DNV-OS-D202【2014】Automation, Safety, and Telecommunication Systems

DNV-OS-D202

Automation, Safety and Telecommunication Systems

JULY 2014

The electronic pdf version of this document found through http://www.dnv.com is the officially binding versionDET NORSKE VERITAS AS

FOREWORD

DNV is a global provider of knowledge for managing risk. Today, safe and responsible business conduct is both a licenseto operate and a competitive advantage. Our core competence is to identify, assess, and advise on risk management. Fromour leading position in certification, classification, verification, and training, we develop and apply standards and bestpractices. This helps our customers safely and responsibly improve their business performance. DNV is an independentorganisation with dedicated risk professionals in more than 100 countries, with the purpose of safeguarding life, propertyand the environment.

DNV service documents consist of among others the following types of documents:—Service Specifications. Procedural requirements.—Standards. Technical requirements.—Recommended Practices. Guidance.

The Standards and Recommended Practices are offered within the following areas:A)Qualification, Quality and Safety MethodologyB)Materials TechnologyC)StructuresD)Systems

E)Special FacilitiesF)Pipelines and RisersG)Asset OperationH)Marine OperationsJ)Cleaner EnergyO)Subsea Systems

U)Unconventional Oil & Gas

© Det Norske Veritas AS July 2014

Any comments may be sent by e-mail to rules@dnv.com

This service document has been prepared based on available knowledge, technology and/or information at the time of issuance of this document, and is believed to reflect the best ofcontemporary technology. The use of this document by others than DNV is at the user's sole risk. DNV does not accept any liability or responsibility for loss or damages resulting fromany use of this document.

Offshore Standard DNV-OS-D202, July 2014

CHANGES – CURRENT – Page 3

CHANGES – CURRENT

General

This document supersedes DNV-OS-D202, October 2013.

Text affected by the main changes in this edition is highlighted in red colour. However, if the changes involvea whole chapter, section or sub-section, normally only the title will be in red colour.

Det Norske Veritas AS, company registration number 945 748 931, has on 27th November 2013 changed itsname to DNV GL AS. For further information, see www.dnvgl.com. Any reference in this document to“DetNorske Veritas AS” or “DNV” shall therefore also be a reference to “DNV GL AS”.

Main changes July 2014

•General

A new Ch.2 Sec.8 has been included, describing specifically the requirements for floating storage units. Ch.2Sec.7 applies now for floating production and storage units only.

Editorial corrections

In addition to the above stated main changes, editorial corrections may have been made.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Contents – Page 4

CONTENTS

CHANGES – CURRENT................................................................................................................... 3

CH. 1INTRODUCTION......................................................................................... 7

Sec. 1

General................................................................................................................................. 7

1

Introduction...............................................................................................................................................71.1Objectives........................................................................................................................................71.2Scope ...............................................................................................................................................71.3Application.......................................................................................................................................71.4Structure...........................................................................................................................................81.5Assumptions.....................................................................................................................................8References..................................................................................................................................................82.1Normative references.......................................................................................................................82.2Offshore standards...........................................................................................................................9Definitions..................................................................................................................................................93.1Verbal forms....................................................................................................................................93.2General terms...................................................................................................................................93.3Terms related to computer based system.......................................................................................113.4Abbreviations.................................................................................................................................12

2

3

CH. 2TECHNICAL PROVISIONS..................................................................... 14

Sec. 1

Design principles............................................................................................................... 14

1

System configuration...............................................................................................................................141.1General...........................................................................................................................................141.2Field instrumentation.....................................................................................................................141.3System............................................................................................................................................141.4Integrated systems..........................................................................................................................141.5Redundancy....................................................................................................................................15System availability...................................................................................................................................152.1General...........................................................................................................................................152.2Continuous availability (R0)..........................................................................................................152.3High availability (R1)....................................................................................................................152.4Manual system restoration (R2).....................................................................................................152.5Repairable systems (R3)................................................................................................................16Response to failures.................................................................................................................................163.1Failure detection.............................................................................................................................163.2Fail-safe functionality....................................................................................................................163.3System response – redundant systems...........................................................................................17User interface...........................................................................................................................................174.1General...........................................................................................................................................17Tests..........................................................................................................................................................175.1General...........................................................................................................................................175.2Software testing.............................................................................................................................185.3Integration testing..........................................................................................................................185.4System testing................................................................................................................................185.5On-board testing.............................................................................................................................185.6Pneumatic and hydraulic systems..................................................................................................19System elements.......................................................................................................................................201.1General...........................................................................................................................................201.2Automatic control..........................................................................................................................201.3Remote control...............................................................................................................................201.4Safety.............................................................................................................................................211.5Alarms............................................................................................................................................211.6Indication.......................................................................................................................................231.7Planning and reporting...................................................................................................................231.8Calculation, simulation and decision support................................................................................23General requirements.............................................................................................................................242.1System operation and maintenance................................................................................................242.2Power distribution..........................................................................................................................24

DET NORSKE VERITAS AS

2

3

45

Sec. 2System design.................................................................................................................... 20

1

2

Offshore Standard DNV-OS-D202, July 2014

Contents – Page 5

Sec. 3Additional requirements for computer based systems.................................................. 26

1

General requirements.............................................................................................................................261.1Assignment of responsibility for integrated systems.....................................................................261.2Back-up means of operation..........................................................................................................261.3Storage devices..............................................................................................................................261.4Computer usage.............................................................................................................................261.5System response and capacity........................................................................................................271.6Temperature control.......................................................................................................................271.7System maintenance.......................................................................................................................271.8System access.................................................................................................................................27System software.......................................................................................................................................282.1Software requirements...................................................................................................................282.2Software development...................................................................................................................282.3Software and hardware change management.................................................................................29Network systems and communication links..........................................................................................303.1General...........................................................................................................................................303.2Network communication................................................................................................................313.3Network analysis............................................................................................................................323.4Network test and verification.........................................................................................................323.5Wireless communication................................................................................................................32General.....................................................................................................................................................341.1Environmental strains....................................................................................................................341.2Materials........................................................................................................................................341.3Component design and installation................................................................................................341.4Maintenance...................................................................................................................................341.5Marking..........................................................................................................................................341.6Standardisation...............................................................................................................................35Environmental conditions, instrumentation.........................................................................................352.1General...........................................................................................................................................352.2Electric power supply....................................................................................................................352.3Pneumatic and hydraulic power supply.........................................................................................362.4Temperature...................................................................................................................................362.5Humidity........................................................................................................................................362.6Salt contamination.........................................................................................................................362.7Oil contamination...........................................................................................................................362.8Vibrations.......................................................................................................................................362.9Electromagnetic compatibility.......................................................................................................362.10Inclination......................................................................................................................................382.11Miscellaneous................................................................................................................................38Electrical and electronic equipment......................................................................................................383.1General...........................................................................................................................................383.2Mechanical design, installation......................................................................................................383.3Protection provided by enclosure...................................................................................................393.4Cables and wires............................................................................................................................393.5Cable installation...........................................................................................................................393.6Power supply..................................................................................................................................393.7Fibre optic equipment....................................................................................................................39Pneumatic and hydraulic equipment.....................................................................................................404.1Pneumatic equipment.....................................................................................................................404.2Hydraulic equipment......................................................................................................................40General.....................................................................................................................................................411.1Application.....................................................................................................................................411.2Introduction....................................................................................................................................41Workstation design and arrangement...................................................................................................412.1Location of visual display units and user input devices................................................................41User input device and visual display unit design..................................................................................423.1User input devices..........................................................................................................................423.2Visual display units........................................................................................................................423.3Colours...........................................................................................................................................423.4Requirements for preservation of night vision

(UIDs and VDUs for installation on the navigating bridge)..........................................................43Screen based systems..............................................................................................................................43

DET NORSKE VERITAS AS

2

3

Sec. 4Component design and installation................................................................................. 34

1

2

3

4

Sec. 5User interface.................................................................................................................... 41

1

23

4

Offshore Standard DNV-OS-D202, July 2014

Contents – Page 6

4.14.2General...........................................................................................................................................43Computer dialogue.........................................................................................................................43

Sec. 6Supplementary requirements for drilling units............................................................. 45

12345

Introduction.............................................................................................................................................45Design principles.....................................................................................................................................45System design...........................................................................................................................................453.1General...........................................................................................................................................45User interface...........................................................................................................................................45Enhanced system.....................................................................................................................................455.1General...........................................................................................................................................45Introduction.............................................................................................................................................47Design principles.....................................................................................................................................472.1General...........................................................................................................................................47System design...........................................................................................................................................473.1General...........................................................................................................................................47User interface...........................................................................................................................................48Introduction.............................................................................................................................................49Design principles.....................................................................................................................................49

Sec. 7Supplementary requirements for production and storage units.................................. 47

1234

Sec. 8Supplementary requirements for storage units............................................................. 49

12

CH. 3CERTIFICATION AND CLASSIFICATION......................................... 50

Sec. 1

Requirements.................................................................................................................... 50

1

General.....................................................................................................................................................501.1Introduction....................................................................................................................................501.2Classification principles.................................................................................................................501.3Applicable requirements................................................................................................................50Documentation.........................................................................................................................................512.1General...........................................................................................................................................51Certification.............................................................................................................................................543.1General...........................................................................................................................................54Inspection and testing.............................................................................................................................554.1Manufacturing survey....................................................................................................................554.2On board testing.............................................................................................................................554.3Renewal survey..............................................................................................................................55Alterations and additions........................................................................................................................55

234

5

CHANGES – HISTORIC................................................................................................................. 56

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 7

CHAPTER 1 INTRODUCTION

SECTION 1 GENERAL

1 Introduction

1.1 Objectives

The objectives of this standard are to:

—provide an internationally acceptable standard for general requirements to safety, automation, and

telecommunication systems by defining minimum requirements for design, materials, fabrication,installation, testing, commissioning, operation, maintenance, re-qualification, and abandonment—serve as a technical reference document in contractual matters between purchasers and contractors—serve as a guideline for designers, purchasers and contractors.

—specify procedures and requirements for offshore units or installations subject to DNV Certification and

Classification.

Guidance note:

Additional requirements for specific applications will be given in the DNV Offshore Standard covering thoseapplications.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.2 Scope

1.2.1 The requirements of this standard, shall apply to all safety, automation, and telecommunication systemsrequired by the DNV Offshore Standards.

1.2.2 All safety, automation, and telecommunication systems installed, but not necessarily required by theDNV Offshore Standards, that may have an impact on the safety of main functions (see DNV-OS-A101), shallmeet the requirements of this standard.

1.2.3 The requirements of this standard are considered to meet the regulations of the MODU Code, with regardto safety, automation, and telecommunication systems.

1.2.4 For telecommunication only relevant parts are applicable. For specific requirement totelecommunication equipment reference is made to DNV-OS-A101 Ch.2 Sec.5 [6].

1.3 Application

1.3.1 Interpretations

This standard has been based on international accepted principal requirements, defined in the normativereferences as listed in [2]. In cases where these a) contain only functional requirements, b) allow alternativesolutions to prescriptive requirements or c) are generally or vaguely worded, a DNV interpretation has beenadded.

1.3.2 The interpretations are not aiming at introducing additional requirements but at achieving uniformapplication of the principal requirements. The interpretations can be regarded as norms for fulfilling theprinciple requirements.

1.3.3 The interpretations do not preclude the use of other alternative solutions. Such solutions shall bedocumented and approved for compliance to the principal requirement equivalent to the original interpretation.1.3.4 Classification

For use of this standard as technical basis for offshore classification as well as description of principles,procedures, and applicable class notations related to classification services, see Table 1-1.Table 1-1 DNV Offshore Service Specifications

Reference

DNV-OSS-101DNV-OSS-102DNV-OSS-103

Title

Rules for Classification of Offshore Drilling and Support Units

Rules for Classification of Floating Production, Storage and Loading Units

Rules for Classification of LNG/LPG Floating Production and Storage Units or Installations

1.3.5 The scope of classification may be extended by the voluntary notation ES. The applicable sections orrequirements as indicated accordingly shall only be enforced in case this notation is part of this extended

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 8

classification scope.

1.4 Structure

1.4.1 Ch.2 Sec.1 to Sec.5 give common requirements which are considered applicable to all types of offshoreunits and installations.

1.4.2 Ch.2 Sec.6 gives supplementary requirements to Drilling Units.

Guidance note:

It should be noted that separate automation and safety requirements related to DRILLING PLANT is described inDNV-OS-E101.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.4.3 Ch.2 Sec.7 gives supplementary requirements to Oil and Gas Production and Storage Units.

1.4.4 Ch.2 Sec.8 gives supplementary requirements to Oil Storage Units in addition to the above, see [1.4.3].1.4.5 Ch.3 gives procedures and requirements applicable when this standard is used as part of DNVclassification. Documentation requirements are also given.

1.5 Assumptions

The requirements of this standard are based on the assumptions that the personnel using the equipment to beinstalled on board are familiar with the use of, and able to operate, this equipment.

2 References

2.1 Normative references

The standards listed in Table 1-2 include provisions which, through reference in this text, constitute provisionsof this offshore standard. The latest issue of the references shall be used unless otherwise agreed. Otherrecognised standards may be used provided it can be demonstrated that these meet or exceed the requirementsof the standards referenced.Table 1-2 Normative references

ReferenceIEC 60529IEC 60533IEC 60945IEC 61000-4-2IEC 61000-4-3IEC 61000-4-4IEC 61000-4-5IEC 61000-4-6IEC 60092-504ISA 5.1

ISO 3511-1/2/3/4IMO Resolution A.1021.(26)IACS UR E22

Title

Degrees of protection provided by enclosures (IP Code)

Electrical and electronic installations in ships - Electromagnetic compatibility

Maritime navigation and radiocommunication equipment and systems - General requirements - Methods of testing and required test results

Electromagnetic compatibility (EMC) - Part 4: Testing and measurement techniques - Section 2: Electrostatic discharge immunity test. Basic EMC Publication

Electromagnetic compatibility (EMC) - Part 4: Testing and measurement techniques - Section 3: Radiated, radio-frequency, electromagnetic field immunity test

Electromagnetic compatibility (EMC) - Part 4: Testing and measurement techniques - Section 4: Electrical fast transient/burst immunity test. Basic EMC Publication

Electromagnetic compatibility (EMC) - Part 4: Testing and measurement techniques - Section 5: Surge immunity test

Electromagnetic compatibility (EMC) - Part 4: Testing and measurement techniques - Section 6: Immunity to conducted disturbances, induced by radio-frequency fieldsElectrical installations in ships

Code on alerts and indicators

On board use and application of programmable electronic systems

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 9

2.2 Offshore standards

2.2.1 The latest revision of the DNV Offshore Standards listed in Table 1-3 applies. Table 1-3 DNV Offshore Standards and other DNV references

Standard

DNV-OSS-101DNV-OSS-102DNV-OSS-103DNV-OS-A101DNV-OS-D101DNV-OS-D201DNV-OS-D301DNV-OS-E101DNV-OS-E201DNV-OS-E301

Title

Rules for Classification of Offshore Drilling and Support Units

Rules for Classification of Floating Production, Storage and Loading Units

Rules for Classification of LNG/LPG Floating Production and Storage Units or InstallationsSafety Principles and Arrangement

Marine Machinery Systems and EquipmentElectrical InstallationsFire ProtectionDrilling Plant

Oil and Gas processing systemsPosition Mooring.

