Knowledge / Ship systems

Ship electrical protection: selectivity, short circuits and shared failures

Protection coordination across ship operating modes, fault-current ranges, control dependencies and equipment withstand.

On this page

Electrical selectivity is the ability to isolate a fault without unnecessarily removing healthy parts of a ship’s power system. Achieving it requires more than placing progressively larger breakers upstream. The protection study must connect fault current, operating modes, equipment withstand, control power and the actual consequences of each trip. This article explains those relationships and an illustrative coordination check. It is educational material for technically competent readers, not instructions for live electrical work, relay setting changes or energizing equipment. Those activities require authorized personnel and the ship’s approved procedures.

Start with the service that must survive

A single-line diagram shows electrical connections, but the protection objective should also identify the functions that must remain available. Two pumps may be mechanically independent yet lose power when one shared feeder trips. Separate feeders may still depend on a common control supply. A study that counts components without following these dependencies can claim redundancy that a fault removes in one event.

Define the relevant operating modes: generators connected, bus sections joined or split, shore supply, emergency supply and any battery or converter contribution. The available fault current and the route through protective devices can change between modes. A coordination result valid for a closed bus and three generators is not automatically valid for an isolated section with one generator. The modes allowed by operating procedures must be included in the engineering assessment.

Understand the requirement hierarchy

IEC 60092-202:2016 covers the main features of protective systems for ship electrical installations. The publisher’s public page verifies its scope and edition; it does not provide the full normative text. Its application depends on the governing statutory, classification and contractual framework. A standard’s publication is not, by itself, proof that every clause applies to every vessel.

As an example of classification requirements, the ABS Marine Vessel Rules, Part 4, 2021 archive links system protection to continuity of essential services and requires adequate short-circuit ratings. This historical edition illustrates the principles; it is not represented here as the current rule set for a new project. The applicable edition, vessel notation and approved protection study must be established independently.

Calculate both demanding and weak fault conditions

Maximum prospective fault current is important for interrupting and making capability and for equipment withstand. Minimum fault current is important because a protective device must still detect and clear the relevant fault. Considering only the maximum can overlook a weak-source condition in which a fault produces insufficient current for the assumed fast protection. Considering only normal load current overlooks both questions.

Generator contributions vary with time after fault inception, and connected motors can contribute initially. Converters may limit current or respond according to their controls, so a synchronous-generator assumption cannot simply be transferred to them. IEC 61363-1 describes a calculation framework for unmeshed three-phase marine and offshore AC systems. Its stated scope matters: a different network or technology may require another justified method and suitable manufacturer data.

Read curves as bands of behaviour

A time-current curve relates current to expected protective operation. Real coordination requires allowances for tolerances, relay processing, breaker opening and the device’s total clearing behaviour. Comparing two ideal thin lines can overstate the separation between them. Check whether the plotted values are pickup, operating or total clearing values and whether both devices are expressed on the same voltage and current basis.

Long-time overload protection, short-time protection and instantaneous operation address different regions. Increasing an upstream delay may improve coordination in one region while increasing thermal stress or incident energy. Raising a pickup can leave a weaker fault uncleared for too long. The task is therefore a constrained engineering balance, not an attempt to maximize delay everywhere. Cable and equipment damage limits remain part of the same study.

Selectivity has several mechanisms

Current discrimination uses differences in pickup. Time discrimination allows the downstream device to operate before the upstream one. Energy-based behaviour and zone-selective interlocking introduce additional device-specific relationships. ABB’s selectivity-techniques explanation describes these mechanisms. Manufacturer combinations, ratings and tested limits matter; a general principle is not proof that two arbitrarily chosen devices coordinate.

For current-limiting devices, conventional time-current plots alone may not establish performance at high fault currents. Use the appropriate tested coordination information and verify the exact device versions and settings. Similarly, a backup or cascading arrangement that supports interrupting capability does not automatically provide the desired continuity of supply. State whether selectivity is demonstrated throughout the relevant range or only up to a stated limit.

