Big Orange DP Fmea Rev e PDF

No 1 The
Hinna Park (Blokk A) Exchange

Jaataavaagveien62
7 Market Street
4020 Stavanger Aberdeen
AB11 5PJ UK
Tel +47 920 32 277
Tel +47 33 44 760 00
Phone +44 1224 289100
Fax +44 1224 289101
Peter.solvang@nobledenton.com
www.gl-nobledenton.com
www.gl-nobledenton.com
WILHELMSEN SHIP MANAGEMENT

BIG ORANGE XVIII
DP SYSTEM FMEA
February 2012
Report No: 9031 12 00168 424E
DOCUMENT DETAILS AND ISSUE RECORD

REV NO DATE DESCRIPTION AUTHOR APPROVED
B 07.02.2012 Internal issue for QA PS
C 08.02.2012 Issued to client PS RI
D 09.02.2012 Re-issued to client with minor amendments PS RI
E 20.02.2012 Issued to client RI PS
DISTRIBUTION
COMPANY ADDRESSEE COPIES
Wilhelmsen Ship Management Andreas Ziotopoulos 1 Electronic
Internal GLND Stavanger 1 Electronic
REVISION STATUS
REV DATE DESCRIPTION
A 31.01.2012 Revised for Internal Review – NDC A6093/NDC/00/AKC/ch revised
B 06.02.2012 Internal issue for QA
C 08.02.2012 Issued to client
D 09.02.2012 Re-issued to client with minor amendments
E 20.02.2012 Revised to reflect 230V Clean Power switchboard modifications
Wilhelmsen Ship Management Big Orange XVIII DP FMEA Rev E
__________________________________________________________________________________
Summary
This report represents the findings of a Failure Modes and Effects Analysis
(FMEA) of the DP System of the Wilhelmsen Ship Management Well Stimulation
Vessel, ‘Big Orange XVIII’. This study includes all systems concerned, whether
directly or indirectly with maintaining the vessel in position using Dynamic
Positioning.
This FMEA is based on information gained from earlier DP FMEA practitioners
involved in the vessel build and conversion. The vessel already had a DP FMEA
compliant with the DNV Classification Society Rules for the DP Notation
DYNPOS AUTR, which is the equivalent of IMO DP Class 2. GL Noble Denton
has assessed and included the following reports from the new build in the FMEA:
· Failure Modes and Effects Analysis FMEA for DNV Class AUTR by Global
Maritime, Report Number, GM-12653-0296-13711,Rev1 Vessel Name: MV
Big Orange XVIII dated 23.05.96.
· Preliminary FMEA Document PML/9625/Rep-01/Rev-0 by Poseidon
Maritime (UK) Ltd, dated 07.08.2002.
· PML, DP Proving Trials, NDC 5527155 Rev-0, Test Sheets, No’s 01 to 39,
14.08.2006.
· NDC FMEA document A6093/NDC/00/AKC/ch & proving trials from 2008
This FMEA update Report No 9031 12 00168 424 Rev E issued in February 2012 is based on
Kongsberg Maritime K-POS & C-JOY standard system information & schematics, and a review
of “as built” information gathered on the vessel during annual trials, and responses to GL ND
Technical Queries. In addition, it reflects changes made to the 230V clean power switchboard
and DP UPS unit distribution.
The FMEA identifies single point failures and assess their affect on the DP system
and confirms the vessel’s compliance with the following rules and guidelines:
International Maritime Organisation (IMO) MSC 645, ‘Guidelines for
Vessels with Dynamic Positioning Systems’, for a DP Class 2 vessel
The DP rules of the relevant Classification Society, i.e. DNV DP Class
Notation DYNPOS AUTR, which is equivalent to IMO DP Class 2.
M190 - IMCA Guidelines for Design and Operation of Dynamically
Positioned Vessels.
IMCA Study – ‘Establishing the Safety and Reliability of DP Systems’,
2004 - Appendices D & E in particular.
Current good operating practice was also taken into account.
Page 2 of 62
__________________________________________________________________________________
Worst case failure design intent: The vessel’s worst case single failure is
considered to be the loss of one section of either of the 600V or 440V
switchboards; these will have a similar effect on equipment loss, either from the
main power supplies or through the loss of auxiliaries such as main motor fans.
This was confirmed during the DP FMEA Proving Trials.
On the basis of compliance with the notation DNV DP Class DYNPOS AUTR and
IMCA Guidelines and Recommendations, the Big Orange XVIII is considered fit
for the purpose of carrying out DP operations equivalent to IMO Class 2 subject to
the vessel being operated within limits.
Page 3 of 62
__________________________________________________________________________________
ABBREVIATIONS
ABS American Bureau of Shipping

AC Alternating Current
ACH Anti Condensation Heater
ACOS Automatic Change Over Switches
ACU Air Conditioning Unit
ADCL Alstom Drivers and Controls Limited
AHU Air Handling Unit
ASR Auto Synchronisation Relay
AVR Automatic Voltage Regulator
BA Bus Arbiter
BCR Breaker Close Relay
BFOC Bayonet Fibre Optic Connector
BOR Breaker Open Relay
CD Carrier Detect/Collision Detect
CMF Common Mode Failure
CPP Controlled Pitch Propeller
CPU Central Processing Unit
CRC Cyclic Redundancy Check
CSMA Carrier Sense Multiple Access
CT Current Transformer
DBR Dead Bus Relay
DBSR Dead Bus Slave Relay
DE Drive End
DECS Digital Excitation Control System
DG Diesel Generator
DGPS Differential Global Positioning System
DI Digital Input
DO Diesel Oil
DP Dynamic Positioning
DPO Dynamic Positioning Operator
DPS Dynamic Positioning System
DSLC Digital Synchroniser & Load Controller
DSC Digital Speed Controller
DSR Dead Bus Slave Relay
Page 4 of 62
__________________________________________________________________________________
ECR Engine Control Room
EDM Exciter Diode Monitor
EG Emergency Generator
EGB Electric Governor – Backup
ELP Emergency Lighting Panel
ER Engineroom
ESD Emergency Shut Down
F&G Fire and Gas
FAD Free Air Delivery
FBC FIP Bus Controller
FIP Factory Interface Protocol
FLA Full Load Amps
FMEA Failure Mode and Effect Analysis
FMECA Failure Mode and Effect Criticality Analysis
FO Fuel Oil
FW Fresh Water
G Generator
GIR Generator Interface Relay
GL ND GL Noble Denton AS, Norway
GPS Global Positioning System
GVR Generator Voltage Relay
HF High Frequency
HO Heavy Oil
HPR Hydroacoustic Position Reference
HPU Hydraulic Power Unit
HRC High Rupture Current
HV High Voltage
HVAC Heating, Ventilation and Air Conditioning
IAS Integrated Automation System
ICS Integrated Control System
IJS Independent Joystick System
IMCA International Marine Contractors Association
IMO International Maritime Organisation
I/O Input/Output
kVA Kilo Volt Ampere
kVAr Kilo Volt Ampere Reactive
kW Kilowatt
LAN Local Area Network
LBL Long Base Line
Page 5 of 62
__________________________________________________________________________________
LCR Inductance, Capacitance, Resistance
LED Light Emitting Diode
LO Lube Oil
LONTM Local Operating Network
LOP Loss of Position
LOR Lock Out Relay
LUSBL Long Ultra-Short Base Line
LV Low Voltage
mA Milliamps
MAC Manually Activated Call
MAU Media Access Unit
MBC Micro Biological Contamination
MCC Motor Control Centre
MCOS Manual Changeover System
MF Medium Frequency
MMI Man Machine Interface
MMS Marine Management System
MPR Manual Position Relay
MR Multiple Reference
MRU Motion Reference Unit
MSB Main Switchboard
MSC Maritime Safety Committee
MTC Manual Thruster Controls
MUX Multiplexer
MVAr Mega Volt Ampere Reactive
MW Megawatt
NDE Non Drive End
NDC Noble Denton Consultants Ltd
NPS Negative Phase Sequence
OIM Offshore Installation Manager
OLM Optical Link Module
OR Open Relay
O/S Outstation
OS Operator Station/Outstation
OZD Fibre to Copper Converter
PA Public Address
PC Personal Computer
PLC Programmable Logic Controller
PM Planned Maintenance
Page 6 of 62
__________________________________________________________________________________
PME Position Measuring Equipment
PML Poseidon Maritime (UK) Ltd
PMS Power Management System
PSU Power Supply Unit
QC Quick Closing
QCV Quick Closing Valve
RMT Reserve Mud Tank
ROV Remotely Operated Vehicle
rpm Revolutions per Minute
RTD Resistance Temperature Device
SG Specific Gravity
SW Sea Water
T Thruster
THD Total Harmonic Distortion
TQ Technical Query
UPS Uninterrupted Power Supply
USBL Ultra Short Base Line
VAr Volt Ampere Reactive
VCB Vacuum Circuit Breakers
VCOM Communications Variable (also COMV)
VDU Visual Display Unit
VMS Vessel Management System
VRU Vertical Reference Unit
VT Voltage Transformer
WCC Well Control Centre
Page 7 of 62
__________________________________________________________________________________
CONTENTS
1. INTRODUCTION ......................................................................................................................................... 10
1.3 Scope of Work ................................................................................................................................... 10
1.4 Background ....................................................................................................................................... 11
1.5 General Layout ..................................................................................................................................11
1.6 Vessel Particulars .............................................................................................................................. 11
2. POWER GENERATION ................................................................................................................................ 13
2.1. General .............................................................................................................................................. 13
2.2. Fuel Systems ..................................................................................................................................... 14
2.3. Lubricating Oil Systems ................................................................................................................... 15
2.4. Main Sea Water Cooling System ..................................................................................................... 15
2.5. Auxiliary Sea Water Cooling System .............................................................................................. 16
2.6. Central Fresh Water Cooling Systems ............................................................................................. 16
2.7. Starting Air Systems ......................................................................................................................... 17
3. POWER MANAGEMENT ............................................................................................................................ 18
3.1. General .............................................................................................................................................. 18
3.2. Governors .......................................................................................................................................... 18
3.3. Automatic Voltage Regulators ......................................................................................................... 19
3.4. Generator Protection ......................................................................................................................... 19
3.5. Power Management .......................................................................................................................... 20
4 POWER DISTRIBUTION .............................................................................................................................. 22
4.1. Summary of System Design and Operation .................................................................................... 22
4.2. 600V Switchboards........................................................................................................................... 23
4.3. 440V Switchboards........................................................................................................................... 25
4.4. 220 V Distribution ............................................................................................................................ 26
4.5. Emergency Switchboard...................................................................................................................29
4.6. 24Vdc Systems..................................................................................................................................29
5 THRUSTER SYSTEMS .................................................................................................................................. 31
5.1. Bow Tunnel Thrusters ...................................................................................................................... 31
5.2. Stern Azimuth Thrusters ................................................................................................................... 32
5.3. Silicone Controlled Rectifiers .......................................................................................................... 38
Page 8 of 62
__________________________________________________________________________________
5.4. Thruster Sea Water Cooling ............................................................................................................. 39
6 DP CONTROL SYSTEM................................................................................................................................ 40
6.1 Bridge Consoles ................................................................................................................................ 40
6.2 System overview ............................................................................................................................... 40
6.3 K-POS Operator stations .................................................................................................................. 42
6.4 Failure Modes of the DP Operator Stations .................................................................................... 43
6.5 Failure Effects of the Operator Stations .......................................................................................... 43
6.6 Hidden Failures of the DP Operator Consoles ................................................................................ 44
6.7 DP Operator Console Configuration Errors .................................................................................... 44
6.8 Maloperation of the DP Operator Consoles .................................................................................... 44
6.9 Worst Case Failure - DP Operator Stations ..................................................................................... 44
6.10 Dpc-2 controller ................................................................................................................................ 45
6.11 DPC-2 Controller Failure Modes .....................................................................................................47
6.12 Failure of DPC-2 Controller Failure Effects ................................................................................... 48
6.13 Hidden Failures in the DPC-2 Controller ........................................................................................ 49
6.14 Common Mode Failures Affecting the DPC-2 Controller ............................................................. 49
6.15 Maloperation of the DPC-2 Controller ............................................................................................ 49
6.16 Configuration Errors of the DPC-2 that could Defeat Redundancy .............................................. 49
6.17 Worst Case Failure - DP Controllers ............................................................................................... 49
6.18 DP System Sensors – MRU – Anemometer - Gyro ........................................................................ 50
6.19 Motion Reference Units (MRU) ...................................................................................................... 50
6.20 Failure Modes of MRUs ................................................................................................................... 51
6.21 Wind Sensors..................................................................................................................................... 51
6.22 Gyrocompasses ................................................................................................................................. 52
6.23 Dp reference sensors ......................................................................................................................... 53
6.24 Light weight taut Wire (LTW) ......................................................................................................... 55
6.25 Fanbeam ............................................................................................................................................ 57
6.26 cJoy independent joystick ................................................................................................................ 58
Page 9 of 62
__________________________________________________________________________________
1.INTRODUCTION
1.1 GL Noble Denton AS was requested by Wilhelmsen Ship Management to update the DP
System Failure Mode and Effect Analysis (FMEA) of the Big Orange XVIII.
Instructions were received from Vessel manager Andreas Zeotopoulis in January 2012.
The instructions were to update the FMEA to reflect the DP operating system
modifications that took place when upgrading from the Kongsberg 702 system to the K-
POS & c-JOY systems. The scope of work was supervised by Kongsberg Maritime with
installation of cabling, electrical sub systems and components undertaken under owners
supervision. Kongsberg Maritime installation engineers accepted the above work and
commissioned the equipment and subsequent sea trials, to prove the correct operation of
the upgrade. Modifications to the switchboard by way of the installation of surge
protection modules to the existing Silicone Controlled Rectifiers was also undertaken,
these modifications under the supervision of Zeefax Ltd engineers, and modifications
have also been included within this revised study.
1.2 Following the installation of the K-POS and c-Joy systems, Wilhelmsen Ship
Management opted to modify the clean power 230V switchboard and relocate the
distribution for DP UPS 1 and DP UPS 2. The modification was approved by DNV and
quayside trials were carried out to verify the modifications. This document was also
revised to reflect those modifications.
1.3 Scope of Work
1.2.1 The scope of work was to review and verify the existing FMEA of all systems directly
and indirectly involved with the DP System, and to amend & update with regards to the
20112 vessel modifications. In particular the scope was taken to include the installations
and interfaces between existing systems, and those modified during the 2012 upgrade.
K-POS OS, DPC’s & I/O modules

