DP SWC Pt.2 – Redundancy & Configuration

Introduction:  Last week’s dynamic positioning (DP) article looked at generic threats and protections for sea water cooling systems (SWC).  The threats included marine growth, erosion/corrosion, water temperature, clogs from excessive silt, fish, or debris, gas build up, and control faults.  Detection and solutions were offered for each threat, but the size and handling of each threat really depends on the configuration of the system and its operation.  Before we look at the effect of configuration, let’s look at our acceptance criteria and redundancy groups, so we remember what we are trying to achieve.

Redundancy Groups:  We know that almost anything can fail, malfunction, or be maloperated.  We’ve had lots of experience with this over the years, so we have learned not to put all our eggs in one basket, but to split up vital systems into self-sustaining, independent, sometimes self-correcting, redundancy groups that are capable of maintaining internal services and enough external thrust to maintain position.  This requires separating redundancy group systems from other redundancy groups, and protecting from faults that affect other redundancy groups, whether directly by acting on the other group, indirectly by increasing load, or via a shared resource.  In the simplest form, no fault that affects Port redundancy group equipment can be allowed to cause failure of Stbd redundancy group equipment, or vice versa.  This includes both simple loss of function and complex interacting malfunctions, from both external and internal faults, within the acceptance criteria.  Generally, world shattering meteors are outside the criteria (no one will be around to complain about losing position), but most familiar vulnerabilities, such as DGs paralleled across closed bus ties with inadequate protection, or other shared systems, are within.  Some vessels have redundancy concepts that are wrong, and have unworkable redundancy groups or grouplets as a result, but that’s beyond what we are looking at.  To determine, if the redundancy groups are right and well defined, we need to know how things work and our acceptance criteria.

Acceptance Criteria:  The tablet of stone above tells us how well we need to defend redundancy groups from each other, external threats, and us.  For DP2, active elements must be prevented from causing single point failures, and passive elements must be adequately protected.  Sea chests, strainers, pumps, coolers, and anything we control is active.  This is mostly because the sea water cooling flow is the vital active element.  That’s directly measurable in a forced SWC system, but indirectly measured with box coolers.  The pipes are passive, and need adequate protection shown and maintained.  The valves are generally passive elements that need protected against maloperation, but remote controlled valves are active elements that need protected against single point power and control failures.  Generally, all the elements need split and duplicated, to support each redundancy group, to reflect the redundancy concept.  But there is one big problem, there is only one sea. 

Problem:  If DP fuel redundancy is about the miracle of turning common and questionable storage and transfer system fuel, into independent day tank fuel for each redundancy group, through configuration, separation, settling, purification, monitoring, and sampling, DP sea water cooling (SWC) redundancy is the miracle of turning common sea water into effectively independent cooling for each redundancy group via configuration, separation, standbys, monitoring, operator intervention, testing, and maintenance.  It is inescapable that we begin with common sea water.  Like fuel, DP SWC redundancy mostly comes from the operators, but good design makes this easier.

Managing Risk:  Duplicating intakes doesn’t get rid of all common problems, and sometimes creates new ones.  Sometimes, design can’t solve conflicting requirements and needs to depend on operator intervention to ensure safe operation.  Even completely separate systems, such as DP3 requires, can’t escape problems created by the common sea water, but the risks can be managed to provide equivalent safety.  That depends on a mixture of good design and good operation.  Sometimes, forced SWC systems with multiple modes of operation require a well-protected common pipe to avoid complication and risk.  For example, a jackup might have normal SWC when floating, recirculation cooling from a large internal SWC tank when jacking, and leg or submersible pump SWC when jacked up.  It can survive common external SWC faults, when duplicated sea chests couldn’t.  Safely duplicating those services is difficult and dangerous.  It is much harder to deal with two or three simultaneous sets of clogged strainers in time to save the systems, than to change over just one set of strainers (one active strainer & one clean standby), and almost impossible, if the clean strainers start clogging while still trying to clean three dirty ones.  The demand on the engineers can become unreasonable.  When IMO MSC 1580 was being discussed, one of the goals was to eliminate common SWC systems, but examples like these prevented it.  Split when practical, but always provide effective alarms, protections, and backups to support the operators in preventing common faults.  Having spent too much time explaining the stakes, we better move on to examples.

Example 1 - Old Forced SWC:  Two sea chests are connected by a common pipe that feeds pumps that supply the engine cooling, main prop oil cooling, and fresh water cooling (FWC) systems.  The sea chests are labeled Port and Stbd, rather than high and low, because those features are duplicated.  We weren’t allowed to color code drawings back then, but you can see green pump 1 feeds the green Stbd engines and fresh water cooler, and tan pump 2 feeds the tan Port engines and fresh water cooler (pump 3 is backup).  I can’t remember why the main prop oil cooling fed from the aux pump was non-critical (Slow heat? SWC prop return oil?).  The only really active elements in this old system are the sea chests, the strainers, the pumps/motors, all the coolers, and the wax element temperature control valves (TCV).  Everything else was passive or manual, and needed proper setup and protection.  Of course, the SWC flow is the vital active element.  There would have been cathodic protection, an air vent, and a blow down in each sea chest, anti-growth before the strainers, differential pressure alarm across the strainers, pump failure alarms, equipment high temperature alarms, and high high temperature trips for the engines.  Everything else was local gages and operation.  The engine internal FWC was probably only good for a couple minutes of no SWC at high load, and the auxiliary FWC might be good for 15, so the crew had to perform a lot of local monitoring and keep track of temperature and pressure trends to catch problems before they became serious.  The drawing shows a clean strainer in standby, rather than both in use, but back then they might have been both on, depending on risk.  One strainer on was found back then for the same reason as today, but there was the concern of getting there in time, so the risks needed balanced, depending on manpower and sea.  The crossover valve between the sea chests can be closed to isolate a leak in the main pipe and allow cooling to continue on the other side.  In the worst case, that would be limited to pump 1.  If someone closed the common Port/Stbd overboard valve, then the water recirculates and new cool SWC would be limited to what was pumped out by the aux pump. Limited alarms, limited response time, and heavy manual monitoring and response made this system’s redundancy very operator and maintenance dependent.  This is when ships paid for good men, rather than automation.  It doesn’t work with reduced manning.

