Dr. Asgeir J. Sørensen and Dr.
Alf Kåre Ådnanes
Reconfigurable Marine Control Systems and Electrical Propulsion
Systems for Ships
ABSTRACT
This paper is about design and operations of
reconfigurable marine control and electrical propulsion
systems for marine vessels. Design requirements
accounting for physical segregation and redundancy,
flexibility in operation, reduced mechanical wear and
tear, and methodologies to achieve predictable power
consumption and black-out prevention and restoration
are treated. Design aspects related to high level vessel
control such as power management and dynamic
positioning (DP) to low level thruster control are
addressed. A new safety concept for testing and
verification of marine control systems is shown. This is
denoted as Hardware-In-the-Loop (HIL) testing and
verification.
INTRODUCTION
By reconfigurable marine control systems and electrical
propulsion control system it is meant systems which can
be reconfigured as a part of the normal operation
conditions in order to optimize the performance towards
the intended functional mode. A reconfigurable system is
designed to be fault-tolerant to equipment faults,
communication errors, and in certain cases also physical
damage due to fire and flooding. In order to fully
understand the different aspects related to these features,
this paper presents the characteristics of marine control
systems and electric propulsion related to performance,
redundancy, and fault-tolerance, as well as means to test
and verify solutions.
According to the knowledge of the authors and the
history of automated closed-loop ship control started
with Elmer Sperry (1860-1930), who constructed the
first automatic ship steering mechanism in 1911 for
course keeping (Allensworth, 1999, Bennet, 1979 and
1
Fossen, 2002). This device is referred to as the "Metal
Mike", and did compensate for varying sea states by
using feedback control and automatic gain adjustments.
Later in 1922, Nicholas Minorsky (1885-1970),
presented a detailed analysis of a position feedback
control system where he formulated a three-term control
law which today is refereed to as
Proportional-Integral-Derivative (PID) control
(Minorsky, 1922). These terms were motivated by
observing the way in which a helmsman steered a ship.
In the 1960s systems for automatic control of horizontal
vessel position in surge and sway and heading were
developed. Such systems are today commonly known as
dynamic positioning (DP) systems. From the middle of
the 1970s more advanced control techniques based on
multivariable linear optimal control and Kalman filter
theory were proposed. In the 1990s nonlinear control
were introduced for certain complex control applications.
Electric propulsion is not a very new concept. It has been
used as early as in the late 19th century. However, only in
few vessels until the 1920s where the electric shaft line
concept enabled the design of the largest Trans-Atlantic
passenger liners. Variable speed propulsion was used in
some few applications during the 1950s and 1960s,
while, first when the semiconductor technology became
available in large scale commercial applications, this
technology became acceptable for a wide range of
applications. The introduction of AC drives and podded
propulsors was another shift in technology that led to a
rapid increase in the use of electric propulsion through
the last 15-20 years. Typically, ships with electric
propulsion tend to have more system functionality
implemented in integrated automation systems, partially
because such functionalities are regarded to be necessary
for safe and optimal operation, but also because the
electric propulsion plant enables the use of such
functions. In the commercial market the offshore vessels
in addition to cruise ships and ice breakers have been
technology drivers concerning automation, power and
propulsion systems. They are characterized by the
required ability to conduct complex marine operations,
operational availability, safety focus, cost effectiveness
and flexibility in operational profile concerning transit,
station keeping, maneuverability and to some extent also
a significant vessel or process load system. These rather
complex power plants opened up for an increasing use of
fully all-electric ships and the introduction of fully
integrated computer-controlled systems in order to
operate safely and cost efficiently. Such concepts are
today applied in an increasing number of ship
applications.
Consequently, the complexity has also increased with a
variety of solutions consisting of stand-alone systems,
partly integrated systems to fully physical and functional
integrated systems. Up to now integrated automation
systems have been proprietary with a limited number of
vendors. However, in the automation industry it is a trend
towards openness in communication protocols and
network. How this will influence on the technology
solutions and responsibilities for multi-vendor integration
systems is still a subject for discussion. During the late
1990s the introduction of low-cost off-shelf computers
not originally designed for automation purposes have
also been taken more into use. This development is
driven by the need to make more cost efficient solutions.
Nevertheless it also creates new issues of concern:
• Development of new adequate testing and
verification methods.
• New procedures for design and specification that
considers compatibility and integration aspects.
• Failure analysis and test methods, adequate to
ensure fault-tolerance in the overall system.
This paper focuses on aspects related to fault-tolerance
and automatic reconfiguration of vessels with electric
propulsion and integrated, automation systems with
closed-loop control functionality. In commercial vessels,
such aspects have mainly been considered in applications
where controllability and availability are critical, such as
in DP vessels and passenger ships. DP vessels in the
offshore oil and gas industry are selected as
demonstrating examples of such installations.
2
EXAMPLE APPLICATION:
- OFFSHORE DP VESSELS
A DP vessel is by the class societies, defined as a vessel
that maintains its position and heading (fixed location or
pre-determined track) exclusively by means of active
thrusters. The DP system's functionality, design methods,
sensors and total reliability have improved over the years
and are still a topic of research, see Fossen (2002),
Sørensen (2005a and b) and the references therein.
System Overview
A DP offshore drilling vessel as illustrated in FIGURE 1
may comprise the following sub-systems:
• Power system.
• Marine control or automation system.
• DP system including thrusters and sensors.
• Propulsion system including rudders and main
propellers.
• Nautical system including autopilot, radar, automatic
identification system (AIS), and GPS.
• Safety systems.
• Auxiliary systems, such at HVAC, water cooling,
hydraulic systems, etc.
• Drilling system.
Power System
Power system comprises all units necessary to supply the
vessel with power. The power generation and
distribution systems are divided into the following main
parts:
• A power generation plant with prime mover and
generators. In commercial vessels, the prime movers
are typically medium speed diesel engines, due to
high efficiency and cost efficiency. Gas turbines, and
also steam turbines, are used in some ship
applications due to their advantages in weight and
size. There are intensive research and development
in the field of commercial feasible fuel cells, which
in some future also can be applied in a wider scale
than of today. In addition, combined power plants
are also looked more into.
• An electric power distribution system with main and
distribution switchboards. The distribution system is
typically split in two, three or four sections, with the
possibility to connect and split the sections by use of
 bus ties or bus feeders. With a proper protection
system and operational philosophy, such systems
may have the flexibility of operating in a common,
connected mode for optimizing the energy
production in normal modes, while isolating faulty
parts of the system and obtain the intended
redundancy without loss of maneuverability or
station keeping ability by automatic splitting and
segregation of the system.
• Transformers for feeding of alternate voltage levels
in main or distribution electric system.
• Uninterruptible power supply of sensitive
equipment and automation systems.
• Cabling, including cable routing and segregation.
Marine Automation System
In marine industry, there are two main directions of
solutions for automation systems:
• Integrated automation systems.
• Stand-alone automation systems.
The two different classes of solutions are found in most
kind of vessels. However, since complex functionalities
and tasks are handled better by the integrated solutions,
this is more often found in the vessels with complex and
advanced propulsion and station keeping installations. In
the following integrated automation system is treated.
Marine automation or vessel control system comprises:
• The operator's user interface to the automation
system is through the Human-Machine Interface
(HMI) with display systems and operator panels,
often denoted as operator stations.
• Centralized computers with scalable CPU
processing and I/O capacities, often denoted as
controllers or process control stations FIGURE 2.
• Distributed computers or PLCs, typically with local
control and interfaces to process and to centralized
computers.
• Communication buses at the different levels of
control.
• Associated cabling, segregation and cable routing.
With today’s standardization on communication in
automation systems, it is relatively easy to connect
various sub systems into a network communication
system. The evolution of interconnecting systems in such
networks has, today, developed to be an international
standard of many new buildings. It is a challenge of
designers, to distinguish between the essential and
important communication, and to define the right level of
redundancy and inter-dependency of sub systems.

