at the navigation bridge
control station should not prevent generation of the audio alarm signal at the centralized control
station of the engine room and local control station.

5.13.3 The device to eliminate audio alarm signal (silencing) should be provided. When the
silencing button is pressed down after the alarm signal is responded, the visual alarm signal can be
changed (for example, from flashing to front light) rather than being eliminated, which should
remain clean and distinguishable. The silencing button for the audio alarm signal at the centralized
control station of the engine room and local control station can only be set at the centralized
control station of the engine room and local control station, and the audio signal should be held till
the failure is eliminated. After failure elimination, such alarm channel should be restored to
normal operation status automatically.

5.13.4 The alarm system should be provided with self-inspection function, i.e. it can inspect the
failure of itself and give an alarm (or indication), so as to avoid any failure not alarm or false
alarm, for example, to provide it with a lighting push button.

5.13.5 The visual alarm and indicator on the navigation bridge should be provided with a device to
adjust the brightness of the indicating lamp to a low level (but not turn off the lamp), so as not to
affect the night vision of the driver.

5.14 VDR interface (if VDR is provided for the ship)

5.14.1 The main engine remote control system should input and record into the VDR the direct
engine control commands and feedback instructions (including the forward/backward instruction
and the control station used, shaft speed, steering, and feedback instructions) as well as alarms
required in the navigation bridge (including main engine remote control system failure, speed
reduction and shutdown of the main engine remote control system, as well as the automatic speed
reduction, shutdown and overriding of the main engine remote control system). For relevant
requirement, see the modified performance standard of the marine voyage data recorder (VDR)
approved according to the MSC.333 (90) resolution of the marine safety committee.

5.15 Air source and air supply line

5.15.1 Safety valve should be provided in the pneumatic-control air supply line. The opening
pressure of the safety valve should not exceed 1.1 times the rated operating pressure.

5.15.2 The reducing valve, filter, oil-water separator and dryer should be provided in the air
supply pipe so as to keep the air dry and free of impurity and oil content. Generally, at least two
reducing valves, two filters, and two dryers should be provided in parallel; however, one filter and
one dryer are allowed provided that measures are available to quickly complete the maintenance
and replacement of the above-mentioned components without adverse effect on the normal
operation of the pneumatic control system.

12 / 17
 E-16 (201510) Main Engine Remote Control System

6 Type test

6.1 Selection of Typical Sample

6.1.1 When applying for type approval for the product with single control mode, the applicant
should select one device with all control positions for type test.

6.1.2 When applying for type approval for the product with different control modes, the applicant
should select the most typical device for each control mode for type test.

6.2 Type test environment and operating conditions

6.2.1 The test site should be maintained within the following atmospheric conditions:

(1) Ambient temperature: 15℃~35℃;

(2) Relative humidity: 30％RH~90％RH;

(3) Air pressure: 86~106 kPa.

6.2.2 The main engine remote control system should work under rated operating voltage and
frequency.

6.3 Type test items and test method

6.3.1 The main engine remote control system should be subject type test according to the
requirement in Table 6.3.1.

6.3.2 Any test method and standard cited in the section can be replaced with other equal standards
or those accepted by CCS according to actual conditions.