2.2.2 Other reference documents are given in Table 1-4.Table 1-4 Informative references

Standard

DNV Certification Note No. 1.2DNV Certification Note No. 2.42009 MODU Code (IMO)IMO FSS Code

Title

Type Approval

Environmental Test Specification for Instrumentation and Automation EquipmentCode for the Construction and Equipment of Mobile Offshore Drilling Units, 2009, as amended

International code for fire systems

3 Definitions

3.1 Verbal forms

Table 1-5 Verbal forms

TermShallShouldMay

Definition

Verbal form used to indicate requirements strictly to be followed in order to conform to the document.Verbal form used to indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required.

Verbal form used to indicate a course of action permissible within the limits of the document.

3.2 General terms

3.2.1 Agreement, agreed or by agreement: Unless otherwise indicated, agreed in writing between contractorand purchaser.

3.2.2 Automation system: A system that is able to control, and/or monitor fully of partly, the operation ofequipment under control (EUC).

3.2.3 Monitoring system: A system that is able to monitor and issue alarms relating to the operation of anequipment under control (EUC).

3.2.4 Safety system: Systems, including required utilities, which are provided to prevent, detect/ warn of anaccidental event/abnormal conditions and/or mitigate its effects.

Guidance note:

Examples of safety systems are:

— ESD including blowdown where relevant — PSD

— Fire & gas detection — PA/GA

— Fire-fighting systems — BOP control system

— Safety systems for equipment.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 10

3.2.5 Telecommunication system: A system providing internal communication within the unit (e.g. telephones,public address, general alarm) or externally to the unit (e.g. radio).

3.2.6 Alarm: A combined visual and audible signal for warning of an abnormal condition, where the audiblepart calls the attention of personnel, and the visual part serves to identify the abnormal condition.

3.2.7 Safety shutdown: A safety action that will be initiated upon EUC failure or by other predefined events(e.g. gas detection) and shall result in the shutting down of the EUC or part of the EUC in question.

3.2.8 System: A system includes all components necessary for performing safety, automation ortelecommunication functions, including sensors and actuators. As used in this standard, system is short forsafety, automation or telecommunication system. A system includes all resources required to support onespecific function, including:

—the field instrumentation of one or more process segments

—all necessary resources needed to maintain the function including system monitoring and adequate self-check

—all user interfaces.

—initiate required actions.

—feedback on activated actions, when relevant.

3.2.9 An essential safety, automation or telecommunication system (hereafter called an essential system oressential function): A system supporting equipment, which needs to be in continuous operation or continuousavailable for on demand operation for maintaining the unit's safety.

Systems supporting the propulsion and steering functions are considered as essential for all units incorporatingsuch functions. The definition essential system may also apply to other functions when these are defined assuch in the DNV Offshore Standards.

Guidance note:

The objective for an essential function is that it should be in continuous operation for relevant operational modes, i.e.transit, operation, e.g. the emergency shutdown (ESD) system for an offshore unit.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2.10 An important safety, automation or telecommunication system (hereafter called an important system orfunction): A system supporting functions in order to perform in accordance to class requirement, unlessspecified otherwise in other DNV Offshore Standards.

3.2.11 Non-important safety, automation and telecommunication systems (hereafter called non-importantsystems or non-important function): Systems supporting functions that are not required by the DNV OffshoreStandards.

3.2.12 Field instrumentation: All instrumentation that forms an integral part of a process segment to maintaina function. The field instrumentation includes:

—sensors, actuators, local control loops and related local processing as required to maintain local control and

monitoring of the process segment

—user interface for manual operation (when required).

Other equipment items do not, whether they are implemented locally or remotely, belong to the fieldinstrumentation. This applies to data communication and facilities for data acquisition and pre-processing ofinformation utilised by remote systems.

3.2.13 Process segment: A collection of mechanical equipment with its related field instrumentation, e.g. amachinery or a piping system. Process segments belonging to essential systems are referred to as essential.3.2.14 Integrated system: A combination of computer based systems which are interconnected in order toallow common access to sensor information and/or command or control.

3.2.15 User: Any human being that will use a system or device, e.g. captain, navigator, engineer, radiooperator, stock-keeper, etc.

3.2.16 Workstation: Workstation is a work place at which one or several tasks constituting a particular activityare carried out and which provides the information and equipment required for safe performance of the tasks.3.2.17 System availability: The time the system is available.

3.2.18 Equipment under control (EUC): The mechanical equipment (machinery, pumps, valves, etc.) orenvironment (smoke, fire, waves, etc.) monitored and/or controlled by an automation and safety system.3.2.19 Process: The result of the action performed by the EUC.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 11

3.2.20 Indications: The visual presentation of values for the EUC or system status to a user (lamps, dials, VDUdisplays, etc.).

3.2.21 Uninterruptible power supply (UPS): A device supplying output power in some limited time periodafter loss of input power with no interruption of the output power.

3.2.22 Independency:

Mutually Independent: Two systems are mutually independent when a single system failure occurring in eitherof the systems has no consequences for the maintained operation of the other system as described above.Redundancy may provide the necessary independence.

Independent: System B is independent of system A when any single system failure occurring in system A hasno effect on the maintained operation of system B. A single system failure occurring in system B may affectthe maintained operation of system A.

3.2.23 Redundancy: A system with redundancy is one with duplication which prevents failure of the entiresystem in the event of failure of a single component.

3.2.24 Remote control system: Comprises all hardware and software necessary to operate the EUC from acontrol position where the operator cannot directly observe the effect of his actions.

3.2.25 Back-up control system: Comprises all hardware and software necessary to maintain control when maincontrol systems have failed, malfunctioned or are being maintained.

3.2.26 Safety and automation system (SAS): Term used for integrated safety, automation, and/ortelecommunication system.

Guidance note:

Other terms used for such systems are: Integrated Control and Safety System (ICSS) and Safety and InstrumentationSystem (SIS).

The term is also commonly used on stand alone system not integrated with other systems.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2.27 Separated: Terms used on cables, networks nodes, etc. to indicate that they are physically located withdistance or mechanical separation sufficient to prevent a single failure taking out the entire function.

Guidance note:

The best separation that is reasonably practicable in order to minimise the chances of a single incident affecting bothsystems should be applied. Redundant controllers in the same cabinet are considered to be acceptable because thecabinet is located in a well protected “safe” area.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2.28 Warning: An indication of equipment under control (EUC) or system state that needs attention.3.2.29 Approval centre: The body that is performing the verification of the design and/or fabrication surveys.3.2.30 Fire pane/central: A standalone system for presenting of fire alarms and system failure.

3.2.31 A normally energised (NE) circuit: A circuit where energy is present when the circuit is not activatedby the activating function.

3.2.32 A normally de-energised (NDE) circuit: A circuit where energy is present when the circuit is activatedby the activating function.

3.3 Terms related to computer based system

3.3.1 Complex system: A system for which all functional and failure response properties for the completedsystem cannot be tested with reasonable efforts. Systems handling application software belonging to severalfunctions, and software that includes simulation, calculation and decision support modules are normallyconsidered as complex.

3.3.2 Computer: A computer includes any programmable electronic system, including main-frame, mini-computer or micro-computer (PLC).

3.3.3 Visual display unit (VDU): Any area where information is displayed including indicator lamps or panels,instruments, mimic diagrams, and computer display monitors.

3.3.4 User input device (UID): Any device from which a user may issue an input including handles, buttons,switches, keyboard, joystick, pointing device, voice sensor and other control devices.

3.3.5 System software: Software used to control the computer and to develop and run applications.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 12

Guidance note:

Typically the Operating System or system firmware.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.3.6 Application software: Standard software which is required for developing, running, configuring orcompiling application software and project specific program(s) with associated parameters which carry outoperations related to the EUC being con-trolled or monitored.

3.3.7 Software module: A small self-contained program which carries out a clearly defined task and is intendedto operate within a larger program.

3.3.8 Function block: A small self-contained function with a set of defined inputs and outputs that carries outa clearly defined task and is intended to operate within an application program.

3.3.9 Computer task: In a multiprocessing environment, this means one or more sequences of instructionstreated by a control program as an element of work to be accomplished by a computer.

3.3.10 Data communication links: This includes point to point links, instrument net and local area networks,normally used for inter-computer communication on board units.

A data communication link includes all software and hardware necessary to support the data communication.

Guidance note:

For local area networks, this includes network controllers, network transducers, the cables and the network softwareon all nodes.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.3.11 A node in a system: A computer based controller, usually with associated field device I/O, capable ofcarrying out logic, control and calculation functions and communicating data with other nodes and stations onthe system network(s).

3.3.12 Point to point: Link used for data communication between two dedicated nodes.

3.3.13 Local area network: A network used for data communication between the automation, safety and theother parts of a system, and between different systems.

3.3.14 Instrument net: A network used for data communication within the field instrumentation connectinginstruments in a network.

3.3.15 Multifunction VDUs and UIDs: VDUs and UIDs that are used for more than one essential and / orimportant function for both safety and/or automation, e.g. VDUs and UIDs used for integrated computersystems.

3.3.16 Critical Alarm and Action Panel (CAAP): Panel used to present vital safety related information, and toactivate vital safety related functions independent of operator stations.

3.3.17 Operator Station in an integrated system is a unit consisting of a user interface, i.e. UIDs and VDU,and interface controller(s). An integrated operator station is one serving two or more systems.

3.3.18 Fire and gas node: The system elements related to fire and gas detection and related actions within asafety system, organised as an independent node within the system.

3.3.19 Network components: All hardware devices directly connected to a communication network.

3.4 Abbreviations

The abbreviations given in Table 1-6 are used.Table 1-6 Abbreviations

AbbreviationBOPCAAPCCRDCSDPDSSS ECREMC

In full

Blow Out Preventer

Critical Alarm and Action Panel

Central Control Room on MOUs, on tankers CCR normally refers to Cargo Control RoomDrilling Control SystemDynamic Positioning

Direct Sequence Spread SpectrumEngine Control Room

Electromagnetic Compatibility

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.1 Sec.1 General – Page 13

Table 1-6 Abbreviations (Continued)

AbbreviationEUCEUTESDEPROMEEPROMF&GFAT FHSSHVACI/OICSSIECLANLEDLCDMOUMSNDENEOTDRPA/GAPCSPLCRPMRPPROMPSDSASSWUIDUPSVDUVLANVMSWPA

In full

Equipment Under ControlEquipment Under TestEmergency Shut Down

Erasable Programmable Read-Only Memory

Electrically Erasable Programmable Read-Only MemoryFire and Gas

Factory acceptance test

Frequency Hopping Spread SpectrumHeating, ventilation and air conditioning Input and/or Output

Integrated Control and Safety System

International Electrotechnical CommissionLocal Area NetworkLight Emitting DiodeLiquid Crystal DisplayMobile Offshore UnitManufacturing SurveyNormally De-energised Normally Energised

Optical Time Domain Reflectometry

Public Address & General Alarm System Process Control System

Programmable Logical ControllerRotations Per MinuteRedundant Propulsion

Programmable Read Only MemoryProcess Shutdown

Safety and Automation SystemSoftware

User Input Device

Uninterruptible Power SystemVisual Display Unit

Virtual Local-Area NetworkVessel Management SystemWiFi Protected Access

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 14

CHAPTER 2 TECHNICAL PROVISIONS

SECTION 1 DESIGN PRINCIPLES

1 System configuration

1.1 General

1.1.1 Essential and important systems shall be so arranged that a single failure in one system cannot spread toanother system.

Guidance note:

The system should be designed so that a failure in the automation function does not have any impact on the safetyfunction. Other items are use of selective fusing of electrical distribution systems.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.1.2 Failure of any remote or automatic control system shall initiate an audible and visual alarm at a mannedcontrol station and shall not prevent manual control.

1.2 Field instrumentation

1.2.1 The field instrumentation belonging to separate essential process segments shall be mutuallyindependent.

1.2.2 When the field instrumentation of a process segment is common for several systems, and any of thesesystems is essential, failures in any of the systems shall not affect this field instrumentation.

1.2.3 When manual emergency operation of an essential process segment is required, the field instrumentationrequired for the manual emergency operation shall be independent of other parts of any system.

1.2.4 Electronic governors shall have power supply independent of other consumers and system availabilityof R0. Governors for engines, other than those driving electrical generators, which keep the last position uponpower failure, are regarded as fulfilling the redundancy type R0. (Ref. IACS UR M3.1.3)

Guidance note:

Electric or electronic fuel injectors should be designed to permit the necessary functionality in case of the mostprobable failures.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.3 System

For an essential system having more than one process segment, failure in the field instrumentation of oneprocess segment shall not result in failure for the remaining parts of the system.

1.4 Integrated systems

1.4.1 Control shall only be available on workstations from where control is intended and access shall beprovided via a command transfer system.

1.4.2 Simultaneous display of overview and detailed-information for relevant control, monitoring and safetysystems shall be ensured.

Interpretation:

For control and monitoring systems:

—Sufficient number of operator stations should be available at the main work station ensuring that all

functions that may need simultaneous attention are available.For safety systems:

—Sufficient overall status should be provided without browsing between screen pictures. This implies

that it should be possible to both have fixed overview of safety related information as well as detailedinformation about the incident.