BACK-UP PLANT
SYSTEM NETWORK
SAFETY SYSTEM
WIND SENSORS PROCESS CONTROL
EMERGENCY SHUTDOWN
FIRE & GAS STATION
VRU

GYRO
INFORMATION MANAGEMENT
REMOTE DIAGNOSTIC INTEGRATED THRUSTER
CONTROL SYSTEM
- DYNAMIC POSITIONING
- POSMOOR
- AUTOSAIL
CONTROL - OPERATOR CONTROL
NETWORK SYSTEM
INTEGRATED MONITORING &
CONTROL SYSTEM
- EXTENSION ALARM
- PROCESS CONTROL

PROPULSION

AZIPOD
DRILLING DRIVE FIELDBUS
SYSTEM NETWORK
ENERGY MANAGEMENT
SYSTEM
POWER GENERATION
& DISTRIBUTION

FIGURE 1. DP drilling vessel.

3
 also provide transverse thrust with high efficiency.
Other types of transverse thrust units are the tunnel
thruster, or azimuthing thrusters, various water jet
Office Plant Network designs, etc.

The thrust magnitude and for steerable units, the

Control Network
direction, is conventionally controlled by the speed
(RPM) of the propellers, the pitch, or by these in the
combination (consolidated control). This control is
often referred to as low-level thrust control, which will
Fieldbus Network be treated in more detail later in the text.

The redundancy concept of the electrical power and

propulsion plant will be based on the required ability
for maneuvering and propulsion after faults in the
system. In commercial vessels, these requirements are
determined by national and international legislations,
FIGURE 2. Integrated automation system.
and specified by the classification societies by the
different class notations. A typical redundancy diagram
Physical integration based on standardized
for a DP class 2/3 drilling rig is indicated in FIGURE 3.
communication protocols ensure connectivity of
Each block represents a part of the system which is
devices and integration of controllers and operator
susceptible to a single failure.
stations into three network levels (FIGURE 2): Real
time field bus network communication on low level
between devices and controllers, real time control
network connecting controllers and operator stations,
and office plant network to various office systems and
information management systems. The last level opens
up for satellite communication to land offices at ship
operators or vendors. It is common to characterize the
automation system by the number of I/Os and dividing
the applications into low-end or high-end segments.
For a drilling rig as shown in FIGURE 1 the number of
I/O signals may be up to 10-15000. For a conventional
supply vessel the I/O number is typically lower than
1.500 - 2.000 signals.

Propulsion System
A ships propulsion system is in this work regarded to
consist of its propulsors and thruster units and the
electric drive system used for driving the units. A ship
can be equipped with several types of propulsors and
thrusters. Conventional ships typically have a main
propulsion unit located aft. Traditionally, shaft line
propulsion with controllable pitch or fixed pitch
propellers is applied, with rudders to direct the thrust.
In more recent years, azimuthing thrusters and podded
propulsors have gained increasing usage, and these can
FIGURE 3. Redundancy diagram for a typical DP 2/3
drilling rig.
Process System
In many ships there is a vessel or process plant system,
which is critically dependent on the electrical power
system. Such systems can be:
• Hotel loads, e.g. for cruise and passenger vessels.
• Crane and winch systems, e.g. for support vessels.
• Drilling systems, e.g. for drilling rigs.

4
• Oil and gas production, for FPSOs.
• Load/cargo handling systems, for cargo vessels G G G G

and tankers.

