This is a drop-in replacement for the earlier version.
⚡ Relay Protection on Ships
Functions, Settings, and When “Correct” Trips Kill Ships
4
Introduction — Relays don’t protect equipment, they decide outcomes
Relay protection on ships is often taught as a technical subject: functions, ANSI numbers, curves, settings. In reality, relay protection is a decision-making system.
Every relay setting answers one question:
What do we sacrifice first when something goes wrong?
If the answer is “the ship”, the philosophy is wrong — even if the relay operates exactly as designed.
What relay protection is actually for on ships
On land, protection philosophy prioritises:
- asset protection
- fire containment
- restart later
At sea, the priorities invert:
- Preserve propulsion and steering
- Contain the fault locally
- Protect people
- Protect equipment
A relay that trips “correctly” but causes a total blackout during manoeuvring has failed its maritime purpose.
Core protection functions — and what they really do at sea
50 / 51 — Overcurrent (Instantaneous / Time-Delayed)
These are the backbone of shipboard protection.
- 50 (Instantaneous)
Clears high-energy faults quickly. Limits arc flash and fire. - 51 (Time-delayed)
Allows discrimination — but at the cost of time and energy release.
On ships, excessive delay increases:
- arc energy
- fire risk
- switchboard destruction
- blackout probability
64 — Earth Fault / Insulation Monitoring
Most ships operate ungrounded (IT) systems.
An earth fault:
- does not immediately trip
- is an early warning
- is often ignored
This is dangerous. Many catastrophic phase-to-phase faults start as unresolved earth faults.
27 / 59 — Under / Over-Voltage
These protect:
- motors from stall damage
- control systems from collapse
- PMS logic from instability
Disabling undervoltage trips to “ride through” disturbances has repeatedly led to complete system collapse instead.
81 — Under / Over-Frequency
Frequency protection prevents:
- generator pole slip
- mechanical stress
- loss of synchronism
During load changes or fault recovery, frequency behaviour is often the first sign the system is failing.
87 — Differential Protection
Applied to:
- generators
- transformers
- bus sections (where fitted)
Differential protection is fast and selective — but only if CT ratios, polarity, and wiring are correct. Incorrect commissioning has caused both:
- false trips
- total non-operation during internal faults
🔧 Regulatory framework (non-negotiable)
SOLAS Chapter II-1, Regulation 45
“Electrical installations shall be arranged so as to minimize the risk of fire and electric shock.”
This regulation underpins all protection philosophy onboard ships.
IEC 60092-401 / 402
Require:
- protection against overload and short-circuit
- coordination appropriate to system behaviour
- arrangements that limit fire and shock risk
IACS E11 (Class Rules)
Class societies expect:
- a documented protection philosophy
- relay settings aligned with system studies
- evidence of testing and review after modification
Undocumented relay changes are routinely raised as Class deficiencies.
🔻 Real-World Case: MV Dali — Blackout, Protection, and the Baltimore Bridge Collapse (2024)
On 26 March 2024, the Singapore-flagged container vessel MV Dali suffered a total electrical blackout while departing the Port of Baltimore.
With propulsion and steering lost, the vessel struck the Francis Scott Key Bridge, causing its catastrophic collapse.
Six construction workers were killed.
This was not a navigation error.
It was a power system failure with no effective recovery window.
Why this is a relay-protection lesson
While the full investigation is ongoing, the incident highlights the central danger of shipboard protection philosophy:
- A fault occurred
- Electrical power was lost
- Redundancy did not preserve propulsion
- Recovery time exceeded the available stopping distance
From a protection perspective, the critical questions are:
- Why was the fault not isolated while maintaining partial power?
- Why did protection and PMS behaviour permit a total blackout?
- Were settings optimised for equipment protection rather than ship control?
The relays may have operated “correctly”.
The system outcome was catastrophic.
🔻 Real-World Case: Generator Damage After Delayed Overcurrent Trip
In a separate, well-documented incident on a multipurpose vessel, a stator fault developed in a running generator.
Investigation found:
- overcurrent relay time-delayed for “selectivity”
- fault energy sustained too long
- severe thermal and mechanical damage to the generator
The relay operated exactly as set.
The generator was destroyed — and the vessel lost generating capacity for weeks.
This incident reinforces the same truth as MV Dali:
Protection that waits too long trades equipment damage for system survival — and sometimes loses both.
Where relay philosophy fails onboard ships
Common failure patterns include:
- Inherited settings copied from sister vessels
- Over-selective coordination that extends fault duration
- Earth fault alarms ignored because “nothing trips”
- PMS logic fighting protection logic
- Settings adjusted after incidents without system review
Protection that is not periodically reviewed becomes historical fiction.
How professional ETOs think about relays
Instead of asking:
- “Will this trip?”
They ask:
- Where is the ship when it trips?
- What remains powered afterwards?
- How much time do we have before impact, grounding, or loss of control?
Relays are not technical abstractions.
They are risk governors.
Knowledge to Carry Forward
Relay protection on ships is not about protecting copper — it is about preserving control while time still exists.
Every delay, curve, and pickup setting must be judged against one question:
If this operates now — what does the ship lose next?
When protection philosophy allows:
- total blackout,
- slow recovery,
- or cascading trips,
the electrical system itself becomes the hazard.
Tags
ETO, Relay Protection, Marine Blackout, Generator Protection, MV Dali, Protection Philosophy, SOLAS II-1, IEC 60092, Ship Electrical Failures, Accident Case Study