1

Dr. Asgeir J. Sørensen and Dr. Alf Kåre Ådnanes

Reconfigurable Marine Control Systems and Electrical Propulsion Systems for Ships

ABSTRACT This paper is about design and operations of reconfigurable marine control and electrical propulsion systems for marine vessels. Design requirements accounting for physical segregation and redundancy, flexibility in operation, reduced mechanical wear and tear, and methodologies to achieve predictable power consumption and black-out prevention and restoration are treated. Design aspects related to high level vessel control such as power management and dynamic positioning (DP) to low level thruster control are addressed. A new safety concept for testing and verification of marine control systems is shown. This is denoted as Hardware-In-the-Loop (HIL) testing and verification. INTRODUCTION By reconfigurable marine control systems and electrical propulsion control system it is meant systems which can be reconfigured as a part of the normal operation conditions in order to optimize the performance towards the intended functional mode. A reconfigurable system is designed to be fault-tolerant to equipment faults, communication errors, and in certain cases also physical damage due to fire and flooding. In order to fully understand the different aspects related to these features, this paper presents the characteristics of marine control systems and electric propulsion related to performance, redundancy, and fault-tolerance, as well as means to test and verify solutions. According to the knowledge of the authors and the history of automated closed-loop ship control started with Elmer Sperry (1860-1930), who constructed the first automatic ship steering mechanism in 1911 for course keeping (Allensworth, 1999, Bennet, 1979 and

Fossen, 2002). This device is referred to as the "Metal Mike", and did compensate for varying sea states by using feedback control and automatic gain adjustments. Later in 1922, Nicholas Minorsky (1885-1970), presented a detailed analysis of a position feedback control system where he formulated a three-term control law which today is refereed to as Proportional-Integral-Derivative (PID) control (Minorsky, 1922). These terms were motivated by observing the way in which a helmsman steered a ship. In the 1960s systems for automatic control of horizontal vessel position in surge and sway and heading were developed. Such systems are today commonly known as dynamic positioning (DP) systems. From the middle of the 1970s more advanced control techniques based on multivariable linear optimal control and Kalman filter theory were proposed. In the 1990s nonlinear control were introduced for certain complex control applications. Electric propulsion is not a very new concept. It has been used as early as in the late 19th century. However, only in few vessels until the 1920s where the electric shaft line concept enabled the design of the largest Trans-Atlantic passenger liners. Variable speed propulsion was used in some few applications during the 1950s and 1960s, while, first when the semiconductor technology became available in large scale commercial applications, this technology became acceptable for a wide range of applications. The introduction of AC drives and podded propulsors was another shift in technology that led to a rapid increase in the use of electric propulsion through the last 15-20 years. Typically, ships with electric propulsion tend to have more system functionality implemented in integrated automation systems, partially because such functionalities are regarded to be necessary for safe and optimal operation, but also because the electric propulsion plant enables the use of such functions. In the commercial market the offshore vessels in addition to cruise ships and ice breakers have been

2

technology drivers concerning automation, power and propulsion systems. They are characterized by the required ability to conduct complex marine operations, operational availability, safety focus, cost effectiveness and flexibility in operational profile concerning transit, station keeping, maneuverability and to some extent also a significant vessel or process load system. These rather complex power plants opened up for an increasing use of fully all-electric ships and the introduction of fully integrated computer-controlled systems in order to operate safely and cost efficiently. Such concepts are today applied in an increasing number of ship applications. Consequently, the complexity has also increased with a variety of solutions consisting of stand-alone systems, partly integrated systems to fully physical and functional integrated systems. Up to now integrated automation systems have been proprietary with a limited number of vendors. However, in the automation industry it is a trend towards openness in communication protocols and network. How this will influence on the technology solutions and responsibilities for multi-vendor integration systems is still a subject for discussion. During the late 1990s the introduction of low-cost off-shelf computers not originally designed for automation purposes have also been taken more into use. This development is driven by the need to make more cost efficient solutions. Nevertheless it also creates new issues of concern: • Development of new adequate testing and

verification methods. • New procedures for design and specification that

considers compatibility and integration aspects. • Failure analysis and test methods, adequate to

ensure fault-tolerance in the overall system. This paper focuses on aspects related to fault-tolerance and automatic reconfiguration of vessels with electric propulsion and integrated, automation systems with closed-loop control functionality. In commercial vessels, such aspects have mainly been considered in applications where controllability and availability are critical, such as in DP vessels and passenger ships. DP vessels in the offshore oil and gas industry are selected as demonstrating examples of such installations.

EXAMPLE APPLICATION: - OFFSHORE DP VESSELS A DP vessel is by the class societies, defined as a vessel that maintains its position and heading (fixed location or pre-determined track) exclusively by means of active thrusters. The DP system's functionality, design methods, sensors and total reliability have improved over the years and are still a topic of research, see Fossen (2002), Sørensen (2005a and b) and the references therein. System Overview A DP offshore drilling vessel as illustrated in FIGURE 1 may comprise the following sub-systems: • Power system. • Marine control or automation system. • DP system including thrusters and sensors. • Propulsion system including rudders and main

propellers. • Nautical system including autopilot, radar, automatic

identification system (AIS), and GPS. • Safety systems. • Auxiliary systems, such at HVAC, water cooling,

hydraulic systems, etc. • Drilling system. Power System Power system comprises all units necessary to supply the vessel with power. The power generation and distribution systems are divided into the following main parts: • A power generation plant with prime mover and

generators. In commercial vessels, the prime movers are typically medium speed diesel engines, due to high efficiency and cost efficiency. Gas turbines, and also steam turbines, are used in some ship applications due to their advantages in weight and size. There are intensive research and development in the field of commercial feasible fuel cells, which in some future also can be applied in a wider scale than of today. In addition, combined power plants are also looked more into.