Even though these systems may not be directly critical

AC AC AC AC
for the safe maneuverability of the vessel, there may AC AC AC AC

be serious consequences by loss of controllability, both M M M M

with concern to safety, environmental or economical

consequences. Hence, redundancy and segregation in
the process and automation systems may be equally G G G G

important as in the electrical power and propulsion

system. This can be explained by the redundant
configuration of a drilling drive system, with dual
AC AC AC AC
independent power feeding and possibility to segregate AC AC AC AC

into independent sections either in normal or faulty M M M M

conditions, as shown in FIGURE 4.

FIGURE 5. Mirror image design of the vessel control
system ensures to achieve a unified redundancy and
segregation philosophy.
G G G G G G G G

AC AC AC AC AC AC
AC AC AC AC AC AC

M M M M M M

Drilling package
AC Multidrive
AC AC
DC DC

DC DC DC DC DC DC
AC AC AC AC AC AC

M M M M M M

FIGURE 4. Drilling drive system.

The vessel control system must follow the same

redundancy and segregation principles as the electric
system. Principally, this is achieved by designing the
vessel control structure as a mirror image of the
electrical power plant, as shown in FIGURE 5.

At higher level of controls the redundancy concept is

different and achieved by the duplication of the control
systems in hot back-up configuration, as seen in
FIGURE 6.

FIGURE 6. A total integrated vessel control system for

drilling vessels (Courtesy of Kongsberg Maritime).

5

CONTROLLER STRUCTURE
Concerning the controller structure in marine control
systems as illustrated in FIGURE 7 it is as shown in
FIGURE 2 divided into two main areas: Real-time
vessels. An important reference is Blanke et al. (2003).
We will in the following of this section show brief
examples of low level thruster control in a DP system
(FIGURE 8) and power/energy management system.
Business enterprise/
Office Systems

Office Network
control and monitoring and Operational and Business Fleet management

enterprise management. The real-time control Ship 3:

Ship 2:
structure is further by Sørensen (2005b) divided into Ship 1:
Operational management
low level actuator control, high level plant control and
Real-Time Control
local optimization. For the DP vessels examples of the
control structure levels are: Local optimization (min-hour)

• Actuator controller: The actuators for DP systems

Fault-Tolerant Control
Control layers
are normally thrusters, propellers, and rudders.

Real-Time Network
Other important actuators may be pumps, High level
Plant control
separators, compressors, HVAC, drilling drives, (0.1-5 s)

cranes, winches, etc. Dependent on whether the

actuators are mechanically, hydraulically and/or Actuator control Low level
(0.001-1 s)
electrically driven, controllers with different
properties will be used.
FIGURE 7. Controller Structure.
• Plant controller: In station keeping operations the
DP system is supposed to counteract the
disturbances like wave (mean and slowly
varying), wind and currents loads acting on the
vessel. The plant controller calculates the
commanded surge and sway forces and yaw
moment needed to compensate the disturbances.
A multivariable output controller often of PID
type using linear observers e.g. Kalman filter or
nonlinear passive observers may be used. Set
points to the local thruster controllers are
provided by the thruster allocation scheme. Other
examples may be the ballast and loading
controller, power management system (PMS)/
energy management system (EMS), etc.
• Local optimization: Depending of the actual
marine operation (drilling, weather vaning, pipe
laying, tracking operations, etc.) the DP vessel is
involved in; optimizations of desired set points in FIGURE 8. DP system.
conjunction with appropriate reference models
are used. In the guidance, navigation and control Actuator Controller
literature local optimization corresponds to the For DP vessels the thruster system normally represents
guidance block (Fossen, 2002). one of the main consumers of energy, and is regarded
as a critical system with respect to safety. In the ship
With the improved local monitoring and diagnostics positioning control literature the focus has traditionally
abilities, the field of fault-tolerant control is important been placed on the high-level controller design, where
ensuring efficient and safe operations of marine the control input vector has been regarded as ideal

