4 Failure detection and response of control systems

  4.1 Failure detection

  4.1.1 The most probable failures that may cause reduced or erroneous system performance should be detected, and should consider at least the following:

• .1 power supply failure;

• .2 loop failures in closed loop systems, both command and feedback loops (normally short circuit, broken connections and earth faults);

• .3 if programmable electronic systems are used:

  • .1 data communication errors; and

  • .2 computer hardware and software failures; and

• .4 hydraulic locking considering order given by steering wheel or lever.

  4.1.2 All failures detected should initiate an audible and visual alarm on the navigation bridge. Hydraulic locking should always be warned individually unless system design makes manual action unnecessary.

• Note: "Hydraulic locking" includes all situations where two hydraulic systems (usually identical) oppose each other in such a way that it may lead to loss of steering. It can either be caused by pressure in the two hydraulic systems working against each other or by hydraulic "by-pass" meaning that the systems puncture each other and cause pressure drop on both sides or make it impossible to build up pressure.

  4.1.3 Alternatively to 4.1.1.2 and 4.1.1.3, depending on the rudder characteristic, critical deviations between rudder order and response should be indicated visually and audibly as steering failure alarm on the navigating bridge.

  4.1.4 The following parameters should be monitored:

• .1 Direction: Actual rudder position follows the set value.

• .2 Delay: Rudder's actual position reaches set position within acceptable time limits.

• .3 Accuracy: The end actual position should correspond to the set value within the design offset tolerances.

  4.2 System response upon failure

 The most probable failures, e.g., loss of power or loop failure, should result in the least critical of any new possible conditions.