• An electric power distribution system with main and distribution switchboards. The distribution system is typically split in two, three or four sections, with the possibility to connect and split the sections by use of

3

bus ties or bus feeders. With a proper protection system and operational philosophy, such systems may have the flexibility of operating in a common, connected mode for optimizing the energy production in normal modes, while isolating faulty parts of the system and obtain the intended redundancy without loss of maneuverability or station keeping ability by automatic splitting and segregation of the system.

• Transformers for feeding of alternate voltage levels in main or distribution electric system.

• Uninterruptible power supply of sensitive equipment and automation systems.

• Cabling, including cable routing and segregation. Marine Automation System In marine industry, there are two main directions of solutions for automation systems: • Integrated automation systems. • Stand-alone automation systems. The two different classes of solutions are found in most kind of vessels. However, since complex functionalities and tasks are handled better by the integrated solutions, this is more often found in the vessels with complex and advanced propulsion and station keeping installations. In the following integrated automation system is treated.

Marine automation or vessel control system comprises: • The operator's user interface to the automation

system is through the Human-Machine Interface (HMI) with display systems and operator panels, often denoted as operator stations.

• Centralized computers with scalable CPU processing and I/O capacities, often denoted as controllers or process control stations FIGURE 2.

• Distributed computers or PLCs, typically with local control and interfaces to process and to centralized computers.

• Communication buses at the different levels of control.

• Associated cabling, segregation and cable routing. With today’s standardization on communication in automation systems, it is relatively easy to connect various sub systems into a network communication system. The evolution of interconnecting systems in such networks has, today, developed to be an international standard of many new buildings. It is a challenge of designers, to distinguish between the essential and important communication, and to define the right level of redundancy and inter-dependency of sub systems.

FIGURE 1. DP drilling vessel.

INTEGRATED THRUSTERCONTROL SYSTEM- DYNAMIC POSITIONING- POSMOOR- AUTOSAIL- OPERATOR CONTROL SYSTEMINTEGRATED MONITORING &CONTROL SYSTEM- EXTENSION ALARM- PROCESS CONTROL

POWER GENERATION& DISTRIBUTION

PROCESS CONTROL STATION

PROPULSION

WIND SENSORS

VRU

GYRO

BACK-UPSYSTEM

SAFETY SYSTEMEMERGENCY SHUTDOWN

FIRE & GAS

ENERGY MANAGEMENTSYSTEM

AZIPOD

INFORMATION MANAGEMENTREMOTE DIAGNOSTIC

DRILLING DRIVESYSTEM

PLANTNETWORK

CONTROLNETWORK

FIELDBUSNETWORK

4

Control Network

Fieldbus Network

Office Plant Network

FIGURE 2. Integrated automation system. Physical integration based on standardized communication protocols ensure connectivity of devices and integration of controllers and operator stations into three network levels (FIGURE 2): Real time field bus network communication on low level between devices and controllers, real time control network connecting controllers and operator stations, and office plant network to various office systems and information management systems. The last level opens up for satellite communication to land offices at ship operators or vendors. It is common to characterize the automation system by the number of I/Os and dividing the applications into low-end or high-end segments. For a drilling rig as shown in FIGURE 1 the number of I/O signals may be up to 10-15000. For a conventional supply vessel the I/O number is typically lower than 1.500 - 2.000 signals. Propulsion System A ships propulsion system is in this work regarded to consist of its propulsors and thruster units and the electric drive system used for driving the units. A ship can be equipped with several types of propulsors and thrusters. Conventional ships typically have a main propulsion unit located aft. Traditionally, shaft line propulsion with controllable pitch or fixed pitch propellers is applied, with rudders to direct the thrust. In more recent years, azimuthing thrusters and podded propulsors have gained increasing usage, and these can

also provide transverse thrust with high efficiency. Other types of transverse thrust units are the tunnel thruster, or azimuthing thrusters, various water jet designs, etc. The thrust magnitude and for steerable units, the direction, is conventionally controlled by the speed (RPM) of the propellers, the pitch, or by these in the combination (consolidated control). This control is often referred to as low-level thrust control, which will be treated in more detail later in the text. The redundancy concept of the electrical power and propulsion plant will be based on the required ability for maneuvering and propulsion after faults in the system. In commercial vessels, these requirements are determined by national and international legislations, and specified by the classification societies by the different class notations. A typical redundancy diagram for a DP class 2/3 drilling rig is indicated in FIGURE 3. Each block represents a part of the system which is susceptible to a single failure.

FIGURE 3. Redundancy diagram for a typical DP 2/3 drilling rig. Process System In many ships there is a vessel or process plant system, which is critically dependent on the electrical power system. Such systems can be: • Hotel loads, e.g. for cruise and passenger vessels. • Crane and winch systems, e.g. for support vessels. • Drilling systems, e.g. for drilling rigs.

5

• Oil and gas production, for FPSOs. • Load/cargo handling systems, for cargo vessels

and tankers. Even though these systems may not be directly critical for the safe maneuverability of the vessel, there may be serious consequences by loss of controllability, both with concern to safety, environmental or economical consequences. Hence, redundancy and segregation in the process and automation systems may be equally important as in the electrical power and propulsion system. This can be explained by the redundant configuration of a drilling drive system, with dual independent power feeding and possibility to segregate into independent sections either in normal or faulty conditions, as shown in FIGURE 4.

