What You Should Learn

  • Which generator measurements come from the engine, alternator, breaker and PMS.
  • The difference between an alarm, breaker trip and engine shutdown.
  • Which faults commonly stop a main generator and which faults remove it electrically from the bus.
  • Why the first event in the alarm history matters more than the list of alarms visible after the engine has stopped.
  • Why emergency-generator shutdown logic must not simply copy the main-generator protection scheme.

One Generator, Several Protection Systems

A generator alarm appears on the vessel-management screen and the set drops off the bus. Within seconds the alarm list fills with low oil pressure, underfrequency, undervoltage and breaker-open indications.

It’s easy to misidentify the cause if you look at the wrong alarm. Once the engine starts slowing down, several perfectly healthy monitoring channels will report abnormal values. You need to determine which protection acted first in the list, and why.

A diesel generating set is normally watched by several systems at the same time. The engine ECU or safety system monitors the prime mover. Electrical protection monitors the alternator and its connection to the switchboard. The PMS determines whether the set is available, connected and carrying its share of load. The VMS/AMS or alarm system then presents much of that information to the crew.

Understanding which system owns each protection function makes generator faults much easier to investigate.

What Is Being Monitored?

A typical classed generator installation can contain dozens of measurements. Below are some of the primary examples:

Area Typical measurements and feedback What they tell you
Engine speed and start system RPM, overspeed device, start failure, starting-air pressure or battery condition Whether the prime mover can start, accelerate and remain within safe speed.
Lubrication Lubricating-oil pressure and temperature, filter differential pressure, sump level where fitted Whether bearings and moving parts are receiving adequate lubrication.
Cooling Coolant outlet temperature, coolant pressure or flow, seawater or low-temperature circuit status where fitted Whether heat is being removed from the engine.
Combustion and fuel Exhaust-gas temperatures, fuel pressure, high-pressure fuel leakage, common-rail pressure where applicable Combustion balance, fuel-system condition and leakage faults.
Crankcase and bearings Oil-mist detection or bearing-temperature monitoring on engines where required Early warning of bearing distress and crankcase explosion risk.
Alternator Voltage, current, frequency, kW, kvar, power factor, winding and bearing temperatures Electrical loading, excitation condition and thermal condition of the machine.
Electrical protection Overcurrent, short circuit, reverse power, undervoltage, earth fault and differential protection where applicable Faults that require the generator to be disconnected from the bus or de-excited.
Breaker and PMS Breaker open/closed/tripped, spring charged, generator ready, available, synchronised, auto/manual and common trip Whether the PMS can start, connect, load and unload the set.

The value shown on the VMS is not likely to be the same signal used for shutdowns. A pressure transmitter may provide the displayed value while a separate pressure switch or ECU channel initiates the safety action. The approved drawings and cause-and-effect should show how the fitted system is arranged.

Alarm, Breaker Trip and Engine Shutdown Are Different Actions

These terms are often used loosely onboard, but they describe different responses.

Protective action What happens Typical purpose
Alarm The condition is reported to the operator. The set may continue running. Give the engineer time to investigate or take load off the machine.
Load reduction or load shedding The PMS reduces generator loading or disconnects non-essential loads. Keep the running plant within available generating capacity.
Generator breaker trip The generator is disconnected from the switchboard. The engine may continue running unloaded. Clear an electrical fault or stop the machine motoring (reverse power) from the bus.
Engine safety shutdown Fuel is shut off and the prime mover stops. Prevent serious mechanical damage, fire or a hazardous engine condition.
Emergency/manual stop A crew member or external safety circuit stops the engine directly. Provide a deliberate means of stopping the machine when continued running is unsafe.

A breaker trip therefore does not automatically mean the engine protection operated. Reverse power, for example, normally acts on the generator circuit breaker. Low-low lubricating-oil pressure is an engine condition and may shut the prime mover down.

Typical Main-Generator Protection

The following table shows common protection behaviour on diesel-driven shipboard generators. It is a guide to the logic, not a universal trip schedule. The approved vessel documentation and manufacturer settings take precedence.

