Every blackout report we have read opens with the same sentence: 'the generator tripped'. That is almost never the event. The generator is the last link in a chain that had already broken somewhere earlier, and the interesting part is upstream.
What a blackout actually is
A blackout is a power imbalance that was not dealt with fast enough. Load exceeded available power, frequency started to fall, and the system had two options: shed load, or lose the network. Losing the network means the first option either did not exist, or was set too slow.
That changes how the incident should be investigated. The question is not 'why did the generator trip', but 'why did the system fail to shed load in time'.
The three settings that decide the outcome
1. The load-dependent start threshold
The PMS starts the next gen-set when load exceeds a percentage. If that percentage is 85% and start-plus-paralleling takes 40 seconds, the vessel has 15% of margin for 40 seconds. A bow thruster does not respect that margin.
The threshold must follow from the real availability time of the standby machine and from the largest load step that can occur — not from the factory default.
2. The load-shedding delay
Load shedding exists precisely for the cases where starting a generator is too slow. If it is set with a two or three second delay 'so it does not trip unnecessarily', it will never beat a load step. Underfrequency protection will act first.
3. Shedding groups and order
Many systems still carry the shedding groups defined at the yard. Meanwhile the vessel changed trade, consumers were added, and the 'non-essential' group now contains something that must not be lost. Or worse, the essential group has grown so much that shedding the non-essential one no longer helps.
Recovery is a separate problem
Even when a blackout is unavoidable, the difference between ten minutes and two hours lies in the recovery logic. The points that usually fail:
- The emergency generator takes over correctly, but there is no release logic when main power returns — and the vessel stays on emergency power longer than it should.
- Dead-bus logic allows two gen-sets to close onto a dead busbar simultaneously, producing a second trip.
- Essential consumers all restore together, creating a load step that trips the one generator that managed to start.
- Starting air or batteries do not cover three attempts, and nobody had checked.
- A pre-lubrication or coolant permissive blocks the automatic start because the pump is fed from the busbar that has just been lost.
How it is verified in practice
The only reliable test is a controlled interruption, with the vessel in a safe condition and fully coordinated with the technical department. Before that, four things are checked on paper:
- The power balance against today's loads, not those at delivery.
- The largest load step that can occur, and the time the standby machine needs.
- The shedding groups, item by item, with an engineer who knows what each board feeds today.
- The controllers' event logs for the last two years — the warning signs are nearly always there.
On most vessels we examine, analysing those four points finds the problem before any test is needed.