New DP UPS installations and distributions
C-Joy installation and power supplies
One new DGPS position reference system
Surge suppression systems, modifications to the SCR power supplies
1.2.2 Upgrade work took place in Fresderikshavn and Montrose during January/February
2012 to remove the existing Kongsberg 702 system, install the new K-POS & c-Joy
systems and to verify system operation & redundancy requirements. In addition to this
upgrade work, the 230V clean power switchboard was modified by splitting into two
discrete sections (No 1 and No2) and the supplies for newly fitted DP UPS 1 and DP
UPS 2 were relocated to be fed from 230V Clean Power Switchboards 1 and 2
respectively. The clean power distribution on the bridge was also split in line with the
redundancy conecept of the vessel. No modifications were made to other vessel systems
with the exception of the fitting of one additional DGPS and the addition of new surge
Page 10 of 62
__________________________________________________________________________________
suppression modules.
1.2.3 The purpose of the FMEA is to identify any single point failure, which may cause the
vessel to lose position while working under the control of the DP computers.
1.4 Background
1.3.1 Global Maritime originally wrote the DP System FMEA of the vessel in 1996. This
FMEA was upgraded in 2008 by NDC and issued as document 6093/NDC/00/AKC/ch
which has been used as a base for this present document, to reflect the latest changes.
1.3.2 Failure modes identified refer to single failure conditions that have an immediate effect
on vessel operations. These are intended to be used for guidance when the vessel is
engaged in DP operations. In some cases positioning capability can be restored or, if
not totally lost, increased, after a short period of time, by operator intervention
1.3.3 This revision of the FMEA was carried out by Richard Inkster, DP Technical Lead
Engineer for GL Noble Denton Norway.
1.5 General Layout
1.4.1 The Big Orange XVIII is a purpose built mono-hull Well Stimulation Vessel, built in
1984 by Ulstein Hatlo AS, of Ulsteinvik, Norway. It is classed by Det Norske Veritas
and is registered in Nassau, Bahamas. The accommodation for 30 persons is located at
the forward end of the vessel. The Engine Room is located below the forward part of
the Main Deck, separated from the well stimulation equipment by a watertight
bulkhead. The two variable speed bow thrusters are located below the accommodation
and the variable speed stern azimuth thrusters are located in a watertight compartment at
the aft end of the vessel.
1.4.2 The other spaces aft of the accommodation are permanently fitted with well stimulation
equipment and chemical tanks.
1.6 Vessel Particulars
1.5.1 The principal dimensions of the vessel are:

Length Overall 76.1m
Breadth Moulded 18.0m
Depth Moulded 7.5m
Draught 6.5m
The main items of machinery are:
Main Generators 3 x 3200kW
Harbour Generators 2 x 250kVA
Page 11 of 62
__________________________________________________________________________________
Emergency Generator 1 x 26kW
Bow Tunnel Thrusters 2 x 800kW
Aft Azimuth Thrusters 2 x 1600kW

Main Switchboard 1, divided into two sections by a tiebreaker
Independent Joystick System

Kongsberg c-Joy
1.5.2 The DP system utilises the following equipment:

Kongsberg K-POS dual redundant DP control system
3 x Gyro Compasses. C-Plath Navigat X
3 x Vertical Reference Sensors. 3 x Seatex MRU 2 units
2 x Wind Sensors.
1 x DGPS DPS 116, Inmarsat B, IALA, Spotbeam SBAS Corrections
1 x new DGPS receiver DPS 232, Inmarsat, IALA, G2 & spotbeam corrections
2 x Light Weight Taut Wire. Mark 12 Units
1 x Fanbeam Laser, MDL
2 x new Kongsberg-supplied DP UPS.
Page 12 of 62
__________________________________________________________________________________
2.POWER GENERATION
2.1. General
2.1.1 The vessel is equipped with three Bergen KVGB 18 cylinder, four-stroke, turbocharged,
medium speed diesel generators rated at 3700kW maximum output. Each unit directly
drives a water-cooled 4000kVA Siemens alternator producing 600V at 60Hz. The
generator sets are all located in the main Engine Room and the alternator supply is by
Siemens Type 1FJ 5 80Z 8TA 93Z, 600V star connected windings, 3849A, 900rpm at
0.7 cos phi, power factor.
2.1.2 There are two 250kVA, 440V Harbour Generators, used for harbour and emergency
power supplies to the 440V Switchboard. One Harbour Generator is set to standby start
in the event of loss of supplies to the 440V Switchboard, they play no part in normal DP
operations.
2.1.3 There is a 26kW, 220V Emergency Generator, this generator is automatic start in the
event of a failure of the 220V supply to the Emergency Switchboard.
2.1.4 The generators have a remote or local start facility and are normally started remotely
from the ECR; there is no automatic start function from the Power Management System.
2.1.5 Generator operating parameters are monitored by a series of pressure and temperature
sensors on each engine via the ECR alarm system. Each engine is fitted with an Oil
Mist Detector, which does not trip the engine, but has an alarm facility only. Each
engine is protected by an emergency shut down monitor which initiates the shut down
circuits in event of the following:
High high cooling water temperature.
Low low lubricating oil pressure.
Engine overspeed.
2.1.6 There are alarms for essential services such as:

Lubricating Oil pressure.
Rocker LO pressure.
Standby start of LO pump.
Cooling water high temperature.
Sump level low.
Etc.
2.1.7 The alarm console is supplied by 24Vdc Distribution DC 3 with the distribution board
having a battery back up.
Page 13 of 62
__________________________________________________________________________________
2.2. Fuel Systems
2.2.1 All the generators use Marine Gas Oil as fuel; there is no provision for the heating of a
heavier grade of fuel.
2.2.2 Total fuel capacity is 488m3. The fuel is stored in several double bottom tanks, from
here the fuel is transferred and purified to either of the two Day Tanks by the fuel oil
purifier. Fuel is directed to either Day Tank No. 1 or Day Tank No. 2 by a manually
operated three way valve. Day Tank no. 1 has a capacity of 15m3, day tank no. 2 has a
capacity of 25m3 and the settling tank has a capacity of 11m3. If the purifier fails it is
possible to transfer non-purified fuel from the storage to the Day Tanks using one of the
two fuel transfer pumps.
2.2.3 The Day Tanks are protected by high and low level alarms.
2.2.4 Day Tank No. 1 has three compressed air actuated, Quick Closing Valves (QCV)
supplying the following:
V222A Main Generator No. 2 (supply - 1).
V201A 2 x Harbour Generators and Boiler (supply - 1).
V223A Main Generator No. 3 (supply - 1)
V202 Purifier and Transfer Pump suction. (Supply - 1)
2.2.5 Day Tank No. 2 has five compressed air actuated, Quick Closing Valves (QCV)
supplying the following:
V205 Main Generator No. 1 (supply - 1).
V222 Main Generator No. 2. (supply – 2)
V222 Main Generator No. 3. (supply – 2)
V201 2 x Harbour Generators and Boiler (supply - 2).
2.2.6 The settling tank has two Quick Closing Valves (QCV) supplying:
V206 Main Generator No. 1 (supply - 2).
The QCVs are activated by two levers in a central control cabinet located on the main
deck on the port side. The levers are split in operation, for lever 1 closes all valves to the
three main engines and lever two closes all the valves for harbour generators, purifiers
and transfer pumps and the boiler. The cabinet is secured with only senior personnel
having access to prevent mal-operation.
Page 14 of 62
__________________________________________________________________________________
2.2.7 Fuel is supplied to each Main Generator via a simplex coarse filter, an engine driven
pump and a duplex fine filter. There are no electric fuel booster pumps. Fuel is
supplied to each Harbour Generator via a simplex coarse filter and an engine driven
pump.
2.2.8 General good house keeping of the fuel system is essential to ensure the reliability of
the vessel. Regular sludging of the service and settling tanks in conjunction with testing
for microbial build up can avert an impending loss of fuel supply to an engine.
2.3. Lubricating Oil Systems
2.3.1 The lubricating oil system for each engine has its own sump and has no connection with
the lubrication system of any other engine. There is an engine driven lubricating oil
pump and an electric driven standby/pre-lube pump that cuts in on low system pressure.
Failures of the engine lubricating oil system such as blocked filters or damaged cooler,
etc., will only affect one engine.
2.4. Main Sea Water Cooling System
2.4.1 The seawater suction main is a single pipe between the Port and Starboard sides of the
engine room. The main has a normally open crossover isolating valve in the centre and
a sea chest with isolating valves at each end. The Ballast Pumps take suction from one
side of the crossover valve and the Main Sea Water Pumps take suction from the other
side.
2.4.2 There are two Main Sea Water Pumps, each taking suction from the sea water main
through the same line. The discharge lines from both pumps merge for the short run to
two Central Fresh Water Coolers. After the Central Coolers the line again merges
before the single overboard discharge.
2.4.3 The Sea Water pumps are each capable of supplying sufficient sea water to cool all main
generators, therefore they will run on a one running and one on standby basis.
2.4.4 The Sea Water pumps are supplied with 440 V as follows:
440V Stbd Side 440V Port Side
SW Cooling pump No. 1 SW Cooling pump No. 2
Thus any single failure of the power supply network will leave sufficient seawater
cooling to maintain all Main Generators online.
2.4.5 Failures such as blocked sea chest strainers will activate a low pressure alarm, allowing
time to open up the supply from the other sea chest before temperatures become critical.
Pump failure will cause the standby pump to start and also activate an alarm. Dirty
cooler is discussed in the Fresh Water Cooling section.
Page 15 of 62
__________________________________________________________________________________
2.5. Auxiliary Sea Water Cooling System
2.5.1 The Harbour Generator cooling system takes suction from either the seawater cooling
main or from a dedicated sea suction valve on the low sea chest. The single supply line
divides at the generators and merges again at the outlet before discharging overboard
through a single valve.
2.5.2 Each Harbour Generator has its own engine driven seawater pump and FW thermostatic
valve, therefore a failure of this sea water system will only affect one Harbour
Generator.
2.6. Central Fresh Water Cooling Systems
2.6.1 The Engine Room is fitted with two Central Low Temperature Fresh Water (LTFW)
Cooling Systems. LTFW System 1 supplies Main Generators 1 and 2, while LTFW
System 2 supplies Main Generator 3.
2.6.2 Each system has its own central cooler, expansion tank and temperature control valve.
It is possible to operate all three main generators on a single LTFW System by changing
over a set of three way valves. The vessel’s original design had a single FW system
therefore it is known that there is sufficient cooling capacity in one cooler to operate all
three generators.
2.6.3 Each main generator has two freshwater cooling circuits, both using engine driven
cooling water pumps. The LTFW circuit circulates water through the charge air coolers,
lubricating oil cooler and the alternator cooler.
2.6.4 The High Temperature Fresh Water (HTFW) cooling circuit circulates water around the
engine cylinders and turbochargers. The HTFW circuit takes suction from the LTFW
circuit after the lubricating oil cooler and discharges back into the LTFW outlet to the
central cooler. The HTFW circuit has own temperature control valve.
2.6.5 A dirty central cooler will be indicated by a high temperature alarm on the affected
engine(s), at least one engine will remain online, allowing the vessel to make a
controlled departure from location to clean the cooler. It is possible to open the
crossover valves and restore cooling from the clean cooler but care should be taken if
this is carried out on DP, as there is the potential to operate one or more of the valves
incorrectly and shut the cooling to all generators.
2.6.6 In the event of a cooler failure or an external leakage, the faulty generator can be
stopped and the engine can be isolated by closing the isolating/shut off valves to prevent
further loss of cooling water.
Page 16 of 62
__________________________________________________________________________________
2.7. Starting Air Systems
2.7.1 There are two compressed air systems on the vessel, a Starting Air system and a
Working Air system, the Working Air system has been proved to have no connection
with the DP System and is not considered further in this analysis.
2.7.2 There are two 30bar start air compressors supplying two air receivers in the main engine
room. The receivers supply compressed air circuits for the main engine and generator
start system and also for control air systems. 30bar air is used to prime the Main
Generator Governors, although it is not required by the governors once the engine is up
to full speed.
2.7.3 Failure of the air supply to the Main Generators and the Harbour Generators will
prevent them from being started, but will have no effect if they are already running.
2.7.4 The 8bar Control Air is reduced from the Starting Air system, this is used for the remote
starting system and the Emergency Stop system. Failure of this supply will prevent the
automatic stopping of a faulty engine but will not affect a normal engine while it is
running.
2.7.5 The Main Generator engine oil mist detectors rely on Control Air for operation, failure
of the air supply will initiate an alarm but will not trip the engine.
Page 17 of 62
__________________________________________________________________________________
3.POWER MANAGEMENT
3.1. General
3.1.1 The power management system consists of a load limitation control that will perform a
controlled load shedding as the demand increases above a given point (approx. 90%) of
the generator load. The Well Stimulation pumps will be reduced first giving priority to
the thrusters.
3.1.2 The PMS will be capable of effectively sharing the load between the generators whether
the 600V tie-breaker is open or closed. It will be capable of starting a Harbour
Generator if the supply to the 440V Switchboards fails. It will monitor the 600V tie-
breaker and the generator breakers.
3.1.3 Information on the generator breakers and tiebreaker position together with generator
load information will also be given to the DP computers.
3.2. Governors
3.2.1 The speed and load of the Main Generators is regulated by a Woodward EGB-13P
electro/hydraulic governor, this type of governor has a solenoid controlled speed
regulation system with a pilot motor back up regulation system. The solenoid control is
performed directly by the Hill Graham control system.
3.2.2 The pilot motor is used to increase or decrease the load on a synchronised generator
when it is operating under manual control. When the governor is operating on
automatic load control the pilot motor is adjusted to its maximum position, this allows
the governor to move the fuel rack to full load if required. The power supply for the
pilot motor comes from the 220V switchboard. Failure of this power supply prevents
the motor from adjusting the load while on manual but has no effect on a generator
running on automatic load sharing.
3.2.3 A Hill Graham AC Control Module controls the electric part of the governors on each
engine; each module is supplied directly from the input side of the generator breaker
through special transformers for combined power supply and measuring. The unit has
also got a 24V dc power supply from a dedicated battery for starting purposes, although
this supply is not needed for normal operation. The load sharing system is built into the
Hill Graham control module and has been modified to function in a split bus system.
3.2.4 Historically, failure modes of governors include failure to the zero fuel position, failure
to the full power position and stuck linkages. Failure of the power to the governor
solenoid has been shown to cause the governor to fail to zero power and circuit breaker
opening. Provided the diesel engines are sufficiently responsive, a spinning reserve
roughly equal to the rating of one generator should provide immediate protection
against overload of the remaining generators.
Page 18 of 62
__________________________________________________________________________________
3.3. Automatic Voltage Regulators
3.3.1 The Hill Graham AC Control Modules monitor and control the output voltage, kW and
kVAr of each generator. The module controls a thyristor bridge feeding the field
winding directly. As with the Governors the Generators will trip if the power supply to
the AC Control Modules fails.
3.3.2 Failure to over excitation has been the cause of a number of DP vessel blackouts.
Failure to this mode causes over-voltage in a standalone machine but abnormal reactive
power sharing in paralleled machines. Failure to over excitation in one machine can
force the operating point of other online generators to be pushed into the region of
instability. The Power Management System has kVAr monitoring, which should trip a
faulty generator in the event of AVR failure.
3.4. Generator Protection
3.4.1 The main generators protection from over current and short circuit is included in the
generator breakers.
3.4.2 The generator secondary protection is built into the Hill Graham control module and
consists of the following functions:
Reverse power
Over frequency
Under frequency
Over voltage
No pulse from tacho
Furthermore, the system has voltage reduction as a function of frequency to avoid
overloading the exciter circuit at low rpm.
Page 19 of 62
__________________________________________________________________________________
3.5. Power Management
3.5.1 The power management system consists of two PLCs, one for each bus system. These
PLCs are fed with load signals 0 – 10V from the Hill Graham generator control units.
Each unit provides two signals, one proportionate to the active load and one
proportionate to the apparent load. The PLCs will also read the status signals for the
generator breakers and tie-breaker and based on this information calculate the
appropriate load limiting signals.
3.5.2 The load limiting signals for each bus system are:
Limiting Well Stimulation pumps
Limiting on azimuth thrusters
Limiting on bow thrusters
3.5.3 Operational priority is given to the thrusters, i.e. all well stimulation pumps will be
stopped before the thrusters are affected. Limiting on the thrusters is only applicable in
case of loss of one generator when operating with two thrusters only and closed tie-
breaker.
3.5.4 For vessel positioning reasons the bow thrusters are the most critical thrusters and these
will be given priority over the azimuth thrusters, by reducing the azimuth thrusters to a
power level where they become equally critical to the bow thrusters before the bow
thrusters are reduced.
3.5.5 The limiting signals are analogue voltage signals ranging from –10V to +0.5V where
the limiting starts on about 0V for a fully loaded SCR. The limiting is load dependent
on the SCRs so that the heaviest loaded SCRs will be limited first.
3.5.6 Principal sketch.
Page 20 of 62
__________________________________________________________________________________
PORT STARBOARD
220Vac 24Vdc
FEEDER 1 F3 PSU
FEEDER 2 F3 PSU
PLC PLC
G1 SYSTEM 1 G2 SYSTEM 2 G3
N.O.
600V 600V
M M M TRANSFORMER TRANSFORMER M M M
FEEDER FEEDER
SCR 3 SCR 5 SCR 6 SCR 4 SCR 1 SCR 2
G4 G5
660/440V
800kVA
)
MCC
M M M M M 19/20 M M M M
SCR 7 SCR 8 SCR 9 SCR 10 SCR 11 SCR 12 SCR 13 SCR 14 SCR 15
Power Management System Schematic