Condition Typical response What the engineer should check
Low lubricating-oil pressure First-stage alarm; a lower second-stage value may shut down the engine. Local mechanical pressure, sensor channel, oil level, filters, pump and actual engine condition.
High coolant temperature Alarm followed by shutdown at a higher threshold on many main generating sets. Local temperature, coolant level, pumps, heat exchanger, seawater flow and sensor accuracy.
Overspeed Rapid engine shutdown through the overspeed protective device. Governor/control failure, fuel rack operation, sudden load loss, magnetic pickup sensor.
Oil mist or critical bearing condition Alarm and, for relevant engine arrangements, automatic shutdown. Do not repeatedly restart until the crankcase/bearing condition has been investigated under the engine maker's procedure.
Reverse power Generator breaker trip after the protection delay. Fuel/governor response, load sharing, breaker event log and protection relay.
Short circuit or severe overcurrent Breaker trip; larger or HV machines may also be de-excited by dedicated protection. Protection-relay first event, fault location and coordination with downstream protection.
Undervoltage Breaker trip where required by the generator protection scheme. AVR, excitation, speed/frequency, sensing fuses and actual bus condition.
Generator overload PMS load shedding or load redistribution should normally act before thermal protection has to remove the generator. Online load, spinning reserve, load-sharing system and recent large-load starts.

The engine and electrical protection therefore work together but do different jobs. A healthy engine can be taken off the bus by an electrical relay. A mechanically unsafe engine can be shut down even when the alternator and breaker are electrically healthy.

Why First-Out Indication Matters

When a diesel engine stops, lubricating-oil pressure falls. Frequency falls with engine speed - Alternator voltage may collapse - The breaker opens. Those events can generate new alarms after the actual cause.

A useful protection system records the first-out condition or preserves an event sequence with reliable timestamps. When investigating a trip, capture that information before resetting controllers or clearing alarms.

For a generator trip, try to obtain:

  • the engine ECU shutdown code;
  • the generator-controller or safety-module first-out indication;
  • PMS and VMS event history;
  • protection-relay trip record;
  • breaker trip cause;
  • actual local pressure and temperature readings where available; and
  • the sequence in which the events occurred.

The initiating fault is often clear once the records are placed in time order.

Worked Example: Several Alarms, One Actual Cause

Generator 2 is carrying hotel load when it suddenly comes off the bus. The PMS starts Generator 3 and restores the power. On the alarm page, Generator 2 now shows high coolant temperature, low lubricating-oil pressure, underfrequency and undervoltage.

Looking only at the active alarms does not tell the engineer what happened first.

The event history shows high-high coolant temperature from the engine safety system before the shutdown command. The breaker opens as the engine stops. Underfrequency follows, then lubricating-oil pressure falls as the oil pump slows.

A local temperature check confirms that the engine had genuinely overheated. Inspection finds poor cooling-water flow caused by a partially blocked seawater strainer.

The low oil-pressure alarm was real, but it was a consequence of the engine stopping. It was not the reason the generator was removed from service.

The Emergency Generator Is Deliberately Different

A standby main generator and an emergency generator do different jobs. The standby set helps restore the vessel’s normal electrical supply. The emergency set provides an independent supply for designated safety services when the main supply is lost.

That difference affects where the set is installed, what it powers and which engine faults are allowed to stop it.

Main Genset or Emergency Genset?

The comparison below describes a typical classed diesel installation. The vessel’s approved arrangement determines the details.

What changes? Main generating sets Emergency generating set
Loads supplied Normal ship services: machinery, hotel loads and propulsion where electrically driven. Designated emergency services, such as emergency lighting, communications and fire detection, plus pumps or steering where required. Its required duty is emergency loads, not the full hotel load.
Independence Part of the normal generating plant and its service arrangements. Separated from the main plant, with independent fuel and starting arrangements. Its cooling and other essential services must remain available during the emergency situation which has initiated it’s coming online.
Blackout response The PMS may start a standby set and reconnect it to restore the main switchboard. In a typical automatic arrangement, the emergency switchboard’s normal main-board feed disconnects, the emergency set starts, and it connects to supply emergency loads.
Low oil pressure or high coolant temperature Commonly produces an alarm, followed by engine shutdown at a more severe threshold, according to the fitted protection scheme. Produces an alarm. Under the emergency-duty rules described below, additional automatic engine shutdowns are overridden so these conditions do not automatically remove emergency power.

For the supply and separation requirements, see ClassNK Part H, sections 3.3–3.4. Yacht-specific arrangements also matter: REG Yacht Code Part A, sections 8A and 8B distinguishes smaller yachts from those of 500 GT and above.

Why Some Engine Faults Alarm Instead of Stopping the Set

On a main genset, shutting down a distressed engine can protect the machinery while another set takes over. During an emergency, stopping the emergency set may also remove the electrical services needed to deal with the emergency.

For engines within its scope, IACS UR M63 requires additional engine shutdowns, except overspeed, to be automatically overridden when the engine is in automatic or remote-control mode during navigation. This is an approved control function, not an instruction for crew to bypass a protection circuit. The same requirement retains local stopping and fuel-control arrangements outside the space. See IACS UR M63 Rev.1, section 3.