6
forces in surge and sway and moment in yaw
neglecting the effect of limitations caused by the thrust
allocation, actuator dynamics and thrust losses.
Important results in the fields of thrust allocation,
propulsion control and low-level control of the thruster
devices can be found in Fossen (2002), Sørensen
(2005a and b), Smogeli et al. (2005a and b) and the
references therein.
The propeller and thruster devices can be controllable
pitch propeller (CPP) with fixed speed, controllable
speed with fixed pitch propeller (FPP), or controllable
pitch and speed in combination. Since normally no
sensors are available for measuring the actual force
developed by the propeller, there is no guarantee for
fulfilling the high-level thrust commands, and the
mapping from commanded thruster force to actual
propeller force can be viewed as an open-loop system.
Conventionally, the resulting pitch or speed set-point
signals are determined from stationary propeller
force-to-speed/pitch relations based on information
about thruster characteristics found from model tests
and bollard pull tests provided by the thruster
manufacturer. These relations may later be modified
during sea trials. However, they are strongly
influenced by the local water flow around the propeller
blades, hull design, operational philosophy, vessel
motion, waves and water current. Hence, the
developed thrust Ta may differ substantially from the
commanded thrust setpoint Tref. Variations in these
relations are not accounted for in the control system,
resulting in reduced positioning performance with
respect to accuracy and response time. In addition, the
variations may lead to mechanical wear and tear of
propulsion components and deterioration of
performance and stability in the electrical power plant
network due to unintentional peaks or power drops
caused by load fluctuations on the propeller shafts, as
illustrated in FIGURE 9.
The unpredictable load variations force the operator to
have more available power than necessary. This
implies that the diesel generators will get more running
hours at lower loads in average, which in terms also
gives more tear, wear and maintenance. This motivates
finding improved methods for local thruster control.
The local thruster control scheme may be divided in
two control regimes, depending on the operational
7
conditions: 1) Normal thruster control regime and 2)
Extreme thruster control regime with anti-spin thruster
control. For both regimes we will here only consider
speed controlled thruster drives, which is FPP.
RPM INPUT TORQUE INPUT
POWER POWER
RPM RPM
DISTURBANCE
VARIABLE
PROPELLER
CONSTANT
PROPELLER
TORQUE TORQUE TORQUE
FIGURE 9. Torque and power control.
Local Thruster Control in Normal Operating
Conditions
Assuming normal thruster control regime we are well
familiar with shaft speed feedback control or
simplified, speed control as the normal way to control
the thrusters. However, as we will see later this may
not be the best design choice. The following types of
thruster controller designs may be considered
(Sørensen, 2005a and b):
• Shaft speed feedback control.
• Torque feedforward control.
• Power feedback control.
• Combined power and torque control.
The three first controllers are as shown in FIGURE 10.
A significant shortcoming of the power control
scheme in is the fact that it is singular for zero shaft
speed, n=0. This means that power control should not
be used close to the singular point, for example when
commanding low thrust or changing the thrust
direction. For low thrust commands, torque control
shows better performance in terms of constant thrust
production than power control, since the mapping
between thrust and torque is more direct than the
mapping between thrust and power. For high thrust
commands, it is essential to avoid large power
transients, as these lead to higher fuel consumption and
possible danger of power black-out and harmonic
distortion of the power plant network. Power control is if torque or power control is used. Since the torque and
hence a natural choice for high thrust commands. This power controller keep the motor torque or power
motivates the construction of a combined constant, the loss of propeller load torque will lead to
power/torque control scheme, utilizing the best severe motor racing, which again leads to large load
properties of both controllers. transients when the propeller re-enters the water.
qP , xP
From the experimental results carrier out at NTNU in
Qa
f Q (.) the Cavitation tunnel, FIGURE 11, and open water tests
Q max , Pmax qP , xP

T ref n ref Qc Motor Qm 1 n Ta carried out in MCLab,

gn 0 ( T ) PID 2 pIs f T (.)
ref
Dynamics FIGURE 12, it can be seen that reducing the propeller
Kw shaft speed during ventilation may increase the thrust
significantly. This motivates the introduction of
qP , xP
anti-spin thruster control.
Qa
Qmax , Pmax fQ (.)
qP , xP

T ref Qref Qc Qm n Ta
Torque Motor 1
gQ 0(T ) ref
Algorithm Dynamics 2 p Is f T (.)
1

Kw
0.8

0.6
max
T/T

0.4
qP , xP

Qa 0.2
Qmax , Pmax fQ (.)
qP , xP
0
T ref P ref Pc ( . ) Qc Qm n Ta
Power Motor 1 2
gP 0 (T )
ref
.) Dynamics 2 pIs f T (.)
Algorithm (
1.5 20
2p 1 15
Kw h/R
n
0.5 10
0 5

FIGURE 10. Shaft speed controller (upper), torque FIGURE 11. Cavitation tunnel: non-dimensional
controller (middle) and power controller (lower). thrust vs. relative submergence h/R and propeller shaft
for advance speed J=0.2.
Anti-spin Thruster Control in Extreme
220 15
Conditions n [rev/s] Propeller thrust [N]
200
Thruster control in extreme conditions accounting for 14
severe thrust losses has been addressed by Smogeli et 180

al. (2005a and b). For vessels operating in extreme 160

13
Propeller thrust [N]

conditions, like supply vessels and shuttle tankers in

140 12
n [rev/s]
the North Sea, accurate thrust production is essential
for safety and operational performance. In such 120 11
conditions, the thrusters are often subject to ventilation 100
and in-and-out-of water effects. This leads to loss of 10
80
thrust, excessive mechanical wear and tear and
9
undesirable power transients. The conventional shaft 60

speed control is partly able to handle the loss transients, 40 8

0 50 100 150
since the object of the controller is to keep the shaft Time [s]
speed constant, but problems arise because a
well-tuned PID controller for normal conditions FIGURE 12. MCLab: Time series of propeller thrust
typically behave badly when subject to large thrust Ta and shaft speed n in moderate waves, with ventilation
losses. This problem becomes even more pronounced at high propeller loading.

8
 torque have the smallest variance.
• The power controller keeps the motor power
constant, and as a result both the shaft speed and
motor torque varies with the loading. The
resulting propeller thrust and torque lie between
the shaft speed and torque controller values.
Torque
Power
Controller comparison in waves Shaft speed
95
FIGURE 13. Block diagram of the proposed anti-spin

T [N]
control concept, with detection and anti-spin control 90

a
action. 85

The general ideas of anti-spin control are to:

• Reduce the wear and tear of the propulsion unit.

Qa [Nm]
3.6
• Limit the transients on the power system.
• Optimize the thrust production and efficiency in 3.4
transient operation regimes.
7
The approach chosen here is a hybrid control scheme,
n [1/s]

where the condition of the thruster is monitored, and 6.8

an anti-spin control action is invoked when a
ventilation incident is detected. FIGURE 13 shows the 6.6

structure of the proposed anti-spin control system. 5

Qm [Nm]

Experimental Results 4.8

Experiments conducted by Smogeli et al. (2005b) at
4.6
the Marine Cybernetics Laboratory (MCLab) at
215
NTNU showed the performance of the proposed
P [W]

controllers. The propeller diameter D = 25 cm, number 210

m

of blades Z = 4 and pitch ratio P/D = 0.55. The thrust 205

reference was Tref=100N and the carriage was kept 200
stationary. A comparison of the controller performance 0 1 2 3 4 5 6 7
Time [s]
in regular waves with wave height 8cm and period 1s
is shown in FIGURE 14. FIGURE 14. Controller comparison in regular waves.