––––––––––––––– end of Interpretation –––––––––––––––

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 15

Guidance note:

The number of VDUs and UIDs at control stations should be sufficient to ensure that all functions may be providedfor with any one VDU or UID out of operation, taking into account any functions that should be continuouslyavailable.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5 Redundancy

1.5.1 Redundancy shall be built in to the extent necessary for maintaining the safe operation of the unit.Changeover to redundant systems shall be simple even in cases of failure of parts of the Safety and AutomationSystem (SAS).

1.5.2 The redundancy requirement shall imply redundant communication links, power supplies, computersand operator stations.

Guidance note:

Redundancy of computers should be limited to controllers with CPUs; single I/O cards/modules are accepted.Consideration should be given to the allocation of signals to I/O modules in order to minimise the consequences of asingle card/module failure.

Addressable loops for fire detector systems with single CPU central units are presently accepted for living quarter andmarine areas as well as for drilling areas, but areas with more than one detector should normally be covered by at leasttwo loops, Consideration should be given to distribution of detectors on different loops.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2 System availability

2.1 General

2.1.1 The availability requirements for the SAS shall be adapted to the availability requirements imposed onthe function served.

2.1.2 The system availability for the various SAS applications shall be arranged in accordance with thedifferent categories as given in Table 1-1.Table 1-1 System availability

System category

Continuous availability (R0)High availability (R1)

Manual system restoration (R2)Repairable systems (R3)

Repair timeNone45 s

10 minutes3 hours

2.2 Continuous availability (R0)

2.2.1 A system serving a function that shall be continuously available shall be designed to provide nointerrupts of the function neither in normal operation modes nor in case of a single system failure.

2.2.2 Changeover between redundant systems shall take place automatically and with no disturbances for thecontinuous operation of the function in case of system failure. User requested changeovers shall be simple andeasily initiated and take place with no unavailable time for the function.

2.2.3 User interfaces of redundant systems shall allow supervision of both systems from the same position.

2.3 High availability (R1)

2.3.1 A system serving a function that shall have high availability shall be designed to provide continuousavailability in normal operation modes.

2.3.2 In case of system failures, changeover between redundant systems shall take place automatically ifredundancy is required. User requested changeover in normal operation shall be simple and easily initiated andtake place within the same repair time.

2.3.3 User interfaces of redundant systems shall be located close to each other and changeover between thesystems shall have no significant effect on the user's maintained execution of other tasks.

2.4 Manual system restoration (R2)

A system serving a function that requires manual system restoration shall be designed to provide restoration ofthe function within a repair time specified for R2, in case of system failures.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 16

Guidance note:

Restoring a function may involve a limited number of simple manual actions.

User interfaces of redundant systems may be designed for manning of normally unattended workstations whenrequired, provided such manning is immediately available.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.5 Repairable systems (R3)

A system serving a function of category R3 shall be designed to provide restoration of the function within arepair time specified for R3 in case of system failures.

Guidance note:

Restoring a function may involve a number of manual operations, including minor replacements or repair ofequipment.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3 Response to failures

3.1 Failure detection

3.1.1 Essential and important systems shall have facilities to detect the most probable failures that may causereduced or erroneous system performance.

Failures detected shall initiate alarms in an assigned manned control station.

3.1.2 The failure detection facilities shall at least, but not limited to, cover the following failure types:—power failures

Additionally for computer based systems:—communication errors— hardware failures

—software execution failures.Additional for essential/safety systems:—loop failures—earth faults.

Interpretation:

This implies also loop monitoring of emergency stop circuits.

––––––––––––––– end of Interpretation –––––––––––––––

3.2 Fail-safe functionality

3.2.1 The most probable failures, for example loss of power or wire failure, shall result in the least critical ofany possible new conditions.

Guidance note:

References also made to DNV-OS-A101, Sec.4 [2] and sections 6, 7 or 8 as applicable.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2.2 An instrument failure in a fire or gas detector shall be considered as equivalent to fire or gas detectionrespectively, and cause the equivalent fail safe action. The instrument failure shall be alarmed.

Interpretation:

For detector voting applications, a failed detector should count as an active detection.

––––––––––––––– end of Interpretation –––––––––––––––

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 17

Guidance note:

If shutdown logic requires no shutdown action on confirmed fire/gas detection, detector failure should also only givealarm with equal priority. Normally local HVAC should be tripped on gas detection in the inlets and then detectorfailure should also cause HVAC trip.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.3 System response – redundant systems

A redundant system shall, upon failure, have sufficient self-diagnostics to effectively ensure transfer of activeexecution to the standby unit.

Interpretation:

For redundant systems, any failure should not cause an interruption that jeopardizes safe operation. Thisapplies also to the most time critical functions.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

This typically applies to duplicated networks or controllers where a failure in one unit or network shall not lead to adowntime that may jeopardize the time response of the activation of a critical function, like e.g. a shutdown.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---4 User interface

4.1 General

4.1.1 When designing the layout of operation and display devices, due consideration shall be given to the userinterface. Attention shall be paid to the significance of human factors in the event that a critical failure orcondition occurs. Graphic information systems shall contain all relevant functions for safe operation, shall beeasy to understand and operate, and shall enable system overview.

4.1.2 For essential and important systems, deviations between a command action and expected result of thecommand action shall initiate an alarm.

5 Tests

5.1 General

5.1.1 All relevant tests shall be performed according to an approved test program.

5.1.2 Testing according to [5.2], [5.3], and [5.4] shall be performed at the manufacturers’ works.

Interpretation:

For Systems subject to certification an internal test according to [5.1.1] should be performed prior tocertification/FAT.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

It is acknowledged that all project information may not be available at the time of final testing in the manufacturer'sworks. Testing should be performed to the extent possible prior to system delivery.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---5.1.3 The following shall be evaluated during test of computer based system:—means for access control and system configuration/modification—implementation of software quality plan. (Ref. IACS UR E22, Appendix 1, sections 3, 5 and 6)

5.1.4 The tests and visual examinations shall verify that all requirements given by the applicable DNVOffshore Standards are met. The test procedures shall specify in detail how the various functions shall be testedand what is to be observed during the tests.

5.1.5 Failures shall be simulated as realistically as possible, preferably by letting the monitored parametersexceed the alarm and safety limits. Alarm and safety limits shall be checked.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 18

5.1.6 It shall be verified that all automation functions are working satisfactorily during normal load changes.

5.2 Software testing

5.2.1 Documentation of software module and function block testing shall be available at the manufacturer'sworks.

(Ref. IACS UR E22, Appendix 5.1 and 5.2)

5.2.2 Application software testing shall be performed to demonstrate functionality in accordance with designdocumentation with respect to the Equipment Under Control (EUC), including the Operator interface.(Ref. IACS UR E22, Appendix 5.3)

5.3 Integration testing

Integration tests includes integration of hardware components and integration of software modules into thesame hardware.

5.3.1 Integration tests shall be performed with the actual software and hardware to be used on board.(Ref. IACS UR E22, Appendix 6.1)

Interpretation:

1)The integration test should include at least the following:

a)Hardware tests;

hardware failures.b)System software tests;

System software failures.c)Application software tests.

d)Function tests of normal system operation and normal EUC performance, in accordance with the

requirements of the DNV Offshore Standards. Function tests are also to include a degree ofperformance testing outside of the normal operating parameters.e)User interface tests.

2)If the integration test is not practicable before the hardware is installed on-board, the testing should be

planned for and described in a test plan, describing where and how the necessary tests are to beperformed to achieve the same level of verification. In such cases, the yard, supplier and DNV shouldagree on the plan.

––––––––––––––– end of Interpretation –––––––––––––––

5.4 System testing

System testing shall be performed to demonstrate that the system fulfills the requirements as stipulated by theapplicable rules.

(Ref. IACS UR E22, Appendix 6.3)

Interpretation:

1)System tests should include the entire system, integrating all hardware and software. The test may also

include several systems.

2)System tests should be performed with the software installed on the actual systems to be used on-board,

interconnected to demonstrate the functions of the systems.

3)The tests should include those tests which were not or could not be completed on hardware component

or software module level.

4)If the system test is not practicable before the hardware is installed on-board, the testing shall be

planned for and described in a test plan, describing where and how the necessary tests are to beperformed to achieve the same level of verification. In such cases, the yard, supplier and DNV shallagree on the plan.

––––––––––––––– end of Interpretation –––––––––––––––

5.5 On-board testing

5.5.1 The testing shall demonstrate, verify and document full functionality of all automation and safetysystems and shall include:

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014 Ch.2 Sec.1 Design principles – Page 19

a)During installation the correct function of individual equipment packages, together with establishment of

correct parameters for automation and safety (time constants, set points, etc.).

b)During installation and sea trials, the correct function of systems and integration of systems, including the

ability of the automation and safety systems to keep any EUC within the specified tolerances and carry outall safety/protective actions.

c)The correct distribution, protection and capacity of power supplies.

d)Back-up and emergency automation and safety functions for essential unit/installation systems.

Interpretation:

The tests should demonstrate that the essential installation functions are operable on the available back-upmeans of operation (as required in the relevant application standard), and in a situation where the controlsystem for normal operation is disabled as far as practical.

––––––––––––––– end of Interpretation –––––––––––––––

5.5.2 The test program for harbour and sea trials shall be approved prior to tests by the local DNV station.5.5.3 The on board testing should include all the tests which could not be completed during integration orsystem-testing/ FAT.

5.5.4 The remote control system shall, if fitted, be tested at sea to demonstrate stable control and operation ofthe propulsion system with its necessary auxiliaries over the full operating range, and regardless of the type ofpropulsion. It shall be demonstrated that necessary ramping / controller functions are implemented to ensurethat any operation of the manoeuvring levers do not cause shutdown, instability or damage to the propulsionmachinery or power generating units.

5.5.5 If the machinery system is designed for different normal operational modes, e.g. dual fuel engines, thetest described in [5.5.4] shall be run for each relevant mode of operation.

5.6 Pneumatic and hydraulic systems

5.6.1 Hydraulic automation and shut-down systems shall be tested with maximum return flow to verify thatreturn headers are adequately sized and free of blockages which could prevent correct system performance.5.6.2 For pneumatic and hydraulic automation systems with accumulators used to ensure fail safe operation,tests shall include verification of accumulator charge level and capacity.

5.6.3 Piping and tubing to actuators and between actuators and local accumulators shall be hydrostaticallytested to 1.5 times the system design pressure for minimum 15 minutes.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 20

SECTION 2 SYSTEM DESIGN

1 System elements

1.1 General

1.1.1 A system consists of one or several system elements where each system element serves a specificfunction.

1.1.2 System elements belong to the categories: ———————

automation systemremote controlalarmsafety

indications

planning and reporting

calculation, simulation and decision support.

1.1.3 Whenever automatic or manual shutdown is required in the rules, the function shall be implemented ina safety system that is mutually independent of the control and alarm systems. Control and alarm functions may then be implemented in common system units.

Exceptions from these general principles may be given if specified in the application rules.

Interpretation:

ESD/PSD, F&G and automation nodes should be physically segregated in different cabinets.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

The independency requirement does not intend to prevent the different control-, alarm- and safety system units fromcommunicating status information over e.g. a network, provided that the network is designed according to Sec.3, buteach unit shall be able to perform its main functions autonomously.

The independency between safety systems and other systems is intended to provide a robust single fault tolerance. Itis in general not acceptable to integrate safety systems with other systems even when arranged with redundancy orduplication - redundancy in system design is in general not accepted as an alternative way to meet the requirement forindependency between systems.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.2 Automatic control

1.2.1 Automatic control shall keep process equipment variables within the limits specified for the processequipment (e.g. the machinery) during normal working conditions.

1.2.2 Automatic control shall be stable over the entire control range. The margin of stability shall be sufficientto ensure that variations in the parameters of the controlled process equipment that may be expected undernormal conditions, will not cause instability. The automation system element shall be able to accomplish thefunction it shall serve.

1.2.3 Automatic control such as automatic starting and other automatic operations, when relevant, shallinclude provisions for manually overriding the automatic controls unless safe manual operation is not feasible.Failure of any part of such systems shall not prevent the use of the manual override.

1.2.4 In closed loop systems, feedback failures shall initiate an alarm, and the system shall fail to safety whichnormally implies either to remain in its present state or move controlled to a predefined safe state.

1.3 Remote control

1.3.1 At the remote command location, the user shall receive continuous information on the effects of thecommands given.

1.3.2 Each group of functions shall have a default main command location. The main command location shallhave priority of other command locations.

1.3.3 When control is possible from several workstations, only one workstation shall be in control at any time.1.3.4 Actual control shall not be transferred before acknowledged by the receiving command location unless

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 21

the command locations are located close enough to allow direct visual and audible contact. Transfer of controlshall give audible warning.

1.3.5 The main command location shall be able to take control without acknowledgement, but an audiblewarning must be given at the work station that relinquish control.

1.3.6 Means shall be provided to prevent significant alteration of process equipment parameters whentransferring control from one location to another or from one means or mode of operation to another.

Interpretation:

If this involves manual alignment of control levers, indicators should show how the levers are to be set tobecome aligned.

––––––––––––––– end of Interpretation –––––––––––––––

1.3.7 On each alternative command location, it shall be indicated when this location is in control. 1.3.8 Safety interlocks in different parts of the systems shall not conflict with each other.

Basic safety interlocks shall be hard-wired and shall be active during remote and local operation.

Guidance note:

Hard-wired safety interlocks should not be overridden by programmable interlocks.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.4 Safety

1.4.1 A safety system element shall be arranged to automatically take safety actions on occurrence ofpredefined abnormal states for the EUC. The corresponding system element includes all resources required toexecute these actions. Where fail safe condition is defined as “continue” for essential systems, a failure in theloop monitoring shall initiate an alarm and not stop the unit. Where loop failure monitoring is not possible, atwo out of two voting system may be accepted.

Guidance note:

For fail safe condition reference is made to DNV-OS-A101 Ch.2 Sec.7 [4.3] and Sec.6 or 7 as applicable.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.4.2 The safety system element shall be so designed that the most probable failures, for example loss of powersupply or wire failure, result in the least critical of any possible new condition (fail to safety) taking intoconsideration the safety of the machinery itself as well as the safety of the vessel/unit.1.4.3 Automatic safety actions shall initiate alarm at manned workstations.

