Aldo Da Rin, Piero Raffin, Giorgio Sulligoi

All Electric Ship Power Stations: Analysis of Voltage Controls and Protections
ABSTRACT
Subject of this paper is to analyze design aspects of power station generators controls and protections in All Electric Ships (AESs) moving from the simulated reconstruction of a sequence of electro-mechanical events eventually degenerated into a black-out on board a cruise liner. The aim is promoting a more integrated approach to the design of alternator voltage control systems and protections, which are involved in the overall management of the station and therefore are determinant for power generation quality and safety. The work moves from an in-deep analysis of the Integrated Power System (IPS) of a modern all electric cruise liner and examines some transients due to operative and fault conditions. From a simulated reconstruction of a black-out event sequence, this work aims at identifying issues for improving system integration design of different equipments into the IPS. Therefore, after an analysis of voltage control systems and their coordination with protections, suggestions for additional specifications and actions to be taken regarding the performance of Automatic Voltage Regulators (AVRs) and the coordination between voltage controls, alternator protections, and Power Limitation System (PLS) will be outlined. outs (Jonasson and Soeder, 2000). The latter has to be categorically avoided as it eliminates any possibility of maneuvering the ship until the restart of the system has been completed. A blackout occurring during maneuvers in port, for instance, could cause a substantial accident. Following the guidelines proposed by Da Rin and Sulligoi (2007), an effort was made in this work to assess dynamic coordination between protections and controls and to show the possibility of improving power quality of the IPS using advanced voltage regulators as suggested by Arcidiacono, Menis and Sulligoi (2007).

APPROACH
This work presents an analysis aimed at determining some operative limitations that arise in shipboard power control and protection systems. To this purpose, an electric incident that occurred to an all-electric cruise liner during sea trials and degenerated into a black-out is investigated and reconstructed using the Italian Integrated Power Plant Ship Simulator (IIPPSS) presently under development at the University of Trieste (Giadrossi, Menis, Sulligoi, and Tessarolo, 2008). Incident reconstruction has been done by building an accurate mathematical model of all connected subsystems (including machinery, harmonic filters, controls, protections) and by simulating the IPS from the initial conditions resulting from the data collected from the ship.

INTRODUCTION
AESs present an IPS, which connects and feeds all shipboard loads, electrical propulsion included. The generation power station thus becomes the core system and power station controls result fundamental, in particular those controlling fast voltage and reactive power dynamics. Normally, the design of alternators, AVRs and protections is demanded to different subjects, who normally neither utilize complete models of the shipboard IPS, nor they perform simulated analyses of transient phenomena, with the result that often solutions are tested only after installation on board, that is during first sea trials. This is one of the reasons why power quality problems are sometimes experienced on board AES, from important variations in bus-bar voltage, to black-

Cruise Liner IPS Description

The ship in subject has a very common power plant architecture, with six 14 MVA diesel-driven 0.9 power-factor synchronous generators, connected in groups of three to two Medium Voltage (MV) 11kV interconnected distribution switchboards, as sketched in Fig.1. All users are fed from these two switchboards either directly, as MV induction motors (thrusters and chillers) and harmonic filters, or indirectly, through appropriate transformers, as the propulsion systems (4 load commutated inverters feeding each a winding of the double three-phase propulsion synchronous

motors), accommodation services, consisting mainly of induction motor for air conditioning,

and electric heating and lighting for galleys and cabins and public spaces.

Fig.1. Cruise liner Medium Voltage IPS layout.

Incident Description
The Ship was maneuvering to sea in a channel, assisted by tugs and proceeding with sea-trials. Three generators were connected to the bus feeding two harmonic filters (which serve the purpose of generating reactive power too). The loads were five thruster asynchronous motors (not generating thrust, but only idling for a possible maneuvering), one or two chillers (ship was mainly unoccupied and in the winter condition, so demand for air conditioning was small) and the propulsion system, limited to about 50 rpm (according to the maximum speed allowed in the channel of 5 knots). Hotel load was estimated in the range of about 10 MVA at 0.8 power factor, as galleys, air conditioning, and lighting were not in full operation. Due to the low propellers speed and to the hotel load the resulting network power factor was quite low. One of the three diesel engines on duty then failed owing to lubrication problems. This failure caused an automatic network reconfiguration, which consisted in removing one of the two inserted harmonic filters, as commanded by the PLS software logic to avoid VAR overcompensation.

