SCHEDULE VIIIRemote Control and Monitoring Systems in Periodically Unattended Machinery Spaces
PART I(Section 4)Design Specifications
Description of Ships
In this schedule,
Group 1 ship means a ship in which machinery is controlled and monitored from the bridge and engineers do not maintain surveillance watch duties in the machinery spaces and that is certificated for the following voyages:
(a) Foreign voyage, Home Trade Class I or II or Inland Waters Class I; or
(b) Home Trade Class III or IV, Inland Waters Class II or Minor Waters where the propulsion total brake power of the ship exceeds 2000 kW;
Group 2 ship means a ship in which machinery may be controlled from the bridge and at least one engineer is on watch in a remote central control room location only and that is certificated for the following voyages:
(a) Foreign voyage, Home Trade Class I or II or Inland Waters Class I; or
(b) Home Trade Class III or IV, Inland Waters Class II or Minor Waters where the propulsion total brake power of the ship exceeds 2000 kW;
Group 3 ship means a ship
(a) that has main propulsion and ship service reciprocating type-internal combustion engines;
(b) in which machinery is controlled and monitored from the bridge or a central control room;
(c) that is certificated for Home Trade voyages Class III or IV, Inland Waters Class II or Minor Waters voyages where the propulsion total brake power of the ship does not exceed 2000 kW; and
(d) in which engineering personnel do not maintain surveillance watch duties within the machinery space.
This Schedule does not apply to Group 1, 2 or 3 ships that are
(b) non-passenger ships fitted with a remote machinery control location, which may be the bridge, where
(i) the machinery space is continuously manned by an engineer maintaining surveillance watch duties who is capable of locally controlling the machinery, and
(ii) bridge-to-machinery-space telegraphic and telephonic communication systems are fitted; and
(c) non-passenger ships fitted with a machinery control location in a room within, or immediately adjacent to, the machinery space where
(i) engineering personnel maintain regular surveillance watch duties within the machinery space, and
(ii) an audible and visual alarm system provides a means to alert engineering personnel to return to the control location room.
DIVISION IIGroup 1, 2 and 3 Ships
Remote and automatic control and monitoring of machinery located in periodically unattended spaces shall offer the same level of safety from remote control locations as would be obtained if the machinery were arranged for continuous local manual control and monitoring by watchkeeping engineers.
Control, monitoring and safety devices and their location shall meet the requirements set out in rules or codes in respect of ship motion, structural vibration and atmospheric environment.
Every enclosed central control location shall have two means of access located remote from each other, except where such enclosures are so small that two means of access are impracticable.
Two sources of power to ensure continuous operation shall be provided for control, monitoring and alarm systems, and
(i) the systems shall be served by at least two exclusive circuits fed directly from the main switchboard, and one of the circuits shall be supplied through the emergency switchboard, where fitted, and these circuits shall not supply power for any other machinery, and
(ii) a main-line disconnect or circuit-breaker for all console power shall be provided in a readily accessible location;
(b) where pneumatic power is used, each source shall consist of an air compressor, separately supplied with power, and an air receiver, both of adequate capacity and arranged to allow cross connection or isolation; and
(c) where hydraulic power is used, these sources shall be separate from any other hydraulic service requirements and each hydraulic pump shall be separately supplied with power.
Failure of control, monitoring and alarm systems or their power supply shall activate an audible and visual alarm at the central control location.
An audible and visual alarm system shall be provided to indicate any fault requiring attention and shall
(a) be capable of sounding an audible alarm in the main machinery control room or at the propulsion machinery remote control location and of indicating each separate alarm function visually at a suitable location;
(b) be connected to the engineers’ public rooms and to each of the engineers’ cabins through a selector switch that connects to at least one of the cabins at all times;
(c) activate an audible and visual alarm on the bridge for any situation that requires action by or the attention of the officer on watch;
(d) as far as practicable, be designed to have fail safe characteristics; and
(e) activate the alarm in the engineers’ public rooms and cabins if an alarm has not received attention locally within a set time.