This shows the principle of the information flow in the system. The information on
generator breakers and tiebreaker includes status and load information.
3.5.7 The PLC units are each fed from each half of the switchboard by both feeders (Fuse F3
in each feeder) and a back up supply is also available from the 24Vdc distribution.
Page 21 of 62
__________________________________________________________________________________
4 POWER DISTRIBUTION
4.1. Summary of System Design and Operation
4.1.1 The overall one line diagram of the power system is shown on drawing contained in
Appendix A
4.1.2 The system consists of three 600V, 3200kW, 4000kVA, 3ph, 60Hz diesel generators
feeding a common 600V collecting bus. The system can be operated with any number
of generators running on line and the control of each generator frequency and voltage is
set individually on the respective switchgear cubicle by adjustment of the governor
controller and the automatic voltage regulator.
4.1.3 When two or more generators are run in parallel the kW load sharing is forced by
electronic governor regulation.
4.1.4 Fifteen SCR power cubicles are connected to the common bus and draw AC power from
whichever generators are running, converting it to DC power for driving the various DC
motors. The previously installed Marine DC modules have been upgraded in 2012 with
a more modern & efficient surge suppression power supply modules. The DC modules
are powered by a 6 phase 30v AC feed which is rectified within the module to give +/-
40v signal to power the pulse drive circuits and others. This signal is further regulated
down to a +/- 12v value for the internal control circuits. The new units are highly
temperature efficient, reducing the power loss by around 90% based on the previous
units, and ensuring the modules operate at a much cooler temperature to reduce the
possibility of heat damage.
4.1.5 Each SCR bridge is permanently assigned to one motor other than SCRs 2 and 5 which
each may be assigned to the two different motors. The SCR drive automatically selects
the correct speed control function suitable for the motor to which it is assigned, as soon
as the main DC contactors are energised.
4.1.6 Two 1800A feeder breakers are provided to feed the 1400 kVA 600/440V transformers
to supply the MCC, distribution and lighting. Four control positions are provided for
the control of the propulsion motors, the engine room console, aft bridge and forward
bridge consoles and the dynamic positioning system.
4.1.7 The overvoltage protection system has also been upgraded in 2012. The ‘old’ 50v
overvoltage protection units were prone to overheating and failure. This new Zeefax
surge suppression board is an uprated version of the 50v protection which, on detecting
a surge, quickly switches in a 5 ohm 25W resistor to limit the surge current. These
boards are tested to 50% overload (60v) and during the brief overload have proven to
continue in normal operation. The system is supplied with a 12v line feed with inbuilt
protection against voltage surges to around 30% of nominal voltage value.
Page 22 of 62
__________________________________________________________________________________
4.2. 600V Switchboards
4.2.1 The Main 600V switchboard is located in a space aft of the Engine Control Room. A
tie-breaker divides this switchboard into two sections. The main switchboard includes
the newly modified Silicone Controlled Rectifiers (SCRs) for supplying the bow tunnel
and stern azimuth thrusters as well as the distribution breakers for other consumers.
Refer to Main Switchboard Sketch in Appendix A and figure 5.1 Single Line Diagram
of power Generation System.
PORT STBD
N. C.
SCR 4
600V B1
3200kW
4000 kvA G2 ECU 24Vdc DC2
60 Hz
0.7PF
SCR 3 24Vdc DC4
B2
24Vdc DC2 ECU
24Vdc DC4
SCR 2 SCR 5
SCR 6 SCR 1
220V CLEAN 220V CLEAN

POWER ECU ECU POWER
PORT STBD
24Vdc STERN STERN 24Vdc
AZIMUTH AZIMUTH
600V
600V 3200kW
3200kW G1 G3 4000 kvA
4000 kvA 60 Hz
60 Hz 0.7PF
0.7PF
M M M M M M M M M
SCR 7 SCR 8 SCR 9 SCR 10 SCR 11 SCR 12 SCR 13 SCR 14 SCR 15
Figure 5.1 Single Line Diagram of Power Generation System
4.2.2 The tie-breaker is tripped by short circuit and overload protection. Each side of the
switchboard is fitted with surge protection.
4.2.3 The control circuits for each generator breaker are supplied from an internal 600/110V
voltage transformer, fed from the generator side of the breaker, this allows for control of
Page 23 of 62
__________________________________________________________________________________
the individual breakers onto a dead switchboard. This controller (Hill Graham) also has
a 24 V dc supply for operation during starting of the generator fed from two sets of
batteries to all three generator controllers. The battery supplies are only used during
starting of the generator.
4.2.4 The two sections of the main 600V switchboard are supplied by the Main Generators as
follows:
Port Busbar Starboard Busbar
Main Generator 1 Main Generator 3
Main Generator 2 OR Main Generator 2
Main Generator 2 can supply either side of the 600V switchboards. However, there is
an interlock to prevent it from supplying both sides at the same time.
4.2.5 The two sections of the main 600V switchboard supply the following consumers:
Section 1 Port Section 2 Starboard
Stbd Azimuth Drive Motor 1(SCR 1) Stbd Azimuth Drive Motor 2 (SCR 5).
Port Azimuth Drive Motor 2(SCR 2) Port Az. Thruster Drive Motor 1(SCR 6).
Bow Thruster 2 (SCR 3) Bow Thruster 1 (SCR 4)
600/440V Transformer 1 600/440V Transformer 2
Well Stimulation Equipment Well Stimulation Equipment
4.2.6 Failure of one side of the 600V switchboard will therefore cause the loss of one bow
thruster, one motor on each of the stern azimuth thrusters and one of the 440V
transformers. Provided there are sufficient hydraulic and lubricating oil pumps online
both stern azimuth thrusters will remain on line but maximum power on each will be
reduced to 50%.
4.2.7 It should be noted that there have been short circuit failures on other vessels that were
so severe that the vessel blacked out before the tie-breakers had the time to trip. There
were also several vessels that while the breakers did operate and prevent the vessel from
blacking out the temporary voltage drop caused the hold on coils on critical motors, or
critical instrumentation to drop out and the vessels subsequently lost position.
Page 24 of 62
__________________________________________________________________________________
4.3. 440V Switchboards
4.3.1 The 440V Switchboard is located in the ECR, it is divided into two sections by a
tiebreaker. The 440V Switchboard is normally supplied from the 600V Switchboard by
the two 600/440V Transformers.
4.3.2 Normal operation when the Main Generators are online will be with the two
transformers online and the 440V tiebreaker closed as long as the 600V tiebreaker is
closed. If both transformer breakers are closed and the 600V tiebreaker is opened, the
interlocking system will automatically trip the 440V tiebreaker.
4.3.3 A short circuit on one side of the 440V busbars will cause the tiebreaker and the
transformer feeding the faulty busbar to trip.
4.3.4 In the event of a blackout of the 440V switchboard the standby Harbour Generator will
start restoring power to essential equipment.
4.3.5 The two sections of the 440V switchboard are supplied by the transformers and harbour
generators as follows:
Port Side Starboard Side
Harbour Generator 1 Harbour Generator 2
4.3.6 DP related consumers are divided between the two sections as follows:
Port Side Starboard Side
Clean Power UPS No. 1 Clean Power UPS No. 2
Port Taut Wire Stbd Taut Wire
Main Gen 1 LO Priming Pump Main Gen 3 LO Priming Pump
Main Gen 2 LO Priming Pump
Port Azimuth Steering Pump 1 Port Azimuth Steering Pump 2
Stbd Azimuth Steering Pump 2 Stbd Azimuth Steering Pump 1
Port Azimuth LO Pump 1 Port Azimuth LO Pump 2
Stbd Azimuth LO Pump 2 Stbd Azimuth LO Pump 1
Start Air Compressor 1 Start Air Compressor 2
Main SW Pump 1 Main SW Pump 2
ER Ventilation Fan 1 ER Ventilation Fan 2
Thruster SW System 1 Pump 1 Thruster SW System 1 Pump 2
Page 25 of 62
__________________________________________________________________________________
Thruster SW System 2 Pump 1 Thruster SW System 2 Pump 2
Port Azimuth Motor 2 Vent Fan 1 Port Azimuth Motor 1 Vent Fan 1
Port Azimuth Motor 2 Vent Fan 2 Port Azimuth Motor 1 Vent Fan 2
Stbd Azimuth Motor 1 Vent Fan 1 Stbd Azimuth Motor 2 Vent Fan 1
Stbd Azimuth Motor 1 Vent Fan 2 Stbd Azimuth Motor 2 Vent Fan 2
Bow Thruster 2 Motor Vent Fan 1 Bow Thruster 1 Motor Vent Fan 1
Bow Thruster 2 Motor Vent Fan 2 Bow Thruster 1 Motor Vent Fan 2
4.3.7 From the above it can be seen that failure of the port or starboard sides of the 440V
Switchboards will have similar effects to the failure of the port and starboard sides of
the 600V switchboards.
4.3.8 Failure of the Thruster Motor vent fans will rapidly cause the affected motors to trip on
an interlock signal and then by high temperature. Failure of one of the azimuth thruster
LO or Steering pumps will cause the standby start pumps fed from the opposite side of
the tiebreaker to start.
4.3.9 Cooling water pumps all have a standby pump on the opposite side and one ER
ventilation fan will be maintained.
4.4. 220 V Distribution
4.4.1 There are three 220 V switchboards. A General Services 220V switchboard and two
Clean Power 220V Switchboards. The General Service switchboard is a single bus
system fed by two 440/220V transformers as detailed in Figure 5.2 simplified schematic
below. There are two relay contactors that have a monitoring control circuit such that in
the event of a 440V supply failure the control circuit will effect a change over of supply
from the other side of the 440V switchboard
Page 26 of 62
__________________________________________________________________________________
N.O.
440V PORT 440V STARBOARD
C/B 1018 N.C. N.C. C/B 1516
RELAY RELAY
CONTACTOR CONTACTOR
RELAY
INTERLOCK SIGNAL INTERLOCK SIGNAL
CONTROLLER
440/230V 440/230V
C/B 1717 N.C. N.C. C/B 1817