Soon after another one of the two diesel engines on duty failed, most probably affected by the same lubrication problems (lubricating circuit is common to a group of three engines). This in turn caused the automatic disconnection of the last harmonic filter. As no harmonic filter were connected to the IPS to provide VAR, the last alternator overexcited. PLS automation system failed to detect the reactive overload the last generator was suffering owing to a sensor problem, so it did not reduce power to shaft lines, but on the contrary it commanded a rotational acceleration of one propeller. This increased VAR requested to the generator, so that generator AVR went into saturation, limiting excitation current. As a consequence, voltage progressively dropped, in an uncontrolled fashion, well below the rated value of 11 kV. No stall of induction motor was reported; therefore their contribution to system stability should be considered as positive (they operated at constant power factor and active power, therefore they reduced reactive power absorption), but overload was so severe even this contribution did not help.

Load shedding system did not bring help, as it is by rules a wattmetric protection (so it monitors

and switches-off active loads), while engine was overloaded in reactive, not in active, power.

Fig.2. Experimental Record of Generator and Propulsion currents.

Fig.3. Experimental Record of Generator and Propulsion Currents (detail).

Finally protections operated, although it was unclear which protection did operate, as the ship report was not accurate in this respect; simulated reconstruction in the next section shows the intervention of the generator over-current protection and a black-out happened. Fig.2 shows

the plots of the experimental records of generator and propulsion currents taken during those sea trials, whose final part including the black-out sequence is detailed in Fig.3.

NUMERICAL SIMULATION

IPS Modeling
The Medium Voltage section of the IPS has been simulated by connecting all involved subsystems: three-phase alternators, prime movers, main busbar, propulsion loads, harmonic filters, passive loads (representing hotel base load). Generator and main bus-bar protections have been simulated, complete of their logic functions, measurement blocks, intervention characteristics and actual setup values. Synchronous generators have been simulated by implementing the reduced order model for electromechanical transients (Marconato, 2004).

Propulsion motors are fed by synchroconverters, whose power factor is linearly related to shaft angular speed. Therefore, propulsion drive active power has been obtained from propeller speed through the usual cubic law, while propulsion drive power factor law has been assumed as a linear function of the same propeller speed. Finally, MV main bus-bar has been simulated as a network node connecting all running generators to the supplied loads and to the harmonic filters.

Protections
The list of generator protections simulated is reported in Table 1.

ANSI CODE 59 (*) 27 51 50 51 (*) 81< (*) 81>

IEC CODE U> U<< I> I>> I> & V< f< f>

Protection Over-voltage Under-voltage Over-current Short circuit over-current Voltage restrained over-current Under-frequency Over-frequency

Operating charact. def. time def. time very inverse def. time def. time def. time def. time def. time def. time

Set value 14300 V 7700V 850A 1700A 1700A, 8800V 57Hz 54Hz 63Hz 66Hz

Set time [s] 0.5 3 1.2 1 1 5 0 5 0

Table 1: Setup of Implemented Protections

Protections denoted with (*) have been implemented both at generators and at main busbar, complete of intervention setups (bus-bars protections trip interruptible loads and are set more sensitive than generators ones). As regards the operating characteristic, setups are: -definite time: protection opens the breaker after the set time value when the measured quantity exceed the threshold; -inverse: the operating time of protection is not constant but depends on the ratio between the measured quantity value and set value. The operating time t is given by relation:

-very inverse: the operating time of protection is inversely proportional to the ratio between the measured quantity and the threshold, so that the greater is the measured value the faster is the protection intervention.

