specific functions, operating and equipment related to the asset’s industrial mission Protection Each redundant will also have a range of protective functions – designed to prevent fault propagation from one redundant group to the other by way of common points in the design and a range of alarms or other detection methods intended to help reveal hidden failures that could defeat the redundancy concept. Testing should be designed to prove the operation of all protective functions upon which the redundancy concept depends. A review of the FMEA should identify all protective functions which need to operate effectively to isolate faults or prevent cascade failures. Tests should be carried out in all relevant power plant configurations. Tests coming under the heading of protection may include but not be limited to: Load dependent starting of standby generators Alarm starting of stand-by generators in response to alarm on running generator Load shedding thruster phase back (via DP control system, PMS, and Drives) – Load shedding preferential trips of non-critical equipment – Advanced generator and bus tie protection Thruster emergency stops Protective functions intended to reject faulty DP control sensors Protective function intended to reject faulty DP control reference systems It is important that all protective functions upon which the redundancy concept depends are proven with a high degree of confidence and that they will operate successfully on demand. Detection tests are designed to prove the effectiveness of alarm and indications – intended to alert the operator to potential hidden failures or that some part of the redundancy concept is not functioning correctly and may require operator intervention. Tests falling under this category include but not limited to: Thruster and azimuth command/feedback prediction errors Alarms and indications for thrusters ready, running and enabled Alarms for unscheduled stop of machinery Alarms for start of a standby pump or other service Control loop failure alarms (input errors) Alarms to indicate that a UPS or 24Vdc battery system is on battery power Alarms to indicate that a backup supply has failed Alarms related to pressure/temperature in cooling water systems Indication that a standby generator is no longer available Alarms to indicate network failure In all cases, refer to the equipment manufacturer for specific instructions. Ensure that proper reactivation protocols for all equipment are developed and properly implemented as outlined within this document or applicable industry guidance. Create a checklist identifying the support and materials required for reactivation testing. Request support well in advance of reactivation. These may include: Technical support Manufacturer or vendor support Third party surveyor/auditor support
specific functions, operating and equipment related to the asset’s industrial mission Protection – Each redundant will also have a range of protective functions designed to prevent fault propagation from one redundant group to the other by way of common points in the design and a range of alarms or other detection methods intended to help reveal hidden failures that could defeat the redundancy concept. Testing should be designed to prove the operation of all protective functions upon which the redundancy concept depends. A review of the FMEA should identify all protective functions which need to operate effectively to isolate faults or prevent cascade failures. Tests should be carried out in all relevant power plant configurations. Tests coming under the heading of protection may include but not be limited to: Load dependent starting of standby generators Alarm starting of stand-by generators in response to alarm on running generator Load shedding – thruster phase back (via DP control system, PMS, and Drives) Load shedding – preferential trips of non-critical equipment Advanced generator and bus tie protection Thruster emergency stops Protective functions intended to reject faulty DP control sensors Protective function intended to reject faulty DP control reference systems It is important that all protective functions upon which the redundancy concept depends are proven with a high degree of confidence and that they will operate successfully on demand. Detection – tests are designed to prove the effectiveness of alarm and indications intended to alert the operator to potential hidden failures or that some part of the redundancy concept is not functioning correctly and may require operator intervention. Tests falling under this category include but not limited to: Thruster and azimuth command/feedback prediction errors Alarms and indications for thrusters ready, running and enabled Alarms for unscheduled stop of machinery Alarms for start of a standby pump or other service Control loop failure alarms (input errors) Alarms to indicate that a UPS or 24Vdc battery system is on battery power Alarms to indicate that a backup supply has failed Alarms related to pressure/temperature in cooling water systems Indication that a standby generator is no longer available Alarms to indicate network failure In all cases, refer to the equipment manufacturer for specific instructions. Ensure that proper reactivation protocols for all equipment are developed and properly implemented as outlined within this document or applicable industry guidance. Create a checklist identifying the support and materials required for reactivation testing. Request support well in advance of reactivation. These may include: Technical support Manufacturer or vendor support Third party surveyor/auditor support
MTS%20DP%20-%20DP%20Asset%20Reactivation%20Guidance%20-%20Rep003-B%20-%20MASTER.DOCX