Heater for davit’s hydraulic tank —

Investigation of fault
Problem description
The davits for both rescue boats and the fast rescue boat (FRB) are driven each by an hydraulic
system. The energy to operate the hydraulic cylinders is stored in cylindrical pressure reservoirs
which are partially filled with hydraulic fluid. Each of the reservoirs also contains a bladder made
from elastomer which is filled with pressurised nitrogen at over 10 MPa. The expansion of these
bladders delivers the energy to swivel out the boats. After expansion the reservoirs are repressurised
by the main hydraulic pump for the next operation of the davit. For repressurisation of the reservoir
a considerable volume of hydraulic fluid is necessary. This is provided by a large tank below the
hydraulic pump. As the whole hydraulic arrangement is exposed to the varying climate outside the
ship’s hull it is necessary to maintain certain conditions inside it. To keep the viscosity of the
hydraulic fluid inside necessary limits there’s a heater and a sensor in the tank to prevent increase of
viscosity in cold environments.

On the evening of the 9th of April the bridge personnel received an automated alarm from the
hydraulic system of the FRB’s davit. On close inspection the control cabinet showed an alarm for an
inacceptable oil temperature. It did not reveal whether it was too high or too low. However sensory
check showed a temperature significantly above environmental temperature.

Troubleshooting
The temperature increase was confirmed by the fitter and the ETOA. The temperature sensor
showed more than 40°C. It was assumed that the heater had been operated and the temperature
therefore had increased above a programmed alarm level. The schematic was consulted to identify
the breaker which hadn’t tripped.

The schematic was consulted again to identify the contactor responsible for the heater. It was found
the contactor was operational, i.e. had no welded contacts, and that it was energised. The circuitry
seemed to exhibit inconsistent behaviour. As there was no PLC involved the root cause was guessed
to be related with the temperature switch measuring the fluid’s temperature and issuing a
errouneous signal to the contactor.

Considerations were made if the root cause should be tracked down instantly. However the ambient
temperature at 5° South were around 27°C so it was safe to assume that the fluid wouldn’t fall below
a critical temperature soon. Thus and because of the time having passed 8 pm already it was decided
to postpone the investigation until the next day. The circuit breaker for the heater was then switched
off and the nautical officer on duty was informed that the alarm would persist until final resolution of
the failure.

Root cause analysis

At the next day the schematic was studied in depth. It was found that the temperature sensing
element is directly connected to a relay triggering the temperature alarm as well as to the contactor
for the heating element.
The temperature switch
The temperature sensing element is a programmable temperature switch with two digital signal
outputs. The device can be programmed with two reference levels for each digital output. The
outputs can be defined as normally open (NO) or normally closed (NC). Two functions can be
assigned, either a window function or a hysteresis. Additionally a delay can be set for every output’s
activity.

It was found that the switch one was set to hysteresis mode, the switching level was set to 33°C and
the reset level to 28°C. The output was configured as NO. No delays were applied.

The switch two was found set to exactly the same values.

The wiring
Switch one is connected to the solenoid of relay 7K4. This relay has an NO contact which is in series
with all NO contacts from other relays responsible for alarms. Hence if all conditions are normal the
circuit is closed through all NO contacts of all alarm relays. The circuit then powers the solenoid of
the relay for the collecticve alarm. The alarm is evaluated at the bridge through a circuit with
negative logic, i.e. a closed circuit is, again, interpreted as absence of alarm conditions.

If any of the relays for the alarm conditions is switched off, loses power or fails to operate, the alarm
circuit is interrupted. Subsequently the relay for the collective alarm will fall back as well opening the
circuit to the bridge electronics.

This means if the temperature switch opens contact #1 a collective alarm will be issued and the
alarm light on the panel will indicate an inacceptable oil temperature because 7K4 is deenergised.

Switch two is connected to a three phase contactor operating the heating element inside the tank. To
operate the heater the contact #2 must be closed by the temperature switch.

Evaluation
The heater should be operated only when the temperature of the fluid is below a certain limit. To
prevent the heater to switch on and off rapidly wearing out the contactor unduly a certain hysteresis
is desired. I.e. it should start when the temperature drops below a limit A and stop when the
temperature rises over a limit B. A must be lower than B. However the output of the temperature
switch had to be programmed to be normally closed, too, which it wasn’t. On the contrary with the
switch being programmed as NO, the heater instead could be operated only above the higher limit B.

The alarm should be issued if either the temperature drops and the heater isn’t capable of
preventing this for any reason or if the heater doesn’t switch of even if the upper limit is exceeded.
As both limits A and B for the heater operation are part of normal operation’s condition the limits C
and D for the alarm have to be wider. I.e. C has to be set below A and D over B.

As for the operation of the heater a very frequent activation and deactivation of an alarm around
one of the limits isn’t desired measures have to be taken against fluttering signals. This can be done
by adding a time delay to the temperature alarm. Excess of temperature limits is a very slow process
considering the volume of fluid. Hence delaying the temperature alarm by 5 or 10 minutes won’t lead
to extreme increases or drops until alarm. However a slowly rising temperature will cross the limits
and present a stable signal after such a delay.
Solution
The first switch controlling the heater will be set to NC with selected limits to ensure operation
below the desired temperature limit. The hysteresis range should be big enough to reduce excessive
switching. The original values (A=28°C and B=33°) seem to have a reasonable distance but are
unneccessary high. A=20°C and B=25° seem more usable. The fluid used is liquid still way below 0°C.

The second switch should issue an alarm significantly below or above these limits. C=17°C and D=28°
could be tested. The operation mode of the switch should be windowed and the output should be
configured as NC.

Zeitraum:

Zeitbedarf: 7,5 Stunden

Datum Unterschrift ETOA Unterschrift Leiter der Maschinenanlage