Redundant DP2/3 Closed Bus Efficiency Is A Myth

Introduction:?I’ve written a few articles addressing a series of recent DP incidents.?You don’t need to go back and read them to understand this one.?There were a number of blackouts caused by operators performing maintenance or troubleshooting problems with a closed bus tie.?The first article reminded people not to play with problems in unsafe conditions – limit the risk and then do the work – don’t bet the whole power plant.?Because most of those unfortunate vessels were DP3, the second article reminded people that there was no such thing as closed bus DP3.?If operators think the system is bullet proof, then they don’t think they are taking a chance when they work on a problem closed bus tie.?None of the systems are bullet proof enough to justify closed bus DP3, so failures occur.?This time we are going after the root cause of these problems – the myth that closed bus tie operation is cheaper by saving fuel.?It’s sometimes true, but usually isn’t.?The drive to save money is putting people and companies at risk.?It’s a powerful and widely believed industry myth that needs debunked before someone dies for it.

Heresy??Having failed to get myself kicked out of the DP industry with last week’s article supporting IMO645/1580 definitions (DP3 or closed bus, pick one), this week’s article is going for the biggest DP myth of the all:?“If only we could close the bus ties, we could run less generators and save a ton of fuel!”?Nope.?Your vessel probably isn’t designed for it.?Redundant closed bus fuel efficiency is mostly a myth and an example of intellectual inertia (anchoring).?Non-redundant closed bus fuel efficiency is greater, but redundancy imposes requirements and costs.?Non-redundant and redundant closed bus operation must not be confused.?As the old DP hands say, “Redundancy costs fuel.”?There is no free lunch and everything has its price.?One price of being fair is the need to explain how the other side isn’t dumb.

Skippable History Detour:

Orthodoxy:?There are a bunch of people in the industry thinking that they can get free fuel savings and demanding that it be done.?If it is easy and simple, then of course they want to do it – that’s just good management.?Furthermore, once someone wants something, then they can see all the reasons for it and have a hard time seeing the reasons against it.?That’s a bit more dangerous, but very human.?The situation is further confused by the history of DP vessel operation and changing benchmarks.?What was a good decision at one point can become a bad decision a decade or two later.?At that point, the people, who were in the trenches when it was a good decision, are in management, and some of them no longer know the technical reasons, but remember that it used to be good and want to save money.?Because they want something, there is market for people to sell it, so they can find people to sell them anything they want, whether it works or not, and usually get it approved.?So there are people who swear by closed bus, and people who know why it is a problem.

History:?The interpretation of which risks are DP significant have varied over the years.?When the DP control system had a serious malfunction each day, the power system was comparatively rock solid.?But by the time DP control systems had a serious failure once a year, power system failures became significant risks.?They still aren’t a risk for dedicated direct diesel systems, but they are significant for the typical, energy efficient, diesel electric, power plant.?At one point, DP2 closed bus tie power plants with isochronous load sharing lines and a bus tie with just a short circuit, overcurrent, and undervoltage trip were acceptable.?Many managers and captains remember this and don’t know why it changed.?Technological improvement is double edged.?The DP control systems and their sensors improved enough in reliability that the power systems went from insignificant to a major threat to safe and redundant operation. The control systems got better faster than the power systems and this created pressure to reduce the power system risks.

IMO645:?The industry had been there before because different parts of the industry got there at different times.?Dive ships had lives on the line and took risk seriously, drill ships usually less seriously, supply vessels even less seriously, and standby vessels least of all.?Some ships were so well engineered and operated that power plant failures were quickly an important contributor to operational risk.?Meanwhile, other portions of the market were performing lower risk operations to less rigorous standards.?This segmentation of the DP market explains the three DP classes - with DP3 for high risk, DP2 for medium risk, and DP1 for low risk.?The high risk portion of the market demanded closed bus, but the medium risk people, who wanted to move up and earn the DP3 safety premium, wanted that left potentially flexible, so the high risk people made it theoretically possible but practically impossible.?The high risk people looked at the medium risk plants (DP2) and said that the bus ties need to block blackouts, and the medium risk people agreed because they didn’t want the low risk DP1 people taking their work.?Then the low risk people bought DP2 and DP3 vessels and tried to operate them like low risk vessels, as they wanted the safety premium at low cost and some didn’t know the difference.?The DP market got confusing.