A worked timing example with explicit assumptions

Consider an illustrative radial feeder with a downstream breaker D and upstream breaker U. At one assumed fault current, the validated study data give a maximum total clearing time of 0.12 seconds for D and a minimum operation time of 0.30 seconds for U. The numerical separation is 0.18 seconds. Suppose the project’s justified coordination criterion requires at least 0.15 seconds under these definitions. The pair satisfies that particular timing check with 0.03 seconds of remaining margin.

This example does not establish full selectivity. The comparison must be repeated across the relevant fault range, including instantaneous regions and other supply modes, and checked against equipment withstand. If the upstream minimum were instead 0.20 seconds, separation would be 0.08 seconds and the assumed criterion would fail. Neither the 0.15-second criterion nor the device times are recommended settings; they are invented values demonstrating how uncertainty and the definition of time affect a conclusion.

Keep protection separate from power management

Protection isolates faults and damaging conditions. Power management can prevent overload by starting generation, limiting demand or shedding selected loads. Both influence availability, but their time scales and objectives differ. A load-shedding function cannot be assumed to clear a cable short circuit, and a feeder breaker should not be used as a substitute for an orderly demand-management strategy.

Review the interaction during generator loss. Remaining sources may experience a step in load while undervoltage, underfrequency and motor protection respond. A technically correct trip on one device can lead to broader loss if the surrounding system was not designed for that sequence. The study should distinguish the initiating fault from consequential trips. Otherwise a blackout may be blamed on the last breaker that opened rather than the dependency that made its opening unavoidable.

Follow control power and measurement paths

A breaker needs more than sound main contacts. Trip coils, close circuits, relays, current transformers, communications and DC supplies participate in the protective function. A healthy power circuit may be unprotected if its trip path has failed; an auxiliary-supply failure can also trigger unwanted loss. Check which protections remain available after the very disturbance they are intended to manage.

Shared dependencies deserve explicit treatment. Two relays on separate feeders may use the same battery distribution branch or a common communications switch. Different product names do not establish independence. Record the failure consequences of these shared elements and the monitoring that reveals their loss. Where communications-assisted protection is used, the degraded or failed-communications behaviour must be understood from the approved design rather than inferred from normal operation.

Treat earth faults according to the actual earthing system

Earth-fault behaviour depends strongly on the distribution system’s earthing arrangement and connected equipment. An isolated system, resistance-earthed system and solidly earthed system can require different detection and response philosophies. It is unsafe to transfer a familiar shore-based rule of thumb to a ship without checking that arrangement. Insulation monitoring and fault isolation also answer different questions and should not be conflated.

A first indication may require prompt investigation even where immediate disconnection is not the intended response. A subsequent fault elsewhere can create a different and more severe current path. That general observation is not a direction to continue operating faulty equipment. The vessel’s approved protection philosophy, hazardous-area requirements and competent electrical assessment determine the response. Diagnostic testing must not expose people or equipment to uncontrolled energized work.

Verify the installed system, not only the calculation

A protection study can be internally correct while the installation differs from its assumptions. Check device identity, trip-unit version, transformer ratios, wiring, supply mode logic and approved settings. Replacement with a similarly rated breaker can alter instantaneous response or coordination. Changes to generator arrangements, large motors, converters or bus operation can also invalidate previous fault-current assumptions.

Verification has layers. Settings inspection checks configuration; relay injection assesses selected measurement and logic functions; breaker testing addresses mechanical and electrical operation; an integrated approved test demonstrates selected interfaces. None should be casually described as proof of the entire protection system. Define the scope, limitations and acceptance evidence of each test. Preserve the approved baseline and record changes so later maintenance can reconstruct why a setting exists.

Balance availability with personnel safety

Selectivity improves service continuity, but fault energy must remain controlled. Delaying an upstream breaker to save healthy loads can worsen the consequences of an internal arc or exceed a component’s withstand. A sound design considers both the protected equipment and the people who operate and maintain it. Arc-flash assessment and safe-work procedures cannot be inferred from a coordination curve alone.

The most common analytical errors are checking one operating mode, comparing nominal breaker ratings, ignoring minimum fault current and treating a curve plot as final evidence. Another is assuming duplicated equipment has independent supplies. A useful final report states the protected zones, credible modes, calculation assumptions, verified device combinations, unresolved limitations and change triggers. The conclusion should say exactly what remains available after the assessed fault, and what has not been demonstrated.

Sources