Example 2 - New Forced SWC:  These designs depend on automation to enhance reliability and make up for reduced manpower.  (This doesn’t work if the designers get cheap and sacrifice vital I/O points to other systems.  Either full manpower or full monitoring - choose.  Half and half is looking for failure.)  All the valves shown are automated and remote controlled.  The pump valves are controlled by the VSD starting and stopping, and the isolation prevents offline air build up.  The pumps sometimes still have priming.  Pump speed is controlled by the target of the FWC systems that are fed, so some designs have individual pumps for each, while others have a splittable discharge main (manual valves aren’t shown in the drawing).  Some FWC designers get confused and put in conflicting TCV and VSD speed control.  Feeding larger FWC systems, rather than multiple dedicated small equipment FWC, allows a larger thermal “bank” to delay shutdown after supply failure.  Cooler flow direction is reversible, via unshown manual valves, to allow backflush.  Both DP2 & DP3 systems are split after the pump, but not before.  DP3 is forced into a true 2 split by DP3 rules, including its power, so it ends up with duplicated piping, and the same external vulnerability and rush to clean multiple strainers, with reduced manpower, if there is a problem.  DP2 uses a common pipe, but can isolate a pipe segment and still provide the rest.  Both systems can detect strainer clogs, and can remotely change over strainers.  Both can detect flow control problems, but only the DP2 can alarm and automatically reroute to support continued operation, as loss of isolation is loss of DP3 redundancy (separation).  None of this is free and requires good design, good operation, and lots of maintenance to keep it reliable and working.  Operator load is reduced, but the operators are still vital to system redundancy.  The design transfers some of the workload from operation to maintenance, so it’s even more important that the more complex maintenance is done (no free lunch).  The DP2 system can be less vulnerable to external faults than DP3, if a ballast tank backup is used, like in many jackups.  That can be done for DP3, but duplication gets increasingly expensive and impractical as the number of separated redundancy groups increases.  Minimum sensors need to include sea water temperature, valve status & position, pump/VSD status, speed, & pressure, cooler differential temperature (pressure also desired), and discharge pressure or flow.  I should never see a design without a strainer differential pressure sensor, but I have.

Box Cooler SWC: “Sick of fish attacking your ship, and silt clogging your strainers? Stop sucking that dirty muck into your ship, and operate the clean, modern way, with box coolers!” At least, that is what some salesmen say. It does cut down on some of the risks, but clean surfaces and sea water circulation are still needed for it to work. They are normally protected by being in sea chests that require venting, blowdowns, anti-growth, and cathodic protection, just like active sea chests. It probably doesn’t work in polar waters, due to ice buildup restricting water flow. As the water isn’t forced, currents counter to the natural SWC convection current can restrict cooling. The sea chests should be split according to redundancy group, as an external restriction or counter-current is only detected when the cooler FWC temperature differential falls (loss of cooling), despite normal pressure and flow (turn ship or blowdown, depending on problem). Box coolers need occasionally cleaned, but are difficult to access underwater. They typically require a larger external footprint and are lower efficiency compared to forced water. These trade-offs are worth it, if operating in shallow water and other areas with serious common sea water problems. They still need managed.

People: The neglected component in most SWC analysis of systems and configurations is the people that make it work. None of these systems work on their own. They all need watched and corrected by ship’s engineers. Magical automation solutions can be an improvement by reducing watch keeping burden, or they can be a cost via increased watch keeping burdens and equipment that cannot be maintained. Engineers still need to be intimately familiar with the physical (not just screen) systems and regularly compare the virtual with the actual. Some problems won’t show up on the screen and depend on people in the field looking for them. Management and surveyors are attracted to screens and paperwork, but keeping the systems running in the field is what counts. For that, we need good people, and need to support them, so they can do their jobs. People look outside the simplified automation and procedures to see trends, foresee consequences, and fix things to keep running. We seem to have forgotten that the ultimate system enhancement is usually the crew.

Conclusion: As usual, I’ve gone too long by trying to cover too much. I hope the information isn’t too cryptic or compressed by trying to make it shorter. We’ve looked at the effect of SWC system configuration and design in supporting operation that helps the DP redundancy groups meet DP acceptance criteria by creating resistance or adaption to single faults. The approach to SWC systems has changed over the years, but it’s still one of the foundations of the DP redundancy required for safe operation. While configuration and design play vital roles, they are subject to oversight, and the crew make or break the system. So, it is vital that they have time watching, working, and maintaining the systems. Good design and crew are vital. Good managers need to strive to support this.

P.S. Next week is the Aug/24 DP incident article. I have a couple incidents (privately shared with me) to discuss. If you know a failure that you think is worth sharing, then message me. Don’t use the article comments, as they aren’t private. I’m looking to share lessons learned, not the parties involved.