220V SWITCHBOARD (GENERAL SERVICES)
Simplified schematic of 220V GS Switchboard Supply
4.4.2 The General Services Switchboard is used mainly for lighting, it is supplied by either of
two 440/220V Transformers, one from each side of the 440V Switchboard. The DP
related consumers are listed below:
Main Generator temperature control - 1 Charger for 24 Vdc system 1
Monitoring and Alarm system Charger for 24 Vdc system 2
ME pilot motors (manual control)
4.4.3 Tests in the past have shown that the vessel’s system can continue DP operation for the
duration of the 24V batteries without problem with the 220V switchboard blacked out.
4.4.4 The Clean Power switchboards are each supplied by a UPS unit. Please refer to Figure
5.3 for simplified schematic below. As can be seen from Fig 5.3, there are two
440/400V transformers before the UPS so that the supply conditions match the
specification of the UPS units. The UPS cabinet contains a stabilised ac power supply
system, which is comprised of a charger unit, a dc to ac inverter and a bank of batteries,
together with all necessary controls, indicators and fuses. The charger, whose output is
stabilised, supplies dc power to both the inverter and the battery bank. The inverter
output is also stabilised and provides ac power for the rest of the system. The UPS
batteries will allow the system to run for 10 minutes with full inverter load and this
corresponds to over 30 minutes on batteries with normal load. Each UPS is capable of
supplying the total connected load. The UPS units also have automatic electronic
bypass switches that will connect if both units fail.
Page 27 of 62
__________________________________________________________________________________
Simplified schematic of supplies to 220V Clean Power Switchboards 1 and 2
4.4.5 The following systems relevant to DP are supplied from the Clean Power system.
Clean Power System 1 Clean Power System 2
DP UPS 1 supply DP UPS 2 supply
Bridge Clean 230V Distribution 1 Bridge Clean 230V Distribution 2
Port Azimuth Control Circuit 2 Starboard Azimuth Control Circuit 2
Gyro Compass 2 Primary Supply Main Generator temperature control circuit 2
4.4.6 Failure of the Clean Power Switchboard 1 will fail the primary supply to Gyro 2 but the
unit is fed by 24V dc and will be unaffected.
Page 28 of 62
__________________________________________________________________________________
4.5. Emergency Switchboard
4.5.1 The Emergency Switchboard has a 220V bus bar. It is normally supplied from the 220V
General Services Switchboard via a transfer breaker, in the event that the normal supply
fails the Emergency Generator should start automatically and re-supply the Emergency
Switchboard.
4.5.2 There are no supplies vital to the DP system from the Emergency Switchboard.
4.6. 24Vdc Systems
4.6.1 There are two 24Vdc systems on the vessel. They each have a charger and a battery
bank. The systems supply the following consumers. Please refer to the following Figure
5.4 for simplified sketch of DC Distribution System.
DISTRIBUTION BOARD
DC1 ENGINE ROOM
220V
C/B 1802
DISTRIBUTION BOARD
DC2 WHEELHOUSE
ENGINE
ROOM
LOCATION
24Vdc DISTRIBUTION BOARD
150Ah DC5 STEERING FLAT
DISTRIBUTION BOARD
DC3 ENGINE ROOM
220V
C/B 1801
DISTRIBUTION BOARD
DC4 WHEELHOUSE
ENGINE
ROOM
LOCATION
24Vdc
150Ah
Simplified sketch of DC Distribution System
Page 29 of 62
__________________________________________________________________________________
SYSTEM 1 SYSTEM 2
DC 1 Distribution DC 3 Distribution
Main Generator 1 remote start/stop Main Generator 2 and 3 remote start/stop
Harbour Generator 1 and 2 Safety Systems
DC 2 Distribution DC 4 Distribution
Bow Thruster 1 control circuit 2 Bow Thruster 1 control circuit 1
Bow Thruster 2 control circuit 2 Bow Thruster 2 control circuit 1
Stbd Azimuth Thruster control circuit 1 Port Azimuth Thruster control circuit 1
C-Joy IJS
DC 5 Distribution
Propulsion Plant Port local control
Propulsion Plant Stbd local control
4.6.2 Failure of one 24Vdc system will either leave a running engine unaffected or will cause
the thruster controls to revert to the backup power supply.
Page 30 of 62
__________________________________________________________________________________
5 THRUSTER SYSTEMS
5.1. Bow Tunnel Thrusters
5.1.1 There are two Ulstein fixed pitch, variable speed, tunnel thrusters in the bow. A single
800kW, 600Vdc motor, drives each Bow Thruster.
5.1.2 The main drive motors have a water-cooled heat exchanger fitted with a leak detector.
The motor cooling circuit is enclosed, with the air being circulated through the heat
exchanger and motor by two electric fans.
5.1.3 An expansion tank, fitted with a low level alarm, maintains lubrication pressure inside
the lower gearbox. Lubricating oil circulation is achieved by the rotation of the drive
shaft and gears with the oil being cooled by external sea water flowing over the hub.
5.1.4 A variable output voltage Silicon Controlled Rectifier (SCR) varies the motor and
therefore the propeller speed: See section 6.3 for more details on SCRs.
5.1.5 DP Speed Command signal failure will cause the relevant thruster to output a zero rpm
command to the drive motor. Speed Feedback signal failure from the thruster
tachometer to the SCR Interface PCB and DC Control Module historically caused the
thruster speed to accelerate to 100%, but this has now been modified to a ‘fail-safe’
setting, such that thruster motor will trip and the thruster will be rejected from the DP.
Please refer to the following Figure 6.1 Simplified Speed Control.
Page 31 of 62
__________________________________________________________________________________
DP
ADP 702
ISO AMPS
DM = DRIVE MOTOR
DM1 S/P
S/P = COMMAND SIGNAL
DM1 F/B
F/B = FEED BACK
DM2 S/P
DM2 F/B SPEED
FEEDBACK
REFERENCE
INPUT
AFT LEVER
PCB
INTERFACE
LE
CURRENT THYRISTORS
DU
CONTROL MO SCR1
LOOP BRIDGE
DC
FIRING
CIRCUIT
FWD LEVER
SPEED
CONTROL LOOP
TACHO 1 TACHO 2
RELAY CURRENT IS DERIVED FROM DM1 DM2