ClassNK’s current rules list low lubricating-oil pressure and high cooling-water or cooling-air temperature as emergency-engine alarms, with indication locally and on the bridge. Its shutdown-override requirement excludes overspeed protection. Required overspeed shutdown remains active; it is not one of the functions to disable for emergency duty. See ClassNK Part D, section 18.5.2 and Table D18.2.

An alarm still requires attention. Keeping the engine running does not make low oil pressure or overheating harmless.

What This Means for the Engineer or ETO

Keep engine shutdown logic separate from electrical protection. Overriding an engine shutdown does not disable the generator’s short-circuit protection or authorise bypassing switchboard protection. Breaker trips and overload responses must follow the approved electrical scheme. See ClassNK Part H, section 2.3.

Before testing or changing settings, establish:

  • which conditions alarm, stop the engine or trip its breaker;
  • which shutdown overrides operate in each control mode; and
  • how the set is returned to its approved automatic-ready condition after testing.

Use the vessel’s approved cause-and-effect, applicable flag/class rules and manufacturer’s emergency-duty configuration. Do not copy the main-genset shutdown settings onto the emergency set.

Testing Sensors and Protective Actions

Generator protection should be tested as a chain, not just as individual sensors.

A planned test may use:

  • a calibrated pressure source for pressure switches or transmitters;
  • a temperature simulator, resistance box or manufacturer test function for temperature channels;
  • a loop calibrator for 4–20 mA inputs;
  • protection-relay secondary injection for electrical trips;
  • breaker test functions and event logs;
  • engine-controller diagnostic or simulation functions approved by the manufacturer.

Compare the test value with the alarm setpoint, time delay and action shown in the cause-and-effect. Confirm whether the result is an alarm, breaker trip, engine shutdown or PMS action.

Overspeed testing needs particular care. Follow the engine and class-approved test method rather than improvising by manipulating the governor or running the engine beyond normal speed without a defined procedure.

After testing, remove every bypass, simulation and override. Confirm normal sensor values, clear the test alarms, restore the PMS to its intended mode and record the result.

Generator Trip Evidence

Record What to capture
First-out event Exact initiating alarm or trip and timestamp.
Engine data ECU code, RPM, lube-oil pressure, coolant temperature and other relevant values before and after the event.
Electrical protection Relay trip cause, voltage, current, frequency, reverse power or fault record as applicable.
Breaker status Open/closed/tripped state and breaker event record.
PMS response Standby-generator start, load shedding, load transfer and restoration sequence.
Physical checks Local gauges, leaks, cooling flow, filters, belts, pumps and engine-room observations.
Configuration Setpoints, delays, cause-and-effect revision and software/configuration version.
Close-out Repair, functional test and confirmation that all overrides and bypasses were removed.

Applicability Note

This article describes common arrangements on classed diesel-driven shipboard generating sets. Exact sensors, setpoints and protective actions depend on the engine and alternator manufacturer, generator rating, voltage, vessel class, flag, automation notation and whether the set is a main, standby or emergency source.

Use the approved protection study, generator cause-and-effect, engine and alternator manuals, class rules and vessel-specific test procedures as the controlling information. High-voltage generation and protection-relay testing require additional competence and procedures beyond the scope of this article.

References

  1. IMO — International Convention for the Safety of Life at Sea (SOLAS), Chapter II-1

https://www.imo.org/en/about/conventions/pages/international-convention-for-the-safety-of-life-at-sea-%28solas%29%2C-1974.aspx

2. IEC 60092-504:2026 — Electrical installations in ships — Part 504: Automation, control and instrumentation

https://webstore.iec.ch/en/publication/68493

3. IEC 60092-202:2016 — Electrical installations in ships — Part 202: System design — Protection

https://webstore.iec.ch/en/publication/25899

4. IACS UR M3 Rev.7 — Speed governor and overspeed protective device

https://iacs.org.uk/resolutions/unified-requirements/ur-m/ur-m3-rev6-cln

5. ClassNK — Rules and Guidance for Automatic and Remote Control Systems

https://www.classnk.or.jp/HP/en/publications/pub_rule_g.aspx?book_code=erul15-490

6. ClassNK — Amendment on Automatic and Remote Control of Machinery, 26 December 2024

https://www.classnk.or.jp/hp/pdf/rules/amendments/e-amend/20241226/24-3-09e_am.pdf

7. Lloyd's Register — Rules and Regulations for the Classification of Ships, July 2026

https://www.lr.org/en/knowledge/lloyds-register-rules/rules-and-regulations-for-the-classification-of-ships/