The alarm system shall be equipped to indicate at the same time more than one fault and the acceptance of an alarm shall not inhibit another alarm.
Acceptance at either of the locations referred to in subitem 6(a) of an alarm shall be indicated at the location where the alarm was activated.
An audible alarm shall sound until it is accepted and the visual indication of the alarm shall remain until the fault has been corrected, after which the alarm system shall automatically reset to the normal operating condition.
Machinery controls shall be designed to remain accurate throughout the operating range and to have fail safe characteristics.
Machinery controls shall be robust and easy to operate, not cause undue stress in systems being controlled and operate in a logical direction and sequence with a detent at the stop or neutral position.
A safety system shall be provided to ensure that a serious malfunction in boiler and other machinery operations that presents an immediate danger initiates the automatic shut-down of the boiler or other machinery and activates an alarm, except that shut-down of the propulsion system shall only be automatically activated in cases that could lead to serious damage, complete breakdown or explosion.
Where arrangements for overriding the shut-down of the main propelling machinery are fitted, the arrangements shall be such as to preclude inadvertent operation, and visual means shall be provided to indicate when the override has been activated.
Remote-controlled machinery systems and periodically unattended machinery spaces shall be equipped as follows:
(a) a fire detection and alarm system shall be fitted that is capable of providing coverage
(d) the remote fire control system shall be operable from an accessible location outside the machinery spaces;
(e) the fire control location shall have instructions posted and all arrangements necessary for the operation of the system including, where applicable, stopping of machinery and fans, closing of valves, starting of remote fire pumps and release of smothering gas;
(f) guards shall be provided to prevent leakage of oil from fuel oil systems from dripping or spraying onto hot surfaces; and
(g) a fuel leakage collector system leading to a collector tank and fitted with an alarm to indicate leakage shall be fitted except where surveillance is required in accordance with item 67 of Subdivision II of Division IV for ships exempted from carrying watchkeeping engineers.
A reliable means of voice communication shall be provided between the main machinery control location or propulsion machinery control location and the bridge, the engineers’ cabins and the engineers’ public rooms.
Propulsion machinery orders from the bridge shall be indicated in the main machinery control room or at the propulsion machinery control station.
Manuals for the proper operation and maintenance of remote control and monitoring systems, containing all necessary information for normal and emergency operation and maintenance shall be provided aboard ship.
Testing procedure manuals for remote control and monitoring systems shall be provided aboard ship and the testing procedures shall
(a) contain step-by-step or check-off stages and not impair the operation of the installed alarms and safety devices after testing under simulated fault conditions has been completed;
(b) specify the frequency of testing, indicate the tools required to complete the testing and the location of the tools in the systems; and
(c) be concise but sufficiently explicit to allow engineering personnel to carry out the testing and interpret the results.
DIVISION IIIGroup 1 and 2 Ships
Internal combustion engines of 2250 kW or more or having cylinders of more than 300 mm bore shall be provided with crankcase oil mist detectors, engine-bearing temperature monitors or equivalent devices.
Where internal combustion engines are used for main propulsion, means shall be provided to keep the starting air pressure at the level required to start the engine.
The number of consecutive automatic attempts that fail to start an engine shall be limited in order to safeguard sufficient starting air pressure and an audible alarm set at a level that permits starting of the propulsion machinery shall be provided to indicate low starting air pressure.
The main source of electrical power shall meet the following requirements:
(a) where the electrical power can under normal conditions be supplied by one generator, suitable load-shedding arrangements shall be provided to safeguard the supplies of power needed by propulsion, steering and safety systems; and
(b) except where impracticable for ships of less than 1,600 tons gross tonnage, in the case of failure of the operating generator, adequate provision shall be made for automatic starting and connecting to the main switchboard of a stand-by generator of sufficient capacity to permit, in sequential operation where necessary, automatic restarting of the essential propulsion, steering and safety systems.
Where electrical power is supplied simultaneously by more than one generator in parallel operation, provision shall be made in case of failure of one of the operating generator sets to keep the remaining generator sets in operation without overload to permit propulsion and steering, and to ensure the safety of the ship.
