DP2 blackout: one generator trip, one overcurrent trip and a six-minute drift
An 8,100 GT DP2 platform supply vessel is on DP approach, 320 m from an installation in 105 m of water, with four 2,150 kW diesel generators at 690 V and three generators on line (G1 at 82% load, G2 at 88%, G4 at 71%), G3 on standby. At 04:12 the power management system logs G4 on reverse power and trips it. The load transfers to G1 and G2, and 2.4 s later G2 trips on overcurrent; the main switchboard blacks out. The 350 kW emergency generator starts and closes onto the emergency switchboard in 41 s, supplying emergency lighting and the radio. Propulsion is lost for six minutes and the vessel drifts to 180 m from the installation before the master drives off. The DP FMEA does not identify a reverse-power trip as part of the worst-case failure, and the client's contract requires DP2.
1. Was the emergency generator's performance compliant, and does it rescue the DP2 case?
Read the worked answer
The 41 s start and connection is within the 45 s allowed by SOLAS II-1/42.3.1.3, and the 350 kW rating must be checked against the connected emergency load: emergency lighting, navigation lights, radio, emergency fire pump and steering indication must all be sustainable for the 18 hours required for a cargo ship by II-1/42.3.1.1. If the connected load exceeds 350 kW the set is overloaded and the endurance claim fails. What is not compliant is the outcome. DP2 (equipment class 2 under MSC.1/Circ.1580) requires redundancy such that a single fault in an active system will not cause loss of position. A generator trip is precisely the single failure the notation is meant to survive, and a six-minute blackout with a 180 m drift shows the redundancy claim failed in practice. The emergency generator is a life-safety source, not a DP power source; it cannot be counted in the DP capability analysis, so its correct operation does not rescue the DP2 case.
2. Explain the trip sequence and identify where the design or the FMEA is deficient.
Read the worked answer
Read the sequence, not just the first trip. Reverse power means the generator was motoring: the prime mover lost power through a fuel, governor or actuator fault, not because electrical load was too high. Reverse-power protection is normally set at about 5-10% of rated power with a 3-5 s delay, so it should not operate on a healthy engine. The overcurrent trip on G2 is a consequence: the PMS moved G4's load onto G1 and G2, already at 82% and 88%, instead of shedding a thruster or another low-priority consumer. Under MSC.1/Circ.1580 the worst-case failure for a DP2 vessel must be defined and the FMEA must show the system survives it, so a blackout caused by a single generator loss is an FMEA and load-shedding design gap, not an operator error. Actions: inspect the G4 fuel system and governor, review the PMS load-shedding priority and the reverse-power setting, and repeat the FMEA proving trials against the revised worst case.
3. What reporting and management follow-up does the incident require?
Read the worked answer
The incident is reportable and the FMEA is now demonstrably incomplete. The company should report to the flag and to the client, record it in the DP incident log, and treat the 180 m drift as evidence that the worst-case failure was misidentified. The FMEA and the annual DP trials required by MSC.1/Circ.1580 must be updated to include the single-generator loss, and the proving trials repeated with the modified load-shedding scheme. Class should be asked whether the DP notation is affected: an incident alone does not suspend a notation, but a repeat would attract action. There is also an ISM angle: the master held position on three generators at 82-88% loading, leaving no margin for load transfer after a trip, so the safety management system should state a maximum generator loading for DP operations and a defined abort criterion. The drift distance should feed the bridge team's emergency drill.