Confusion:?It’s little wonder that the DP market got confused, and the difference between each DP class became less and less clear in practice, as the requirements became increasingly disguised by actual practice.?Experienced engineers, mariners, and managers from the risk adverse part of the market complained for years and were generally ignored until a number of incidents woke people up.?For example, I have an article that identifies the year that the drillers started taking electrical risk seriously.?Once they understood their own risks, they started worrying about the risks posed by the vessels working for them and the industry started to reform.?Of course, IMO645 had already worked out the principles, was already there, and just needed applied, so no closed bus without adequate protection.?Most people were used to operating closed bus and didn’t believe the “change” (applying the guidelines rather than hand waving them).?Many still don’t.?It doesn’t match their experience because systems have changed and that has changed system priorities.?They may not believe in power plant redundancy (“It was good enough before!”) or the guidelines that require it, but they do believe in fuel.?Fuel is a measurable cost, but a lack of redundancy can be invisible - until it bites.?Redundancy is the thing they can get sued or fined over, so it is real.?Not following the guidelines and having a DP incident can have expensive consequences, regardless of what someone believes.??

Detour Conclusion:?Eventually, gravity wins.?It can take a while and sometimes the equipment or operators can be blamed, but eventually the toll is due, so it’s worth figuring out which one is more expensive.?Personal experience can mislead but industry experience shows clear problems need overcome to achieve redundant closed bus operation, and this is reflected in industry guidelines and annual DP incident reports.?It’s too bad many people are too busy to read them.?Times have changed and the guidelines show it.?Closed bus operation usually makes a vessel vulnerable to total failure, and operating unsafely is legally and financially hazardous.

End of History Detour

Fuel:?I could cover open and closed bus in great detail, but I’ve touched on it before and it isn’t the point of this article.?I want to address the misunderstanding that closing the bus tie allows operation with less generators.?It does, but not for most redundant vessels.?Things are usually easier to understand with a concrete example, so let’s use the system in the title picture (repeated above).?The upper half of the picture shows the usual argument.?More generators are being run than needed, and if we could just close the bus tie, then we could stop one diesel generator (DG) and run the remaining engines at more efficient and healthier load levels.?Engines are more efficient at higher load and are generally designed to work best in that range.?Running at low load can cause buildup and other problems.?So, running less engines at higher load reduces both fuel and maintenance.?These are fair points.?But there is a problem.

Vulnerabilities:?The bottom half of the picture shows the problem.?I’m not talking about the well-known and demonstrated common bus problems, which some people don’t want to believe in, because they want to save fuel.?I don’t want to rehash that fight.?Let’s assume no fault can cross the bus tie.?There is still a problem.?With two DGs on one side and only one DG on the other side, any fault that can kill the port DGs will place a 160% load step on the remaining generator which is already loaded at 80%.?This isn’t a DC motor, it isn’t going to take 240% load and the power management system (PMS) isn’t going to be able to shed load fast enough to save it.?This isn’t even an old diesel engine that could take a 100% load step from zero, it’s a wimpy, environmentally friendly engine that is limited to 25% load steps and it just got fed 160%.??Due to the magical breaker, the fault doesn’t transfer, but the load still needs fed and can’t be dropped fast enough, so the port DG fault blacks out the whole thing.?Large generation and load differences between redundant groups are death to redundancy.??

Balance:?On the other hand, balanced generation and loads make fault survival easier.?It’s a lot easier to survive and have the PMS counteract an 80% load step than it is to survive a 160% one.?I have tested systems that can survive the 80% load step at 80% load, but some systems have failed at that level and needed to run at 60% or 70% load to be redundant.?I haven’t performed any 160% load step PMS load reduction effectiveness tests, as I don’t like breaking things and already know the result for most systems.?Having balanced generation and load across the redundancy groups makes faults much more survivable, but prevents getting rid of the extra generator.??That’s why the bottom left shows that four DGs are still needed, even with the bus tie closed and a magic bus tie preventing fault transfer.?Closing the bus tie and paying a fortune for installation and maintenance of a magic bus tie didn’t change anything.?We still need to run four DGs to maintain redundancy, and it is important to understand why.

Group Failures:?Why did we lose two DGs in the first place??Shouldn’t we have just lost one??Isn’t this a double failure, when we only need to consider single point failures for DP redundancy??This wasn’t caused by an obscure electrical or control failure mode that few people understand.?This is simply how most vessels are designed and built.?Let’s assume that the magic bus tie prevents any problems on the bus travelling between generators, there are still lots of obvious systems that both DGs are dependent on.?These shared systems exist because it saves money & space, and eases operation & maintenance, but a failure in these shared systems can affect multiple DGs.?Everyone knows this, so those systems are normally split so each redundancy group is independent, but that means that all the DGs in one group can be lost together.?It’s possible to avoid this and MTS recommends making each DG its own redundancy group with its own independent support systems, but almost no vessels are built that way.??

Myth Busted:?So, closing the bus tie doesn’t let you run one less DG because the load and generation needs to be even to survive a fault in the group support systems that can kill at the DGs on one side (one redundancy group), except for vessels that have been purpose built to allow this.?This is why it’s a myth.?Most vessels have not be built to allow this, and even a magic bus tie (or advanced generator protection system) can’t change this.?For the vast majority of vessels, closing the bus tie will not allow redundant operation with one less DG.?Let’s take a look at the shared systems so this is clear.

