Closed Bus – PMS failure leads to thrust limitation of all thrusters

The vessel encountered a critical situation due to a fault in the Power Management System 
(PMS). A malfunction in the Input/Output (I/O) module for the No. 4 centre generator 
triggered a series of events leading to a loss of vessel position and an emergency disconnect.

1. Misleading alarm and response: An alarm signalled a generator fault, leading the engineer to disconnecting the faulty generator by opening the circuit breaker but leaving the affected generator running. However, due to the I/O module fault, the breaker status incorrectly showed to the PMS as still closed/connected.
   
   
2. I/O module fault: The I/O module for the No. 4 centre generator developed a fault, causing the generator circuit breaker status to freeze in the ‘closed’ position when the breaker was physically opened.
   
   
3. Load sharing imbalance: The disconnection of the generator caused a load sharing imbalance. The PMS attempted to correct this imbalance, but as the disconnected generator could not take any load, the imbalance persisted. The PMS believed it was controlling three generators not two, the status signal was not just for indication but an important input to the PMS control. PMS lowered the fuel setting to G2 & G6 and increased fuel setting to G4.
   
   
4. Bus frequency decline and thrust limitation: The persistent imbalance led the PMS to reduce the bus frequency, eventually triggering a frequency-based thrust limitation function on all thrusters. This resulted in the loss of the vessel’s position and necessitated an emergency disconnect.
   
   When a Power Management System (PMS) tries to manage three generators but only two are actually connected in parallel, while the PMS believes all three are connected, several issues can arise due to this discrepancy:
   
   
   1. Load sharing problems: The PMS is designed to balance the load across all connected generators. If it believes three generators are connected and operating, it will attempt to distribute the load across all three. However, since only two are actually connected, it will still try and load up the unconnected generator, which in this case meant lowering the governor setting on the two connected generators and raising the governor settings on the unconnected generator. 
   2. Voltage and frequency instability: Generators in a parallel setup need to maintain synchronicity in terms of voltage, frequency, and phase. If the PMS tries to synchronise three generators but only two are present, it can lead to instability in voltage and frequency. In this case the two connected generators were ‘slowing down’ this had the effect of reducing the bus frequency, as the frequency detreated the thruster drives tripped on their protection settings. The unconnected generator was ‘speeding up’ and eventually tripped on overspeed.
   3. Incorrect system readings and responses: The PMS uses data from all generators to make decisions about load distribution, start-up, shutdown, and other operational aspects. Incorrect data due to a non-existent third generator can lead to inappropriate decisions, such as unnecessary generator start-ups or shutdowns, or failure to start an additional generator when needed.
   4. Protection system mis-operation: The protection systems in power management are designed to prevent damage to generators and connected systems in cases of faults. If the PMS incorrectly assumes the presence of a third generator, it may not correctly identify and react to real faults, potentially leading to equipment damage or safety hazards.

G4 eventually tripped off on overspeed, once this trip happened the two connected generators returned to normal load sharing and returned the bus frequency to 60Hz, however this was too late as the thrusters had already reduced their thrust output to zero.

The standby generators were prevented from connecting prior to G4 trip due to the low bus frequency. Once G4 tripped, the PMS return to normal load sharing and as the frequency returned to normal level the standby generators were able to connect.

Once the thruster drives detected the normalisation of the bus frequency the thrusters were able to return from phase back allowing DP Control.

The time duration was relatively short (approximately three mins) – however, the position excursion was in excess of 75 metres.

The incident underscores the criticality of robust PMS functioning in marine vessels, especially in complex configurations like closed bus mode. It highlights the need for comprehensive FMEA, rigorous system testing, and continuous review of operational procedures to ensure the safety and reliability of marine operations.

Additionally, the need for appropriate protective function related to load control (i.e. additional generator protection).