1. Introduction

The International Maritime Organization has established an air pollution regulation scheme by enforcing NOx Tier III, which aims to reduce the NOx emissions from marine vessels by 75 % or more. Moreover, this standard aims to achieve a reduction in the carbon dioxide emitted from vessels of 40 % by 2030 compared with 2008 and 70 % by 2050. Owing to the strengthened environmental regulations, the demand for eco-friendly vessels has increased sharply, and the demand for electric propulsion systems based on eco-friendly elements, such as variable-speed engines, direct current (DC) distribution systems, and fuel cells, has increased. This trend is spreading to various types of vessels, as well as offshore plants, cruise ships, and icebreakers that have conventionally used electric propulsion systems. Furthermore, redundancy configurations are mainly adopted to increase reliability and facilitate onboard arrangement. Particularly, the power management system (PMS) is an important component of electric propulsion vessels. As a top-level automation system that manages and operates the electric power of the vessel reliably and efficiently, a PMS requires several algorithms for functions, such as restricting load on high-load equipment, preventing blackout, and auto-piloting based on load changes (Bø, 2016).

Failure modes and effects analysis (FMEA) is a risk assessment method developed by the U.S. Department of Defense to evaluate the reliability of devices. It analyzes the failures, effects, results, and causes that may occur in designed products and is applied mandatorily to offshore plant equipment. In recent years, the use of FMEA has expanded to regular commercial vessels as well, owing to the demands of shipowners and insurance companies. FMEA basically analyzes the cause of the failure, identifies the diagnosis and measures, and evaluates the risk and frequency of occurrence. However, the FMEA of marine vessels analyzes the failures of equipment and the resulting damage to the redundancy system, as well as the entire system, to conserve propulsion as a top priority. As the engine, electric power system, and propulsion system are intricately linked in an electric propulsion vessel, a single failure may lead to secondary damage and escalate to the failure of other systems. Therefore, analysis and research in this regard are important.

The digital twin technology predicts outcomes in advance by implementing real equipment or space in a virtual world like twins based on the Fourth Industrial Revolution technologies, such as the Internet of things (IoT), big data, and artificial intelligence (AI); integrating real-world information and data with the virtual world; and simulating situations that can occur in a real environment on a computer. Studies are being actively conducted on cloud-platform-based three-dimensional integrated information and virtual vessel models to ensure the safety of vessels and develop technologies (Giuffrida, 2019).

In this study, we applied the ship redundancy FMEA method suggested for ship classification and certification to the redundant PMS of electric propulsion vessels for the digital twin technology development for electric propulsion vessels. Accordingly, we analyzed the optimal system configuration to ensure the safety and reliability of electric propulsion vessels (Sørensen, 2012). Furthermore, by investigating the failures that can occur in electric power supply systems under real operating conditions, we analyzed the primary and secondary damages of a single equipment failure and the impacts on the entire system. Then, we proposed an algorithm to prevent additional damages and verified that the proposed algorithm improved propulsion conservation, which is the most important element in vessels (Radan, 2008).

2. FMEA of Vessel

2.1 Concept of FMEA

FMEA is the most common method of assessing the reliability of devices. It refers to analysis performed from an empirical perspective to achieve the optimal standards by assessing the reliability in the prevention aspect, which is performed in the design stage of a system or component. It is useful for identifying product/system failure modes and causes, as it predicts the causes and results of the impacts on the system based on the measures and methods that can cause failure in some parts of the system in an unintended way and analyzes their process elements or structures in detail. It is widely used as a method of assessing the risks of design, process, and system across all industries.

The most common technique in FMEA is the risk priority number (RPN) methodology, which lists and groups all possible failures in the system. Furthermore, it determines the severity (SEV), occurrence (OCC), and detection (DET) and calculates the RPN for each effect, as shown in Eq. (1), to select the RPN with a high SEV. A plan is established and executed to reduce or eliminate the risk of failure for the selected RPN, and the RPN is recalculated.

The FMEA proceeds in three steps classified according to the IEC 60812 guidelines: preparation, performance, and finishing.

2.2 FMEA of Vessels

Among three types of FMEA, namely, design FMEA, process FMEA, and equipment FMEA, the equipment FMEA, which analyzes the final operating status of the vessel, forms the basis for the FMEA of vessels. This type of FMEA analyzes the risks in terms of vessel operation to reduce the risks and damages. The entire system of a vessel is divided into the fuel supply, seawater cooling, freshwater cooling, lubricating, air compression, power distribution, automation, and emergency firefighting systems to analyze their risks. The analysis is performed based on the main machines that affect the system, such as the main engine and auxiliary machines, which are individual machines (IMCA, 2016).