Where stand-by machines are necessary for the operation of other auxiliary machinery essential to propulsion, automatic change-over devices shall be fitted.
Controls and Alarms
Under all operating conditions the speed, direction of thrust and, where applicable, the pitch of the propeller shall be fully controllable by remote control from the bridge.
The remote control shall be operated by a single control device for each independent propeller with automatic performance of all associated services without causing overload of the propulsion machinery.
The main propulsion machinery shall be equipped with an emergency stopping device on the bridge that is independent of the bridge control system.
The control system shall be such that the services needed for the operation of the main propulsion machinery and its auxiliaries are performed automatically.
An audible and visual alarm shall be activated when the automatic change-over of the control power source is activated.
An alarm system that meets the requirements of items 7 to 9 of Division II shall be provided for all pressures, temperatures, fluid levels and other data essential to the safe operation of the ship.
A centralized control location shall be arranged with the necessary alarm panels and instrumentation to indicate that an alarm has been activated.
Remote control of the propulsion machinery shall be possible only from one location at a time and inter-connected control positions are permitted at each location.
At each location there shall be an indicator showing which location is in control of the propulsion machinery and the transfer of control between the bridge and machinery spaces shall be possible only in the main machinery space or in the machinery control room.
The control system shall include means to prevent, when the system transfers control from one location to another, the propelling thrust from altering to the extent that control of the ship is endangered.
All machinery essential for the safe operation of the ship shall be capable of being controlled locally.
The design of the remote automatic control system shall be such that an alarm is given on failure of the system and, unless impracticable, the preset speed and direction of thrust of the propeller is maintained until local control is in operation.
Indicators shall be fitted on the bridge for
(a) propeller speed and direction of rotation in the case of fixed-pitch propellers; or
(b) propeller speed and pitch position in the case of controllable-pitch propellers.
Bilge wells in periodically unattended machinery spaces shall be located and monitored in such a way that the accumulation of liquids is detected at normal angles of trim and heel, and shall be large enough to easily accommodate normal drainage during an unattended period.
Where the bilge pumps are capable of being started automatically, visual and audible alarms shall be provided to indicate when the influx of liquid is greater than the pump capacity or when the pump is operating more frequently than would be expected under normal conditions.
Where automatic bilge pumps are fitted,
(a) an audible and visual alarm and shut-down arrangement shall be fitted in the system to operate in the event of oil being detected and the shut-down arrangement shall have an emergency manual override capability; and
(b) valves that are open on dry bilges shall be automatically closed so that there is no loss of suction in bilge suction systems.
The position of the controls of any valve serving a sea inlet, a discharge below the water-line or a bilge injection system shall be located to allow adequate time for operation of the controls in case of an influx of water to the space, having regard to the time likely to be required to reach and operate the controls.
Arrangements shall be made to operate the controls from a position above the level to which the unattended space might become flooded when the ship is fully loaded.
DIVISION IVGroup 3 Ships
In this Division, the bridge control station includes the wheelhouse, its top and wings.
Main and Auxiliary Machinery Controls
Control locations shall have a visual indicator to show when they are in command and the central control location shall have monitors and alarms in accordance with items 65 and 66.
The machinery control arrangement shall be such that only one location can be in control at any one time, and with the exception of the override capability referred to in item 8, transfer of control from the central control location to local control shall not be possible until the receiving location has indicated its readiness to accept the intended transfer.
All essential machinery shall be capable of being fully operated locally when remote or automatic control systems are not operating.
Transfer to local control of machinery shall be easily and rapidly accomplished and any material or tools required to effect the transfer shall be permanently located at a convenient location adjacent to the machinery.
Where an engine is arranged to start automatically or by remote control, interlocks shall be provided to prevent starting of the engine under conditions that could be hazardous to the machinery, which conditions shall include turning gear engaged, low lubricating-oil pressure and, where applicable, shaft brake engaged.