List of type test items Table 6.3.1

No. Test items Test method and result

1 Visual inspection Article 2.1 of GD01-2006

2 Functional test See Article 7.2.4 of the Guideline for details

3 High voltage test Article 2.14 of GD01-2006

4 Power supply fluctuation test Article 2.4 of GD01-2006

13 / 17
 E-16 (201510) Main Engine Remote Control System

Continued Table 6.3.1

5 Power supply variation test Article 2.5 of GD01-2006

6 Insulation resistance measurement Article 2.3 of GD01-2006

7 Low-temperature test Article 2.9 of GD01-2006

8 Dry heat test Article 2.8 of GD01-2006

9 Cyclic damp heat test Article 2.10 of GD01-2006

10 Vibration test Article 2.7 of GD01-2006

11 Inclination and sway test Article 2.6 of GD01-2006

12 Protection level test Article 2.15 of GD01-2006

13 Electrostatic discharge immunity test Article 3.4 of GD01-2006

Radio-frequency electromagnetic field

14 Article 3.5 of GD01-2006
radiated immunity test

15 Low frequency conduction immunity test Article 3.8 of GD01-2006

Immunity test on conducted disturbance

16 Article 3.9 of GD01-2006
induced in radio-frequency field

17 Electrical fast transient burst immunity test Article 3.6 of GD01-2006

18 Surge immunity test Article 3.7 of GD01-2006

Radiation emission measurement at the shell

19 Article 3.3 of GD01-2006
interface

20 Conduction emission measurement Article 3.2 of GD01-2006

21 Flame retardant test Article 2.16 of GD01-2006

14 / 17
 E-16 (201510) Main Engine Remote Control System

Continued Table 6.3.1

2.7.1.1 and 2.7.1.2 of Chapter 3 of the International

22 Pipeline hydraulic test
Regulations for Pre-venting Collisions at Sea

2.7.3.1 of Chapter 3 of the International Regulations

23 Piping tightness test
for Pre-venting Collisions at Sea

7 Unit/batch inspection

7.1 After obtaining the CCS type approval certificate, the factory should still conduct the
unit/batch inspection on each main engine remote control system, and submit self-inspection
report of the factory. The CCS Surveyor will inspect the product one by one.

7.2 The unit/batch inspection should at least involve the following items:

7.2.1 Visual inspection: Check whether the equipment structure, material used, internal wiring,
component selection and installation, manufacturing process and marking meet the requirements
of relevant CCS provisions, approved plans and documents, and technical conditions provided by
the manufacturer.

7.2.2 High voltage test: It should be conducted with the test voltage specified in 7.2.2 and
frequency of 50 Hz or 60 Hz, which should be free of breakdown for 1 min. during the test. The
printed circuit board with electronic components that may be damaged when bearing the test
voltage during the test can be removed before the test.

List of test voltages Table 7.2.2

Rated voltage (V) Test voltage (V)

U n ≤ 65 2×
U n + 500

66 ＜
U n ≤ 250 1500

7.2.3 Insulation resistance measurement: Immediately after the high voltage test, the insulation
resistance between live parts as well as live parts and the ground (the housing) should be measured
at the test voltage of Table 7.2.3 (1), which should not be less than those specified in Table 7.2.3
(2). The printed circuit board with electronic components that may be damaged when bearing the
test voltage during the test can be removed before the test.

List of test voltages Table 7.2.3 (1)

Rated voltage (V) Test voltage (V)

U n ≤ 65 2×
U n , min. 24

15 / 17
 E-16 (201510) Main Engine Remote Control System

Un ＞ 65
500

List of insulation resistance values Table 7.2.3 (2)

Min. insulation resistance value (MΩ)

Rated voltage (V)
Before test After test

U n ≤ 65 10 1

Un ＞ 65
100 10

7.2.4 Functional test: Verify whether each function of the equipment meets the requirement of the
approved plans and documents and technical product conditions, including but not limited to the
following:

(1) Starting/shutdown function test;

(2) Test of passing quickly the critical speed zone;

(3) Forward/backward speed regulation test;

(4) Transfer of control test;

(5) Emergency shutdown test;

(6) Test on speed reduction and shutdown due to failure;

(7) Overriding function test (including overriding and non-overriding items);

(8) Analog alarm function test;

(9) Power supply conversion test;

(10) Test on keeping the propeller speed in case of failure (including the power supply and air
source failure).

7.2.5 Pipeline hydraulic test: The pipeline and accessories, after having been produced, should be
subject to hydraulic test at the test pressure of not lower than 1.5 times the design pressure. For
pipelines with inner diameter of less than 15 mm, the hydraulic test is not required.

7.2.6 Piping tightness test: The pipeline and accessories should be subject to leakage inspection
under working conditions. The test pressure is suggested to be set at 1.1~1.25 times the design
pressure.

16 / 17
 E-16 (201510) Main Engine Remote Control System

8 Onboard test

8.1 Installation inspection on the main engine remote control system should be carried out after
being installed on the ship, and onboard test carried out together with external equipment. For test
contents, refer to the requirement of 7.2.4 of the Guideline, so as to verify the specific functions.

17 / 17