SWITCHING 3CTs ON THE 600V 3Ø SUPPLY
TO THE SCR BRIDGE CT
CURRENTS RECTIFIED TO STARBOARD
PRODUCE A dc SIGNAL AZIMUTH
PROPORTIONAL TO THE THRUSTER
ARMATURE CURRENT FIRING
CIRCUIT SCR1 SCR5
SELECTOR
SWITCH L22
DP SYNC P CT CT
FCM2 SYNC S
FCM1
Figure 6.1 Simplified Speed Control
5.2. Stern Azimuth Thrusters
5.2.1 There are two Ulstein fixed pitch, variable speed, azimuth thrusters in the stern. Each
thruster is driven by two 800kW, 600Vdc motors.
5.2.2 The main drive motors have a water-cooled heat exchanger fitted with a leak detector.
The motor cooling circuit is enclosed, with the air being circulated through the heat
exchanger and motor by two electric fans.
5.2.3 The azimuth gearbox has two lubricating oil pumps, running on a one online, one on
standby basis.
Page 32 of 62
__________________________________________________________________________________
5.2.4 The steering hydraulic system for each azimuth thruster uses two hydraulic pumps,
running on a one online, one on standby basis. There are two hydraulic motors for
steering the azimuth; these are both in use at all times.
5.2.5 The 2008 upgrade of the remote control system for the stern azimuth thrusters are for
the azimuth/directional control only. This was due to the maintenance and availability of
spare parts for the original Mar El Mazcon 250 controllers, which were no longer
supportable by Rolls Royce Marine. The speed control of the bow thrusters and the
stern azimuth thrusters are as the original concept and any differences in hardware are
discussed below.
5.2.6 The 2008 upgrade of the system consisted of several main and supporting components
of hardware and software for the Stern Azimuth Thrusters Remote Control System and
they are discussed in the following: Please refer to the following Figure 6.2 Simplified
Steering Control.
DP
AFT FWD DP702
ADP
LEVERS LEVERS
DP FEEDBACK
SIN
-Ve +Ve
POTMETER
SERIAL LINE DP
CAN COMMAND COS
BUS + / - 10Vdc
STEERING VALVE 1
RUNNING
SIGNAL
SERVO
P/P 1
NODE 1
L22 COMMAND
SELECTOR + / - 8Vdc STEERING VALVE 2
SWITCH ECU
SERVO
P/P 2
RUNNING
SIGNAL
COS
SIN
SIN
-Ve +Ve
POTMETER
FEEDBACK COS
Figure 6.2 Simplified Steering Control
Page 33 of 62
__________________________________________________________________________________
· Switch Panel L4
· Switch Panel L22
· Main Manual Control Unit Aft Bridge Node 53 Panel
· Slave Manual Control Unit Fwd Bridge Node 55 Panel
· Helicon X Node 1 Remote Controller
· Helicon X Node 21 Actuator Interface Electronics
· HGC Interface Control Cabinets
· DP System Interface
· Autopilot Interface
5.2.7 Switch Panel L4: There is one for each main Azimuth Thruster located in the engine
control room and is an original supply. The unit switches main control of the thrusters
from the ECR to the bridge therefore it is essential this switch is selected to the remote
position for bridge control. This is connected directly to switch panel L22.
5.2.8 Switch Panel L22: is located on the aft bridge and is still the original control switching
between the propulsion control locations of the manual Synchronised Port lever, manual
synchronised starboard lever, DP control system, FCM 1 and FCM 2. This unit
provides digital input and digital output signals for control transfer to the Helicon X
Node 1 remote control unit and bridge panel aft Node 53 and bridge panel forward
Node 55 units. It also enables the relays in the Hill Graham Interface Units located on
the Aft Bridge for transfer of signals to the speed controllers for the drive motors.
5.2.9 Main Bridge Panel (Aft) node 53 unit: This panel incorporates the manual lever control
for the ahead/stern speed control of the azimuth thruster and the direction (CW/CCW)
rotation of the azimuth thruster. The control stations are based on a panel controller
card, which communicates with the electronic unit through a serial bus. The serial bus
for this project is a Can Bus protocol. The speed control philosophy and inter cabling
remain as the original build however the potentiometer for the speed output is a
component of the physical lever arrangement. The manual lever outputs a variable DC
analogue value of between +/- 8 volts to the Hill Graham Interface Unit cabinets, which
are mounted on the aft bridge on the Port side. The motor drive controls perform signal
conditioning/amplification before outputting to the thyristor in the main switchboard to
control the main DC voltage output and therefore the speed of the drive motors.
5.2.10 Main Bridge Panel (Aft) node 53 unit (Contd.): The azimuth control is derived from a
potentiometer mounted on the lever whose output is coded by the panel card to the
serial bus protocol and relayed by serial line to the electronic unit, which decodes the
value and converts to an analogue value and transmits directly to the thruster steering
Actuator Interface card.
Page 34 of 62
__________________________________________________________________________________
5.2.11 Slave Bridge Panel (Fwd) node 55 unit: This unit is identical to the above and each
panel controls its respective thruster in exactly the same way, with the signals being
daisy chain connected between each Panel.
5.2.12 Helicon X Node 1 Remote Controller (Electronic Unit): The electronic unit includes the
CPU controller board, back-up electronics, supervisor and voltage monitor circuits,
input and output signal conditioning, and power supply with fused distribution to the
control system units. Each ECU is fed from two separate sources of power, 220Vac from
the vessels clean power distribution board mounted on the forward bridge and 24Vdc
from the vessels battery back up system, distribution board DC 4, which is also mounted
on the forward bridge. The ECU continuously monitors and carries out internal
diagnostics for the following:
1. 220Vac Mains
2. 24Vdc Back-up supply
3. Fuses
4. Internal voltage levels
5. Input analogue signals (order, feedback)
6. Memory
7. Microprocessor
If a failure or an illegal value is detected, an alarm signal is passed to the main alarm
plant.
Failures 4 - 7 will release the System Failure alarm in the control panels.
The thruster emergency azimuth backup control is automatically engaged if the failure
affects the normal azimuth control. The thruster will remain in the same azimuth
position until the backup control is operated.
5.2.13 Helicon X Node 1 Remote Controller (Electronic Unit) (Contd.): The Main Processor
Card is based on an Intel 80386 EX microprocessor and is designed to be the main
processor unit in the propeller systems. It contains the necessary functions for running
system, application software, and communication, via the Can Bus with the processors
in the operating panels and performing various I/O functions via the interface circuits on
the card.
5.2.14 Helicon X Node 21 Actuator Interface Electronics: This unit receives digital status
signals of the steering pump that is running, either servo pump number 1 or servo pump
number 2 and will output a CW or CCW signal to either steering control valve 1 or
steering control valve 2. The steering control signals are received as analogue values in
the range of +/- 8Vdc and the actuator card outputs directly to the Steering control valve
a varying value of between 130mA and 350mA. There is also a separate back up control
system for the steering as the Node 21 actuator control box has a local/remote selection
Page 35 of 62
__________________________________________________________________________________
switch and a CW/CCW switch. In an emergency, if all remote control is lost, then
selection of local control will switch 24Vdc from the ships power source DC5, so that
clockwise and/or counter clockwise direction control can be applied locally. The manual
CW/CCW switch applies the dc current directly to the solenoid valves.
5.2.15 Hill Graham Interface Units: These units are used to facilitate the change over of speed
control and feedback signals via relays which are energised by the main mode selector
switch L22 on the aft bridge panel. They also provide splitting of the tachometer speed
feedback signals by way of Isolation amplifiers to the, DP, FCM and Manual control
levers. The command signals are passed via the switch over relays to the thrusters DC
control module which is installed in the thrusters SCR control cabinets. The feedback
signals are received at the thrusters Interface PCB module, signal conditioned and fed
back to the DP, FCM or manual control levers via isolation amplifiers dependant upon
which system has been selected as command by the selector switch panel L22.
5.2.16 DP System Interface: The DP Interfaces remain the same as built. The azimuth analogue
output command signal +/- 10Vdc is transmitted to the Helicon X Node 1 Unit, which
then transmits the signal conditioned value of +/- 8Vdc to the Rolls Royce Node 21
Actuator Interface Amplifier Card, which in turns supplies a corresponding signal for
clockwise (CW) or counter clockwise (CCW) direction to rotate the thruster to the
desired angle. The feedback signal for direction is derived from an individual sin/cosine
potentiometer, which the Kongsberg DP control system supplies 4 – 20 mA from its
isolated analogue output power supplies and receives two signals from the
potentiometer, sine and cosine, which combined can be interpreted as the angle of the
direction of thrust. The speed control from the Kongsberg DP control system is a
continuously varying analogue output value between 0 to 10Vdc directly to the Hill
Graham Motor Control Centres via the Hill Graham Interface change over relay
cabinets. The speed feedback is derived from a tachometer mounted on the shaft of each
of the main drive motors.
5.2.17 Autopilot Interface: The autopilot function is only selectable from either of the forward
or aft bridge manual lever panels. Upon selection the autopilot outputs a varying
analogue voltage to the Helicon Node 1 modules, which regulates the signal to +/- 8Vdc
and transmits to the thruster actuator interface driver card.
5.2.18 Loss of DP Speed Signals: Loss of the DP Speed Command signal to the bow thrusters
will cause the relevant thruster to output a zero force signal. In the case of the azimuth
thrusters this was only relevant for drive motor 1 (Master) as tests proved that a loss of
DP speed command signal to drive motor 2 (Slave) had no effect on the speed
regulation for any of the two drive motors, However, If motor 1 fails, motor 2 will
become Master and any loss of speed command will have the same effect as with motor
1. Loss of the DP feedback signal from the thrusters Interface PCB has no effect on the
thruster output, but the DP feedback signal indicates zero output. Command signal
failures will cause a “Thruster Prediction RPM Error” alarm on the DP system, and
Page 36 of 62
__________________________________________________________________________________
Feedback signal failure will cause” Input error RPM” alarm
5.2.19 Loss of SCR Signals: Loss of the SCR Speed Command signals to the bow and azimuth
thrusters are as above for the DP control signals. Originally, if a loss occurs of the Speed
Feedback signal failure (tachometer) from either bow thruster to its SCR Interface PCB
caused the thruster motor to accelerate to 100%, the thruster continuing to output to
maximum speed until the thruster drive motor trips on overload. The azimuth thrusters
were similarly affected, the loss of speed signal feedback from the tachometer of either
drive motor, caused both drive motors to accelerate to 100% speed. 2012 modifications
were made as follows: Bow thrusters were modified, such that the loss of the speed
command to the SCR will result in 0 RPM. The thruster will not in this case be rejected
from the DP and vessel could experience initial heading instability. With the loss of
feedback signal, the thruster motor will trip and thruster will be rejected from the DP.
For the Azimuth thrusters, this was modified, such that with the loss of speed command
signal, the RPM will go to zero, but the thruster will not be rejected from the DP and
therefore, if thrusters are in any allocation mode, other than VARIABLE, loss of
position will occur. Following the 2012 annual DP trials, DNV have made the condition
that the system cannot allow the azimuth thrusters to operate in any mode other than
variable until this has been resolved, and KM technicians have disabled all thruster
allocation modes other than Variable.
With loss of feedback signal, the motor#1(master) will trip, but motor #2(slave) will
take over, and the thruster will continue to run normally.
5.2.20 Loss of DP Azimuth Signals: Loss of the DP command signal for steering of the
azimuth thrusters causes the Helicon Node 1 control module to fail the ready signal to
the DP control system causing drop out of the thruster from DP mode. Loss of the
azimuth feedback signal to the DP control system has no affect on the thruster azimuth
operation as the DP command signal is still providing an output value. The DP feedback
indication is zero degrees and eventually a Thruster prediction error is alarmed at the DP
console.
5.2.21 Loss of Node 1 Steering Signals: Failure of the Azimuth control signal between the
Helicon X Control module and the thruster causes an azimuth freeze and a thruster
prediction alarm on DP. Failure of the Azimuth Feedback signal from the control
potentiometer to the Helicon X Control module causes a loss of DP ready signal and an
alarm on DP and the thruster control to change over to emergency steering.
Page 37 of 62
__________________________________________________________________________________
5.3. Silicone Controlled Rectifiers
5.3.1 The Hill Graham Switchboard is fitted with six (Modified in 2012) SCR cabinets, one
for each thruster motor. There is provision for changing the outputs of SCR 2 and 5
over from the azimuth thrusters to the bow thrusters however this would not be carried
out while on DP. The SCR outputs are as follows:
SCR 1 Starboard Azimuth Thruster Drive Motor 1
SCR 2 Port Azimuth Thruster Drive Motor 2.
Aft Bow Thruster Drive Motor.
SCR 3 Aft Bow Thruster Drive Motor
SCR 4 Forward Bow Thruster Drive Motor
SCR 5 Starboard Azimuth Thruster Drive Motor 2.
Forward Bow Thruster Drive Motor.
SCR 6 Port Azimuth Thruster Drive Motor 2
5.3.2 Each SCR is constructed from modular SCR thyristors, controlled by a DC Control
Module. There are two SCR modules inside each SCR cabinet, one to supply a positive
voltage for forward rotation of the motor and one to supply a negative voltage for
reverse rotation of the motor. A ± 10Vdc signal from DP is sent to the HGC Interface
PCB P448T, then to the DC Control Module, which instructs the relevant SCR module
to vary the output voltage and current for speed and Ahead or Astern control of the drive
motor.
5.3.3 Current transformers on the SCR input provide feedback to the DC Control Module and
a tacho-generator mounted on the drive motor shaft is used to send a speed feedback
signal to the DC Control Module and the DP system to assist in more accurate speed
control.
5.3.4 A fuse and an internal thermister, which will trip the SCR if a high temperature is
detected, to protect each thyristor. Due to the large amounts of heat generated by an
SCR there are heat sinks around each SCR and each cabinet has cooling fans that start
automatically when the SCR is enabled. The power supplies to these units were
modified in 2012, effectively reducing the power loss by around 90%, such that the heat
sinks now run much cooler, reducing the possibility of overheating.
5.3.5 The DC Control Module is powered from the 600V busbars by a 6 phase 30v AC feed,
which is rectified inside each module to provide a +/-40v which powers the pulse drive
circuits and externally, the motor contactors. It is regulated down to +/- 12v for the
internal transformer/rectifier producing the required control voltages.
Page 38 of 62
__________________________________________________________________________________
Further modifications to these modules were made, by way of the addition of improved
surge protection & suppression boards. These represent an uprated version of the
original 50v protection devices, where a 5 ohm 25W resistor will now quickly switch in
to limit the surge current.
5.3.6 Provided the power supplies from the main switchboard are intact, SCR faults should be
restricted to one motor. This will fail a bow thruster or one of the stern azimuth thruster
drive motors depending on which SCR fails, the azimuth thruster would be able to
continue although at a reduced output because only one of the two drive motors is being
supplied.
5.4. Thruster Sea Water Cooling
5.4.1 The thruster seawater cooling system is divided into two systems as follows:
System 1 System 2
Bow Thruster 2 Drive Motor Bow Thruster 1 Drive Motor
Port Azimuth Drive Motors Stbd Azimuth Drive Motors
Port Azimuth Oil Coolers Stbd Azimuth Oil Coolers
5.4.2 Each system has two sea water cooling pumps, one running and one on standby. The
two pumps for each system are supplied from opposite sides of the 440V switchboard,
therefore there will be cooling available if one 440V Busbar should fail.
5.4.3 There are normally closed crossover valves between the two systems that can be opened
to maintain cooling in the unlikely event of both pumps on one system failing
completely.
Page 39 of 62
__________________________________________________________________________________
6 DP CONTROL SYSTEM
6.1 Bridge Consoles
6.1.1 The aft bridge DP console houses the Kongsberg K-POS OS 1 & OS 2. Attached to the
DP consoles is a third console for controlling and displaying the outputs of the DGPS
and Fanbeam Laser. Close by the DP Console is the manual thruster control stand,
incorporating the thruster emergency stop buttons, this control stand has individual
controls for all the vessels thrusters. The forward bridge console has controls similar to
the manual thruster control stand with the addition of an autopilot for steering the ship
while on passage. There is also a portable joystick with a length of cable capable of
being used on either bridge wing.
6.2 System overview
6.2.1 The vessel position in relation to the seabed is maintained by the K-Pos DPC control
system using vectored thrust. The DP system uses the thrusters’ force and direction to
counteract the effects of wind, waves and sea current as effectively as possible. There
are six motions of movement for the vessel; these are surge, sway, yaw, heave, pitch,
and roll. The DP controllers can use the thrusters to counteract forces in the x and y
plane only. These are surge, sway and yaw.
6.2.2 The central hub for the Kongsberg K-Pos system is the DPC-2 control cabinet. This
houses the IO modules and two DP controllers (DPC). The DPC cabinets are dual
supplied by two 230Vac supplies which are fed via UPS to two 24Vdc power supplies.
UPS 1 and 2 are used to provide this supply and they are located in the small room in
the centre of the wheelhouse. The system is also part of a dual Ethernet network labelled
A and B respectively. The operator commands are entered through the K-Pos operator
station (OS) units 1 and 2 situated on the bridge. The network switch for Net A is
located in DP OS1 and the switch for Net B is located in DP OS2.
6.2.3 There is also an independent joystick on the bridge (cJoy). This has hardwired
connections to each thruster control station
6.2.4 DP operator stations (OS) are marinised computers running Windows XP operating
system. Because the operator stations are process independent they can be located
anywhere on a vessel.
Page 40 of 62
__________________________________________________________________________________
6.2.5 The DP UPS supplies are also redundant shown in the table below:
Table 6-1 DP UPS Consumer List
UPS 1 230Vac Outputs UPS 2 230Vac Outputs
F1 DPC F1 - DPC
F2 OS2 F2 OS1
F3 Printer F4 – DGPS1
F4 DGPS2 F5 – De Mod
F5 Fanbeam F6 – LTW STBD
F6 LTW PORT F7 – RADius (Option)
F8 Gyro 3 F8 – Gyro1
6.2.6 From the table it is shown that the operator stations (OS) are supplied from separate
UPS systems allowing control to continue in the event of a power failure.
6.2.7 The reference systems are also segregated between the two UPS allowing the system to
always have a reference available following a power failure. The DP system control
system is supplied from two Uninterruptible Power Supply units (UPS). They are
located in a room just forward of the aft bridge.
6.2.8 The UPS cabinet contains a stabilised ac power supply system, which is comprised of a
charger unit, a dc to ac inverter and a bank of batteries, together with all necessary
controls, indicators and fuses. The charger, whose output is stabilised, supplies dc
power to the inverter, the battery bank and the 24V dc consumers. The inverter output
is also stabilised and provides 220Vac to the rest of the system.
6.2.9 If the vessel’s main ac supply fails, the 24V dc consumers and the inverter are
automatically supplied with power from the battery bank and an alarm is activated at the
DP system. The batteries are capable of maintaining the UPS output for over 30
minutes. There is an automatic alarmed change over to the Bypass supply should the
inverter output fail.
6.2.10 UPS 1 is supplied by 230V Clean Power Switchboard No 1 and UPS 2 is supplied by
230V Clean Power Switchboard No 2.
6.2.11 Failure of battery fuses are covered by an alarm, giving warning of a possible dormant
fault should the inverter fail.
6.2.12 Failure of the inverter on one UPS will cause the UPS to change over automatically to
Bypass. The bypass supplies are also fed from Clean Power switchboards 1 and 2
Page 41 of 62
__________________________________________________________________________________
respectively.
6.2.13 Failure of the static switch change over from inverter supply to Bypass supply will
cause the output of the UPS to fail completely however there should be sufficient
control equipment and reference sensors online to prevent a loss of position.
6.2.14 Failure of individual mini circuit breakers should only affect the downstream consumer
6.3 K-POS Operator stations
6.3.1 Description
6.3.2 The operator stations (OS) are the main interface between the operator and the
processes that are under the operator’s control. An operator station has three main parts:
1. Windows XP marinised industrial computer.
2. Operator panel with buttons and a trackball / joystick.
3. Colour monitor.
6.3.3 Operator stations are based around Hewlett Packard MP7600 marinised computers
running Windows XP operating system. Minimum specifications for the computers are
Intel© Pentium 4 processors with 1GB RAM. A 23” TFT display and an operator panel
including a trackball provide the HMI.
6.3.4 Each operator station runs the Kongsberg DP software. This is a tailored software
package enabling configuration of DP functions within the DPC-2 controller. These
include the setting of some alarm levels, vessel sensor settings, manual draft setting and
reference sensor weighting
6.3.5 The K-Pos operator stations can display a number of different mimics including
ThrusterView, PowerView and SensorView. Each ‘mimic’ has several sub views
providing more detailed information as required. These are available from drop down
menus accessed by using the trackball and left and right buttons located on the K-Pos
operator panels.
6.3.6 Both OSs are designated as RCU servers for the DPC-2 controller. After switch on, the
RCUs of the controller will request configuration load and standard file load from one
of the operator stations. These files are stored on the computer hard disk
6.3.7 All operator stations are powered from UPS units, which maintain power without
interruption if the vessel power distribution system is lost. In the event of a power
outage the UPSs can supply power for at least 30 minutes as required by Classification
rules. A power supply table listing the UPS supplies is given in Table 6-1 above.
Page 42 of 62
__________________________________________________________________________________
6.4 Failure Modes of the DP Operator Stations
6.4.1 For the purposes of this FMEA, the significant failure modes of the operator stations are
taken to be:
1. Failure to accept operator commands (full or partial).
2. Failure to display data (screen failure).
3. Console dead – power supply fault / internal fault.
4. Network failure.
5. Software corruption
6.5 Failure Effects of the Operator Stations
6.5.1 Failure to accept operator commands (full or partial): This will be apparent to the DPO,
who will simply take command at the other OS. As this is probably due to faulty logic
or a faulty switch it is unlikely that it will be alarmed.
6.5.2 Failure to display data (screen failure): This will be apparent to the DPO, who will
simply take command at the other OS. No alarm will be given for the loss of a screen.
6.5.3 Console dead (internal power supply failed): In the event that the ‘online’ console fails
catastrophically this is alarmed and the DPO will take command at another station. In
the unlikely event the DPO does not notice the faulty console an alarm buzzer will
sound for up to one minute.
6.5.4 Network failure: Loss of Net A or Net B is alarmed and the operator will have the
option to ‘take’ control at another station. However the station is still operational with
reduced redundancy.
6.5.5 Software corruption: Software design is not considered in the FMEA specification.
However software corruption due to a faulty hard disk or other hardware issue has been
considered. It is not expected that such a failure would affect more than a single
operator station. The DPO would take command at the other OS.
Page 43 of 62
__________________________________________________________________________________
6.6 Hidden Failures of the DP Operator Consoles
6.6.1 No hidden failures have been detected within the operator consoles. However as will be
seen from the failure effects below it is possible for a fault to remain dormant, for
example until a button is pressed. This type of failure can be guarded against by
carrying out frequent lamp, key and audible alarm tests.
6.7 DP Operator Console Configuration Errors
6.7.1 Configuration errors would only be evident in the event of a corrupt operator system or
DP software install. As the software is not being investigated in this analysis
configuration errors have not been investigated.
6.8 Maloperation of the DP Operator Consoles
6.8.1 Maloperation can be caused by badly designed features or inexperienced personnel.