1.4.4 When the safety system element stops an EUC, the EUC shall not start again automatically.

1.4.5 When a safety system element is made inoperative by a manual override, this shall be clearly indicatedat the main control station.

1.4.6 When a safety system element has been activated, it shall be possible to trace the cause of the safetyaction at the main control station. There shall be means at the main control station to reset safety functions madeinoperative in a readily accessible manner, unless stated otherwise in the Offshore Standards.

1.4.7 When two or more protective safety actions are initiated by one failure condition, these actions shall beactivated at different levels, with the least drastic action activated first.

Guidance note:

For certain equipment the sequence of events for certain process parameters may be so rapid that it is no use to activatethe two protective safety actions at different levels.

An alarm shall be activated prior to a protective safety action, except when it is regarded as not being possible due tourgency, see relevant parts of SOLAS Ch. II-1.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5 Alarms

1.5.1 Alarms shall be visual and audible and shall indicate abnormal conditions only. In areas where theaudible signal may not be heard due to background noise, additional visual and audible display units shall beinstalled.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 22

Guidance note:

Several suitably placed low volume audible alarm units should be used rather than a single unit for the whole area. Acombination of audible signals and rotating light signals may be of advantage.

IMO resolution A.1021(26) regulation 4.18, requires that alarms and indicators on the navigation bridge should bekept at a minimum. Alarms and indicators not required for the navigation bridge should not be placed there unlesspermitted by the administration.

For PA/GA alarms see DNV-OS-A101 Ch.2 Sec.5 [6] for details.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5.2 Visual alarms shall be easily distinguishable from other indications by use of colour and specialrepresentation.

Guidance note:

In view of standardising, visual alarm signals should preferably be red. Special representation may be a symbol.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5.3 Audible alarms shall be readily distinguishable from signals indicating normal conditions, telephonesignals, different alarm systems and noise.

1.5.4 The audible and visual characteristics of alarm signals defined by IMO Resolution A.1021(26), Code onAlarms and Indicators - Paragraph 7 Characteristics, shall be used.

1.5.5 Responsibility for alarms shall not be transferred before acknowledged by the receiving location.Transfer of responsibility shall give audible warning. At each individual location, it shall be indicated whenthis location is in charge, if relevant.

1.5.6 Acknowledgement of alarms shall only be possible at the workstation(s) dedicated to respond to thealarm.

(Ref. A.1021(26), sec. 4.19)

Alarms shall be annunciated by visual indication and audible signal. It shall be possible to see and distinguishdifferent statuses of the alarms e.g. normal, active, unacknowledged, acknowledged and blocked.Silencing and acknowledgement of alarms shall be arranged as follows:Silencing the audible signal:

—Silencing the alarm shall cause the audible signal to cease, in addition to extinguishing any related light

signals.

—The visual alarm indication shall remain unchanged.Acknowledgement of an alarm:

—When an alarm is acknowledged the visual indication shall change. An indication shall remain if the alarm

condition is still active.

—If the acknowledge alarm function is used prior to silencing of the audible signal, the acknowledgement

may also silence the audible signal.An active alarm signal shall not prevent indication of any new alarms, with related audible signal and visualindication. This requirement shall also apply for group alarms.

In case the alarms are presented on a screen, only visible alarms may be acknowledged.

Guidance note:

Flashing red indication is normally used for un-acknowledged alarm while steady red is used for active,acknowledged alarm. This applies for all operator interfaces, including standard VDU and back-up means.(e.g.CAAP)

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5.7 The presentation of alarms and indicators should be clear, distinctive, unambiguous and consistent.(Ref. IMO A.1021(26), sec. 4.1)

Interpretation:

1)Acknowledgement of visual signals should be separate for each signal or common for a limited group

of signals. Acknowledgement should only be possible when the user has visual information on thealarm condition for the signal or all signals in a group.2)Local equipment audible alarm for equipment connected to the automation and safety system, should

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 23

be suppressed when localised in the same workplace as the user interface for the automation and safetysystem.

––––––––––––––– end of Interpretation –––––––––––––––

1.5.8 Permanent blocking of alarm units shall not be possible. Manual blocking of separate alarms isacceptable when this is clearly indicated.

1.5.9 Sufficient information shall be provided to ensure optimal alarm handling. Alarm text shall be easilyunderstandable. The presence of active alarms shall be continuously indicated, and alarm text shall be easilyunderstood.

Interpretation:

Alarms should be time-tagged, see also [3.1.1].

––––––––––––––– end of Interpretation –––––––––––––––

1.5.10 The more frequent failures within the alarm system, such as broken connections to measuring elements,shall initiate alarm.

1.5.11 Interlocking of alarms shall be arranged so that the most probable failures in the interlocking system,for example broken connection in external wiring, do not prevent alarms.

1.5.12 Means should be provided to prevent normal operating conditions from causing false alarms, e.g.,provision of time delays because of normal transients.(Ref. IMO A.1021(26) sec. 4.17)

Interpretation:

Blocking of alarm and safety functions in certain operating modes (for example during start-up) should beautomatically disabled in other modes.

––––––––––––––– end of Interpretation –––––––––––––––

1.5.13 The number of alarms during abnormal conditions shall be assessed and reduced as far as practicableby alarm processing/suppression techniques in order to have operator attention on the most critical alarms thatrequire operator actions.

1.6 Indication

1.6.1 Indications sufficient to allow safe operation of essential and important functions shall be installed at allcontrol locations from where the function shall be accomplished. Alarms are not considered as substitutes forindications for this purpose.

Guidance note:

It is advised that indicating and recording instruments are centralised and arranged to facilitate watch-keeping, forexample by standardising the scales, applying mimic diagrams, and similar.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.6.2 Adequate illumination shall be provided in the equipment or in the vessel/unit to enable identification ofcontrols and facilitate reading of indicators at all times. Means shall be provided for dimming the output of anyequipment light source which is capable of interfering with navigation.1.6.3 Indication panels shall be provided with a lamp test function.

1.7 Planning and reporting

Planning and reporting system elements shall have no outputs for real-time process equipment control duringplanning mode.

Guidance note:

The output may however be used to set up premises for process equipment control, for example route plan used asinput to an autopilot or load plan used as input for automatic or user assisted sequence control of the loading.Planning and reporting functions are used to present a user with information to plan future actions.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.8 Calculation, simulation and decision support

1.8.1 Output from calculation, simulation or decision support modules shall not suppress basic information

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 24

necessary to allow safe operation of essential and important functions.

Guidance note:

Output from calculation, simulation or decision support modules may be presented as additional information.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2 General requirements

2.1 System operation and maintenance

2.1.1 Prior to restart after a shut-down, the situation resulting in the shut-down shall be cleared and be resetprior to restart.

2.1.2 Start-ups and restarts shall be possible without specialised system knowledge. On power-up andrestoration after loss of power, the system shall be restored and resume operation automatically, whereapplicable.

Interpretation:

This restoration and resume of operations should include all controller units, operator stations and network/communication link components necessary to support normal operation of the control and safety system.

––––––––––––––– end of Interpretation –––––––––––––––

2.1.3 The system shall be designed to allow testing without disrupting normal operation of the function served.

Interpretation:

Alarm- and safety functions should be possible to test during operation, and the system should not remainin test mode unintentionally

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

It is recommended to arrange an automatic return to operation mode or alarm.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.2 Power distribution

2.2.1 This part of the rules gives requirements for the power supply to different categories of control andmonitoring systems. The principal requirements for the arrangement of the power supply are defined in DNV-OS-D201 Ch.2 Sec.2 [6.3].

2.2.2 Essential control and monitoring systems shall be provided with two independent power supplies. Thisapplies to both single and redundant control and monitoring systems.

Guidance note:

For redundant control and monitoring systems, it is acceptable that each independent power supply are feeding bothsystems.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.2.3 Redundant control and monitoring systems for important services, and control and monitoring systemsrequired to be independent, shall be supplied by independent power supplies.

2.2.4 Redundant units in an integrated control and monitoring systems shall be provided with independentpower supplies.

2.2.5 The following categories of control and monitoring systems shall be provided with uninterruptible powersupply:

—Control and monitoring systems required to be operable during black-out.

—Control and monitoring systems required to restore normal conditions after black-out.—Control and monitoring systems serving functions with redundancy type R0.

Control and monitoring systems serving functions with redundancy type R1 - unless the control and

monitoring system will be immediately available upon restoration of main power supply (i.e. no bootingprocess).

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.2 System design – Page 25

—Control and monitoring systems for services with other redundancy types if the restoration time of the

control and monitoring system exceeds the corresponding allowed unavailable time.

—Certain control and monitoring systems where specific requirements for stand-by power supply are given.The capacity of the stored energy providing the uninterruptible power shall be at least 30 minutes, unlessotherwise specified.

Guidance note:

Refer to DNV-OS-D201 Ch.2 Sec.2 Table 2-1.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.2.6 If the user interface is required to be duplicated, the requirement for independent power supplies alsoapplies to the user interface. If uninterruptible power supply is required for the control system, this also appliesto at least one user interface at the dedicated work stations.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 26

SECTION 3 ADDITIONAL REQUIREMENTS FOR COMPUTER BASED

SYSTEMS

1 General requirements

1.1 Assignment of responsibility for integrated systems

The responsibility of total integrated system shall be assigned to one organisational body.

Guidance note:

This organisational body may be the yard, a major manufacturer or another body holding necessary competence andresources to enable a controlled integration process.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.2 Back-up means of operation

Where the normal user interface for the below listed safety functions is an operator station in an integratedsystem, a back-up means of operation/user interface is required.This applies to:————

emergency shutdown systems (ESD)fire and gas detection system

activation of relevant fire-fighting systems

other safety functions where a back-up means is required by the rules or standards.

The back-up means of operation shall be independent of the normal user interface and its communicationnetworks.

Interpretation:

The back-up means of operation should be based on proven and reliable design and be:—located adjacent to the normal operating position

—for all activation signals and other ESD related signals needed to ensure activation, hard-wired

individually directly to the respective controller.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

The back-up means of operation is typically achieved by provision of a CAAP (Critical Alarm and Action Panel).

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.3 Storage devices

The data storage devices shall ensure satisfactory availability and performance of the function served.

Interpretation:

1)The on-line operation of essential functions should not depend on the operation of rotating bulk storage

devices.

2)Software and data necessary to ensure satisfactory performance of essential and important functions

should normally be stored in non-volatile memory (e.g. EPROM, EEPROM or FLASH). Exceptionmay be given for RAM with battery backup if the following three conditions are met:

—low battery voltage results in an alarm or visual indication detectable by routine inspections—battery can easily be replaced by crew personnel without danger of losing data

—battery failure has no influence on performance as long as normal power supply is maintained.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

Interpretation 1) does not exclude the use of such storage devices (e.g. hard disks) for maintenance, restoration andback-up purposes.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.4 Computer usage

Computers serving essential and important functions shall only be used for purposes relevant to unit operation.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 27

1.5 System response and capacity

1.5.1 Systems used for automation and safety systems shall provide response times compatible with the timeconstants of the related Equipment Under Control (EUC).

Guidance note:

The following response times are applicable for typical EUC on offshore units:

Table 3-1 Typical response times

Function

Data sampling for automatic control purposes (fast changing parameters)

Data sampling, indications for analogue remote controls (fast changing parameters)Other indicationsAlarm presentations

Display of fully updated screen views

Display of fully updated screen views including start of new applicationAutomatic emergency actionsGas detector response timeFire detector response time

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---Typical response times

0.1 s0.1 s1 s2 s2 s5 s1 s<10 s<10 s

1.5.2 System start-up and system restoration after power failures shall take place with sufficient speed tocomply with the system availability requirements for the systems. The system shall revert to a pre-defined stateproviding an appropriate level of safety.

1.5.3 System capacities shall be sufficient to provide adequate response times for all functions, taking themaximum load and maximum number of simultaneous tasks under normal and abnormal conditions for theEUC into consideration.

1.6 Temperature control

Wherever possible, computers shall not have forced ventilation. For systems where cooling or forcedventilation is required to keep the temperature at an acceptable level, alarm for high temperature or mal-operation of the temperature control function shall be provided at a manned control station.

1.7 System maintenance

1.7.1 Integrated systems supporting one or more essential or important function shall be arranged to allowindividual hardware and software entities to be tested, repaired and restarted without interference with themaintained operation of the remaining parts of the system.

1.7.2 Essential systems shall have diagnostic facilities to support finding and repair of failures.

1.8 System access

1.8.1 Access to system set-up or configuration functions for the EUC shall be protected to avoid unauthorisedmodifications of the system performance. For screen based systems, tools shall be available to allow easy andunambiguous modification of configuration parameters allowed to be modified under normal operation.

Guidance note:

As a minimum this should cover:-calibration data

-alarm limit modification

-manual alarm blocking or inhibiting.

The operator should only have access to the application(s) related to the operation of the functions covered by thesystem according to [1.4.1], while access to other applications or installations of such, should be prevented. Hot keysnormally giving access to other functions or program exits (Alt+Tab, Ctrl+Esc, Alt+Esc, double-clicking inbackground, etc.) must be disabled.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.8.2 Unauthorised access to essential and important systems from a position outside the unit shall not bepossible. See also [2.3.4] for remote diagnostics and maintenance.

Interpretation:

1)Systems allowing for remote connection (e.g. via Internet), for e.g. remote diagnostics or maintenance

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 28

purposes, should be secured with sufficient means to prevent unauthorised access, and functions tomaintain the security of the control and monitoring system. The security properties should bedocumented.

2)Any remote access to the control system should be authorised on-board.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

The system should have appropriate virus protection also related to the possibility of infection via the remote connection. If remote connection for e.g. the above purposes is possible, the function is subject to special considerations and case-by-case approval.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2 System software

2.1 Software requirements

Application software shall, to the extent possible, be standardised with the flexibility to provide the requiredfunctionality for an individual system by simple configuration and parameterisation (i.e. with minimal need forhigh level programming).

(Ref. IEC 60092-504 10.9.2, 10.11.4)

Interpretation:

1)Application software should be realised using standard software modules (e.g. function blocks) to the

greatest extent possible. The software modules should have the flexibility to provide individualapplication functionality by use of simple configuration and parameterisation. The use of high levelprogramming should be minimised.

2)The application software, software modules and function blocks should encourage consistent

programming of functions within the system as well as maximising the consistency of operation andconsistency of presentation of information to the Operator.