Where an internal combustion engine is arranged to start automatically, the number of consecutive automatic attempts to start the engine without success shall be limited in order to safeguard sufficient starting air pressure or in the case of electric starting, sufficient battery power, for local attempts to start the engine.
Main Propulsion Systems
Means shall be provided at the central control location and locally at the engines themselves to stop the main propulsion engines in an emergency and the emergency stopping devices shall be independent of the normal control system and adequately protected against accidental damage or operation.
Local control of the main propulsion engines shall have capability of overriding the remote control systems and there shall be an audible and visual alarm to alert the locations affected by an override in accordance with subitem 65(a)(i).
For ships of not more than 150 tons gross tonnage remote propulsion engine controls are not required to be power-operated and are not required to be in duplicate.
Prolonged running of a main propulsion engine in a restricted speed range shall be prevented automatically or an indication of restricted speed ranges shall be posted at each control location.
In the event of failure of the main steering system there shall be an auxiliary system capable of being brought into operation from the central control location within 45 seconds.
Electrical Power Systems
In the event of failure of the electrical generator supplying ship service power where generated electrical energy is required for essential service, there shall be a stand-by generator capable of assuming all essential electrical load and, for ships in excess of 150 tons gross tonnage, the stand-by generator shall be arranged to assume the load automatically within 45 seconds.
Boilers and Hot-Air Heating Units
Steam and hot-water boilers, hot-air heating units and associated systems shall be capable of automatic operation and of meeting requirements within design limitations under all working conditions.
Automatic operation shall include, as applicable, controls and monitors for fuel flow and temperature, combustion air flow, burner flame, feed-water flow, feed-water contamination by salt or oil, boiler pressure and hot-air heating unit circulating air flow.
The control and monitoring equipment shall be designed to prevent unsafe operation of the boiler or hot-air heating unit.
Any failure of control and monitoring equipment shall prevent continued operation of the boiler or hot-air heating unit and cause the fuel supply to be cut off and an audible and visual alarm to be activated in accordance with subitem 65(e).
A master fuel oil shut-off valve shall be fitted in the fuel supply line and shall close automatically in the event of
A fuel oil shut-off valve shall be fitted to each burner in the fuel supply line and the valve shall close automatically in the case of flame failure or whenever the automatic program requires that the master fuel oil shut-off valve be closed.
Automatic combustion controls shall be fitted to provide an adequate fuel-to-air ratio throughout the operational range.
Where the system is designed to light the initial burner automatically or from a remote location, purging of the combustion chamber and convection spaces shall automatically take place for a period that is sufficient to ensure at least four changes of air, which period shall last at least 15 seconds.
Adequate air flow and the correct position of the air registers and dampers shall be indicated before the purging period starts.
Fuel oil may be ignited by an electrical spark generated by a transformer having an output of not less than 10,000 volts, a glow plug or a light-oil pilot flame that has been electrically ignited.
A means of ignition system described in item 22 shall be provided for burners that are automatically or remote controlled.
The electrical ignition system shall be energized before or simultaneously with the introduction of fuel or light oil and shall remain energized during the trial-for-ignition period referred to in item 25.
Where fuel or light oil is electrically ignited, the flame safeguard control system shall provide a trial-for-ignition period of not more than 15 seconds, during which fuel or light oil may be introduced to the ignition source and, if a flame is not established within 15 seconds, the oil supply valve shall close automatically.
Where fuel oil is ignited by a light-oil pilot flame, the flame safeguard control shall provide a trial-for-ignition period of not more than 15 seconds, during which fuel oil may be introduced to the pilot flame and if a fuel oil flame is not established within 15 seconds the fuel oil supply valve to the pilot flame shall close automatically.
Fuel oil shall not be supplied to a burner before the light-oil pilot flame has been confirmed.
Flame safeguard controls of the thermostatic type operated by means of an open bi-metallic helix shall not be used.
A flame safeguard control shall be provided to each burner so that the fuel oil supply valve can be closed in not more than four seconds in the event of flame failure and the master fuel oil shut-off valve can be closed in the event of flame failure at all burners.