This investigation cannot account for inexperience but can verify that the design of the
operator station minimises the chances for maloperation.
6.9 Worst Case Failure - DP Operator Stations
6.9.1 Worst case failure: Is a completely failed operator station, the DPO will have to ‘take’
command at an alternate operator station.
Page 44 of 62
__________________________________________________________________________________
6.10 Dpc-2 controller
NET A
TO REST OF NET B
IAS SYSTEM TO R EST OF
NDU A1 NDU B1 IAS SYSTEM
24Vdc 2 4V dc
2 4V dc
24Vdc RCU 50 1 A RCU 50 1 B
SERIAL IN PU TS SERIAL INPUTS
SERIAL OUTPUTS (NMEA) SERIAL OUTPUTS (NMEA)

PSU 1 PSU 2
R BU S A R BU S A
UPS 1 UPS 2
RHUB (U31 )
R SER (U32 )
R SER (U33 )
RHUB (U61 )
RSER (U62)
RMP (U35)
RMP (U36)
230V 2 30V
RMP (U34)
RMP (U64)
RMP (U65)
RMP (U66)
R BU S B R BU S B
2 4V DC
GY RO 1 READY
GY RO 3 READY
UPS 1 OK
GY RO 2 READY
UPS 2 OK
UP S 2 OK
M RU 1 SIGNA LS
M RU 3 SIGNA LS
M RU 2 S IGNA LS
WI ND 1
GEN 1
GEN 3
WI ND 2
GEN 2
GEN 4
GYRO 1
DGPS 1
GYRO 3
GYRO 2
DGPS 2
T HRUS TER 1
BUSTIE 1
T HRUS TER 3
THRUS TER 2
THRUS TER 4
RA DIUS
Typical DPC cabinet configuration – Fig 7.2
6.10.1 Please refer to above drawing. As discussed earlier the DPC-2 comprises two identical
single board computers (SBC). These are RCU 501 modules based on the Motorola
MPC8245 processor operating at 400MHz. The dual controllers are nominally called DP
A and DP B. Although the controllers are the heart of the DP system they need to
communicate with the rest of the system. This is accomplished by utilising several
different mediums:
1. Serial communication.
2. Analogue / digital communication
6.10.2 Serial communication: The DPC-2 cabinet has three RSER200-4 serial line interface
modules that are linked to both RCUs. Each of these modules can have up to four serial
inputs, all galvanically isolated. The serial inputs are spread across the RSER units and
the RBUS dual-rail racks to enhance redundancy. Data is fed via two wire connections
from the RSER to serial inputs on the RCU501.
Serial data is received as a proprietary NMEA 0183 sentence. The National Marine
Electronics Association has developed a specification that defines the interface between
various pieces of marine electronic equipment. The standard permits marine electronics
to send information to computers and to other marine equipment. Vendors, such as
Kongsberg in this case, can adapt the string to feed their own equipment.
Page 45 of 62
__________________________________________________________________________________
6.10.3 Analogue / digital communication: The DPC-2 is equipped with three RMP200-8
multipurpose I/O modules on each rail. There are two RSER200-4 modules on one side
of the cabinet and one on the other. The RSER modules are inputs from the
environmental and position reference sensors and use NMEA inputs. Communication
between the RMP and field equipment is via software configurable digital or analogue
I/O ports. Communication between the RMP and the RCU501 is on a dual-rail RBUS
interface designated RBUS A and RBUS B. The RBUS interface is a standard multidrop
RS485 serial line. Each RMP houses a processor and an RBUS driver. Analogue inputs
are MRU inputs (+/-10V), DP Alert signals, UPS common alarms and Gyro ready
signals.
To transfer the data from the RBUS to the RCU501 an RHUB module is used. This is a
5-channel galvanically isolated repeater for connection to the RBUS dual-rail
connections (downstream), and both RCU controllers (upstream).
All modules described above, RMP200-8, RHUB200-5 and RSER200-4 are part of
KMs RIO200 module family. RIO200 modules are the same shape and are mounted on
a DIN dual-rail system. The modules snap onto the rails with a double spring action
making them secure. The rails provide a dual power supply to the modules and in the
case of the RMP200-8 the interface to the RBUS. From the drawing below it can be
seen that PSU 1 supplies RBUS A and PSU 2 supplies RBUS 2. Within the modules
semiconductors connect the two supplies together. RMP and RSER units monitor that
power is available on the respective rails and give an alarm if power is missing.
Reference sensor IO lists are given below
Page 46 of 62
__________________________________________________________________________________
Table 7-2 Reference sensor I/O locations
RSER RSER RMP RSER RMP RMP4 RMP7 RSERV
U32 U33 U37 U62 U66 1 1 63
Wind 1 X4:1 3
Wind 2 X4:1 3
Gyro 1 X2: 1,2
Gyro 2 X2: 1, 2
Gyro 3 X2: 1, 2
MRU 1 X3: 1, 2
MRU 2 X3: 1, 2
MRU 3 X3: 1, 2
DGPS 1 X1: 1, 2
DGPS 2 X1: 1, 2
LTW 1 X2: 4, 6
LTW 2 X2: 4, 6
Fanbeam X3:1,3
RADius X1: 1, 2
6.11 DPC-2 Controller Failure Modes
6.11.1 Failure modes have been assessed for the DP controllers and the failures are listed
below:
Failure of a DP controller RCU.
Failure of a DP cabinet power supply.
Total failure of DP system.
Communication fault on one network interface (within the cabinet).
Failure of an RHUB module.
Failure of an RMP module.
Failure of a common RSER module.
Failure of an RBUS rail.
Page 47 of 62
__________________________________________________________________________________
6.12 Failure of DPC-2 Controller Failure Effects
6.12.1 Failure of a DP controller SBC: The failure of a single RCU controller whether due to a
power failure or hardware failure is the most likely failure. This will cause a bumpless
transfer to the redundant processor and will therefore not cause any loss of position.
The system will drop down to simplex as described above.
6.12.2 Failure of DP cabinet power supply: All units within the DPC Cabinet are dual supplied
from PSU 1 and PSU 2. In the event of a loss of either supply the DPC will continue to
operate with loss of redundancy. Alarms will alert the operator of the failure.
6.12.3 Total failure of DP system: In the event of a total loss of the DP system requiring
changeover to manual thruster control. Control may be taken on individual levers or via
the cJoy Independent Joystick system. Mitigation against this event is through the
redundancy inside the DPC cabinet.
6.12.4 Communication fault on one network interface: The DP system will alarm for loss of
appropriate network (A or B) from the faulty RCU. The DP system will still operate as a
simplex system.
6.12.5 Failure of an RHUB module: Failure of an RHUB module will cause loss of redundancy
in the DPC I/O setup. The two controllers will still receive data but only from either
RBUS A or RBUS B. The RCU controllers are alarmed to indicate loss of RBUS input.
6.12.6 Failure of an RMP module: Information from the specific module will not be available
to the DP system. The loss of a single RMP module will lead to loss of a single thruster
through loss of command and feedback signals. In addition, dependant on which module
fails there may also be the loss of a gyro along with the thruster. This should have no
effect on the vessel’s ability to hold position and heading.
6.12.7 Failure of a common RSER module: Three separate RSER modules are used to accept
inputs from the different sensors and PME. In the event of the failure of a module, data
from the sensor will not be available to any of the RCUs. As above table shows, the
sensor inputs have been distributed to ensure loss of a single RSER module will not
cause loss of all references. Loss of a RSER is also alarmed to the operator. All RSER
modules are dual supplied from the dual-rail within the DPC-2 cabinet.
6.12.8 Failure of an RBUS rail: Each RBUS rail provides power to the snap-on I/O modules
and carries data from the RIO200 units to the RHUB. In the event of a failure of the
power supply this would be detected by the RIO modules attached. A fault on the
RBUS RS485 link would mean the RHUBs would have differing information. This
would be detected when the signal is sent to the RCUs. A failure of a rail or a difference
between the two RBUS networks will be alarmed at an operator station.
Page 48 of 62
__________________________________________________________________________________
6.13 Hidden Failures in the DPC-2 Controller
6.13.1 Within the RIO200 units there is a dual supply connected together via semiconductors,
with either supply being able to power the whole load. In the event of a failure of the
semiconductors, this could mean only one supply is supplying the load. This is not
alarmed or detectable by the unit. Redundancy tests by failing one of the main DPC
PSUs (PSU 1 or PSU 2) would reveal this fault.
6.13.2 The RMP and RSER units monitor the DIN-rails and give an alarm if power is missing
from the rail. The RHUB module does not monitor the power supply and it is
conceivable that either a bad connection or incorrect seating of the unit could cause the
RHUB to have only one supply. This is not alarmed or detectable by the unit.
Redundancy tests by failing one of the main DPC PSUs would reveal this fault. In
mitigation for this to be critical both RHUBs would have to fail the same way (i.e. both
with bad connection to the same rail) and the other DPC power supply fail to lose
contact between both RHUBs and the RCU501 controllers.
6.14 Common Mode Failures Affecting the DPC-2 Controller
6.14.1 The RMP200-8 has eight multipurpose I/O channels, two of the channels are
galvanically isolated to handle individually configured analogue I/O. The other six
channels have a common ground so there is the potential for a common mode failure.
This is not critical as a failure is no worse than loss of a complete RMP module.
6.15 Maloperation of the DPC-2 Controller
6.15.1 Maloperation of the DPC-2 is not expected as there is no operator input.
6.16 Configuration Errors of the DPC-2 that could Defeat Redundancy
6.16.1 Not having both DP controllers running with auto change enabled would defeat the
redundancy concept. Checking of the controllers is covered by completion of routine
checklists.
6.16.2 Software configuration errors would only be evident in the event of a corrupt load
install. As the software is not being investigated in this analysis, these types of
configuration errors have not been investigated further.
6.17 Worst Case Failure - DP Controllers
6.17.1 Worst case failure: The worst case failure would be loss of an RMP module containing
command and feedback information from a thruster; “load” and “connected” signals
from a generator and the ready signal from a single gyro. This should not have an
adverse effect on the position keeping of the vessel.
Page 49 of 62
__________________________________________________________________________________
6.18 DP System Sensors – MRU – Anemometer - Gyro
6.18.1 To enable the DP model to be built accurately, there are sensors for heading, pitch, roll,
and wind speed and direction. Heading is measured by gyro compasses, while pitch and
roll are detected by motion reference units. Wind speed and direction is measured by a
pair of anemometers. Heading information and vessel motion information are used to
correct position reference information for GPS antenna. Wind speed and direction are
used as inputs to the DP systems’ mathematical model as a feed forward term to
improve the DP control systems response to sudden increases in wind velocity or rapid
changes in direction. The two wind sensors fitted to this vessel are very old and the KM
commissioning engineers had great difficulty in calibrating them to the new DP system.
Errors are inherent and the actual wind speed and direction may cause large and
erroneous DP currents to be calculated by the system.
6.19 Motion Reference Units (MRU)
6.19.1 There are three MRUs used for the DP related equipment.
6.19.2 There are three units, two of them are located outside the engine control room and the
third unit, is located in the AC Vent Fan Room on the deck below the wheelhouse. They
are Seatex type, MRU-2 pitch and roll sensors. These sensors measure the pitch and
roll of the vessel. Magnetic fields pick up the movement of the vessel, voltages are
induced and amplified to give output signals proportional to the pitch and roll.
6.19.3 Various of the reference systems such as taut wire and DGPS use accurately measured
angles relative to the hull for their inputs to DP, the VRS input to DP is used to correct
the signals taking into consideration the angle of the hull, longitudinally and
transversely, relative to the horizontal. The importance of the VRS signal increases as
the weather worsens and the ships movements become more severe.
6.19.4 The three MRU are powered by the isolated power supplies in computer console B. The
units are alarmed for pitch/roll difference but not for loss of power, however loss of
power to one MRU would cause a pitch/roll difference alarm to be activated on the DP
system as soon as there was any significant pitch and roll.
6.19.5 Loss of any one MRU should not unduly effect the operation of the DP system
providing sufficient references are available.
Page 50 of 62
__________________________________________________________________________________
6.20 Failure Modes of MRUs
The following failure modes are possible for MRU:
Loss of power to the MRU.
Loss of signal from the MRU.
Catastrophic fault in the MRU.
6.20.1 Failure Effects of MRUs
Loss of power to the MRU: The failure effects of loss of power and loss of signal
would have the same effect. The faulty MRU would be rejected from DP system
which would then begin using the healthy MRU as a reference.
Loss of signal from the MRU: may lead to loss of the affected MRU dependant on
how the signal fails. Should the MRU fail in such a way that only one of the pitch or
roll signals is lost then there will be a difference alarm should the alarm parameters
be exceeded. Should all signals be lost to DP then the MRU will be rejected from the
DP desk. The other MRU should remain unaffected.
6.21 Wind Sensors