DP functionality has been simulated, such that all
controllers gave the same mean thrust. The results are
summarized in the following:
• The shaft speed controller keeps the shaft speed
constant, and has to vary the motor torque and
power in order to achieve this. The resulting
propeller thrust and torque have the largest
variance.
• The torque controller keeps the motor torque
constant, and as a result the shaft speed varies with
the loading. The resulting propeller thrust and
Power and Energy Management
In a system of electrical power installations, vessel and
process automation system, DP system, and the other
parts of the automation system controls their parts of
the power system, e.g. the DP system controls the
thruster drives, the off-loading control system use
cargo pump drives, the process control system
interacts with the compressors and cooling/heating
systems etc. The interconnecting point for all the
installed power equipment is the power distribution
system. By starting and inrush transients, load
variations, and network disturbances from harmonic

9
effects, the load and generators are interacting and
influencing each other. Optimum operation and
control of the power system is essential for safe
operation with a minimum of fuel consumption. As it
is the energy control system (power/energy
management system – PMS/EMS), which monitors
and has the overall control functionality of the power
system, it will be the integrating element in a totally
integrated power, automation and DP system.
The purpose of the PMS is to ensure that there is
sufficient available power for the actual operating
condition. This is obtained by monitoring the load and
status of the generator sets and the power system. If
the available power becomes too small, either due to
increased load or fault in a running generator set, the
PMS will automatically start the next generator set in
the start sequence. A PMS can also have extended
functionality by monitoring and control of the energy
flow in a way that utilizes the installed and running
equipment with optimum fuel efficiency. Such
systems can be EMS. Energy management is a new
approach to control and monitor the energy flow in
marine, oil and gas systems. The EMS extends the
concept of power management in the direction of
controlling and coordinating the energy generation and
consumption. In addition to optimize the instantaneous
power flow, the historical energy usage and future
energy demands are considered. EMS will then be the
integrating element in a totally integrated power,
automation and DP system. For PMS and EMS, the
main functions can be grouped in:
• Power generation management: Overall control
with frequency and voltage monitoring with active
and passive load sharing monitoring and possibly
control, and load dependent start and stop of
generator sets. Since control logic and interlocking
functions are a significant part of the power system
switchboard design, the functionally of these
systems must be coordinated.
• Load management: Load power monitoring and
coordination of power limitation functions in other
systems, load shedding and start interlock of heavy
consumers based on available power monitoring.
• Distribution management: Configuration and
sequence control for reconfiguration of the power
distribution system. The distribution system should
be configured to fit the requirements in the actual
operational mode for the vessel.
10
The new generation production vessels and also drill
ships/rigs have a complex power system configuration
with advanced protection and relaying philosophies.
There are close connections between the functional
design and performance of the PMS and the power
protection system functions. It is a challenge for
involved parties to obtain an optimal and functional
solution with several suppliers involved and a yard
being responsible for all the coordination.
Blackout Restoration
Blackout of the power generating system is the most
severe fault that can happen in an electric propulsion
system. Should a blackout occur, and it does
unfortunately happen from time to time, there will
normally be required to have a system for sequence
control of start-up and reconfiguration of the power
system. This is implemented at the system control
level, and includes sequences for starting and
synchronizing generator sets and loads. There will
normally also be a set of predefined operation modes,
e.g. transit mode, station keeping mode, maneuvering
mode, etc. with automatic sequence control for power
system reconfiguration. A typical sequence for:
• Automatic start and connection of emergency
generator control. Separate control system - not
part of the overall vessel control system.
• Automatic start/reconnection of standby
generator(s).
• Reconnection of transformer breakers, distribution
breakers.
• Tie breakers remain open if tripped.
• Restart of fuel and cooling pumps.
• Restart of other pumps and fans in sequence.
• Restart of thrusters, if required.
Load reduction and blackout prevention
The diesel-electrical power system has better
performance and fuel economy if the PMS controls
the number of running engines in the power plant to
match the load demand with high loading of the diesel
engine. The optimal load with respect to fuel
consumption, tear and wear, and maintenance is
typically about 85% of maximum continuous rating
(MCR). With a high load at the running engines, the
system gets more vulnerable to faults in the system,
such as a sudden trip of one diesel engine generator.
The remaining, healthy engines will experience a step
load increase and possible overloading, and in worst
case, under frequency trip unless the functionality in
the system reduces the load power in accordance with
the generating capacity. In a modern drilling vessel,
this load reduction and blackout prevention function is
distributed and handled by several subsystems like:
• Power management’s load management and
blackout prevention functions.
• DP system’s power limitation functions.
• Thruster drive’s load reduction and load phase
back functions.
• Drilling drive’s load reduction and load phase
back functions.
The ability to withstand such faults is also highly
depending on the design and engineering methods and
solutions, such as:
• Load capability and dynamics of the diesel
engine.
• Governor and AVR configuration and settings.
• Generator and switchboard protection relay
settings.
• Critical equipment should be fault-tolerant with
loss of power ride-through functionality.
In DP vessels with high efficient speed controlled
fixed pitch thrusters, the total load under normal
operation is so low that the power plant runs optimal
with few, often only two running diesel engines. In
order to utilize this saving potential, the challenge is to
design and tune the system to be capable of handling
fault scenarios within a time frame not compromising
the stability of the power supply.
FIGURE 15 shows, for illustration, the diesel engines
capability to maintain the frequency for the load step
associated with the loss of a parallel run engine. In
typical installations, it has been seen that the actions of
load reduction and blackout prevention must be
effective within less than 500ms in order to not
compromise the power system stability and limit the
flexibility of operation. Several solutions are in use and
the operators and owners have different preferences.
However, some common conclusions can be made on
what is typically required for the blackout prevention
11
functionality:
• Thruster and thruster drives: Variable speed FPP
thrusters must have a load reduction scheme,
either monitoring the network frequency and/or
receiving a fast load reduction signal from the
PMS, either as a power phase-back signal,
maximum power limitation signal, or – if well
coordinated – fast RPM reference reduction. In
order to avoid instabilities in the network
frequency, the load reduction should be as precise
as possible in order to dampen potential
oscillations. Fixed speed CPP thrusters do not
have fast enough response time for blackout
prevention. These must be included in the power
management’s load shedding scheme.
• Drilling drives: Similar to the requirements of the
thruster drives, with built-in priorities for the
individual drilling drives.
• PMS: By class requirements, the PMS must
include blackout prevention with load
reduction/load shedding functionality. It was
observed earlier, that the response time in this
system was too long to obtain the desired level of
fault-tolerance without a fast acting, stand-alone
load reduction scheme in the thruster drives. With
the knowledge of today, this has been claimed
solved by use of fast acting, and possibly
event-trigged load reduction algorithms.
• DP system: The DP system is also equipped with
a power limitation function, normally based on a
permitted maximum power consumption signal
from the PMS. Generally, this has shown to be
effective in avoiding overloading of the running
plant, but not fast enough to handle faults and loss
of diesel-generator sets. Of importance is also that
the power limitation in manual and joystick
control of the thrusters.
Based on experience, it is recommended that all load
reduction and blackout prevention functions described
above are installed and well coordinated, tuned and
tested during commissioning and sea trial. Also, the
need for retuning and testing must also be considered
after modifications in the installation that may affect
the coordination.
 network into two or more separated sections in DP 2
10 sec
Fixed speed CPP load red or 3 operations. With the developments on
5 sec switchboard protection relays, and thruster drives
Risk for DP power limitation together with new PMS with more precise and faster
1 sec Blackout
load reduction and blackout prevention functions, this
PMS blackout prevention
0,5 sec has changed and it is now more common to operate
with normally closed bus tie breakers and also with
0,1 sec VSI Drives FPP load red
closed ring main bus. This development is motivated
Worst case overload Load
100% 200% 300% x MCR
by the benefits of better and more flexible utilization of
the installed generating capacity and to gain an
FIGURE 15. Regulation time constants for power improved fuel economy. The fuel savings for
reduction, with maximum response time in the order of optimized loading of running engines have shown to
500ms (Illustrative only). be significant.