3)System set-up, configuration to suit the EUC and the setting of parameters for the EUC on-board should

take place without modification of program code or recompilation. Facilities should be provided toallow simple back-up and restoration of Operator configured parameters.

––––––––––––––– end of Interpretation –––––––––––––––

2.2 Software development

Software shall be developed in accordance with procedures for configuration management that ensuretraceability and the integrity of the software.

(Ref. IACS UR E22 2.5, 3.7, 4.1, IEC 60092-504 10.9)

Interpretation:

All relevant actions should be taken during manufacturing of software for a complex system to ensure thatthe probability of errors to occur in the program code is reduced to an acceptable level. Relevant actions should at least include actions to:

—ensure that the programming of applications is based on complete and valid specifications

—ensure that software purchased from other parties has an acceptable track record and is subject to

adequate testing

—impose a full control of software releases and versions during manufacturing, installation on-board and

during the operational phase

—ensure that program modules are subject to syntax and function testing as part of the manufacturing process—minimise the probability of execution failures.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

Typical execution failures are:-deadlocks-infinite loops-division by zero

-inadvertent overwriting of memory areas

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 29

-erroneous input data.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.2.1 The actions taken to comply with 2.2.1 shall be documented and implemented, and the execution of theseactions shall be retraceable.

Interpretation:

1)The documentation should include a brief description of all tests that apply to the system (hardware and

software), with a description of the tests that are intended to be made by sub-vendors, those to be carriedout at the manufacturer’s works and those to remain until installation on-board.

When novel software is developed for essential systems, third party “approval of the manufacturer”may be required, either prior to or as part of the actual product development.

2)Running software versions should be uniquely identified by a version number, date or other appropriate

means. This should apply for all system software (including third party software packages) and allapplication software. Modifications should not be made without also changing the version identifier.

––––––––––––––– end of Interpretation –––––––––––––––

2.3 Software and hardware change management

2.3.1 The requirements in this section apply to software and hardware changes done after the certification, i.e.changes done after approval and issuance of the certificate.

2.3.2 System software shall be protected against un-authorised and unintended modifications by means ofappropriate access control.

(Ref. IACS UR E22 2.5, IEC 60092-504 10.3)

2.3.3 Software shall be maintained in accordance with procedures for configuration management that ensuretraceability and the integrity of the software.

(Ref. IACS UR E22 2.5, 3.7, 4.1, Appendix 1, 1.5)

Interpretation:

1)Manufacturers or system suppliers should maintain a system to track changes as a result of defects

being detected in hardware and software, and inform users of the need for modification in the event ofdetecting a defect.

2)Major changes or extensions in hardware or software of approved systems should be described and

submitted for evaluation. If the changes are deemed to affect compliance with rules, more detailedinformation may be required submitted for approval and a survey may be required to verify compliancewith the rules.

3)When basic- or application software is changed on an approved control system, the following

requirements apply:

—a procedure for software change handling should be available on request, describing the necessary

steps and precautions related to SW handling

—major modifications which may affect compliance with the rules should be described and submitted

to the society for evaluation before the change is implemented on-board

—no modification should be done without the acceptance and acknowledgement by the offshore units

responsible member of the crew

—the modified system should be tested and demonstrated for the offshore units responsible member

of the crew

—the modification should be documented (including objective/reason for the change, description,

authorization, test record, signatures, date, new incremented SW revision no)

—a test program for verification of correct installation and correct functioning of the applicable

functions should be available

—in case the new software upgrade has not been successfully installed, the previous version of the

system should be available for re-installation and re-testing.

––––––––––––––– end of Interpretation –––––––––––––––

2.3.4 If the control system is approved for remote software maintenance (i.e. from outside the vessel), theprocedures and means for configuration management must be expanded beyond the requirements of [2.3.2] toensure that the integrity of the software is maintained.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 30

Interpretation:

1)A particular procedure for the remote SW maintenance operation should exist.

2)No remote access or remote SW modification should be possible without the acceptance and

acknowledgement by the offshore units responsible member of the crew.

3)The security of the remote connection should be ensured by preventing unauthorized access (e.g.

password, and other means of verification) and by protecting the data being transferred (e.g. byencryption methodologies).

4)Before the updated software is put into real-time use, the integrity of the new software should be

verified by appropriate means.

5)The remote session should be logged in accordance with the above procedure for remote SW

maintenance.

––––––––––––––– end of Interpretation –––––––––––––––

3 Network systems and communication links

3.1 General

3.1.1 All nodes in a network shall be synchronized to allow a uniform time tagging of alarms (and events) toenable a proper sequential logging.

Interpretation:

The accuracy of the synchronisation should as a minimum correspond to the time constants in the processso that the true sequence of events may be traced in the alarm list.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

If information is received from a source where time tagging is not practical, it is accepted that the time tagging is doneat the receiving node in the network, at the earliest possible time.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.2 The network shall be designed with adequate immunity to withstand the possible noise exposure inrelevant areas.

Guidance note:

This implies e.g. use of fibre optical cable in areas of high noise exposure from high voltage equipment.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.3 Systems or components not considered to be a necessary part of the automation and safety functions shallnot be connected to the system.

Interpretation:

1)If the automation and safety system is connected to administrative networks, the connection principle

should ensure that any function or failure in the administrative net can not harmfully affect thefunctionality of the automation and safety system. The administrative functions should be hosted inseparate servers and should, if at all necessary, have 'read only' access to the control network.

2)It should not be possible for unauthorized personnel to connect equipment to the SAS network, e.g.

unauthorised access on network components like e.g. switches.

3)Miscellaneous office- or entertainment functions should not be connected to the automation and safety

system.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

Ad 1) the 'administrative network' in this connection may contain functions like e.g. report generation, processanalysis, decision support etc, i.e. functions that by definition are not essential for vessel operation and not coveredby the offshore standard.

Ad 2) and 3) it is normally not acceptable to include CCTV video streams as part of the automation and safety system.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.4 It shall be possible to maintain emergency operation of the vessel/units main functions independent of

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 31

network status. This may imply that essential nodes hosting emergency operation functionality shall be able towork autonomously, and with necessary operator interface independent of the network.

3.1.5 Any network integrating SAS shall be single point of failure-tolerant. This normally implies that thenetwork with its necessary components and cables shall be designed with adequate redundancy.

Interpretation:

If the fault tolerance is based on other design principles, e.g. a ring net, the fault tolerance shall bedocumented specifically. The requirement applies to the network containing the integrated SAS, and noteventual external communication links to single controllers, remote I/O or similar (e.g. a serial line to aninterfaced controller) when such units otherwise can be accepted without redundancy.

––––––––––––––– end of Interpretation –––––––––––––––

3.1.6 Cables and network components belonging to redundant networks shall as far as practicable bephysically separated in exposed areas.

Guidance note:

Exposed areas in this context means machinery spaces category A and hazardous areas and areas where operationalincidents may lead to damage of equipment.

In order to support the system fault tolerance, it is recommended to arrange redundant network components withnecessary power supplies in separate cabinets, and the network cabling serving the redundant networks routedseparately.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2 Network communication

3.2.1 All network components controlling the network traffic and nodes communicating over the network shallbe designed with inherent properties to prevent network overload at any time. This implies that neither thenodes nor the network components shall, intentionally or erroneously, be able to generate excessive networktraffic or consume extra resources that may degrade the network performance.

Guidance note:

This may imply that the nodes and network components should have properties to monitor it's own communicationthrough the network, and to be able to detect, alarm and respond in a predefined manner in case of an excessive trafficevent.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.2.2 The network (traffic) performance shall be continuously monitored, and alarms shall be generated ifmalfunctions or reduced/degraded capacity occurs. The alarm detail level shall be sufficient to clearly identifythe cause of the failure and related modules shall go to fail safe condition if necessary.

3.2.3 Important inter-node signals shall reach the recipient within a pre-defined time. Any malfunctions shallbe alarmed and nodes shall go to fail safe condition if necessary.

Interpretation:

The 'pre-defined time' should as a minimum correspond to the time constants in the EUC, which impliesthat the detection and alarming should be initiated quickly enough to enable appropriate operatorintervention to secure the operation of the EUC.

––––––––––––––– end of Interpretation –––––––––––––––

3.2.4 When different main systems are integrated in a common network, the network topology shall bedesigned with physical segmentation where each main system is allocated to different segments. (Ref. IEC60092-54, 4.3, 4.6 and 9.5.2)

Interpretation:

1)The integrity and autonomy of each segment should be secured with appropriate network components,

e.g. firewalls or routers. It should be possible to protect each segment from unnecessary traffic on theremaining network, and each segment should be able to work autonomously.2)Virtual networks (VLAN) is not considered satisfactory to meet the requirements for network fault

tolerance and segmentation as specified.

––––––––––––––– end of Interpretation –––––––––––––––

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 32

3.3 Network analysis

For complex automation and safety systems, the network with its components, connected nodes,communication links (also external interfaces) shall be subject to an analysis where all relevant failurescenarios are identified and considered.

Interpretation:

1)The requirement is basically applicable for all automation and safety containing nodes connected on a

common network. However, for simpler systems, the above requirement is fulfilled by covering themost relevant failure scenarios in a test program.

2)The analysis should demonstrate robustness against network storm and other possible failure scenarios,

as fail safe may not be achievable. It should specifically focus on the integrity of the different networkfunctions implemented in separate network segments as well as the main network components(switches, routers etc.).

3)The main purpose of the analysis is to identify possible failures that may occur in the network, identify

and evaluate the consequences and to ensure that the consequences of failures are acceptable.

The analysis should be performed in connection with the system design, and not after the system isimplemented.

––––––––––––––– end of Interpretation –––––––––––––––

3.4 Network test and verification

The network functionality shall be verified in a test where at least the following items shall be verified:——————

The main observations / items from the analysis

Self diagnostics, alarming upon different network failuresWorst-case scenarios - network storm

Segment segregation - autonomous operation of segments

Individual controller node integrity - nodes working without network communicationConsequence of single cabinet loss.

3.5 Wireless communication

3.5.1 Wireless technologies may be used in functions that are additional or supplementary to those required bythe offshore standard. Any use of wireless technology in functions required by the offshore standard shall besubject to special considerations where the requirements of this chapter is observed.(Ref. IACS UR E22 sec. 2.4.1)

3.5.2 Functions that are required to operate continuously to provide essential services dependant on wirelessdata communication links shall have an alternative means of control that can be brought in action within anacceptable period of time.

(Ref. IACS UR E22 sec. 2.4.2)

3.5.3 The wireless equipment shall not cause interference to licensed users of the ISM frequency bands in thegeographical areas where the vessel/unit shall operate. The radiated power level shall be adjustable.(Ref. IACS UR E22, sec. 2.4.4)

Guidance note:

The wireless-equipment should be certified according to technical requirements established by applicable IEEE802standards for operation within the ISM band. The user manual should identify any relevant spectrum and powerrestrictions for the ISM bands that may have been enforced by the authorities in the various states of relevance in theoperating area of the vessel/unit.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.4 The wireless broadcasting shall operate in the radio bands designated for ISM.(Ref. IACS UR E22, Sec. 2.4.4)

Guidance note:

The industrial, scientific and medical (ISM) bands are located at 900 MHz (902-928 MHz), 2.4 GHz (2400-2483.5MHz) and 5.8 GHz (5725-5850 MHz).

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.5 The wireless broadcasting shall sustain the anticipated electromagnetic environment on board and betolerant towards interference from narrow-band signals.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.3 Additional requirements for computer based systems – Page 33

Guidance note:

The type of modulation used should be of the category “spread spectrum” and be in compliance with the IEEE 802series. Direct Sequence Spread Spectrum (DSSS) and Frequency Hopping Spread Spectrum (FHSS) are recognisedstandards for modulation.

If DSSS modulation is used and more than one access point (AP) may be active simultaneously, these APs should bephysically separated and also use separate channels. The minimum processing gain should not be less than 10 dB.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.6 The wireless system shall entail a fixed topology and support prevention of unauthorised access to thenetwork.

(Ref. IACS UR E22, Sec.2.4.3d)

Guidance note:

The access to the network should be restricted to a defined set of nodes with dedicated MAC (media access control)addresses.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.7 In case more than one wireless system shall operate in the same area on board and there is a risk ofinterference, a frequency coordination plan shall be made and the interference resistance shall be documentedand then demonstrated on board.

3.5.8 The wireless equipment shall employ recognised international protocols supporting adequate means forsecuring message integrity.

(Ref. IACS UR E22, Sec. 2.4.3a)

Guidance note:

The protocol should be in compliance with the IEEE 802 standard and the nodes should execute at least a 32-bit cyclicredundancy check of the data packets.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.9 In case any form of control signals or confidential data is transferred over the wireless network, dataencryption according to a recognised standard shall be utilised. (Ref. IACS UR E22, Sec. 2.4.3c)

Guidance note:

Secure encryption schemes such as WiFi Protected Access (WPA) should be used to protect critical wireless data.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.5.10 The data handling and final presentation of information shall comply with the offshore standard andregulations being applicable to the information category.

Guidance note:

Isochronous (real-time) or asynchronous (transmit-acknowledgment) transport will be required depending on theapplication.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 34

SECTION 4 COMPONENT DESIGN AND INSTALLATION

1 General

1.1 Environmental strains

1.1.1 Safety, automation and telecommunication equipment shall be suitable for marine use, and shall bedesigned to operate under the environmental conditions as described in [2].

1.1.2 Data sheets, which are sufficiently detailed to ensure proper application of the instrumentationequipment shall be available.

1.1.3 Performance and environmental testing may be required to ascertain the suitability of the equipment.

1.2 Materials

Explosive materials and materials, which may develop toxic gases shall not be used. Covers, terminationboards, printed circuit cards, constructive elements and other parts that may contribute to spreading fire shallbe of flame-retardant materials.

Guidance note:

Materials with a high resistance to corrosion and ageing should be used. Metallic contact between different materialsshould not cause electrolytic corrosion in a marine atmosphere. As base material for printed circuit cards, glassreinforced epoxy resin or equivalent should be used.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.3 Component design and installation

1.3.1 Component design and installation shall facilitate operation, adjustment, repair and replacement. As faras practicable, screw connections shall be secured.