The vessel is fitted with two old (double tail) wind sensors. They are very hard to
calibrate to the modern K-Pos system. The wrong input from wind sensors will affect
the DP current values as mentioned above.
6.21.1 Failure Modes of Anemometers
The following are potential failure modes of the anemometers:
Loss of power supply.
Loss of signal to DP controller.
Turbulent air.
Cold weather
6.21.2 Failure Effects of the Anemometers
Loss of power: This would cause loss of the faulty wind sensor’s signal into DP and
the wind sensor being rejected. The sensors have separate UPS supplies (wind 1 is
supplied via UPS 1 and wind 2 via UPS 2) so there should still be a wind sensor
remaining following this failure.
Loss of signal to DP controller: Should create a difference alarm to be generated at
the operator station. This failure could be caused by a failure of the communication
link from the controller to the sensor or by a complete failure of U41 or U71
RSER200-4 IO modules.
Turbulent air: This can cause the sensor to give an inaccurate reading to the DP
Page 51 of 62
__________________________________________________________________________________
system causing an alarm to be given. Wind eddies can be caused by obstructing
structural parts. Wind eddies can also cause errors in the perceived direction of the
wind. Helicopter operations in the vicinity are also a potential cause for erroneous
wind readings. This type of problem requires DPO intervention in order to prevent
position loss as with incorrect environmental sensor readings the vessel will give
inaccurate commands to the thrusters.
Cold weather: This can cause ice to form over the sensor heads. This would be no
worse than turbulent air. The anemometers fitted to the vessel have heaters fitted to
them. Therefore the likelihood of ice formation affecting the sensors is reduced.
6.22 Gyrocompasses
6.22.1 The vessel operates with three gyros. Gyro 1, Gyro 2 and gyro 3 are NAVIGAT Mk 1
(C-Plath) and they are all interfaced to the DP system for heading reference. No. 3 has a
repeater close to the DP console.
6.22.2 All three gyros are located in the UPS/Gyro Room on the bridge. No. 1 Gyro is
powered from DP UPS 2, No. 2 Gyro is powered from the Clean Power system and No.
3 from DP UPS 1, with 24Vdc back up supplies from the DC distribution.
6.22.3 The DP system monitors the output of the gyros and alarms for angle difference and
power loss. The DP system will vote on the heading output from all three gyros and
deselect the output from any gyro that does not agree with the other two.
6.22.4 The gyro compasses are probably the most critical vessel status reference sensors,
failure of the vessel heading reference can cause the vessel to oscillate or lose the
heading altogether with serious consequences if near to a platform.
6.22.5 Failure Modes of Gyros
Loss of power supply: would lead to the affected gyro compass being rejected from
the DP system. The vessel would continue to operate using the two healthy gyro
compasses.
Loss of signal: would lead to the same circumstances as loss of power. The sensor
would be rejected from the DP system and the vessel would be able to maintain
heading using the two healthy gyros.
Incorrect reading from one gyro would lead to the faulty gyro being rejected from DP
through the K-Pos “voting” system. After three consecutive updates are out with
predefined accuracy limits. This would have no effect on the vessel’s ability to
maintain an accurate heading. If only two gyros were in use then an incorrect reading
would generate a “difference” alarm and it would be up to the DP operator to
ascertain which gyro was faulty and deselect it. Incorrect heading information can
have a significant effect on DP position keeping and this is why 3 gyros are required
Page 52 of 62
__________________________________________________________________________________
for DP2 operations.
6.22.6 Worst Case Failure - DP System Sensors
Worst case failure: Would be loss of a single sensor. The DP system would continue
to use information from the remaining sensors.
6.23 Dp reference sensors

The DP system has the ability to utilise various different position reference systems.
These are two DGPS units, 2 LTW (Porft & stbd) and a Fanbeam. There is provision
and software in place for the addition of a RADius unit, but this is not as yet installed
on board and is not considered further under this study. This gives the vessel the
sufficient sensors as required by MSC 645 which states the requirement for three
independent sensors of two different measurement principles.
6.23.1 DGPS
6.23.2 The vessel operates using two GPS systems each with differential correction. DGPS 1 is
type 116, receiving IALA, SBAS, Spotbeam & InMarsat corrections, DGPS 2 is type
232 receiving IALA, G2, Spotbeam & Inmarsat corrections The Seatex DPS 116
Differential Global Positioning System (DGPS) receiver is included in the DP console.
This position reference system uses radio signals from a series of satellites orbiting the
earth every 12 hours at an altitude of 20,200km. For a DP system a minimum of 4
satellites “in sight” are required to give an accurate signal. The position of each satellite
is calculated by one of a number of terrestrial stations and the corrected position of the
satellite relayed to the vessel via either a direct radio link or via the satellite itself. For
accuracy good enough for DP a corrected satellite position is required at most every 5
seconds.
6.23.3 Failure of one of the diff signals to the DGPS will be indicated on the DGPS screen,
failure of both will activate an alarm on DP and cause the affected DGPS to be
deselected.
6.23.4 By inputting further differential correction signals, for example from a Satellite Spot
Beam, an increase in the reliability and accuracy of multiple positions can be calculated.
The Big Orange DPS 116 installation is inclusive of a target-monitoring feature
providing a graphical display of vessel position relative to a desired target and
associated quality information.
6.23.5 Power to the DGPS 1 and de-modulator1 comes from UPS 2. Power to the de-
modulator 2 (DGPS2) coms from Clean Power System
6.23.6 As with any line of sight system it is important that the antennae are not masked from
the satellite, by sections of a platform for instance, particularly in the more northern
latitudes.
Page 53 of 62
__________________________________________________________________________________
6.23.7 Jump in position signals is a common problem when there is a satellite “constellation
change” or a differential signal problem. Operators should be aware of this problem as
a position reference change of say 5m can have a destabilising effect on the DP system
if there is only one more position reference system on-line.
6.23.8 GPS is a satellite position reference system, using an array of satellites in known orbits.
The GPS receivers calculate a position ‘fix’ using the signal from several satellites
simultaneously. This group of satellites is known as a constellation. For a DP system, a
minimum of four satellites ‘in sight’ is required to give an accurate signal. The position
error of each satellite is calculated by one of a number of terrestrial stations and the
corrected position of the satellite relayed to the vessel via either a direct radio link or
communications satellite link. For accuracy good enough for DP, a corrected satellite
position (or differential correction) is required at least every 5 seconds.
Both DGPS systems take a Gyro string input from separate gyro compasses. This
arrangement enhances redundancy of corrections
6.23.9 Failure Modes of DGPS
The significant failure modes of DGPS are listed below:
Power failure
Loss of correction signals
DGPS jump
6.23.10 Failure Effects of DGPS
Power failure: will lead to loss of only one DGPS unit. This is within the worst case
failure intent and the vessel will maintain position using other available references
Loss of correction signals: the loss of correction signals to a single DGPS will not
affect the position references beyond their ability to maintain a stable position
reference. The faulty DGPS will either reject the reference or significantly reduce the
weighting against other references and issue an alarm alerting the DPO to the
situation.
DGPS jump: a DGPS jump is an unavoidable event which will cause the position
reference from the DGPS to alter by an undeterminable number of metres. The DP
system will detect a sudden jump using “prediction” methods and will reject the
reference system. A slowly drifting DGPS will be detected using “median”
comparison methods providing at least 3 reference systems are selected (as required
during equipment class 2 operations) and will be rejected.
6.23.11 Common Mode Failures of DGPS
All DGPS could theoretically react to a change in satellite (SV) constellation by
recording a position jump. The increased number of SV’s in use has reduced the
probability of this occurrence and the “prediction” software as described above
should identify and reject rogue DGPS. Mitigation is in the number of references
Page 54 of 62
__________________________________________________________________________________
used and the use of capable DPOs who can then react to the situation accordingly.
Masking of GPS or differential signals by large objects such as platforms could affect
both DGPS systems simultaneously as could multipath interference when operating
close to structures. DGPS should not be relied upon as a primary reference in such
circumstances.
Ionospheric errors can be particularly problematic in equatorial regions.
6.24 Light weight taut Wire (LTW)
The vessel is fitted with one Bandak Mk. 12, 300 and one Bandak Mk. 12B, 300 Light
Weight Taut Wires. The two taut wires are located, one each to port and starboard aft of
the Dowell module. The taut wires use an accurate sensor head to measure the angle of
the wire that is attached to a weight on the seabed; this wire is kept under constant
tension by the hydraulic system. An important part of the taut wire is the wire length
counter, this enables the DP system to make allowances for the depth of water and
therefore calculate the distance the vessel is off position using wire angle.
Each taut wire is supplied by 440V from their respective sides of the switchboard, and
220V from different UPS as shown in the UPS distribution section above. Loss of either
supply will cause the unit to fail however failure should be limited to one unit only.
The failures of sensor heads, feedback loops and loss of weight will cause the unit to
fail. This should be no problem if other references are selected, as the DP system will
not accept the spurious or rapidly changing information.
6.24.1 Failure Modes of LTW