GG

M

ACAC

M

ACAC

M

ACAC

M

ACAC

GG

ACDC

ACDC DC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

M

DC

AC

GG GG

M

ACAC

M

ACAC

GG

M

ACAC

M

ACAC

GG GG GG

M

ACAC

M

ACAC

M

ACAC

M

ACAC

Drilling packageAC Multidrive

FIGURE 4. Drilling drive system. The vessel control system must follow the same redundancy and segregation principles as the electric system. Principally, this is achieved by designing the vessel control structure as a mirror image of the electrical power plant, as shown in FIGURE 5. At higher level of controls the redundancy concept is different and achieved by the duplication of the control systems in hot back-up configuration, as seen in FIGURE 6.

GG GG

M

ACAC

M

ACAC

GG

M

ACAC

M

ACAC

GG

M

ACAC

M

ACAC

M

ACAC

M

ACAC

GG GG

M

ACAC

M

ACAC

GG

M

ACAC

M

ACAC

GG

M

ACAC

M

ACAC

M

ACAC

M

ACAC

FIGURE 5. Mirror image design of the vessel control system ensures to achieve a unified redundancy and segregation philosophy.

FIGURE 6. A total integrated vessel control system for drilling vessels (Courtesy of Kongsberg Maritime).

6

CONTROLLER STRUCTURE Concerning the controller structure in marine control systems as illustrated in FIGURE 7 it is as shown in FIGURE 2 divided into two main areas: Real-time control and monitoring and Operational and Business enterprise management. The real-time control structure is further by Sørensen (2005b) divided into low level actuator control, high level plant control and local optimization. For the DP vessels examples of the control structure levels are: • Actuator controller: The actuators for DP systems

are normally thrusters, propellers, and rudders. Other important actuators may be pumps, separators, compressors, HVAC, drilling drives, cranes, winches, etc. Dependent on whether the actuators are mechanically, hydraulically and/or electrically driven, controllers with different properties will be used.

• Plant controller: In station keeping operations the DP system is supposed to counteract the disturbances like wave (mean and slowly varying), wind and currents loads acting on the vessel. The plant controller calculates the commanded surge and sway forces and yaw moment needed to compensate the disturbances. A multivariable output controller often of PID type using linear observers e.g. Kalman filter or nonlinear passive observers may be used. Set points to the local thruster controllers are provided by the thruster allocation scheme. Other examples may be the ballast and loading controller, power management system (PMS)/ energy management system (EMS), etc.

• Local optimization: Depending of the actual marine operation (drilling, weather vaning, pipe laying, tracking operations, etc.) the DP vessel is involved in; optimizations of desired set points in conjunction with appropriate reference models are used. In the guidance, navigation and control literature local optimization corresponds to the guidance block (Fossen, 2002).

With the improved local monitoring and diagnostics abilities, the field of fault-tolerant control is important ensuring efficient and safe operations of marine

vessels. An important reference is Blanke et al. (2003). We will in the following of this section show brief examples of low level thruster control in a DP system (FIGURE 8) and power/energy management system.

Ship 1:Operational management

Local optimization (min-hour)

Plant control

Actuator controlRea

l-Tim

e N

etw

ork

Business enterprise/Fleet management

Ship 2:Ship 3:

Offi

ce N

etw

ork

Control layers

High level(0.1-5 s)

Low level(0.001-1 s)

Real-Time Control

Office Systems

Faul

t-Tol

eran

t Con

trol

FIGURE 7. Controller Structure.

FIGURE 8. DP system. Actuator Controller For DP vessels the thruster system normally represents one of the main consumers of energy, and is regarded as a critical system with respect to safety. In the ship positioning control literature the focus has traditionally been placed on the high-level controller design, where the control input vector has been regarded as ideal

7

forces in surge and sway and moment in yaw neglecting the effect of limitations caused by the thrust allocation, actuator dynamics and thrust losses. Important results in the fields of thrust allocation, propulsion control and low-level control of the thruster devices can be found in Fossen (2002), Sørensen (2005a and b), Smogeli et al. (2005a and b) and the references therein. The propeller and thruster devices can be controllable pitch propeller (CPP) with fixed speed, controllable speed with fixed pitch propeller (FPP), or controllable pitch and speed in combination. Since normally no sensors are available for measuring the actual force developed by the propeller, there is no guarantee for fulfilling the high-level thrust commands, and the mapping from commanded thruster force to actual propeller force can be viewed as an open-loop system. Conventionally, the resulting pitch or speed set-point signals are determined from stationary propeller force-to-speed/pitch relations based on information about thruster characteristics found from model tests and bollard pull tests provided by the thruster manufacturer. These relations may later be modified during sea trials. However, they are strongly influenced by the local water flow around the propeller blades, hull design, operational philosophy, vessel motion, waves and water current. Hence, the developed thrust Ta may differ substantially from the commanded thrust setpoint Tref. Variations in these relations are not accounted for in the control system, resulting in reduced positioning performance with respect to accuracy and response time. In addition, the variations may lead to mechanical wear and tear of propulsion components and deterioration of performance and stability in the electrical power plant network due to unintentional peaks or power drops caused by load fluctuations on the propeller shafts, as illustrated in FIGURE 9. The unpredictable load variations force the operator to have more available power than necessary. This implies that the diesel generators will get more running hours at lower loads in average, which in terms also gives more tear, wear and maintenance. This motivates finding improved methods for local thruster control. The local thruster control scheme may be divided in two control regimes, depending on the operational

conditions: 1) Normal thruster control regime and 2) Extreme thruster control regime with anti-spin thruster control. For both regimes we will here only consider speed controlled thruster drives, which is FPP.