Simulation Description
The simulation was aimed at reproducing the real event that provoked the blackout. Initial conditions of the IPS have been assumed as following, according to the incident report described in Sec.3: 2 generators with the same shared value of active power; 1 harmonic filter; (1) 2 propulsion motors running at about 67 rpm, each motor absorbing 2.25 MW at 0.45 power factor load; an equivalent hotel load rated 6.8 MW at 0.8 power factor.

13.5 t =T G 1 GS
Where T is operating set time; G is measured value; Gs is set value;

After about 4 seconds from the start, the following maneuvers have been operated in sequence,

according to the event sequence deduced from the traces of Figs.2-3: 1. sudden disconnection (breaker opening) of one loaded generator (only one generator remains paralleled and loaded) at t=5 s;

2. sudden disconnection (breaker opening) of the harmonic filter at t=5.5 s; 3. slow increase of the port propulsion motor speed from 67 rpm to 83 rpm, starting from t=10 s.

Fig.4. Frequency Transient Due to the Sudden Loss of One Loaded Generator (1.0 p.u. = 60 Hz).

According to Fig.4, it is noticeable that the frequency drop following to generator disconnection (step 1. above) is almost negligible (less than 0.4%, according to Fig.4). This confirms the assumption on electromechanical

transients, where variations in frequency are small in amplitude, and shows that no underfrequency protection threshold has been trespassed.

Fig.5. Simulated Generator Current.

Fig.6. Simulated Generator Voltage.

With only one generator loaded, machine voltage (coinciding with busbar voltage) started decreasing as generator current increased. This

was due to the lack of capability of the synchronous machine in that operating point: the generator was able to supply active power to

propulsion, but not enough reactive power. This was confirmed by the upper saturation of AVR excitation current. Therefore, voltage began to fall, as machine current (and propulsion power) increased after the loss of the last harmonic filter. Finally, PLS commanded the port propeller speed to increase from 67rpm to 83rpm in about 80s: the related increment of propulsion power determined, as shown in Fig.5, a relevant rise in generator current, from about 800A at t=10s (being rated current 735A, Fig.5 lower dashed line) to about 940A at t=85s. According to the simulation, such generator overcurrent trespassed the threshold value (850A, Fig.5 higher dashed line) of generator protection 51I (generator overcurrent) at t=25s; almost 160s later, protection 51I tripped the generator, causing the complete black-out of the ship. Fig.6 shows a machine/busbar voltage decrement to almost 8200V (the 75% of rated voltage). Time basis in Figs. 4, 5 and 6 is the same, to allow the reconstruction of the complete trend of electromechanic quantities. As excitation current saturated, it was impossible, for that AVR, to recover such voltage drop.

1. adding an alarm triggered by generator over-excitation: this alarm, generated by propulsion control system and transmitted via serial link to ship automation, commands the shedding of a sequence of interruptible loads; 2. improving capability of propulsion control system to cancel propulsion load should the network enter in a single generator configuration; 3. improving propulsion system control in a way that it is able to re-apply torque soon after power becomes available again. As it can be seen, none of these actions aims at preserving propulsion power by, for instance, generating more reactive power for a limited period of time, or at coordinating the switching of harmonic filters. Clearly, those actions were influenced by the lack of enough data records and by the pressure of delivery, so they should be considered only a patch before a proper and accurate approach that encompasses the system in its completeness. Therefore, a series of questions, comments and suggestions, concerning the incident and the remedies taken. A basilar premise is the fact that, according to simulation, the last IPS generator has operated at steady-state for almost 100s at 75% of rated voltage and at about 940A (vs. 735A of rated current), before the 51I protection intervention; referring to experimental records, this time is reduced to almost 60s, but only because reported overcurrent is higher (about 1000A or more), therefore machine voltage would have been even lower than the simulated 75%. Both cases are completely out of what is specified by classification registers (both R.I.Na. Ship Rules and Lloyds Register of Shipping tolerate a maximum voltage drop of -10% in steady-state conditions, while larger drops are tolerated only following load step-changes and have to be recovered in 1,5s). Having considered such important premise, the following conclusive items are evident. 1) Protections: No propulsion load shedding technique is foreseen. Neither signals from busbar or generators protections are sent to the PLS, nor PLS acquire alternators measurements in a secure way (neither redundancy nor self check): it makes measurements by itself, and a result in this case was the saturation of the