A typical coordination diagram is shown in FIGURE 16.
Auto start and auto stop limits shows the level and
time settings for load dependent automatic start and
shutdown of the engines. Available power will under
normal operations be within these limits. Upon faults,
and sudden loss of engine, the available power is being
reduced. The power reduction functions of the DP can
be distinguished between critical or non-critical
situations, allowing the DP to take all available power
after possible load reduction and load shedding of
non-essential consumers or consumers with lower
priority.
t detect governor and AVR faults, and improved the
PA,normal
Load
Reduction/
Shedding
In such systems, it has been observed that under some
load and operating conditions, certain faults in the
governors and automatic voltage regulators, AVRs,
can be difficult to identify with a regular protection
scheme. In worst case, faults have shown to interfere
with healthy equipment causing undesired shutdowns,
and in some cases, even blackout. Developments in
digital generator protection relays with multifunction
and programmable protection logics have enabled a
possibility to combine protection functions in new
manners, and to include logic and algebraic
functionality into the protection scheme. This has
significantly improved the protection relay’s ability to
system’s fault tolerance to such faults. FIGURE 17
shows a possible monitoring scheme for AVR,
including correlation functions of multiple variable
and voting functions for multiple gensets. Such
functionalities can be installed in the modern,
programmable multifunction generator protection
relays, or in separate logic controllers for retrofit and
upgrades.

I1-I4

U1-U4 Voting
Demagnetize
FIGURE 16. Coordination of auto start/stop and Q1-Q4 algorithm
Trig limit
blackout prevention functions (example). and Disconnect

Ii time delay Excitation Alarm

settings
Diesel Engine Governor and AVR Fault Ui Correlation Excitation Fault
algorithm
Tolerance Qi

Although the rules and regulations have allowed for

DP operations with closed bus ties in the electrical FIGURE 17. A monitoring scheme for AVR fault
power system and one commonly connected power detection.
plant, the practices were until mid 1990s to split the