RPM INPUT

VARIABLEPROPELLER

TORQUE

POWER

RPM

DISTURBANCETORQUE

TORQUE INPUT

POWER

RPM

CONSTANTPROPELLER

TORQUE

FIGURE 9. Torque and power control. Local Thruster Control in Normal Operating Conditions Assuming normal thruster control regime we are well familiar with shaft speed feedback control or simplified, speed control as the normal way to control the thrusters. However, as we will see later this may not be the best design choice. The following types of thruster controller designs may be considered (Sørensen, 2005a and b): • Shaft speed feedback control. • Torque feedforward control. • Power feedback control. • Combined power and torque control. The three first controllers are as shown in FIGURE 10. A significant shortcoming of the power control scheme in is the fact that it is singular for zero shaft speed, n=0. This means that power control should not be used close to the singular point, for example when commanding low thrust or changing the thrust direction. For low thrust commands, torque control shows better performance in terms of constant thrust production than power control, since the mapping between thrust and torque is more direct than the mapping between thrust and power. For high thrust commands, it is essential to avoid large power transients, as these lead to higher fuel consumption and possible danger of power black-out and harmonic

8

distortion of the power plant network. Power control is hence a natural choice for high thrust commands. This motivates the construction of a combined power/torque control scheme, utilizing the best properties of both controllers.

���

�� �

�

�

�

��

�

�

�

MotorDynamicsPID

ref

ref

ref

max max

�

�

�

( )

( )2

1

�

,.

.( )� 0

� �� x,

� �� x,

�

�

�

���

�

� �

TorqueAlgorithm

ref

ref

ref

max max,

( )�0

�� �

�

��

�

�

MotorDynamics

�

��

�

�

( )

( )2

1

�

.

.

�

�

�

�

�

�

x

x

,

,

��

�� �

�

��

�

MotorDynamics

�

�

�

�

�

( )

( )2

1

�

.

.�

��� �

� �

PowerAlgorithm

ref

ref

ref

max max

2 �

,

.

.((

()

)

)�0 �

�

�

�

�

�

�

x

x

,

,

��

FIGURE 10. Shaft speed controller (upper), torque controller (middle) and power controller (lower). Anti-spin Thruster Control in Extreme Conditions Thruster control in extreme conditions accounting for severe thrust losses has been addressed by Smogeli et al. (2005a and b). For vessels operating in extreme conditions, like supply vessels and shuttle tankers in the North Sea, accurate thrust production is essential for safety and operational performance. In such conditions, the thrusters are often subject to ventilation and in-and-out-of water effects. This leads to loss of thrust, excessive mechanical wear and tear and undesirable power transients. The conventional shaft speed control is partly able to handle the loss transients, since the object of the controller is to keep the shaft speed constant, but problems arise because a well-tuned PID controller for normal conditions typically behave badly when subject to large thrust losses. This problem becomes even more pronounced

if torque or power control is used. Since the torque and power controller keep the motor torque or power constant, the loss of propeller load torque will lead to severe motor racing, which again leads to large load transients when the propeller re-enters the water. From the experimental results carrier out at NTNU in the Cavitation tunnel, FIGURE 11, and open water tests carried out in MCLab, FIGURE 12, it can be seen that reducing the propeller shaft speed during ventilation may increase the thrust significantly. This motivates the introduction of anti-spin thruster control.

5

10

15

20

0

0.5

1

1.5

20

0.2

0.4

0.6

0.8

1

nh/R

T/T

max

FIGURE 11. Cavitation tunnel: non-dimensional thrust vs. relative submergence h/R and propeller shaft for advance speed J=0.2.

0 50 100 15040

60

80

100

120

140

160

180

200

220

Time [s]

Pro

pelle

r th

rust

[N]

Propeller thrust [N]

n [r

ev/s

]

8

9

10

11

12

13

14

15n [rev/s]

FIGURE 12. MCLab: Time series of propeller thrust Ta and shaft speed n in moderate waves, with ventilation at high propeller loading.

9

FIGURE 13. Block diagram of the proposed anti-spin control concept, with detection and anti-spin control action. The general ideas of anti-spin control are to: • Reduce the wear and tear of the propulsion unit. • Limit the transients on the power system. • Optimize the thrust production and efficiency in

transient operation regimes. The approach chosen here is a hybrid control scheme, where the condition of the thruster is monitored, and an anti-spin control action is invoked when a ventilation incident is detected. FIGURE 13 shows the structure of the proposed anti-spin control system. Experimental Results Experiments conducted by Smogeli et al. (2005b) at the Marine Cybernetics Laboratory (MCLab) at NTNU showed the performance of the proposed controllers. The propeller diameter D = 25 cm, number of blades Z = 4 and pitch ratio P/D = 0.55. The thrust reference was Tref=100N and the carriage was kept stationary. A comparison of the controller performance in regular waves with wave height 8cm and period 1s is shown in FIGURE 14. DP functionality has been simulated, such that all controllers gave the same mean thrust. The results are summarized in the following: • The shaft speed controller keeps the shaft speed

constant, and has to vary the motor torque and power in order to achieve this. The resulting propeller thrust and torque have the largest variance.

