With blackout incidents on cruise ships on the rise, DNV has created a new guidance titled Managing the risk of blackouts which offers best practices on how to reduce the likelihood of their occurrence.
In 2019, there were 12 reported power-loss events on cruise ships that resulted in full or partial blackout while in transit or manoeuvring – up from four events in 2018. The majority of incidents occurred in open water with minimal consequences, but DNV highlights that they represent a major accident hazard, particularly if they result in loss of propulsion.
One high profile case was the blackout, loss of propulsion and near grounding of the Viking Sky off Norway’s coast in March 2019. In this case, an NTNU study identified several failure precursors including a low level of lubricating oil, the failure of a turbocharger, and an inoperative large diesel generator.
The loss of power experienced by the Coral Princess as it was manoeuvring in Juneau, Alaska, in August 2019 was attributed to contaminated lube oil in one of the ship’s diesel generators. When a generator fails, the ship’s power management system is supposed to manage the surge, but in this case the system was not properly configured, and with both generators offline there was no power to the electric propulsion system.
In the new paper, DNV outlines a stepwise approach that centres on a simplified barrier-risk model. A simplified ‘bow tie’ model is used to present the threats and /operational barriers that contribute to /decreasing the likelihood of blackout, and the mitigating barriers for supporting recovery.
The guidance paper is intended to support a step-change in safety for operators, from gaining an overall understanding of blackout causes, defining safety ambitions and prudently managing conflicting goals (such as decarbonization and cost pressures), to identifying appropriate operational and technical measures to reduce risk based on cost-benefit evaluations.
The paper offers a five-step approach:
1. Increase understanding of blackouts
2. Define safety ambitions and manage conflicting goals
3. Identify measures to ensure safe and reliable vessel operations
4. Identify measures to ensure safe and reliable newbuilds
5. Prioritise and implement cost-efficient prevention and mitigation measures.
The paper describes the mandatory requirements for blackout prevention and recovery that provide a minimum technical standard for newbuildings, including Safe Return to Port (SRtP) regulations under SOLAS and additional measures such as DNV’s Operational Reliability (OR) class notation, which specifically targets resilience and availability of propulsion, steering, electrical power and manoeuvrability.
Class rules
The most essential requirements in DNV’s main class rules on blackout prevention are:
• The power system shall be arranged with automatic load shedding, or load reduction, to prevent overloading of the running generator(s).
• When several generators are running in parallel, tripping of one power unit shall not result in overload or tripping of the remaining unit(s).
• There shall be interlocks to ensure that enough generators are connected before large motors are started.
• Essential consumers serving the same service shall be distributed between the two sections of the main switchboard.
• There shall be discrimination in the electrical protection system to ensure that only the switching device nearest to the fault is activated.
The most essential requirements in DNV’s main class rules on blackout recovery are:
• There shall be at least two main generator sets arranged for blackout starting, and these generator sets shall be connected to separate busbar sections of the main switchboard.
• Stored energy for blackout recovery: At least two sources of stored energy shall be arranged for blackout recovery. The generator sets shall be divided between the power sources. The capacity shall be enough for three starting attempts on each engine.
• If power supply to auxiliary systems, such as governors, voltage regulators, switchboard control, fuel supply, etc., is needed for the blackout start, the power supplies to these systems shall be arranged as the energy for starting. The capacity of these power sources shall correspond to the required number of starting attempts /or last for at least 30 minutes.
• Engines in standby mode will usually be arranged with heating /or lubrication oil priming. These systems do not have to be supplied during a blackout situation, provided start blocking is not activated within 30 minutes after the blackout.
• Automatic start and connection of the standby generator is required in case of blackout. The standby power source shall be started and connected to the main switchboard within 45 seconds. Essential auxiliaries shall then be automatically re-started.
Operating mode instructions should define the machinery arrangements in manoeuvring and transit modes with respect to:
• Power generation: Number of generators online, number of generators in standby, ensuring number of remaining generator(s) after a failure has the capacity to maintain the navigational safety of the ship and configuration of auxiliaries and cross-over lines / cross-feeders (i.e. common or separated auxiliaries for the machinery systems)
• Power distribution: Closed or open bus-tie configuration
• Propulsion units (manoeuvring machinery / steering gear): Number of units online and number of units in standby.
Assessing risk
The procedures and decisions to enter /red operations should be risk-based, in accordance with the company’s risk acceptance criteria, says DNV. For example, sailing with only one generator online in calm weather on open sea may not lead to severe post-blackout consequences. The risk acceptance criteria should reflect the company’s safety ambition with respect to blackout.
While it is common practice in the industry that vessels operate with a closed bus tie on the main switchboard, meaning that redundant power systems are configured as one common system, DNV wars that certain failures in a closed-bus configuration will create a failure propagation path leading to blackout, even with multiple gensets online. Unless additional technical measures are implemented, and the systems are tested and verified accordingly, blackouts may be caused by failures such as short circuit, earth fault or excitation control fault and fuel control (speed governor).
Alarms
Alarms are often said to be least useful when they are most necessary, but, says DNV, operators are distracted by nuisance alarms, experience unnecessarily high workloads from redundant alerts, struggle with alarm texts that are difficult to understand, and are overwhelmed by the amount of non-critical information that is presented to them.
DNV advices that alarms should direct the operator’s attention towards vessel conditions requiring timely assessment or action, and every alarm should have a defined response. Alarm levels should be set such that the operator has enough time to respond before the situation escalates.
Holistic approach
Rami Nurminen, Director Technical Assurance at Royal Caribbean Cruises, confirms that value of the guidance for cruise operators: “This is a great initiative that combines design principles, technical commissioning and human factors. A holistic approach is essential to maintaining design principles throughout system development, integration and final testing – not least operator familiarisation and training of new crew members,” he said.
“Factors such as new fuels, change of speed and other measures to remain compliant with EEXI and CII regulations are high on shipowners’ agendas. We also see a considerable focus on keeping opex and capex costs in check after two years with reduced revenue. While dealing with all these challenges we urge ship owners not to lose sight of safety. By increasing awareness of what to do to avoid and manage blackouts we want to contribute positively to building trust across the sector,” said Hans Eivind Siewers, Segment Director for passenger ships and ro-ro at DNV Maritime.