In the vessel FMEA, after identifying the failures of elements of the entire system of the vessel, the operating conditions and status of the vessel are provided. Then, the effect of each failure on the entire system is identified to determine the impact on the propulsion power, which is the most important element in the vessel. FMEA tests should be performed in real operations based on the FMEA documents. Furthermore, the types, causes, and results of failure that can occur in the system should be recorded, documented, and maintained on the vessel.

3. Redundancy System of Vessels and FMEA

3.1 Redundancy System of Vessels and Class Required for Ship Classification and Certification

Redundancy is the concept of having spare devices. By having redundant systems for important components of the entire system, the loss of the function of the entire system is prevented using spare equipment, even if a problem occurs in a component being used, thereby supplementing safety in double and triple layers. The most important element in a vessel is the conservation of propulsion power during operation, and the redundancy scheme in the vessel is based on additionally installing a propulsion system to secure the propulsion and increase the reliability. In vessels, classes are divided by the redundancy propulsion in terms of redundant propulsion and steering systems. DNV-GL has defined them in Part 6.2.7 “Redundant Propulsion,” and Lloyd in Part 1.14 “Redundant Propulsion and Steering System:” the classes are defined by dividing into RP(1, X), RP(2, X), and RP(3, X). The classes of offshore plants are also classified into DP0, DP1, DP2, and DP3 based on the redundancy of dynamic positioning (DP). Fig. 1 shows a conceptual diagram of RP1, RP2, and RP3 for propulsion system redundancy (DNV-GL, 2012).

3.2 FMEA for Vessels with Redundancy System

According to DNV-RP-D102, in the FMEA of system redundancy in DNV-GL, a group is assigned to each redundancy, and each group should be configured as an independent system, as shown in Fig. 2. When the result of a system failure affects only the system internally, it is called a primary failure (IEC 191-04-15), whereas when it also affects other systems, it is called a secondary failure (IEC 191-04-16), as shown in Fig. 3. Ideally, a failure should only affect the system of the assigned group and should not affect other systems. A single failure and its results should be minimized so that they will not lead to a critical outcome (DNV-GL, 2014).

In electric propulsion vessels, redundant systems need to be set up so that a single failure will not cause the loss of propulsion or the blackout of the entire vessel. Therefore, the system should be configured to prevent the spread of the effect of the failure of each machine to the entire system and should be designed to prevent secondary damage based on the fault diagnosis and the FMEA of individual machines (DNV-GL, 2017).

4. FMEA for PMS of Electric Propulsion Vessels

4.1 PMS of Electric Propulsion Vessel

A PMS is a control device system for managing the electric power system of a vessel, with the aim of efficiently and safely managing the electrical energy of the vessel. As a control device of a high system level that controls the governor, automatic voltage regulator (AVR), breaker, power distribution protection device, and power conversion device, it distributes the electric power of the vessel in a balanced and efficient manner and facilitates the monitoring and control of all the power system functions of the vessel. Recently, its use has expanded into the domain of power energy management systems (PEMS) for controlling and managing energy storage systems, such as battery-fuel cells, which are new energy devices of vessels.

A PMS consists of a power source control for producing electric power, such as diesel generators, and fuel cell batteries; a power management control for managing the breaker and energy conversion device for the distribution of power at the switchboard, and a load control for managing the power consumed. The target of the load control varies depending on the characteristics of the vessel. Propellers or thrusters must be included in electric propulsion vessels, and ballast water transfer pumps, main seawater cooling pumps, or cargo transfer pumps fall into this category depending on the vessel. Fig. 4 shows a schematic of the PMS of an electric propulsion vessel (Zahedi, 2014).

4.2 FMEA for PMS Redundancy

The PMS redundancy is designed by using redundant coils of the power converter and electric propulsion motor, as shown in Fig. 5, so that even if a problem occurs in the coils, the remaining system can maintain its propulsion. In (a), as a power converter and a propulsion motor are configured into a system, the entire propulsion power can be lost owing to the failure of one unit. In (b), the redundancy is implemented through a double winding of two inverter units and a propulsion motor in two transformers and power converters to conserve propulsion, even when one unit fails. In (c), the propulsion conservation is further enhanced through a double winding of two transformers, power converters, and propulsion motors in case a unit fails (Lloyd, 2000).