• The torque controller keeps the motor torque constant, and as a result the shaft speed varies with the loading. The resulting propeller thrust and

torque have the smallest variance. • The power controller keeps the motor power

constant, and as a result both the shaft speed and motor torque varies with the loading. The resulting propeller thrust and torque lie between the shaft speed and torque controller values.

85

90

95

Ta [N

]

Controller comparison in waves

3.4

3.6

Qa [N

m]

6.6

6.8

7n

[1/s

]

4.6

4.8

5

Qm

[Nm

]

0 1 2 3 4 5 6 7

200

205

210

215

Pm

[W]

Time [s]

TorquePowerShaft speed

FIGURE 14. Controller comparison in regular waves. Power and Energy Management In a system of electrical power installations, vessel and process automation system, DP system, and the other parts of the automation system controls their parts of the power system, e.g. the DP system controls the thruster drives, the off-loading control system use cargo pump drives, the process control system interacts with the compressors and cooling/heating systems etc. The interconnecting point for all the installed power equipment is the power distribution system. By starting and inrush transients, load variations, and network disturbances from harmonic

10

effects, the load and generators are interacting and influencing each other. Optimum operation and control of the power system is essential for safe operation with a minimum of fuel consumption. As it is the energy control system (power/energy management system – PMS/EMS), which monitors and has the overall control functionality of the power system, it will be the integrating element in a totally integrated power, automation and DP system. The purpose of the PMS is to ensure that there is sufficient available power for the actual operating condition. This is obtained by monitoring the load and status of the generator sets and the power system. If the available power becomes too small, either due to increased load or fault in a running generator set, the PMS will automatically start the next generator set in the start sequence. A PMS can also have extended functionality by monitoring and control of the energy flow in a way that utilizes the installed and running equipment with optimum fuel efficiency. Such systems can be EMS. Energy management is a new approach to control and monitor the energy flow in marine, oil and gas systems. The EMS extends the concept of power management in the direction of controlling and coordinating the energy generation and consumption. In addition to optimize the instantaneous power flow, the historical energy usage and future energy demands are considered. EMS will then be the integrating element in a totally integrated power, automation and DP system. For PMS and EMS, the main functions can be grouped in: • Power generation management: Overall control

with frequency and voltage monitoring with active and passive load sharing monitoring and possibly control, and load dependent start and stop of generator sets. Since control logic and interlocking functions are a significant part of the power system switchboard design, the functionally of these systems must be coordinated.

• Load management: Load power monitoring and coordination of power limitation functions in other systems, load shedding and start interlock of heavy consumers based on available power monitoring.

• Distribution management: Configuration and sequence control for reconfiguration of the power distribution system. The distribution system should be configured to fit the requirements in the actual operational mode for the vessel.

The new generation production vessels and also drill ships/rigs have a complex power system configuration with advanced protection and relaying philosophies. There are close connections between the functional design and performance of the PMS and the power protection system functions. It is a challenge for involved parties to obtain an optimal and functional solution with several suppliers involved and a yard being responsible for all the coordination. Blackout Restoration Blackout of the power generating system is the most severe fault that can happen in an electric propulsion system. Should a blackout occur, and it does unfortunately happen from time to time, there will normally be required to have a system for sequence control of start-up and reconfiguration of the power system. This is implemented at the system control level, and includes sequences for starting and synchronizing generator sets and loads. There will normally also be a set of predefined operation modes, e.g. transit mode, station keeping mode, maneuvering mode, etc. with automatic sequence control for power system reconfiguration. A typical sequence for: • Automatic start and connection of emergency

generator control. Separate control system - not part of the overall vessel control system.

• Automatic start/reconnection of standby generator(s).

• Reconnection of transformer breakers, distribution breakers.

• Tie breakers remain open if tripped. • Restart of fuel and cooling pumps. • Restart of other pumps and fans in sequence. • Restart of thrusters, if required. Load reduction and blackout prevention The diesel-electrical power system has better performance and fuel economy if the PMS controls the number of running engines in the power plant to match the load demand with high loading of the diesel engine. The optimal load with respect to fuel consumption, tear and wear, and maintenance is typically about 85% of maximum continuous rating (MCR). With a high load at the running engines, the system gets more vulnerable to faults in the system,

11

such as a sudden trip of one diesel engine generator. The remaining, healthy engines will experience a step load increase and possible overloading, and in worst case, under frequency trip unless the functionality in the system reduces the load power in accordance with the generating capacity. In a modern drilling vessel, this load reduction and blackout prevention function is distributed and handled by several subsystems like: • Power management’s load management and

blackout prevention functions. • DP system’s power limitation functions. • Thruster drive’s load reduction and load phase

back functions. • Drilling drive’s load reduction and load phase

back functions. The ability to withstand such faults is also highly depending on the design and engineering methods and solutions, such as: • Load capability and dynamics of the diesel

engine. • Governor and AVR configuration and settings. • Generator and switchboard protection relay

settings. • Critical equipment should be fault-tolerant with

loss of power ride-through functionality. In DP vessels with high efficient speed controlled fixed pitch thrusters, the total load under normal operation is so low that the power plant runs optimal with few, often only two running diesel engines. In order to utilize this saving potential, the challenge is to design and tune the system to be capable of handling fault scenarios within a time frame not compromising the stability of the power supply. FIGURE 15 shows, for illustration, the diesel engines capability to maintain the frequency for the load step associated with the loss of a parallel run engine. In typical installations, it has been seen that the actions of load reduction and blackout prevention must be effective within less than 500ms in order to not compromise the power system stability and limit the flexibility of operation. Several solutions are in use and the operators and owners have different preferences. However, some common conclusions can be made on what is typically required for the blackout prevention