The failure of a component in the flame safeguard control shall cause a shut-down of the burner and the design of the control shall prevent automatic restarting.
The flame safeguard control shall be fitted with an audible and visual alarm in the event of flame failure and the control shall require resetting for restart purposes.
A low-fire interlock shall be fitted to a multi-burner boiler so that the lowest burner is ignited first, and the other burners shall not be ignited until the scanner indicates that there is a flame in the lowest burner.
Automatically operated steam boilers shall be fitted with water-level controls and low water-level limit controls.
Water-level controls and low water-level limit controls may be of the float, electrode probe, thermostatic expansion tube or thermo-hydraulic type.
Water-level controls and low water-level limit controls shall be located to minimize the effect of the roll and pitch of the ship.
The low water-level limit control shall close the master fuel oil shut-off valve when the water level falls to a minimum safe level visible in the gauge glass and the system may include a five-second time delay to avoid shut-down due to the rolling and pitching of the ship.
After operation of the low water-level limit control, manual resetting of the control shall be required before the boiler burners can be re-lit.
Float-operated water-level and low water-level limit controls shall be so constructed that they will not be damaged by water levels above or below the operating range.
The low water-level limit control shall have independent connections to the boiler.
Water-level controls shall be so constructed that the water inlet valve cannot feed water into the boiler through the float chamber.
(b) the low water-level limit control float chamber; or
(c) pipes connecting the float chambers to the boiler.
For controls that are external to the boiler drum, the connections shall be fitted with shut-off valves locked and sealed in the open position and attached directly to the boiler drum.
Subject to item 44, pumps and other components essential for main propulsion engine operation shall have stand-by pumps and components, and for ships of more than 150 tons gross tonnage, the stand-by pumps and components shall be arranged to start up automatically on failure of the operating pumps or other components.
In multi-engined ships where engines have integral pumps, a spare pump readily available for installation may be used in lieu of an automatic-starting stand-by pump.
Air compressors, refrigeration systems and other ship service systems that are essentially independent and self-controlled need not be controlled from a remote control location.
Bilge water high-level audible and visual alarms shall be fitted at the central control location in accordance with subitem 65(f)(vi) and shall monitor the following bilges:
(a) aft port and starboard sides of each machinery space of category A; and
(b) any bilge aft of the collision bulkhead on ships certificated for towing operations.
The bilge pumping systems shall be arranged to function for a reasonable period after the sounding of the bilge high-level alarm taking into account the size of the space bilges.
Where automatic bilge pumps are fitted
(a) an audible and visual alarm and shut-down arrangements shall be fitted in the system to operate in the event of oil being detected and the shut-down arrangement shall have an emergency manual override capability; and
(b) valves that are open on dry bilges shall be automatically closed so that there is no loss of suction in bilge systems.
Subject to item 50, the fire control system shall incorporate at least one fire pump capable of being controlled from the fire control location set out in subitem 14(e) of Division II.
For ships of 150 tons gross tonnage or less a manual fire pump and its controls, including means of opening the sea valve, may be installed in a suitable location on the deck in lieu of a remote-controlled pump.
Where valves in essential systems are normally closed to prevent frost damage to exposed piping, the controls for the valves shall be in readily accessible locations.
Where remote controls for valves are fitted, valve status indicators shall be fitted at the locations for the valve controls and valves located in locations liable to be flooded shall be capable of operating when submerged.
Fuel oil service tanks shall be capable of holding sufficient fuel for the total period of the normal ship operational route or for 24 hours normal operation, whichever is the lesser, at full power, except that where provision is made for automatic filling, the period may be reduced to eight hours.
If fuel tanks are required to be heated, fuel oil temperature shall be monitored and thermostatically controlled or the fuel tanks shall be fitted with a high-temperature audible and visual alarm in accordance with subitem 65(f)(iii).
The central control location shall include monitoring indicators as set out in items 65 and 66.
Where continuously reading indicators are impracticable, demand display types may be fitted.
Direct reading indicators shall be fitted at the location of the machinery.