1.3.2 Mechanical resonance with amplification greater than 10 shall not occur.

1.3.3 Electric cables and components shall be effectively separated from all equipment, which, in case ofleakage, could cause damage to the electrical equipment. In desks, consoles and switchboards, which containelectrical equipment, shall pipes and equipment conveying oil, water or other fluids or steam under pressure bebuilt into a separate section with drainage.

1.3.4 Means shall be provided for preventing moisture (condensation) accumulating inside the equipmentduring operation and when the plant is shut down.

1.3.5 Differential pressure elements (dp-cells) shall be able to sustain a pressure differential at least equal tothe highest pressure for the EUC.

1.3.6 Thermometer wells shall be used when measuring temperature in fluids, steam or gases under pressure.1.3.7 The installation of temperature sensors shall permit easy dismantling for functional testing.1.3.8 Clamps used to secure capillary tubes shall be made of a material that is softer than the tubing.1.3.9 Isolation valves in essential instrument sensor piping and speed control valves in actuator control tubingshall be designed to minimise the possibility of inadvertent mal-operation. Speed control valves in essentialcontrol systems shall be locked in position after adjustment.

1.4 Maintenance

Maintenance, repair and performance tests of systems and components shall as far as practicable be possiblewithout affecting the operation of other systems or components. Provisions for testing, (e.g. three-way cocks)shall be arranged in pipes connecting pressure switches or transducers to EUC normally in operation at sea.

Guidance note:

The installation should, as far as possible, be built up from easily replaceable components and designed for easytroubleshooting, testing, and maintenance. When a spare component is mounted, only minor adjustments orcalibrations of the component should be necessary. Faulty replacements should not be possible.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.5 Marking

All equipment and test points shall be clearly and permanently marked. Transducers, controllers and actuatorsshall be marked with their corresponding system identification, so that they can be easily and clearly identifiedon plans and in instrument lists.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 35

Guidance note:

The marking of system identification should preferably not be placed on the equipment itself, but adjacent to it.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.6 Standardisation

Guidance related to standardisation:

Guidance note:

Systems, components and signals should be standardised as far as practicable.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2 Environmental conditions, instrumentation

2.1 General

2.1.1 The environmental parameters specified in [2.2] to [2.11], including any of their combinations, represent“average adverse” conditions to be fulfilled, which will cover the majority of applications on board units.Where the environmental strains will exceed those specified in [2.2] to [2.11], the corresponding requirementsshall be modified accordingly.

2.1.2 The different environmental parameter classes are defined in Table 4-1.Table 4-1 Parameter class for the different locations on board

Parameter

Location

Machinery spaces, control rooms, accommodation, bridge

Inside cabinets, desks, etc. with temperature rise of 5°C or more installed in location A

TemperaturePump rooms, holds, rooms with no heating

Open deck, masts and inside cabinets, desks etc. with a temperature rise of 5°C or more installed in location CALocations where special precautions are taken to avoid condensation

Humidity

BAll locations except as specified for location AAOn bulkheads, beams, deck, bridgeBOn machinery such as internal combustion engines, compressors, pumps, including piping on Vibration

such machineryCMastsAAll locations except as specified for bridge and open deck

EMC

BAll locations including bridge and open deck

Components and systems designed in compliance with IEC environmental specifications for ships, Publication No. 60092-504 (1994), and for EMC, IEC Publication No. 60533, may be accepted after consideration.

Guidance note:

For details on environmental conditions for instrumentation, see Certification Note No. 2.4.Navigation and radio equipment should comply with IEC Publication No. 60945.

For EMC only, all other bridge-mounted equipment; equipment in close proximity to receiving antennas, andequipment capable of interfering with safe navigation of the vessel/unit and with radio-communications shouldcomply with IEC Publication No. 60945 (1996) Clause 9 (covered by EMC class B).

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---ClassABCD

2.2 Electric power supply

2.2.1 Power supply failure with successive power breaks with full power between breaks:—3 interruptions during 5 minutes —switching-off time 30 s each case.

2.2.2 Power supply variations for equipment connected to A.C. systems:

—combination of permanent frequency variations of ±5% and permanent voltage variations of +6 / −10% of

nominal

—combination of frequency transients (5 s duration) ±10% of nominal and voltage transients (1.5 s duration)

± 20% of nominal.2.2.3 Power supply variations for equipment connected to D.C. systems:

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 36

—voltage tolerance continuous ±10% of nominal—voltage transients cyclic variation 5% of nominal—voltage ripple 10%.

2.2.4

Power supply variations for equipment connected to battery power sources:—+30% to −25% for equipment connected to battery during charging—+20% to −25% for equipment connected to battery not being charged—voltage transients (up to 2 s duration) ±25% of nominal.

2.3 Pneumatic and hydraulic power supply

Nominal pressure ±20% (long and short time deviations).

2.4 Temperature

2.4.1 Class A: Ambient temperatures +5°C to +55°C.2.4.2 Class B: Ambient temperatures +5°C to +70°C.2.4.3 Class C: Ambient temperatures –25°C to +55°C.2.4.4 Class D: Ambient temperatures –25°C to +70°C.

2.5 Humidity

2.5.1 Class A: Relative humidity up to 96% at all relevant temperatures, no condensation.2.5.2 Class B: Relative humidity up to 100% at all relevant temperatures.

2.6 Salt contamination

Salt-contaminated atmosphere up to 1 mg salt per m3 of air, at all relevant temperatures and humidityconditions. Applicable to equipment located in open air and made of material subject to corrosion.

2.7 Oil contamination

2.7.1 Mist and droplets of fuel and lubricating oil. Oily fingers.

2.8 Vibrations

2.8.1 Class A

—frequency range 3 to 100 Hz

—amplitude 1 mm (peak value) below 13.2 Hz—acceleration amplitude 0.7 g above 13.2 Hz.2.8.2 Class B

—frequency range 3 to 100 Hz

—amplitude 1.6 mm (peak value) below 25 Hz—acceleration amplitude 4.0 g above 25 Hz.2.8.3 Class C

—frequency range 3 to 50 Hz

—amplitude 3 mm (peak value) below 13.2 Hz—acceleration amplitude 2.1 g above 13.2 Hz.

2.9 Electromagnetic compatibility

The minimum immunity requirements for equipment are given in Table 4-2, and the maximum emissionrequirements are given in Table 4-3.

Guidance note:

Electrical and electronic equipment should be designed to function without degradation or malfunction in theirintended electromagnetic environment. The equipment should not adversely affect the operation of, or be adverselyaffected by any other equipment or systems used on board or in the vicinity of the vessel. Upon installation, it may berequired to take adequate measures to minimise the electromagnetic noise signals. Such measures may be in form of

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 37

a list of electromagnetic noise generating- and sensitive equipment, and an estimate on required noise reduction, i.e.an EMC management plan. Testing may also be required to demonstrate electromagnetic compatibility.

Table 4-2 Minimum immunity requirements for equipment

PortA.C. power

Phenomenon

Conducted low frequency interference

Basic StandardIEC 60945

Performance Test valuecriteriaA50 - 900 Hz: 10% A.C. supply

voltage

900 - 6000 Hz: 10 - 1% A.C. supply voltage

6 - 10 kHz: 1% A.C. supply voltage

B2 kV3)BA

0.5 kV 1) /1 kV 2)3 Vrms3); (10 kHz)6) 150 kHz - 80 MHz

sweep rate ≤ 1.5 x 10-3 decade/s7)modulation 80% AM (1 kHz)50 Hz - 10 kHz: 10% D.C. Supply voltage2 kV 3)0.5 kV 1) /1 kV 2)3 Vrms3); (10 kHz)6) 150 kHz - 80 MHz

sweep rate ≤ 1.5 x 10-3 decade/s7) modulation 80% AM (1 kHz)1 kV 4)3 Vrms3); (10 kHz)6) 150 kHz - 80 MHz

sweep rate ≤ 1.5 x 10-3 decade/s7) modulation 80% AM (1 kHz)6 kV contact/8 kV air

10 V/m5) 80 MHz-2 GHz

sweep rate ≤ 1.5 x 10-3 decade/s7) modulation 80% AM (1 kHz)

Electrical fast transient IEC 61000-4-4(Burst)

Surge voltageIEC 61000-4-5Conducted radio frequency IEC 61000-4-6 interference

D.C. power

Conducted low frequency interference

Electrical fast transient (Burst)

Surge voltage

Conducted radio frequency interference

IEC 60945IEC 61000-4-4IEC 61000-4-5IEC 61000-4-6

ABBA

I/O ports, signal or control

Electrical fast transient IEC 61000-4-4(Burst)

Conducted radio frequency IEC 61000-4-6 interference

Electrostatic discharge (ESD)

Electromagnetic field

IEC 61000-4-2IEC 61000-4-3

BA

EnclosureBA

1)2)3)4)5)6)7)

line to lineline to ground

capacitive couplingcoupling clamp

special situations to be analysed

test procedure to be described in the test report

for equipment installed in the bridge and deck zone (EMC Class B) the test levels are to be increased to 10 Vrms for spot frequencies in accordance with IEC 60945 at 2/3/4/6.2/8.2/12.6/16.5/18.8/22/25 MHz. For screened cables, a special test set-up is to be used enabling the coupling into the cable screen.

Performance criterion A: The equipment under test (EUT) is to continue to operate as intended during and after the test. No degradation of performance or loss of function is allowed as defined in the relevant equipment standard and in the technical specification published by the manufacturer.

Performance criterion B: The EUT is to continue to operate as intended after the test. No degradation of performance or loss of function is allowed as defined in the relevant equipment standard and in the technical

specification published by the manufacturer. During the test, degradation or loss of function or performance that is self recoverable is however allowed but no change of actual operating state or stored data is allowed.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 38

Table 4-3 Maximum emission requirements for equipment

ClassA

LocationPort

All locations except Enclosure

bridge and open deck(Radiated Emission)

Frequency Range (Hz)

150 k – 30 M30 – 100 M100 M – 2 Gexcept:156 – 165 M10 – 150 k150 – 500 k500 k – 30 M150 – 300 k300 k – 30 M30 M – 2 Gexcept:156 – 165 M10 – 150 k150 – 350 k350 k – 30 M

Limits

80 – 50 dBµV/m60 – 54 dBµV/m54 dBµV/m

24 dBµV/m120 – 69 dBµV79 dBµV73 dBµV80 – 52 dBµV/m52 – 34 dBµV/m54 dBµV/m24 dBµV/m96 – 50 dBµV60 – 50 dBµV50 dBµV

Power (Conducted Emission)

B

All locations Enclosure

including bridge and (Radiated Emission)open deck

Power (Conducted Emission)

2.10 Inclination

The requirements in DNV-OS-D101, Ch.2 Sec.1 [2.2] apply.

2.11 Miscellaneous

2.11.1 In particular applications other environmental parameters may influence the equipment, such as:—————————

accelerationfire

explosive atmospheretemperature shock

wind, rain, snow, ice, dustaudible noise

mechanical shock or bump forces equivalent to 20 g of 10 ms durationsplash and drops of liquidcorrosive atmospheres.

2.11.2 Acceleration caused by the ship's movement in waves. Peak acceleration ±1.0 g for ships with lengthless than 90 m, and ±0.6 g for ships of greater length. Period 5 to 10 s.

3 Electrical and electronic equipment

3.1 General

3.1.1 Fused isolating transformers shall be fitted between the main power supply and the different equipmentor systems.

3.1.2 Switching of the power supply on and off shall not cause excessive voltage or other strains that maydamage internal or external components.

3.1.3

Equipment requiring insulating resistance in cables and wiring higher than 200 kΩ shall normally not be used.Exceptions can be made for special cable arrangements.

3.2 Mechanical design, installation

3.2.1 The components shall be effectively secured to avoid mechanical stressing of wires and soldered jointsthrough vibrations and mechanical shock.

Guidance note:

Circuits should be designed to prevent damage of the unit or adjacent elements by internal or external failures. Nodamage should occur when the signal transmission lines between measuring elements and other units are short-circuited, grounded or broken. Such failures should lead to a comparatively safe condition (fail to safe).

The equipment should preferably function without forced cooling. Where such cooling is necessary, precautionsshould be taken to prevent the equipment from being damaged in case of failure of the cooling unit.Components weighing more than 10 g should not be fastened by their connecting wires only.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 39

3.3 Protection provided by enclosure

Enclosures for the equipment shall be made of steel or other flame retardant material capable of providingEMC protection and satisfy the minimum requirements of Table 4-4. The required degree of protection isdefined in IEC 60529.

Table 4-4 Minimum requirements for enclosures

ClassABCD

LocationDegree of protectionControl rooms, accommodation, bridge, local equipment rooms, central equipment roomIP 20Machinery spacesIP 44Open deck, masts, below floor plates in machinery spacesIP 56Submerged applicationIP 68

Guidance note:

Equipment of class A and B that should be in operation during emergency situations, located in areas exposed to washdown, should have IP 55 protection.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.4 Cables and wires

3.4.1 Cables and wires shall comply with the requirements in DNV-OS-D201.

3.4.2 Cables, wires and electrical components in systems required to operate in a fire scenario shall haveadequate fire resistance properties to ensure correct system operation. This is particularly important for systemswhere electric energy is required to operate or maintain control over the system.

3.5 Cable installation

Cable installations shall comply with the requirements in DNV-OS-D201.

3.6 Power supply

Electrical power supply shall meet requirements described in DNV-OS-D201.

3.7 Fibre optic equipment

3.7.1 Fabrication and installation of fibre optic cables shall comply with the requirements of the relevant DNVstandard for electrical systems and equipment, DNV-OS-D201.

Guidance note:

The construction of fibre optic devices should comply with relevant specifications of International ElectrotechnicalCommission's (IEC) Publications.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.7.2 Power budget calculation shall be used to:

—determine the length between I/O components

—select components to obtain a safe reliable transmission system—demonstrate that adequate power reserve has been provided.

After installation, Optical Time Domain Reflectometry (OTDR) measurements for each fibre shall be used tocorrect and re-evaluate the power budget calculations.

Guidance note:

Power budget calculations to be available upon request.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.7.3 The safety of personnel and operations shall be considered in the installation procedures. Warning signsand labels giving information to the operators shall be placed where hazard exists. Care must be taken toprevent fibres from penetrating eyes or skin.