functionality: • Thruster and thruster drives: Variable speed FPP

thrusters must have a load reduction scheme, either monitoring the network frequency and/or receiving a fast load reduction signal from the PMS, either as a power phase-back signal, maximum power limitation signal, or – if well coordinated – fast RPM reference reduction. In order to avoid instabilities in the network frequency, the load reduction should be as precise as possible in order to dampen potential oscillations. Fixed speed CPP thrusters do not have fast enough response time for blackout prevention. These must be included in the power management’s load shedding scheme.

• Drilling drives: Similar to the requirements of the thruster drives, with built-in priorities for the individual drilling drives.

• PMS: By class requirements, the PMS must include blackout prevention with load reduction/load shedding functionality. It was observed earlier, that the response time in this system was too long to obtain the desired level of fault-tolerance without a fast acting, stand-alone load reduction scheme in the thruster drives. With the knowledge of today, this has been claimed solved by use of fast acting, and possibly event-trigged load reduction algorithms.

• DP system: The DP system is also equipped with a power limitation function, normally based on a permitted maximum power consumption signal from the PMS. Generally, this has shown to be effective in avoiding overloading of the running plant, but not fast enough to handle faults and loss of diesel-generator sets. Of importance is also that the power limitation in manual and joystick control of the thrusters.

Based on experience, it is recommended that all load reduction and blackout prevention functions described above are installed and well coordinated, tuned and tested during commissioning and sea trial. Also, the need for retuning and testing must also be considered after modifications in the installation that may affect the coordination.

12

VSI Drives FPP load redVSI Drives FPP load red

PMS blackout preventionPMS blackout prevention

DP power limitationDP power limitation

Fixed speed CPP load redFixed speed CPP load red

100%

10 sec

200% 300%

5 sec

1 sec

0,5 sec

0,1 sec

Loadx MCR

Worst case overload

Risk forBlackout

FIGURE 15. Regulation time constants for power reduction, with maximum response time in the order of 500ms (Illustrative only). A typical coordination diagram is shown in FIGURE 16. Auto start and auto stop limits shows the level and time settings for load dependent automatic start and shutdown of the engines. Available power will under normal operations be within these limits. Upon faults, and sudden loss of engine, the available power is being reduced. The power reduction functions of the DP can be distinguished between critical or non-critical situations, allowing the DP to take all available power after possible load reduction and load shedding of non-essential consumers or consumers with lower priority.

LoadReduction/Shedding

t

PA,normal

FIGURE 16. Coordination of auto start/stop and blackout prevention functions (example). Diesel Engine Governor and AVR Fault Tolerance Although the rules and regulations have allowed for DP operations with closed bus ties in the electrical power system and one commonly connected power plant, the practices were until mid 1990s to split the

network into two or more separated sections in DP 2 or 3 operations. With the developments on switchboard protection relays, and thruster drives together with new PMS with more precise and faster load reduction and blackout prevention functions, this has changed and it is now more common to operate with normally closed bus tie breakers and also with closed ring main bus. This development is motivated by the benefits of better and more flexible utilization of the installed generating capacity and to gain an improved fuel economy. The fuel savings for optimized loading of running engines have shown to be significant. In such systems, it has been observed that under some load and operating conditions, certain faults in the governors and automatic voltage regulators, AVRs, can be difficult to identify with a regular protection scheme. In worst case, faults have shown to interfere with healthy equipment causing undesired shutdowns, and in some cases, even blackout. Developments in digital generator protection relays with multifunction and programmable protection logics have enabled a possibility to combine protection functions in new manners, and to include logic and algebraic functionality into the protection scheme. This has significantly improved the protection relay’s ability to detect governor and AVR faults, and improved the system’s fault tolerance to such faults. FIGURE 17 shows a possible monitoring scheme for AVR, including correlation functions of multiple variable and voting functions for multiple gensets. Such functionalities can be installed in the modern, programmable multifunction generator protection relays, or in separate logic controllers for retrofit and upgrades.

Correlationalgorithm

Ui

Qi

Disconnect

Ii

Trig limit and

time delaysettings

DemagnetizeVoting

algorithmU1-U4

Q1-Q4

I1-I4

Excitation Fault

Excitation Alarm

FIGURE 17. A monitoring scheme for AVR fault detection.

13

CLASSIFICATION Certification In most cases it is up to the owners to decide which type of classification of the ship and hence which certification should apply (or to seek for class approval at all) for the equipment installed. The International Marine Organization (IMO) has also developed Guidelines for Dynamic Positioning, in order to provide an international standard for DP systems on all types of new vessels. The purpose of the Guidelines and class rules is to specify design criteria, necessary equipment, operating requirements, and a test and documentation system for DP systems to reduce the risk to personnel, the vessel itself, other vessels and structures, sub-sea installations and the environment while operating under dynamic positioning control. Taking into consideration that DP operated vessels often operate in different parts of the world, such standardization provides a useful tool for the different Costal states to specify the local rules and regulations, defining levels of safety requirements, requirements for redundancy and operations for DP vessels. The requirements for hardware and software on DP systems are closely connected to the level of redundancy, which is defined as: • Redundancy means ability of a component or

system to maintain or restore its function when a single fault has occurred. This property can be obtained by installation of multiple components, systems, or alternative means of performing a function.