Discrepancies
Some small differences are observed when comparing simulated reconstruction to the experimental records: in real situation protection intervention happened almost one minute before (96s vs. 160s simulated), as generator current was over 1000A (Figs.2-3). The exact final value of such current was unknown because current transducers had saturated. This(difference can be explained by the fact of the presence of further loads, including asynchronous loads, which may have absorbed higher currents due to the important reduction of supply voltage they suffered. Contrarily, simulation considers a constant hotel load, as propulsion and generators currents were recorded while remaining load currents were not. However, if the final value of generator current were assumed around 1000A, then the very inverse characteristic of protection 51I would open the breaker around t=100s, thus fully validating the simulated reconstruction.

CONCLUSIONS
Soon after sea trials, some actions were taken to improve system robustness to this kind of failures and avoid further incidents. These actions were:

VAR transducer. A propulsion load shedding strategy should be implemented, to apply in case all interruptible loads have been already disconnected by busbar protections. Propulsion load shedding can be controlled using PLS propulsion speed and torque controls. In the described event, more than one minute was available to do that. 2) PLS: Beside measurements (why PLS has to carry out itself measurements, instead of acquiring through communication network values already measured by alternators or exciters? A problem of responsibility can be devised, but a crosscheck among sensors is a kind of minimum request). According to event reconstruction, it could be inferred that PLS failed in putting in stand-by an additional generator, starting time would have been absolutely compatible with the length of that sequence of events. Moreover, the decision of accelerating port propeller, as commanded by software control, appears incomprehensible. 3) Harmonic filters: As it was acknowledged that a VAR request caused the generator overcurrent and undervoltage, it has to be remarked that the last harmonic filter was automatically taken off the network: this happened when a single generator remained on duty, to avoid overcompensation. No VAR measurements are normally taken and elaborated by PLS to command filter insertion, whereas in this specific case the lack of VAR generated was evident. 4) AVR: From all equipment involved in voltage/VAR regulation (AVR, Master AVR, PLCs, switchboard controls, PLS, etc.), it was not recognized that overexciting the generator for a couple of minutes would have kept voltage within rules prescriptions. During that time, a decision about either inserting a further generator, or lowering propulsion power could have been taken by PLS. No risk of overheating the generator would have been taken as the time was short and overexcitation very limited: a brief calculation of the saturated vector diagram of the synchronous machine, using IIPPSS, shows that it would be

enough to provide an excitation current if=2.93 p.u. (whereas alternators have about ifn=2.55 p.u. as rated excitation current at full load) for a couple of minutes. Unfortunately, AVR was able to provide a maximum of if=2,67 p.u. at steady state, because of its design settings. This kind of problems could be avoided adopting new generation, integrated voltage and VAR control systems, as proposed in [3], that recalculate in realtime the capability curves and apply inverse-time algorithms of thermal protection to the rotor of synchronous machines. Employing an AVR with such a small overcurrent margin (almost 5% of excitation current) is risky, for these kind of situations. Please note that in landbased power plants a steady-state overcurrent margin of 30-50% (deriving from the usual over-sizing of thyristor bridges and excitation transformers) is an acquired standard. 5) Diagnostics: No data logging automatic recording is foreseen at all, on board, to acquire waveforms of the electromechanical quantities. Conversely, such a practice is commonly employed in land power plants, even in small, non-strategic plants (rated a few MVA). This is another function that can be accomplished by employing smart voltage and VAR control systems, endowed with communication capacity and opportunely interfaced with shipboard automation and PLS. Such items reveal a system integration problems, due to technological limitations of employed equipment, that make it impossible to realize an effective integration between generators and electrical users, especially with reference to the reactive power management. A main suggestion is to address much more responsibility to the suppliers of voltage and VAR control systems, in order they supply not just equipment but also take the responsibility of voltage and VAR management over the entire IPS. This should lead to a revolution in the supply of such systems: many suppliers specialized in land power system can provide innovative equipment, and competence, to avoid such problems and satisfying all the enlisted needs.