Typical Designs:?The picture above shows some common design features that lead to group failures.?Everyone knows to split these systems along the redundancy concept, but far fewer people do it to support operation with one less DG.?Obviously, loss of common control power is loss of the engines or AVRs fed, and can be caused by a supply or load fault.?Similarly. loss of protection relay or breaker relay logic power can trip the breakers or prevent their trip.?Major faults in common controllers can affect the controlled equipment even if in isolated outputs or even separate cards.?Common load share, synchronization, and reference buses can cause common failures.?Common control functions affect all equipment, and failures in common data buses have been known to disrupt function even without control functions.?A major fuel tank contamination or someone stepping on the quick closing valve can take out all the engines fed from that tank.?Cooling is usually more gradual, but a major fault in a common gearbox, pressure pulse to the crankcase over-pressure detectors, or loss of rigsaver air can instantly take out multiple engines.?These are just a sample of the possible group failures and experienced operators can think of many more.?An honest man who starts thinking through his vessel systems will often find several of them.?Very few vessels have purposely eliminated these group faults found in typical designs, as they save space, provide convenience, and lower equipment and maintenance cost.?So you can’t run one less DG and spend less on fuel, because they couldn’t fit enough stuff into the available space and provided you a cost effective design.?Shame on them (irony).??It’s possible to eliminate the cost effective design, but the reasons not to should be obvious.?Closing the bus tie to save fuel on a DP2 or DP3 vessel is starting to get very expensive, even if magic bus ties existed.?So what are the options?

High Risk:?The drawing above shows four options.?People often go for the upper right option of closed bus, 3 DG operation, as they think they can save money, but they don’t normally get rid of the group failures, so that is just eliminating redundancy.?Because magic bus ties don’t exist and the real world protections have limited effectiveness, this isn’t an option for DP3 and is expensive to effectively implement and maintain for DP2.?The slight increase in efficiency can get very expensive and most experts won’t believe it, because they know that most people who sell the systems don’t know what is needed and they know that almost no one in the offshore is willing to do the maintenance to ensure its effectiveness.?It’s an expensive piece of paper.

Solutions:?The drawing shows three other solutions.?All four examples shown have the same load but handle it differently.?Solution 1 is the traditional open bus with PMS asymmetric loading to reduce stress on the engines, but it doesn’t address efficiency.?It can’t be done with closed bus because the asymmetrical loading does not combine well with surviving major electrical faults.??

Less is More:?Solution 2 is a simple solution much beloved by engineers because more and smaller DGs allow better alignment with load, provide a larger voting effect to kick off a bad DG, and eases maintenance because getting 1 of 4 or 5 engines down for maintenance is much easier than getting 1 of 2 or 3.?However, equipment costs and room required is normally higher and more engines need maintained, so maintenance costs are usually higher.?This isn’t a good design for very active loads that surge and fall, as engines would need started and stopped more often.?Larger engines are better for that.?Incidentally, large load swings are another situation where closed bus fuel savings can’t be earned, even if group failures didn’t exist and magic breakers did.?It’s well enough to complain about an average 60% load, but if it regularly spikes to 90% then no one should listen.??

ESS:?Now that batteries aren’t complete rubbish, Solution 3 is an increasingly good option.?The bus tie can stay open, so that saves a lot and supports redundancy, its good with active loads, and the energy storage systems (ESS) can support generator supply or absorb power to allow DGs to run at optimal efficiency and operation.?Battery systems are still expensive and somewhat dangerous, but ESS is probably going to steal closed bus operation’s lunch money, due to its higher efficiency and lower risk.?As ESS systems improve in reliability, safety, and cost, closed bus tie will probably become a non-issue, as it will clearly be the worse option.?Open bus tie, ESS is already the better option for active loads.

Conclusion:?Closed bus tie operation is more efficient than conventional open bus tie when redundancy doesn’t matter.?When redundancy does matter, it provides little or no advantage at considerable risk and sometimes at higher overall operating cost.?Closed bus operation used to be acceptable on some vessels, but system improvements have made older power designs and operating modes problematic.?Old memories of it being good are out of date.?Most vessels aren’t built to run one less DG when the bus tie is closed due to group failures, and common failures make it moot for DP3 and difficult and expensive for DP2.?There are open bus solutions that provide the same or better efficiency at lower risk to redundancy and possibly at lower cost.?I hope this was helpful, made sense, and saves people unnecessary bother and expense.?It’s time to stop risking people and equipment, and wasting money, on a misconception.?It’s time to kill the big myth that has caused so many problems.