A DP system consists of components and systems acting together to achieve sufficiently reliable positioning keeping capability. The necessary reliability of such systems is determined by the consequence of a loss of position keeping capability. The larger the consequence, the more reliable the DP system should be. To achieve this philosophy the requirements have been grouped into three different equipment classes. The equipment class depends on the specific DP operation, which may be governed by Costal state rules and regulations or in agreement between the DP operator company and their customers. A short description of the different classes is given below:

• Class 1: For equipment class 1, loss of position may occur in the event of a single fault, e.g. the DP control system need not to be redundant.

• Class 2: For equipment class 2, loss of position is not to occur in the event of a single fault in any active component or system. The DP control system must have redundancy in all active components in order to be capable of providing station keeping capability after any functional single failure in the system.

• Class 3 Same as DP class 2, with additional requirements on redundancy in technical design and physical arrangement to withstand fire and flooding situations as single failure situations.

Class 2 or 3 system should include the function "Consequence analysis", which continuously verifies that the vessel will remain in position even if the worst single failure occurs. The IMO Guidelines also specifies relationship between equipment class and type of operation. DP drilling operations and production of hydrocarbons, for instance, requires equipment Class 3, according to IMO. Failure Analysis The cost of making design changes during the initial project phase is small, but as the project progresses the cost of design changes increases significantly. Minor changes in a system can cause project delays and huge additional costs during the commissioning and sea trials. During the whole design phase of new buildings, the reliability of the total system can be thoroughly investigated by different reliability methodologies, in order to detect system design errors and thus minimize the risk. Such analysis of DP system and its subsystems is not required by the class societies or the IMO Guidelines. However, the Costal states, oil companies or customers may require it, in addition to classification approval. There are different methods available for assessing the reliability of such complex systems. One common methodology is the Failure Mode and Effect Analysis (FMEA). This is a qualitative reliability technique for systematically analyzing each possible failure mode within a system and identifying the resulting effect on that system, the mission and personnel. This analysis can be extended by a

14

criticality analysis (CA), a quantitative procedure which ranks failure modes by their probability and consequence. As we will see later use of simulator for hardware-in-the-loop (HIL) simulation is an efficient method for testing and verification of control systems. SIMULATION For years simulators have been used as tools in system design and analysis, both in academia and in the industry. At NTNU a new simulator, Marine Systems Simulator (MSS), based on MATLAB/SIMULINK is under development. MSS integrates the disciplines hydrodynamics, structural mechanics, marine machinery, electric power generation and distribution, navigation and automatic control of marine vessels. The main purpose of MSS is to improve the accumulation and reuse of knowledge and thereby the quality of the education for MSc and PhD candidates. The simulator will be continuously developed by students and researchers, and will serve a diversity of applications. This necessitates a modular structure, in which each module is a self-contained unit with a well-defined interface and functionality. Simulator Structure The core of the simulator is the process plant models, which give the necessary detailed description of the vessel dynamics, systems and components and its surroundings, see FIGURE 19. The other main parts of the simulator are the control systems interfaced with the sensor and actuator modules. The control systems may for instance be DP system, thruster assisted position-mooring system, tracking controllers and autopilots, local thrust controllers, PMS, crane control systems, etc. MSS is made partly open-source. Module Hierarchy Depending on the development stage and required accuracy of the operation and application studied, a hierarchy in module complexity is allowed. For any application, several modules of varying technical complexity, built-in functionality and release levels may exist. These should all cover the same basic functionality and have the same interfaces, and may therefore easily be interchanged. FIGURE 18 shows a

module hierarchy example, where module complexity is plotted versus release level and application. Hardware and Software Platform The simulator is currently being developed in a MATLAB/SIMULINK environment on the Windows PC platform. SIMULINK was chosen for running the main simulation loop because of its flexibility towards several programming languages. Applications written in MATLAB, C, C++, and Fortran may easily be linked to the simulation by use of S-functions. This is convenient for generating simulator modules from existing code, and makes development of new modules more user-friendly.

FIGURE 18. Module hierarchy example. Hardware In-the-Loop Testing Use of simulators in verification and testing of target control systems is yet not much exploited in the marine and offshore industry. A new initiative proposed by the NTNU spin-off company Marine Cybernetics AS on Hardware-In-the-Loop (HIL) simulation based on the modular multi-disciplinary simulator named CyberSea Simulator (FIGURE 20) has been developed. Testing and certification of traditional marine technology is well developed and well established, and is performed by class societies. In contrast to this, the required technology and methods for the testing and certification of safety-critical SW in marine control systems have not been available by 3rd party companies until now.

15

FIGURE 19. System simulation. FIGURE 20. Hardware-in-the-loop (HIL) simulation. The overall objective of the HIL-testing is to improve safety and performance in marine operations and sea transportation. A failure mode and effect analysis (FMEA) module are used to test the control system performance, alarm system and logics subject to varying environmental conditions and failure situations in the control system, navigation system, power plant, thrusters and sensor system. DP-HIL Technology and procedures for DP-HIL safety and performance testing has been developed in a pilot project by Statoil, Det Norske Veritas (DNV), NTNU, ship operators, contractors and vendors in cooperation with Marine Cybernetics. Successful sea trials on the supply vessel Viking Poseidon operated by Eidesvik has been carried out to document and verify the concept of DP-HIL.