Guidance note:

It is advised to use equipment with ‘built-in’ safety, e.g. interlock the power to the light sources with the covers,possible to disconnect or lock parts of the system under service, screen laser beams. The safe distance between thelight source or fibre end and the eye of the operator may be determined by applying the formula:

(Pn+10)

Lsafe=---------------------2

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.4 Component design and installation – Page 40

Safe distance: L (cm); Pn: Nominal power (mW).

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.7.4 Fibre optic systems using standard single and multimode fibres to be used for intrinsically safe circuitsin hazardous areas shall have a power level below 10 mW.

4 Pneumatic and hydraulic equipment

4.1 Pneumatic equipment

4.1.1 System components and arrangement shall satisfy the requirements in DNV-OS-D101, Ch.2 Sec.4 [9.2].4.1.2 For air supply, the redundancy requirement of DNV-OS-D101 Ch.2 Sec.4 [1.2.1] applies forcompressors, pressure reduction units, filters and air treatment units (lubricator or oil mist injector anddehumidifier).

4.1.3 Piping, tubing and components in systems required to operate in a fire scenario shall have adequate fireresistance properties to ensure correct system operation. This is particularly important for systems wherepneumatic energy is required to operate or maintain control over the system.

4.2 Hydraulic equipment

System components and arrangement shall satisfy the requirements in DNV-OS-D101, Ch.2 Sec.4 [8].

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.5 User interface – Page 41

SECTION 5 USER INTERFACE

1 General

1.1 Application

The requirements of this section apply for all DNV Offshore Standards class vessel/units.

1.2 Introduction

1.2.1 The location and design of the user interface shall give consideration to the physical capabilities of theuser and comply with accepted ergonomic principles.

1.2.2 This section gives requirements for the user interface to ensure a safe and efficient operation of thesystems installed.

2 Workstation design and arrangement

2.1 Location of visual display units and user input devices

2.1.1 Workstations shall be arranged to provide the user with easy access to UIDs, VDUs and other facilitiesrequired for the operation.

Guidance note:

The VDUs and UIDs should be arranged with due consideration of the general availability parameters as shown inFigure 5-1 and Figure 5-2.

Figure 5-1

VDU arrangement parameters

Figure 5-2

UID arrangement parameters

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.1.2 UIDs and VDUs serving the same function shall as far as possible be arranged and grouped together.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.5 User interface – Page 42

3 User input device and visual display unit design

3.1 User input devices

3.1.1 The method of activating a UID shall be clear and unambiguous.

3.1.2 The direction of UID movements shall be consistent with the direction of associated process responseand display movement.

Guidance note:

The purpose should ensure easy and understandable operation, e.g. a side thruster lever should be arranged athwart,a propulsion thruster lever shall be arranged according to the vessel response. The thruster response shall correspondto the lever movement.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.3 The operation of a UID shall not obscure indicator elements where observation of these elements isnecessary for adjustments.3.1.4

Guidance note:

Rectangular buttons should be used for UID elements, and round lights for VDU elements. For screen based systems,a suitable framing method should be chosen.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.5 UIDs shall be simple to use, and shall normally allow for one hand operation. The need for fine motoricmovements shall be avoided.

3.1.6 The naming, numbering and tagging for the different main components shall be consistent on theapplicable VDUs, UIDs and signboards.

3.2 Visual display units

3.2.1 The information presented shall be clearly visible to the user and permit easy and accurate reading at apracticable distance in the light conditions normally experienced where installed.

3.2.2 In order to ensure readability, the update frequency of VDUs shall be consistent with the operational useof the VDU and the accuracy requirement, if any, to the data displayed.3.2.3 VDU letter type shall be of simple, clear-cut design.

3.2.4 Set points shall always be available at the location of the UID.

3.2.5 Back-up means of operation, see [2.1.1] normally located in the CCR, shall contain the most importantdetection and alarms related to fire and gas; activation of ESD levels and active fire protection devices.

Interpretation:

The level of detail in the presentation of fire alarms should as minimum correspond to the available activefire protection devices.

––––––––––––––– end of Interpretation –––––––––––––––

Guidance note:

This will normally include:

-remove all inhibits/over-rides/blockings-active inhibit/over-ride/blocking indication

-fire water pump start and pump status indication

-release of water based extinguishing systems and release confirmation indication-fire detection status indication-Gas detection

-release of ESD and ESD release confirmation indication-lamp test, silence buzzer etc.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.3 Colours

The use of colours shall be consistent. Red shall be reserved to indicate danger, alarm and emergency only.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.5 User interface – Page 43

Guidance note:

Colour coding of functions and signals should be in accordance with Table 5-1.

Table 5-1 Colour coding

Function

Danger, Alarm, Emergency

Attention, Warning, Caution, UndefinedStatus of normal, safe situation

Colour code

RedYellowGreen

3.4 Requirements for preservation of night vision (UIDs and VDUs for installation on the navigating bridge)

3.4.1 Warning and alarm indicators shall show no light in normal position.

3.4.2 All UIDs and VDUs shall be fitted with permanent internal or external light source to ensure that allnecessary information is visible at all times.

3.4.3 Means shall be provided to avoid light and colour changes which may affect night vision, upon forexample start-up and mode changes.

3.4.4 Means shall be provided for adjustment of illumination of all VDUs and UIDs to a level suitable for allapplicable light conditions. However, to make adjustments down to a level making information belonging toessential and important functions unreadable is not permissible and shall be prevented.

4 Screen based systems

4.1 General

4.1.1 The status of all displayed objects shall be clear and unambiguous, and presentation of displays shall beconsistent.

Interpretation:

For integrated systems, all windows to be called to the VDU should have a similar representation of allcomponents (menus, buttons, symbols, colours, etc.).

––––––––––––––– end of Interpretation –––––––––––––––

4.1.2 Alarms shall have priority over any other information presented on the VDU. The entire list of alarmmessages shall be easily available.

4.1.3 UIDs shall be designed and arranged to avoid inadvertent operation.

Guidance note:

The purpose should be to prevent unintentional activation / de-activation of systems, e.g. by means of a lid over a stopbutton or two-step operation of critical screen-based functions.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---4.1.4 For essential and important systems, dedicated and independent input devices shall be used.

Guidance note:

The input device is normally a dedicated function keyboard, but alternative arrangements like e.g. touch-screens ordedicated software-based dialogue boxes, switches or joysticks may be accepted after special considerations.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---4.1.5 Symbols and their associated information in a mimic display shall have a logical relationship.4.1.6 Means shall be provided to ensure that only correct use of numbers and letters and only values withinreasonable limits will be accepted when data is entered manually into the system.

If the user provides the system with insufficient input, the system shall request the continuation of the dialogueby means of clarifying questions. Under no circumstances is the system to end the dialogue incomplete withoutuser request.

4.2 Computer dialogue

4.2.1 Frequently used operations shall be available in the upper menu level, on dedicated software or hardwarebuttons.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.5 User interface – Page 44

4.2.2 All menus and displays functions shall be self-explanatory or provided with appropriate help-functions.4.2.3 When in dialogue mode, update of essential information shall not be blocked.

4.2.4 Entry of data shall be arranged with a default value prompted by the system and permitted data interval.4.2.5 The systems shall indicate the acceptance of a control action to the user without undue delay.

4.2.6 Confirmation of a command shall only be used when the action requested may have a critical irreversibleconsequence.

4.2.7 It shall be possible for the user to recognise whether the system is busy executing an operation, or waitingfor additional user action. When the system is busy, there shall not be buffering of more than one user input.Manually initiated time-consuming operations shall be possible to cancel.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.6 Supplementary requirements for drilling units – Page 45

SECTION 6 SUPPLEMENTARY REQUIREMENTS FOR DRILLING UNITS

1 Introduction

In addition to the requirements given in this standard, the following requirements apply specially for drillingunits.

2 Design principles

Automation and safety system components that are intended to be alive after an incident shall be suitable forEx zone 2 installation or safe by location, see DNV-OS-A101, Ch.2 Sec.4 [2.1.4].

3 System design

3.1 General

3.1.1 Distributed automation and safety modules with utilities necessary to operate, located in hazardous area,which is intended to be alive after an incident, shall be able to withstand the Design Accidental Load for theactual area, for an agreed time period.

Guidance note:

Relevant Design Accidental Loads are described in DNV-OS-A101 Ch.2 Sec.1.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.2 Upon failure of the ESD system, all connected systems shall default to the safest condition for the unitor installation.

Interpretation:

1)Internode signals between F&G and ESD nodes should follow the fail safe principles given in DNV-OS-A101 Ch.2 Sec.4 [2.1.3] and Sec.6 [4.2.2].

2)When the fail safe principle is NE, single communication links are accepted, provided that

communication failure activates relevant functions accordingly. When the fail safe principle is NDE,the communication link should be redundant in order to be able to activate the function in case ofcommunication failure.

––––––––––––––– end of Interpretation –––––––––––––––

4 User interface

Back-up means of operation, see [1.2.1] shall contain the most important action functions and alarm indicationsrelated to emergency relocation (if required), gas detection, including activation of active fire protectiondevices. (see [3.2.5]).

Guidance note:

In addition to [3.2.5] this will typically include:————

Release of foam systems and indication of foam system status, if applicableGas detection status indication (flammable and toxic)Facilities for emergency relocation, if applicable

Activation of BOP release sequence (normally located in BOP control panel).

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---5 Enhanced system

5.1 General

5.1.1 The following requirement applies only for units with the voluntary notation ES.

5.1.2 Alarm philosophy - ES

An alarm philosophy shall be developed for various alarm conditions.

They shall be distinguished by sound and colour and be given at main control stations and unit as applicable.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.6 Supplementary requirements for drilling units – Page 46

Guidance note:

Necessary maritime alarms must be located accordingly for any unit. Normally ECR and Navigation bridge,according to relevant IMO regulations.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.7 Supplementary requirements for production and storage units – Page 47

SECTION 7 SUPPLEMENTARY REQUIREMENTS FOR PRODUCTION

AND STORAGE UNITS

1 Introduction

In addition to the requirements given in this standard, the following requirements apply specially for floatingproduction and storage units.

2 Design principles

2.1 General

2.1.1 Shutdown or emergency stop commands shall not be reset automatically. Important shutdown devicesshall only be reset locally after the initiating shutdown command has been reset by the operator.

Guidance note:

For ESD valves see DNV-OS-E201 for details, however it is accepted that blow down valves are equipped withremote reset.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.1.2 Power to relevant parts of the ESD system shall not be tripped by lower ESD levels.

2.1.3 Automation and safety system components that are intended to be alive after an incident shall be suitablefor Ex zone 2 installation or safe by location, see DNV-OS-A101, Ch.2 Sec.4 [2.1.4].

3 System design

3.1 General

3.1.1 Distributed automation and safety modules, located in hazardous area, with utilities necessary to operate,which is required to be alive after an incident, shall be able to withstand the Design Accidental Load for theactual area, for an agreed time period.

Guidance note:

Relevant Design Accidental Loads are described in DNV-OS-A101, Ch.2 Sec.1.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.2 For the process plant, the redundancy requirement shall apply for the F&G node(s), see [3.2.3].

Guidance note:

Fire detection in accommodation and engine room including required marine systems the IMO MODU/SOLASrequirement is that such signals have to be routed through the fire panel before being routed to the F&G node.

For the process plant it is recommended that fire and gas detectors are connected directly to the F&G node(s) and notthrough the fire panel.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.3 Internode signals between F&G and ESD/PSD nodes shall follow the fail safe principles given in DNV-OS-A101, Ch.2 Sec.4 [2.1.3].

Guidance note:

When the fail safe principle is NE, single communication links are accepted, provided that communication failureactivates relevant functions accordingly. When the fail safe principle is NDE, the communication link should beredundant in order to be able to activate the function in case of communication failure.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---3.1.4 Alarm philosophy - ES

An alarm philosophy shall be developed for various alarm conditions.

They shall be distinguished by sound and colour and be given at main control stations and unit as applicable.

Guidance note:

Necessary maritime alarms must be located accordingly for any unit. Normally ECR and Navigation bridge,according to relevant IMO regulations.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.7 Supplementary requirements for production and storage units – Page 48

4 User interface

Back-up means of operation, see [1.2.1], shall contain the most important action functions and alarmindications related to ESD and F&G detection, including activation of active fire protection devices. (see[3.2.5]).

Guidance note:

In addition to [3.2.5]. this will normally include:

—Release of foam systems and indication of foam system status, if applicable—Status of vessel boundary shutdown valves

—Gas detection status indication (flammable and toxic)

—Facilities for emergency relocation, if applicable (see DNV-OS-E301, Ch.2, Sec.4 [11.5.9].

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.2 Sec.8 Supplementary requirements for storage units – Page 49

SECTION 8 SUPPLEMENTARY REQUIREMENTS FOR STORAGE UNITS

1 Introduction

In addition to the requirements given in this standard, the following requirements apply specially for floatingstorage units.

2 Design principles

Shutting of import/export valves or other emergency stop commands shall not be reset automatically. Importantshutdown devices shall only be reset locally after the initiating shutdown command has been reset by theoperator.

Guidance note:

For ESD valves see DNV-OS-E201 for details.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 50

CHAPTER 3 CERTIFICATION AND CLASSIFICATION

SECTION 1 REQUIREMENTS

1 General

1.1 Introduction

1.1.1 As well as representing DNV’s recommendations on safe engineering practice for general use by theoffshore industry, the offshore standards also provide the technical basis for DNV classification, certificationand verification services.

1.1.2 This chapter identifies the specific documentation, certification and surveying requirements to be appliedwhen using this standard for certification and classification purposes.

1.1.3 A complete description of principles, procedures, applicable class notations and technical basis foroffshore classification is given by the DNV offshore service specifications for classification, see Table 1-1.Table 1-1 DNV Offshore Service Specifications

No.

DNV-OSS-101DNV-OSS-102DNV-OSS-103DNV-OSS-104

Title

Rules for Classification of Offshore Drilling and Support Units

Rules for Classification of Floating Production, Storage and loading Units

Rules for Classification of LNG/LPG Floating Production and Storage Units or InstallationsRules for Classification of Self-Elevating Units

1.1.4 This chapter identifies the specific documentation, certification and surveying requirements to be appliedwhen using this standard for certification and classification purposes.

1.2 Classification principles

Classification of automation, safety, and telecommunication systems shall generally be according to theprinciples of:

—document evaluation (see [2])—certification requirements (see [3])

—on-board inspection (visual inspection and functional testing).