12
CLASSIFICATION
Certification
In most cases it is up to the owners to decide which
type of classification of the ship and hence which
certification should apply (or to seek for class approval
at all) for the equipment installed. The International
Marine Organization (IMO) has also developed
Guidelines for Dynamic Positioning, in order to
provide an international standard for DP systems on all
types of new vessels. The purpose of the Guidelines
and class rules is to specify design criteria, necessary
equipment, operating requirements, and a test and
documentation system for DP systems to reduce the
risk to personnel, the vessel itself, other vessels and
structures, sub-sea installations and the environment
while operating under dynamic positioning control.
Taking into consideration that DP operated vessels
often operate in different parts of the world, such
standardization provides a useful tool for the different
Costal states to specify the local rules and regulations,
defining levels of safety requirements, requirements
for redundancy and operations for DP vessels.
The requirements for hardware and software on DP
systems are closely connected to the level of
redundancy, which is defined as:
• Redundancy means ability of a component or
system to maintain or restore its function when a
single fault has occurred. This property can be
obtained by installation of multiple components,
systems, or alternative means of performing a
function.
A DP system consists of components and systems
acting together to achieve sufficiently reliable
positioning keeping capability. The necessary
reliability of such systems is determined by the
consequence of a loss of position keeping capability.
The larger the consequence, the more reliable the DP
system should be. To achieve this philosophy the
requirements have been grouped into three different
equipment classes. The equipment class depends on
the specific DP operation, which may be governed by
Costal state rules and regulations or in agreement
between the DP operator company and their customers.
A short description of the different classes is given
below:
13
• Class 1: For equipment class 1, loss of position
may occur in the event of a single fault, e.g. the
DP control system need not to be redundant.
• Class 2: For equipment class 2, loss of position is
not to occur in the event of a single fault in any
active component or system. The DP control
system must have redundancy in all active
components in order to be capable of providing
station keeping capability after any functional
single failure in the system.
• Class 3 Same as DP class 2, with additional
requirements on redundancy in technical design
and physical arrangement to withstand fire and
flooding situations as single failure situations.
Class 2 or 3 system should include the function
"Consequence analysis", which continuously verifies
that the vessel will remain in position even if the worst
single failure occurs. The IMO Guidelines also
specifies relationship between equipment class and
type of operation. DP drilling operations and
production of hydrocarbons, for instance, requires
equipment Class 3, according to IMO.
Failure Analysis
The cost of making design changes during the initial
project phase is small, but as the project progresses the
cost of design changes increases significantly. Minor
changes in a system can cause project delays and huge
additional costs during the commissioning and sea
trials. During the whole design phase of new buildings,
the reliability of the total system can be thoroughly
investigated by different reliability methodologies, in
order to detect system design errors and thus minimize
the risk. Such analysis of DP system and its
subsystems is not required by the class societies or the
IMO Guidelines. However, the Costal states, oil
companies or customers may require it, in addition to
classification approval. There are different methods
available for assessing the reliability of such complex
systems.
One common methodology is the Failure Mode and
Effect Analysis (FMEA). This is a qualitative
reliability technique for systematically analyzing each
possible failure mode within a system and identifying
the resulting effect on that system, the mission and
personnel. This analysis can be extended by a
criticality analysis (CA), a quantitative procedure module hierarchy example, where module complexity
which ranks failure modes by their probability and is plotted versus release level and application.
consequence. As we will see later use of simulator for
hardware-in-the-loop (HIL) simulation is an efficient Hardware and Software Platform
method for testing and verification of control systems. The simulator is currently being developed in a
MATLAB/SIMULINK environment on the Windows
PC platform. SIMULINK was chosen for running the
SIMULATION main simulation loop because of its flexibility towards
several programming languages. Applications written
in MATLAB, C, C++, and Fortran may easily be
For years simulators have been used as tools in system
linked to the simulation by use of S-functions. This is
design and analysis, both in academia and in the
convenient for generating simulator modules from
industry. At NTNU a new simulator, Marine Systems
existing code, and makes development of new
Simulator (MSS), based on MATLAB/SIMULINK is
modules more user-friendly.
under development. MSS integrates the disciplines
hydrodynamics, structural mechanics, marine
machinery, electric power generation and distribution,
navigation and automatic control of marine vessels.
The main purpose of MSS is to improve the
accumulation and reuse of knowledge and thereby the
quality of the education for MSc and PhD candidates.
The simulator will be continuously developed by
students and researchers, and will serve a diversity of
applications. This necessitates a modular structure, in
which each module is a self-contained unit with a
well-defined interface and functionality.

Simulator Structure
The core of the simulator is the process plant models,
which give the necessary detailed description of the
vessel dynamics, systems and components and its
surroundings, see FIGURE 19. The other main parts of
the simulator are the control systems interfaced with
the sensor and actuator modules. The control systems
may for instance be DP system, thruster assisted
position-mooring system, tracking controllers and
autopilots, local thrust controllers, PMS, crane control
systems, etc. MSS is made partly open-source.
Module Hierarchy
Depending on the development stage and required
accuracy of the operation and application studied, a
hierarchy in module complexity is allowed. For any
application, several modules of varying technical
complexity, built-in functionality and release levels
may exist. These should all cover the same basic
functionality and have the same interfaces, and may
therefore easily be interchanged. FIGURE 18 shows a
FIGURE 18. Module hierarchy example.
Hardware In-the-Loop Testing
Use of simulators in verification and testing of target
control systems is yet not much exploited in the
marine and offshore industry. A new initiative
proposed by the NTNU spin-off company Marine
Cybernetics AS on Hardware-In-the-Loop (HIL)
simulation based on the modular multi-disciplinary
simulator named CyberSea Simulator (FIGURE 20)
has been developed. Testing and certification of
traditional marine technology is well developed and
well established, and is performed by class societies. In
contrast to this, the required technology and methods
for the testing and certification of safety-critical SW in
marine control systems have not been available by 3rd
party companies until now.

14
 Simulator
Simulator FMEA User 3D Analysis DP and
Manager Interfaces visualization Toolbox PMS
Manager

ROV
Run Time Infrastructure Control

Vessel Models: Propulsion Power System: Other Models: Sensor and Crane
- Current, wind, System:
- Diesel engine - Crane Instrumentation: control
- Gas turbines - Ballast -DGPS
waves - Thruster
- Generators - Towing / cables -HPR
- Stationkeeping - Rudder
- Maneuvering - Transformers - ROV -Gyros
- Pod Ballast
- Converters - Risers -MRU/VRS
- Mulitibody - etc.
- Switchboards - Mooring -Wind sensors control
- etc. -…

Model Database & Library

Environment Hulls Propulsion Power Crane & Winch Cables, Pipes

Wave, wind and
current loads
WAMIT, VERES units components Hydraulics Nonlinear FEM
Heave Compensators

FIGURE 19. System simulation.