CyberSea DP-HIL Test Plan DP-HIL testing will be performed for new buildings during Factory Acceptance Tests (FAT), and in Customer Acceptance Tests (CAT). For sailing ships DP-HIL tests will be performed at annual tests, and possibly, by initial tests for ships that have not been tested as new buildings. The DP-HIL test equipment is not part of the control systems installed on the ship, and is only used during DP-HIL tests. CONCLUSIONS This paper addressed various aspects related to design and operation of marine control and propulsion systems based on experience from offshore oil and gas vessels. Advanced vessels are often installed with electric propulsion systems and integrated vessel automation systems.

Real time interfaceCyberSea Simulator

Run Time Infrastructure

FMEA User Interfaces

3Dvisualization

SimulatorManager

SimulatorManager

AnalysisToolbox

DP andPMS

ROV Control

Crane control

Model Database & Library

Vessel Models:- Current, wind,

waves- Stationkeeping- Maneuvering- Mulitibody

Propulsion System:- Thruster- Rudder- Pod- etc.

Power System:- Diesel engine- Gas turbines- Generators- Transformers- Converters- Switchboards- etc.

Other Models:- Crane - Ballast- Towing / cables- ROV- Risers- Mooring

Sensor andInstrumentation:-DGPS -HPR-Gyros-MRU/VRS-Wind sensors-…

EnvironmentWave, wind and

current loads

HullsWAMIT, VERES

Propulsion units

Power components

Crane & WinchHydraulics

Heave Compensators

Ballast control

Cables, PipesNonlinear FEM

16

This is driven by the possibility to utilize the installation at an optimum level for a wide operational range. However, integration also introduced concerns on safety and fault-tolerance, which must be met with adequate design, simulation, analysis, and testing methods. Reconfiguration – or fault-tolerance, has for many years been one main concern of commercial ship designs in safety critical operations. Examples of such installations have been taken from DP vessels in the offshore segment. Control structure issues related to high level vessel control such as power and energy management to low level thruster control were discussed. A new safety concept developed by oil companies, class society, contractors, ship operators and vendors based on Hardware-In-the-Loop (HIL) testing and verification of marine control systems were presented. REFERENCES Allensworth, T., “A Short History of Sperry Marine,”

Litton Marine Systems, www.sperry-marine.com/pages/history.html Bennet, S., “A History of Control Engineering

1800-1930,” Peter Peregrinus, London, 1979. Blanke, M., M. Kinnaert, J. Lunze and M.

Staroswiecki, “Diagnostics and Fault-Tolerant Control,” Springer-Verlag, Berlin, Germany, 2003.

Fossen T. I., ”Marine Control Systems: Guidance, Navigation and Control of Ships, Rigs and Underwater Vehicles”, Marine Cybernetics AS, Trondheim, Norway, 2002.

Marine Cybernetics AS, http://www.marinecybernetics.com/ Marine Systems Simulator (MSS),

www.cesos.ntnu.no/mss, Norwegian University of Science and Technology, Trondheim, 2004.

Minorsky, N., “Directional Stability of Automatic Steered Bodies,” J. Amer. Soc. of Naval engineers, 34(2):280-309, 1922.

Smogeli, Ø. N., A. J. Sørensen and K. J. Minsaas, ”The Concept of Anti-spin Thruster Control,” Accepted for publ. in IFAC J. of Control Engineering Practice, 2005a.

Smogeli, Ø. N., E. Ruth and A. J. Sørensen, “Experimental Validation of Power and Torque Thruster Control,” 20th IEEE International Symposium on Intelligent Control (ISIC'05) and

the 13th Mediterranean Conference on Control and Automation (MED'05), Cyprus, 2005b.

Sørensen, A. J., “Marine Cybernetics: Modelling and Control”, Lecture Notes, Fifth Edition, UK-05-76, NTNU, Norway, 2005a.

Sørensen, A. J., “Structural Issues in the Design and Operation of Marine Control Systems,” Accepted for publ. in IFAC J. of Annual Reviews in Control, 2005b.

ACKNOWLEDGEMENTS This work has been carried out as apart of the research project on Energy-Efficient All-Electric Ship (EEAES). The Norwegian Research Council is acknowledged as the main sponsor EEAES. Professor Asgeir J. Sørensen obtained MSc degree in Marine Technology (1988) and Dr. ing. degree in Engineering Cybernetics (1993) at the Norwegian University of Science and Technology (NTNU). In the period 1989-1992 Sørensen was employed at MARINTEK. In 1993-2002 Sørensen was employed at ABB in various positions as Research Scientist, Project Manager, Department Manager and Technical Manager in the Business Area Automation Marine and Turbochargers. Since 1999 Sørensen has held the position of Professor of Marine Cybernetics at the Department of Marine Technology at NTNU. Sørensen is also the President of the NTNU spin-off company Marine Cybernetics AS. Professor Alf Kåre Ådnanes obtained MSc degree in Electrical engineering in 1987 at NTNU, and the Dr. ing. degree in Electrical Engineering at NTNU in 1991. In the period 1988-1991 Ådnanes was employed at SINTEF, working with modelling and control of permanent magnet synchronous motor drives. In 1991 Ådnanes was employed as Research Scientist at ABB Corporate Research Norway working on R&D in the field of power electronics. In 1994 he joined ABB Marine in Norway. In 2001 he took his present position as Technology Manager in ABB Marine, Norway. Since 2001, he has been Adjunct Professor at Department of Marine Technology at NTNU.