Where the control system automatically shuts down machinery for any reason, regaining of control following correction of the fault shall not be possible without reset action and without bringing the control to the stop position.
Alarms associated with machinery control and safety shall be clearly distinguishable from fire-alarms and, where possible, the arrangements of the alarms shall be such that the alarm is activated before failure and shut-down occurs.
Where alarms are displayed as group alarms, provision shall be made to identify each alarm at the central control location.
For the detection of transient faults that are subsequently self-correcting, alarms shall lock in until they are accepted.
The alarm system shall be capable of being tested during normal machinery operation.
Disconnection or manual overriding of any part of the alarm system shall be clearly indicated.
Remote Monitoring Indicators
Where applicable and subject to item 66, the following monitors and audible and visual alarms shall be fitted at the central control location:
Ships Exempted From Carrying Watchkeeping Engineers
Ships exempted from carrying watchkeeping engineers under the Safe Manning Regulations where at least one engineer is required to be aboard shall be
(a) powered by reciprocating-type internal combustion engines;
(b) equipped with remote control and monitoring systems that meet the applicable requirements set out in this Schedule;
(c) equipped with central control and monitoring systems suitable for operation by the person assigned steering duties; and
(d) subject to periodic checks of machinery spaces by a crew member other than the person assigned steering duties.
PART II(Section 6)Plans
General arrangement of remote control and monitoring systems showing all connected machinery.
General arrangement of control and monitoring systems, including scanning points and control locations for periodically unattended machinery spaces.
General arrangement of remote control console identifying control and monitoring instruments, gauges and alarms.
Details of electric, pneumatic or hydraulic operational control and monitoring systems, and details of emergency operation arrangements for all machinery required for, or which may affect, the operational safety of the ship and safety of personnel on board.
Details of remotely controlled fire detection, alarm and extinguishing systems.
List of monitor and audio and visual alarm locations and identification of the equipment used and the manufacturer of the equipment.
General arrangement of intercommunication systems linking the bridge, accommodation spaces, service spaces, the central control room and machinery spaces, including the emergency situation alarm for engineers.
List of symbols and abbreviations used in plans in accordance with a recognized and identified code or fully explained in the data supplied.
Operational, maintenance and testing procedure manuals for control, monitoring, alarm and safety devices including duplicate and emergency arrangements.
Data indicating proposed duration of times in a 24-hour period when machinery spaces of Category A will normally be unoccupied and when other machinery spaces, such as steering gear compartments, will not normally be visited.
Data indicating surveillance arrangements on Groups 1 and 2 ships when operating in confined waters.
Data indicating security arrangements to prevent unauthorized actions in periodically unattended machinery spaces.
PART III(Subsection 12(2))Construction and Installation Inspections
DIVISION IConstruction Inspection
DIVISION iiInstallation Inspection
Identification from component inspection certificates before installation is commenced of materials and components.
Witnessing of pressure testing of components as required in accordance with rules or codes.
Verification of correct adjustment and operational condition of securing arrangements and connection of the remote control and monitoring systems to associated systems.
Witnessing of operational tests of the systems including emergency and simulated fault test arrangements in accordance with rules and codes.
PART IVPeriodic General Inspections and Periodic Special Inspections
DIVISION I(Section 19)Periodic General Inspection
Inspection of all securing arrangements and points where leakages and excessive vibration may occur at all control locations and at the machinery itself.
Inspection of connecting systems between control locations and the machinery without complete removal of all protective panels if
(a) the condition of exposed systems parts is adequate taking into account normal wear; and
(b) there is no apparent damage to, or deterioration of unexposed parts of the systems.
Witnessing of tests including emergency and simulated fault tests to confirm that all control, monitoring, alarm and safety devices are in operational condition and correct adjustment.
Witnessing of tests to confirm that systems are operable from all control locations and that the machinery is operable locally.
Witnessing of tests to confirm that duplicate and emergency systems can be rapidly brought into operation on failure of the main system.
DIVISION II(Section 20)Periodic Special Inspection
Subject to paragraph 20(2)(b) of these Regulations, no periodic special inspection is required.