Real time
CyberSea Simulator
interface

FIGURE 20. Hardware-in-the-loop (HIL) simulation.

The overall objective of the HIL-testing is to improve
safety and performance in marine operations and sea
transportation. A failure mode and effect analysis
(FMEA) module are used to test the control system
performance, alarm system and logics subject to
varying environmental conditions and failure
situations in the control system, navigation system,
power plant, thrusters and sensor system.
DP-HIL
Technology and procedures for DP-HIL safety and
performance testing has been developed in a pilot
project by Statoil, Det Norske Veritas (DNV), NTNU,
ship operators, contractors and vendors in cooperation
with Marine Cybernetics. Successful sea trials on the
supply vessel Viking Poseidon operated by Eidesvik
has been carried out to document and verify the
concept of DP-HIL.
CyberSea DP-HIL Test Plan
DP-HIL testing will be performed for new buildings
during Factory Acceptance Tests (FAT), and in
Customer Acceptance Tests (CAT). For sailing ships
DP-HIL tests will be performed at annual tests, and
possibly, by initial tests for ships that have not been
tested as new buildings. The DP-HIL test equipment
is not part of the control systems installed on the ship,
and is only used during DP-HIL tests.
CONCLUSIONS
This paper addressed various aspects related to design
and operation of marine control and propulsion
systems based on experience from offshore oil and gas
vessels. Advanced vessels are often installed with
electric propulsion systems and integrated vessel
automation systems.

15
This is driven by the possibility to utilize the
installation at an optimum level for a wide operational
range. However, integration also introduced concerns
on safety and fault-tolerance, which must be met with
adequate design, simulation, analysis, and testing
methods. Reconfiguration – or fault-tolerance, has for
many years been one main concern of commercial
ship designs in safety critical operations. Examples of
such installations have been taken from DP vessels in
the offshore segment. Control structure issues related
to high level vessel control such as power and energy
management to low level thruster control were
discussed. A new safety concept developed by oil
companies, class society, contractors, ship operators
and vendors based on Hardware-In-the-Loop (HIL)
testing and verification of marine control systems were
presented.
REFERENCES
Allensworth, T., “A Short History of Sperry Marine,”
Litton Marine Systems,
www.sperry-marine.com/pages/history.html
Bennet, S., “A History of Control Engineering
1800-1930,” Peter Peregrinus, London, 1979.
Blanke, M., M. Kinnaert, J. Lunze and M.
Staroswiecki, “Diagnostics and Fault-Tolerant
Control,” Springer-Verlag, Berlin, Germany, 2003.
Fossen T. I., ”Marine Control Systems: Guidance,
Navigation and Control of Ships, Rigs and
Underwater Vehicles”, Marine Cybernetics AS,
Trondheim, Norway, 2002.
Marine Cybernetics AS,
http://www.marinecybernetics.com/
Marine Systems Simulator (MSS),
www.cesos.ntnu.no/mss, Norwegian University of
Science and Technology, Trondheim, 2004.
Minorsky, N., “Directional Stability of Automatic
Steered Bodies,” J. Amer. Soc. of Naval engineers,
34(2):280-309, 1922.
Smogeli, Ø. N., A. J. Sørensen and K. J.
Minsaas, ”The Concept of Anti-spin Thruster
Control,” Accepted for publ. in IFAC J. of Control
Engineering Practice, 2005a.
Smogeli, Ø. N., E. Ruth and A. J. Sørensen,
“Experimental Validation of Power and Torque
Thruster Control,” 20th IEEE International
Symposium on Intelligent Control (ISIC'05) and
16
the 13th Mediterranean Conference on Control and
Automation (MED'05), Cyprus, 2005b.
Sørensen, A. J., “Marine Cybernetics: Modelling and
Control”, Lecture Notes, Fifth Edition, UK-05-76,
NTNU, Norway, 2005a.
Sørensen, A. J., “Structural Issues in the Design and
Operation of Marine Control Systems,” Accepted
for publ. in IFAC J. of Annual Reviews in Control,
2005b.
ACKNOWLEDGEMENTS
This work has been carried out as apart of the research
project on Energy-Efficient All-Electric Ship (EEAES).
The Norwegian Research Council is acknowledged as
the main sponsor EEAES.
Professor Asgeir J. Sørensen obtained MSc degree in
Marine Technology (1988) and Dr. ing. degree in
Engineering Cybernetics (1993) at the Norwegian
University of Science and Technology (NTNU). In the
period 1989-1992 Sørensen was employed at
MARINTEK. In 1993-2002 Sørensen was employed at
ABB in various positions as Research Scientist, Project
Manager, Department Manager and Technical
Manager in the Business Area Automation Marine and
Turbochargers. Since 1999 Sørensen has held the
position of Professor of Marine Cybernetics at the
Department of Marine Technology at NTNU. Sørensen
is also the President of the NTNU spin-off company
Marine Cybernetics AS.
Professor Alf Kåre Ådnanes obtained MSc degree in
Electrical engineering in 1987 at NTNU, and the Dr.
ing. degree in Electrical Engineering at NTNU in
1991. In the period 1988-1991 Ådnanes was employed
at SINTEF, working with modelling and control of
permanent magnet synchronous motor drives. In 1991
Ådnanes was employed as Research Scientist at ABB
Corporate Research Norway working on R&D in the
field of power electronics. In 1994 he joined ABB
Marine in Norway. In 2001 he took his present
position as Technology Manager in ABB Marine,
Norway. Since 2001, he has been Adjunct Professor at
Department of Marine Technology at NTNU.