Finally, the case studied demonstrates the opportunity of employing simulation tools for validating design activities and new projects in the field of IPS, for testing of both normal and fault or extreme conditions. The simulated reconstruction of the event has shown in particular the effectiveness of the IIPPSS simulator, which is currently under development at the University of Trieste and is due to be delivered by the half of 2009.

Worked for Wartsila North America as control engineer for shipboard and land power station service engineer. From 2003 he has been working for Carnival Corporate Shipbuilding as design and project engineer in the field of power generation and control for multiple projects, such as Queen Mary 2, Liberty Class, Vista Class and Aida
Carnival Corporate Shipbuilding - Mariotti Shipyards Via dei Pescatori, Molo Cagni Genova (Italy) E-mail:

REFERENCES
V. Arcidiacono, R. Menis and G. Sulligoi. Improving power quality in all electric ships using a voltage and VAR integrated regulator. Proc. of IEEE ESTS 2007, Electric Ship Technology Symposium, Arlington (VA), USA, May 2007, pp.322-327. A. Da Rin and G. Sulligoi A cost-effective approach to reactive power management in all electric cruise liners. Proc. of IMAREST AES 2007 All electric Ship Conference The vision Redrawn, London, UK, September 2007, pp.29-40 G. Giadrossi, R. Menis, G. Sulligoi, A. Tessarolo. Voltage Stability Analysis of All-Electric Cruise Liners. IEEE SPEEDAM 2008, International Symposium on Power Electronics, Electrical Drives, Automation and Motion, Ischia (NA), June 2008. I. Jonasson and L. Soeder. Power quality on shipsA questionnaire evaluation concerning island power systems. Proc. of IEEE 9th Int. Conf. on Harmonics and Quality of Power, 2000. .R. Marconato, Electric Power Systems vol.2, CEI, Milano Italy, 2004.

Aldo.DaRin@carnivalshipbuilding.com
Tel +39 010 2549727

Piero Raffin is an employee of Wrtsil Italia S.P.A. - Product Engineering Unit. He obtained his masters degree, with honors, in electrical engineering at the University of Trieste, where he has taken part in research projects on marine electrical applications. He is active in the fields of marine engine automation, factory test, tool development and shipboard power station protection and control.
Dept. of Electrical, Electronic and Computer Engineering, University of Trieste Via Valerio, 10 - 34127 Trieste (Italy) E-mail: pieroraffin@gmail.com Fax: +39 040 5583460 Tel.: +39 040 5587125

_____________________________________ __ Aldo Da Rin is a Project Engineer at Carnival Corporate Shipbuilding, Mariotti Cantieri Navali Genova (Italy). He has graduated in Power Electronics at the University of Padua (Italy) in 1993, started working immediately after in a project for high speed train (emergency ventilation system, based on DC/DC power conversion). Later in 1995 he started working for Fincantieri Cantieri Navali Italiani, till 2001. During this period he covered several roles, among them commissioning engineer for cruise ships, R&D project engineer. In 2001 and 2002

Dr. Giorgio Sulligoi is Assistant Professor of Electric Generators Modeling at the Dept. of Electrical, Electronic and Computer Engineering of the University of Trieste (Italy). He obtained his masters degree, with honors, at the University of Trieste, and his Ph.D. at the University of Padua (Italy), both in electrical engineering. He is active in the fields of shipboard power systems, all electric ships, alternators modeling and voltage control.
Dept. of Electrical, Electronic and Computer Engineering, University of Trieste Via Valerio, 10 - 34127 Trieste (Italy) E-mail: gsulligoi@units.it Fax: +39 040 5583460 Tel.: +39 040 5587125