Either unit is capable of failing as follows:
Power failure (440v or 220v)
Sensor head failure or malfunction
Mechanical failure (Winch, drum, hydraulic)
Loss of air pressure
Wire failure (Loss of the depressor weight)
Strong current / deep water
Fouling of the wire
Vessel movements outside design limits / incorrect wire length
Incorrect brake pressure setting
Page 55 of 62
__________________________________________________________________________________
6.24.2 Failure effects of LTW
Power failure either 440v or 220v UPS supplies will cause an individual LTW to fail,
with DP ‘Mooring not on’ alarms. Any failure will be limited to an individual LTW,
since the power at both 440 & 220v levels are from independent sources. Power failure
will affect one LTW only, leaving the other healthy.
Sensor head failure will not generate an alarm, since the system cannot detect that the
head has failed. The DPO however will notice that the reference weighting for the
affected LTW will increase, and that the LTW display will be in error.
Mechanical failure of a component such as the winch, hydraulics or other mechanical
component will fail the individual LTW and generate a DP alarm. The LTW will then
not be available as a reference until repairs have been affected. The failure of one unit
will not affect the other.
Loss of air pressure supply will not generate a DP alarm, but will generate an engine
room alarm to warn the watchkeeper that the compressed air supply to the LTW’s has
failed. Both units will remain in service using the dual banks of reserve compressed air
on each LTW boom. This will maintain the units in service for around 30 minutes,
giving sufficient time for the compressed air supply to be reinstated from alternate
sources (Work air, start air etc).
Wire failure will generate a ‘Mooring not on’ DP alarm and the a\affected unit will be
rejected from DP. Wire failure in one unit will not affect the other.
Strong current / deep water will affect both LTW’s, but not in the same way. Both will
show differing data depending on brake pressure and other individual characteristics. In
strong currents, the wire may ‘bow’, or ‘belly’ out of the vertical, giving an incorrect
movement of the sensor head and erratic positioning. No alarms will be generated at the
DP to show this, only operator experience and monitoring of the reference weighting
will reveal the reason for possibly erratic position keeping.
Fouling of the wire by an external obstruction has occurred in the past, for example a
diver taking hold of the wire, ROV making contact etc. It is unlikely that both LTW’s
will be affected simultaneously, and the affected wire will generate median alarms at the
DP desk.
Incorrect wire length setting will not alarm at the DP, and can be easily missed unless
incorporated into DP field arrival checklists. Setting the wrong wire-out length will
result in the wrong calculation of vessel movement upon sensor head deflection when
the vessel moves. This will show on the DP desk as incorrect water depth display, and
incorrect inner & outer alarm limits for the affected LTW. The wire counter should be
reset to read the correct zero each time the wire is re-terminated, and checked when
deploying the LTW at a new location.
Incorrect brake pressure setting will not generate a DP alarm and will only be obvious
when monitoring the reference weighting at the DP desk. Incorrect brake pressure may
result in the weight ‘skipping’ across the seabed due to being lifted as the vessel rolls
and heaves.
Page 56 of 62
__________________________________________________________________________________
6.24.3 Common mode failures of LTW
LTW is a physical position reference, effectively connecting the vessel to the seabed.
The most common failure mode is by the operator moving the vessel too far without re-
plumbing the weight. Inner limit fatal warning will be generated once the wire makes
contact with the vessel hull, since at this point the wire angle at the sensor head will not
change with further vessel moves. The outer limits are reached once the sensor head has
exceeded its designed maximum angle. In both cases the DP should warn that fatal
angle is being approached, and an alarm generated once the fatal angle is reached.
Incorrect brake pressure and incorrect wire length indications as described above are
also common and it should be noted that they are unalarmed failures at the DP.
6.25 Fanbeam
The Big Orange XVIII is fitted with a Fanbeam Laser on the mast above the
wheelhouse; the control unit is located at the side of the DP console. The Fanbeam
Laser is an effective short-range position reference system.
The Fanbeam Laser as the name suggests uses a laser to detect and lock on to a
reflective target on a fixed platform. The control unit then calculates the angle and
range of the reflective target from the vessel and converts this information into a
position reference that can be used by DP.
The Fanbeam Laser has a number of failure modes that the operator should be aware of.
As with any line of sight reference system it is important that the laser is not masked by
parts of the platform or crane loads. It has been known for the Fanbeam to follow
personnel with reflective strips on overalls if they have been close to the reflective
target. In addition because it is an optical system fog, heavy rain, snow or even a flock
of birds can cause loss of reference from this unit.
6.25.1 Failure modes of fanbeam

Power failure
Incorrect reflector selection
Signal blocked by obstruction
Excessive distance from reflector.
Meteorological phenomenon
6.25.2 Failure effects of Fanbeam

Power failure of the Fanbeam computer will drop Fanbeam as a reference from the DP.
The unit is powered from one of the two DP UPS’s, and the position references are
equally divided between the 2 distributions so this should not affect vessel position
keeping. Power failure to the Fanbeam monitor will not alarm or affect the fanbeam as a
reference, but will leave the operator without a visual display.
Page 57 of 62
__________________________________________________________________________________
Incorrect reflector selection as mentioned above could mean that Fanbeam has acquired
an incorrect reflector, for example reflective strips on a workers PPE. Correct location
of the reflector on an installation should mitigate this happening.
Signal blocking by an obstruction such as a crane boom, cargo movements or people is
perhaps the most common failure. This will drop the fanbeam from DP for a short
period, but the system will search and re-locate the reflector once the obstruction has
passed. Care should be taken to ensure that the correct reflector has been re-acquired
however.
Excessive distance from reflector. Fanbeam is a relatively short range reference system
and is not reliable at distances above approximately 500 – 750 meters from a reflector.
Meteorological conditions such as fog, snow and rain will degrade the laser path and
render the system unreliable.
6.25.3 Common mode failures of Fanbeam

The most common failure mode is the physical blocking of the laser path between
transmitter and reflector. This can be reduced by mounting the laser in a position on
board with an unrestricted 360 degree view, above the working height of any cranes
mounted on board. Careful positioning of the reflector on an installation, away from
crane & areas accessible by personnel will all help in improving reliability of the
system.
6.26 cJoy independent joystick
The independent joystick system (IJS) is the Kongsberg cJoy system controlled by a cC-1
controller equipped with an RCU501 processor. The cC-1 is used as a manual joystick
and in auto heading mode. The IJS takes heading information from Gyro 1, and wind
from Wind sensor 1. 230V supply is provided from the ship emergency 230V system. The
vessel also has 1 c-Wing joystick. It’s a simplified version of cJoy with an extended
power cable. It connects directly to the cJoy.
A cJoy operator terminal serves as the main operator interface for the cJoy compact
joystick system. Power for these units is supplied from the cC-1 via cJoy junction boxes.
Communication with the cC-1 is via an Ethernet network. cC-1 is then hardwired to each
thruster field station
As with the DPC-2 the cC-1 RCU501 requires a download of configuration files to
become active, in this case a cJoy operator terminal. The download is carried out across
the dedicated Ethernet network. An operator terminal is therefore required to be
connected when the cC-1 is first switched on. This operator terminal will act as a boot
server for the controller.
The cJoy operator terminal is basically a PC104+ embedded µPC running Microsoft
Windows XP embedded operating system. This interfaces with different user interfaces
including:
axis joystick.
Page 58 of 62
__________________________________________________________________________________
Heading wheel.
6.5 inch colour display.
Alarms and buzzers.
6.26.1 Failure Modes of the IJS
For the purposes of this FMEA the significant failure modes of the independent
joystick are taken to be:
Failure of the cC-1 controller.
Failure of the cJoy terminal.
Faulty network.
Loss of a gyro.
Loss of wind sensor.
6.26.2 Failure Effects of the IJS
Failure of the cC-1 controller: This may be due to a processor fault or a total power
failure and will stop the IJS system from operating.
Failure of the cJoy terminal: The terminal will be unavailable.
Faulty network: as above.
Loss of a gyro: will prevent the cJoy from being able to provide automatic control
over the heading of the vessel.
Loss of wind sensor: may cause inaccuracies in the automatic heading control
6.26.3 Hidden Failures of the IJS
As long as the IJS system is powered, alarms for failures will be indicated visually
and / or audibly. A potential failure would be in the selector switch for changing
between manual / DP / IJS, however, this is mitigated by regular testing as part of
normal DP operational procedures.
6.26.4 Maloperation of the IJS
Not expected to be an issue.
6.26.5 Worse Case Failure – IJS
Worst case failure: As each thruster receives a separate discrete analogue signal,
worst case failure would be loss of control to a single thruster while in joystick mode.
This should have no effect on DP operations.
6.26.6 Worst Case Failure - DP Control System
Worst case failure: This would be loss of either RMP 34 or 64 leading to the loss of a
single thruster, a gyro and the loss of generator inputs into DP. The vessel’s
redundancy will be degraded. However, position and heading keeping ability should
be maintained by the three remaining thrusters.
Page 59 of 62
__________________________________________________________________________________
7. CONCLUSIONS AND CONCERNS
7.7. Following the installation of the K-Pos DP control system, the DP annual trials
were carried out in conjunction with proving trials verifying the modifications
made in February/March 2012. The results of these trials confirmed the content of
this report.
7.8. There was no ‘Category A findings’ from the Clean Power Switchboard proving
trials.
7.9. There were seven ‘Category B findings’ from the Clean Power Switchboard
proving trials which were discussed verbally onboard the vessel on 18th February
2012 and presented to Wilhelmsen Ship Management AS formally on 20th
February 2012.
7.10. There was no ‘Category A findings’ from the Clean Power Switchboard proving
trials.
Page 60 of 62
__________________________________________________________________________________
APPENDIX A MAIN SWITCHBOARD SKETCH
Page 61 of 62
__________________________________________________________________________________
This Report is intended for the sole use of the person or company to whom it is addressed and no
liability of any nature whatsoever shall be assumed to any other party in respect of its contents.
As to the addressee, neither the Company nor the undersigned shall (save as provided in the
Company’s Conditions of Business) be liable for any loss or damage whatsoever suffered by
virtue of any act, omission or default (whether arising by negligence or otherwise) by the
undersigned, the Company or any of its servants.
GL Noble Denton AS.
Original Signed by:

R Inkster
DP Technical Lead Engineer
Countersigned by:
Peter Solvang
DP Manager, Norway
Bergen : 20 February 2012
Page 62 of 62

Big Orange DP Fmea Rev e PDF

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Big Orange DP Fmea Rev e PDF

Загружено:

Авторское право:

Доступные форматы

No 1 The

Hinna Park (Blokk A) Exchange

WILHELMSEN SHIP MANAGEMENT

DOCUMENT DETAILS AND ISSUE RECORD

ABS American Bureau of Shipping

K-POS OS, DPC’s & I/O modules

1.5 General Layout

1.6 Vessel Particulars

1.5.1 The principal dimensions of the vessel are:

Aft Azimuth Thrusters 2 x 1600kW

Independent Joystick System

1.5.2 The DP system utilises the following equipment:

2.1.6 There are alarms for essential services such as:

2.3. Lubricating Oil Systems

2.4. Main Sea Water Cooling System

2.6. Central Fresh Water Cooling Systems

3.5.6 Principal sketch.

Power Management System Schematic

24Vdc DC2 ECU

220V CLEAN 220V CLEAN

Figure 5.1 Single Line Diagram of Power Generation System

4.4. 220 V Distribution

C/B 1018 N.C. N.C. C/B 1516

C/B 1717 N.C. N.C. C/B 1817

Simplified schematic of 220V GS Switchboard Supply

Simplified schematic of supplies to 220V Clean Power Switchboards 1 and 2

4.5. Emergency Switchboard

4.6. 24Vdc Systems

Simplified sketch of DC Distribution System

5.1. Bow Tunnel Thrusters

RELAY CURRENT IS DERIVED FROM DM1 DM2

Figure 6.1 Simplified Speed Control

5.2. Stern Azimuth Thrusters

steering the azimuth; these are both in use at all times.

Figure 6.2 Simplified Steering Control

5.3. Silicone Controlled Rectifiers

6.1 Bridge Consoles

6.2 System overview

6.5 Failure Effects of the Operator Stations

6.7 DP Operator Console Configuration Errors

6.8 Maloperation of the DP Operator Consoles

6.8.1 Maloperation can be caused by badly designed features or inexperienced personnel.

6.9 Worst Case Failure - DP Operator Stations

SERIAL IN PU TS SERIAL INPUTS

SERIAL OUTPUTS (NMEA) SERIAL OUTPUTS (NMEA)

Typical DPC cabinet configuration – Fig 7.2

Gyro 1 X2: 1,2

6.11 DPC-2 Controller Failure Modes

6.14 Common Mode Failures Affecting the DPC-2 Controller

6.15 Maloperation of the DPC-2 Controller

6.15.1 Maloperation of the DPC-2 is not expected as there is no operator input.

6.16 Configuration Errors of the DPC-2 that could Defeat Redundancy

6.17 Worst Case Failure - DP Controllers

6.19 Motion Reference Units (MRU)

6.21 Wind Sensors

6.23 Dp reference sensors

6.24 Light weight taut Wire (LTW)

6.24.1 Failure Modes of LTW

6.25.1 Failure modes of fanbeam

6.25.2 Failure effects of Fanbeam

6.25.3 Common mode failures of Fanbeam

7. CONCLUSIONS AND CONCERNS

APPENDIX A MAIN SWITCHBOARD SKETCH