Fig. 6 shows the power system of the RP2 electric propulsion system tested in this study. Four 8,500 kW generators and two 10,500 kW propulsion motors were installed in a redundancy scheme, and Group A and Group B were divided by grouping two generators, a propulsion motor, and a propulsion propeller. The bus tie is a common part that connects Group A and Group B. Fig. 7 shows the overall power system. And Table 1 shows the FMEA worksheet based on Fig. 7.

5. Improvement After FMEA for PMS of Electric Propulsion Vessels based on Actual Operation

5.1 Improvement After FMEA for Overload Prevention Function of PMS

A PMS should be able to limit the load of the propulsion motor by calculating the load in real time based on the power generation capacity, current power generation, etc. In the case where the propulsion motor is operating in a state where the generator power is insufficient and there is no overload prevention function in the PMS, the load of the generator may exceed 100 %, as shown in Fig. 8. In this case, even if the load-dependent start function is activated in the standby generator, a blackout may occur due to the overload of the generator, unless the operator manually pulls down the lever of the propulsion system quickly on the bridge to reduce the load of the propulsion motor because of the time required for the initial start of the power generator. Table 2 shows a worksheet for the FMEA of the PMS in a state where the generator power is insufficient.

As the power generator should be operated without overload by the PMS, we propose a function that limits the load of the propulsion motor to 70 % in a state where the generator power is insufficient, as shown in Table 3, based on the FMEA. Furthermore, as shown in Fig. 9, we have confirmed that, even if the generator power is insufficient, the propulsion can be maintained safely until the additional generator is operated by the load-dependent start function without the need for the operator on the bridge to control the level of the propulsion system manually.

5.2 Improvement After FMEA in the Event of Generator Pre-warning in High-load Operating Condition

Fig. 10 shows that, in a state where the propulsion motor is operated at maximum power and the generators are operated in parallel at a high load of 85 %, the pre-warning function is activated owing to the failure of a generator to reduce the load; however, the output power of the other generator that is already operated in a high-load condition reaches the maximum, and consequently, the load is divided smoothly. Table 4 shows the FMEA worksheet for this situation.

The problem was analyzed through FMEA, and in the case where the load of the generator that has failed cannot be taken over by the other generator, we have demonstrated that additional damage can be prevented by lowering the power consumption of the propulsion motor to reduce the power loads of the failed generator and the operating generator so that the loads of the generators can be divided gradually, as shown in Fig. 11. Table 5 shows the worksheet for the improved FMEA.

5.3 Improvement After FMEA in the Event of Generator Failure without Pre-warning

Some generator failures may occur without pre-warning, including failures that require immediate trips (e.g., mechanical failures, such as overspeed protection, and electrical failures, such as current overload and AVR failures). In the case where a generator operating at maximum output fails without pre-warning at a 100 % load of the propulsion motor and a 78 % load of the generator, the total load is reduced by the 78 % load of the failed generator. Therefore, the remaining load is handled by the other generator, and the load reaches its peak instantaneously. We expected that the load-limiting function controlled in real time would reduce the total load. However, the actual test result shown in Fig. 12 demonstrates that the load changes after a trip owing to the generator failure, and if the governor’s response performance is slow, a blackout may occur. Table 6 shows the worksheet for the FMEA in this situation. To rectify this problem, we applied an event base fast load reduction (EBFR) algorithm that reduces the load at the moment the breaker is open in an abnormally high-load condition by identifying the open/close state of the breaker. Accordingly, it was confirmed that the total power is maintained stably by reducing the load of the propulsion motor at the moment of tripping caused by the generator failure, as shown in Fig. 13. Table 7 shows the worksheet for the FMEA in this situation.

6. Conclusion

In the FMEA for the validation of the PMS of an electric propulsion vessel, it is important to ensure that a single failure of an electric propulsion system module will not affect the entire electric propulsion system so that the vessel will not lose its propulsion power. Furthermore, the FMEA should be documented and verified through actual test operations.

In this study, we used FMEA to validate the PMS redundancy for the digital twin technology development of electric propulsion vessels. Then, based on the redundancy FMEA standards suggested for the ship classification and certification, we tested the overload prevention function of the PMS and the failures of a generator with/without pre-warning in high-load operating conditions under actual ship operating conditions. Based on FMEA, we analyzed the primary damage, secondary damage, and overall system effects for single equipment failures of the PMS to examine the causes. Then, we proposed the role and algorithm of the PMS as a compensation function for preventing additional damage through the PMS function. Furthermore, through actual operating tests, we verified that the propulsion conservation of the electric propulsion vessel was improved based on the improved FMEA and the proposed algorithm, increasing the reliability and safety of the PMS of the electric propulsion vessel.