Guidance note:

The approval may be either case-by-case approval for each system, or type approval as specified in Certification NotesNo. 1.2 and 2.4.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---1.3 Applicable requirements

1.3.1 Requirements as covered by classification are governed by class notations. A complete description ofthese and their related scope can be found in the above listed Offshore Service Specifications.

1.3.2 Requirements applicable only for vessels with the voluntary notation ES can be found in the followingOffshore Standards.

Table 1-2 DNV Offshore Standards including ES requirements

No.

DNV-OS-A101DNV-OS-D101DNV-OS-D202DNV-OS-D301

Title

Safety Principles and Arrangements

Marine and Machinery Systems and Equipment

Automation, Safety, and Telecommunication SystemsFire Protection

1.3.3 Requirements applicable only for vessels with the voluntary notation ES as given in this standard are onalarm philosophy as described in Ch.2 Sec.6 [3.1.2].

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 51

2 Documentation

2.1 General

2.1.1 Overview documentation as listed in Table 1-3 is requested submitted early in the approval work,applicable for vessel/units with automation and safety systems installed.

Guidance note:

Typically submitted by yard/manufacturer/designer based upon their detailed specification.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.1.2 Documentation listed in Table 1-4 is required submitted in order to adequately describe the automationand safety system.

2.1.3 The documentation shall be limited to describe and explain the relevant aspects governed by the standardrequirements.

Guidance note:

Documentation for a specific automation and safety system should be complete (as required in Table 1-4) in a limitednumber of submittals. Priority should be given to documentation providing overall view as supposed to specificdetails.

A document may cover more than one instrumented system. A document may cover more than one documentationtype.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.1.4 Symbols used shall be explained, or reference to a standard code given.

Guidance note:

ISA 5.1 or ISO 3511-1/2/3/4 are accepted standards.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---2.1.5 The documentation type number together with identification of the automation and safety system can beused as a unique identifier for the document. The “T” indicates that the documentation type is required also forautomation and safety systems where type approved components or software modules are used.

2.1.6 For a system subject to certification, documentation listed in Table 1-5 shall be available for the surveyorat testing at the manufacturer.

2.1.7 For on-board inspection, documentation listed in Table 1-6 is required submitted to survey station.2.1.8 The documentation shall be limited to describe and explain the relevant aspects governed by the rulerequirements.

Guidance note:

Documentation for a specific automation and safety system should be complete (as required in Table 1-4) in onesubmittal, to the extent possible.

Typically submitted by manufacturers based upon their project specific specification.

(typically submitted by yard and/or designer and/or manufacturer based upon their detailed specification, applicable for vessels/units with the automation and safety system installed)Documentation typeInformation elementPurposeSystem philosophy (1010) (T)—the tasks allocated to each sub-system, divided between system Information

tasks and manual tasks, including emergency recovery tasks

—principles that will be used in the technical implementation of each

system.

Table 1-3 Documentation requested submitted at an early stage in the approval work

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 52

(typically submitted by manufacturers based upon their project specific specification)Documentation typeInformation element

Functional description —clear text description of the system configuration(system requirement —clear text description of scope of supply and what is controlled and specification) (1020) monitored as well as how(T)—clear text description of safe state(s) for each function implemented

—clear text description of switching mechanisms for systems designed with

redundancy R0

—P&I/hydraulic/pneumatic diagrams if relevant.

System block diagrams —a diagram showing connections between all main components (units, (1030) (T) modules) of the system and interfaces with other systems. With details

showing segregation between F&G, ESD, PSD and PCS systems as well as other systems where relevant.

User interface —a description of the functions allocated to each work and operator stationdocumentation (1040)—a description of transfer of responsibility between work and operator

stations.

—a description of the alarm philosophy

Power supply —electrical supply: diagram showing connection to distribution board(s), arrangement (1050) (T)batteries, converters or UPS. Including information regarding Ex/Non Ex

as applicable.

The purpose is to ensure that for single failures, essential systems will fail to Functional failure

analysis, for essential safety and that systems in operation will not be lost or degraded beyond systems and important acceptable performance criteria when specified by the offshore standard.

The following aspects shall be covered: closed loop system

(Z070) (T)

—a description of the boundaries of the system including power supply

preferably by a block diagram

—a list of items which are subject to assessment with a specification of

probable failure modes for each item, with references to the system documentation

—a description of the system response to each of the above failure modes

identified

—a comment to the consequence of each of these failures.

Failure mode and effect A failure modes and effect analysis (FMEA) is to be carried out for the entire analysis (FMEA) system. The FMEA is to be sufficiently detailed to cover all the systems’

major components and is to include but not be limited to the following (Z071) (T)

(Only when requested)information:

—a description of all the systems’ major components and a functional block

diagram showing their interaction with each other—all significant failure modes

—the most predictable cause associated with each failure mode—the transient effect of each failure on the vessel/unit.—the method of detecting that the failure has occurred

—the effect of the failure upon the rest of the system’s ability to maintain

it’s function

—an analysis of possible common failure mode.

Where parts of the system are identified as non-redundant and where redundancy is not possible, these parts shall be further studied with

consideration given to their reliability and mechanical protection. The results of this further study shall be submitted for review.

Guidance note:

A project specific FMEA would normally only be expected when usingnew, unproven, technology or to resolve any doubt as to the reliability ofthe chosen system topology.

Table 1-4 Documentation required to describe the automation and safety system

PurposeApproval

Approval

Approval

Approval

Information

Approval

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---List of control & A list and or index identifying all input and output signals to the system as monitored points (I110) required in the offshore standard, containing at least the following (T)information:—

———

Circuit diagrams (I150)—

Approval

service descriptioninstrument tag-number

system (control, safety, alarm, indication)

type of signal (digital / analogue input / output).

for essential hard-wired circuits (for emergency stop, shutdown, Approvalinterlocking, etc.) details of input and output devices and power source for each circuit.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 53

(typically submitted by manufacturers based upon their project specific specification)Documentation typeInformation elementPurposeTest program for Description of test configuration and test simulation methods.Approvaltesting at the Based upon the functional description, each test shall be described specifying:manufacturer (Z120)

—initial condition(T)

—how to perform the test

—what to observe during the test and acceptance criteria for each test.

The tests shall cover all normal modes as well as failure modes identified in the functional failure analysis, including power and communication failures.

—environmental conditions stipulated in Sec.4 for temperature, vibration, Information

humidity, enclosure and EMC.—Cause and effect matrix/chart for PSD, ESD and F&G, showing the Approval

various inputs and corresponding actions to be taken by the logic, where relevant.

A document showing the main ESD and F&G overview mimics.InformationA drawing showing layout of the CAAP panel with information showing all Approvalfunctions, feedbacks and alarms.

The following information related to the network properties shall be included Approvalin the documentation submitted for approval:————

Topology and network details including power supply arrangementFunctional description, with special focus on interfacesIdentification of critical network components

Qualitative reliability analysis (e.g. FMEA) Failure response test program.

The following information related to the wireless communication shall be included in the documentation submitted for approval:

—Functional Description

—ISM certificate(IEEE802) from a licence authority (typical flag state) or

alternatively applicable test reports

—Single line drawings of the WLAN topology with power arrangements—Specification of frequency band(s), power output and power management—Specification of modulation type and data protocol—Description of integrity and authenticity measures.

Table 1-4 Documentation required to describe the automation and safety system (Continued)

Data sheets with environmental

specifications (I080)Cause and effect diagrams

ESD and F&G overview mimicsCAAP Panel LayoutNetwork

documentation requirements

Documentation of wireless

communication

Approval

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 54

Table 1-5 Documentation required available for the testing at the manufacturer

Documentation type

Information element

Purpose

Software quality plan,The software life cycle activities shall minimum contain procedures Informationbased upon life cycle activitiesfor:

—software requirements specification—parameters data requirements—software function test:—parameter data test—validation testing

—system project files stored at the manufacturer—software change handling and revision control.

A document intended for regular use on board, providing information as applicableabout:

Operation manualInformation

Installation manualMaintenance manual

—operational mode for normal system performance, related to

normal and abnormal performance of the EUC

—operating instructions for normal and degraded operating modes—details of the user interface—transfer of control—redundancy—test facilities

—failure detection and identification facilities (automatic and

manual)—data security

—access restrictions

—special areas requiring user attention—procedures for start-up

—procedures for restoration of functions—procedures for data back-up

—procedures for software re-load and system regeneration.A document providing information about the installation Informationprocedures.

InformationA document intended for regular use on board providing

information about:—————

maintenance and periodical testingacceptance criteria

fault identification and repairlist of the suppliers' service net

ship’s systems’ software - maintenance log.

Purpose

Approval at local DNV station

Table 1-6 Documentation required for on-board inspection

Documentation type Test program for dockand sea trials

Information element—initial condition—what to test

—how to perform the test

—acceptance criteria for the test

3 Certification

3.1 General

3.1.1 The certification requirement of the various instrumented systems shall follow the same certificationrequirement as the EUC. Reference is made to Ch.1 Sec.1 [2.2] for the list of relevant Offshore Standards.3.1.2 Major units of equipment associated with essential and important control and monitoring systems, asspecified in the rules, shall be provided with a product certificate unless exemption is given in a DNV issuedType Approval Certificate or the logic is simple and the failure mechanisms are easily understood.The certification procedure normally consists of:

——————assessment of certain manufacturer documentationvisual inspection

verification of performance according to functional requirements based on approved test programsverification of failure mode behaviour

verification of implementation software quality plan covering life cycle activities, if applicableissue certificate.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

Ch.3 Sec.1 Requirements – Page 55

Other control and monitoring systems, which when found to have an effect on the safety of the ship may berequired to be certified.

The following control and monitoring systems are subject to certification, if installed, in addition to thosespecified in other sections:

—remote control of vessel main functions—main alarm system

—integrated control and monitoring system.

4 Inspection and testing

4.1 Manufacturing survey

4.1.1 All test programs shall be approved by DNV.

4.1.2 Approval testing according to [3.1] and Ch.2 Sec.1 [5.1] shall be performed at the manufacturer’s works.

4.2 On board testing

4.2.1 Approval testing shall be carried out as necessary to demonstrate that the overall requirements of testingdescribed in Ch.2 Sec.1 [5.1] to [5.5] have been fulfilled.

4.2.2 A copy of the approved test programme and test record shall be kept on board, and shall be completedwith final set points and endorsed by the inspecting party.

4.3 Renewal survey

4.3.1 Correct functioning of the following systems shall be verified, as far as applicable:

——————————

each automation and safety systemfire & gas systemESD / PSD system

manual control of machinery

remote control of propulsion machinery.from stop to aheadfrom ahead to asternstop

from stop to astern

stop by operating the emergency device.

In connection with the latter point, the following manoeuvres are normally required to be effected:

4.3.2 It shall be verified that the remote control can be transferred to standby manual control in the enginecontrol room in case of power supply failure to the remote control system.

Guidance note:

This requirement is related to propulsion control.

---e-n-d---of---G-u-i-d-a-n-c-e---n-o-t-e---4.3.3 When cancelling of automatic load reduction and/or automatic stop of engine are provided, thesefunctions are to be demonstrated to the satisfaction of the surveyor.

5 Alterations and additions

When an alteration or addition to an approved system is proposed, documentation of the alteration or additionshall be submitted for approval. A survey covering testing and installation of the alteration or addition shall beperformed.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

CHANGES – HISTORIC – Page 56

CHANGES – HISTORIC

Note that historic changes older than the editions shown below have not been included. Older historic changes(if any) may be retrieved through http://www.dnv.com.

October 2013 editionAmendment February 2014

••

Ch.2 Sec.3 Additional requirements for computer based systemsCh.2 Sec.4 Component design and installation

—[1.2.1] New text regarding “Back-up means of operation” has been added.

—[2.10] has been amended. Correct requirements are given in DNV-OS-D101 Ch.2 Sec.1 [2.2].

Main changes October 2013

•General

Specific for this edition

Significant changes have been highlighted throughout the document. For clarity, the following changes havenot been highlighted:

—content based on existing requirements from reference documents —interpretations based on old rule requirements—editorial restructuring and moves.

The document has been updated to be in accordance with the new principles for DNV Offshore Standards forClassification, including:

—The structure of this document has been converted to decimal numbering. Older references to this

document may normally be interpreted by analogy to this example:

—“DNV-OSS-101 Ch.2 Sec.3 D506” is now “DNV-OSS-101 Ch.2 Sec.3 [4.5.6]”.

—Interpretations have been added.

—The standard has been aligned with IACS, MODU code and other relevant international standards.

—The standard has been aligned with DNV Rules for Classification of Ships, Pt.4 Ch.9 and the latest insights

and experiences.••

Ch.1 IntroductionCh.1 Sec.1 General

—The chapter has been restructured to clarify objective and scope of the standard.—Definition of Interpretations has been included in [1.3].—Previous A400 has been amended and moved to Ch.2 Sec.3.•

Ch.2 Sec.1 Design principles

—Previous D (Back up Functions and Emergency Operation) has been removed.—Test descriptions have been updated.•

Ch.2 Sec.2 System design

—Detailed descriptions on mutual independence in [1.1.3].—Power distribution requirements of [2] have been updated.•••

Ch.2 Sec.3 System software

Ch.2 Sec.4 Component design and installationCh.3 General

—Previous C on serial communication has been deleted.

—Previous D200 has been deleted since it is covered by DNV-OS-D101.

— An overview of the requirements covered by the voluntary ES notation has been included.

DET NORSKE VERITAS AS

Offshore Standard DNV-OS-D202, July 2014

CHANGES – HISTORIC – Page 57

October 2008 editionCHANGES

•General

Being class related, this document is published electronically only (as of October 2008) and a printed versionis no longer available. The update scheme for this category of documents is different compared to the onerelevant for other offshore documents (for which printed versions are available).

For an overview of all types of DNV offshore documents and their update status, see the “Amendments andCorrections” document located at: http://webshop.dnv.com/global/, under category “Offshore Codes”.This document supersedes the previous edition dated April 2008.•

Main changes as of October 2008:

—Clarification of “secondary means of operation” for the Operator Station, in particular general requirements

for a CAAP.

—Chapter 2, Section 3, B100 System Software.

DET NORSKE VERITAS AS