Operational guide · Safety & equipment

Blackout and Failure Management

A blackout requires a clear distinction between emergency power, main generation and functions actually available. Understanding the ship’s roles, diagnosis and checks helps readers follow recovery and record remaining limitations and follow-up.

blackoutfailureengine room emergencyrestoration

Operational Explanation

A blackout is a loss of the main electrical supply; its consequences depend on the services that lose power and on the ship’s arrangement. Propulsion, steering, auxiliaries and communications may be affected. The response needs to make clear what remains available, what has been restored and which limitations remain.

Function	What needs to be distinguished
Emergency power	Supports the services specified by the approved arrangement. Starting the emergency generator does not demonstrate that the whole ship has power.
Main generation and standby supply	Standby-generator availability, distribution and load management contribute to restoring the main supply. A standby unit’s availability depends on its actual condition and the prescribed checks.
Propulsion and steering	Available voltage, functioning auxiliaries and control of propulsion or the rudder require separate verification. Their status needs to be communicated to the bridge.

The priorities are the safety of people and the ship, knowing which essential functions are available and coordinating bridge and engine-room response. Engineer officers reconstruct the sequence of alarms and protective trips, distinguish observations from hypotheses and assess recovery under the ship’s instructions. Restored voltage alone does not close the failure.

Regulatory Reference

SOLAS II-1/41–44: distinguish main power, the emergency source, services to be supplied and starting arrangements. ISM Code, §§7–10: connect assigned duties, emergency preparedness, event reporting and maintenance with outcomes and corrective action.

Where the emergency source is a generator, II-1/42.3.1.2 for passenger ships requires automatic starting and connection and the ability to carry full rated load as quickly as is safe and practicable, within a maximum of 45 seconds. For cargo ships, II-1/43.3.1.3 permits omission of the transitional source if the generator can start automatically and supply the specified services and required load within that limit. These are distinct provisions; they do not prescribe a universal monthly test.

II-1/42.3.4 and 43.3.4, for ships constructed on or after 1 July 1998 where electrical power is necessary to restore propulsion, require sufficient capacity, together with other appropriate machinery, to restore propulsion from a dead ship condition within 30 minutes after blackout. This is an arrangement-capacity requirement, which must not become a promise of recovery from every actual failure. SOLAS, consolidated text as of 1 January 2017, II-1/42–44; MCA MSN 1907, §§44.3 and 45.3, March 2023. The MCA notice specifically concerns ships built before 2009 under the terms of UK legislation; it does not replace verification of the individual ship’s requirements.

II-1/42.7 and 43.7 require periodic testing of the complete emergency system, including automatic starting. The method, interval and criteria must be identified in the sources applicable to the ship. ISM 10.3 includes regular tests of standby arrangements and equipment not in continuous use; ISM 9 and 10 connect reporting, the possible cause if known, corrective action and records. ISM Code, consulted EMSA 2018 text, §§7–10; IMO MSC.273(85), amendments to §§7, 8.1, 9.2 and 10.3.

Scope of Application

This page supports familiarisation with failures involving loss of the main supply and associated services. SOLAS distinguishes passenger and cargo ships; construction date, propulsion type, distribution, automation and approvals determine the applicable provisions. An isolated auxiliary failure is not automatically a blackout: the lost function matters.

The 36-hour periods for various services on passenger ships and 18-hour periods for various services on cargo ships in II-1/42.2 and 43.2 are not universal endurance figures for every load: individual services have different periods, and the text may provide for exceptions or independent supplies. Read the applicable list alongside the approved arrangement. SOLAS, II-1/42.2 and 43.2, consulted 2017 edition.

The actual recovery sequence, electrical switching, isolations and decisions about the ship’s operation follow onboard plans, instructions and responsibilities. This page helps readers understand and discuss them; it provides no universal switching or restart sequence.

Procedure / How to Complete It

Familiarisation pathway. Use your ship’s blackout procedure to understand these points and identify who manages them. Activities may proceed in parallel: this list is not a switching order.

Connect the failure to its consequences. Identify the indications that allow the engine room and bridge to confirm loss or availability of propulsion, steering and essential services. Find the prescribed roles, calls and ways of updating each other.
Read the electrical arrangement. Recognise main sources, standby units, the emergency switchboard, any transitional source and the loads supplied. Distinguish a running generator from a connected source and from a service that is actually functioning.
Reconstruct the fault. Compare the alarm sequence, protective trips, machinery status and local observations that can be obtained safely. An alarm may be a consequence of the blackout rather than its cause. Diagnosis, access and interventions belong to competent personnel under the procedures.
Understand the prescribed recovery. Find the conditions, checks and responsibilities for restoring generation and loads in the procedure. If a start fails or protection trips, consult the specified branch: repeated resets or restarts without assessing the cause may reproduce the failure. Do not infer breaker positions or protection overrides from this page.
Verify recovered functions. Understand which checks demonstrate stable generation and availability of auxiliaries, propulsion and steering in the resulting arrangement. Communicate remaining limitations and recovery status to the bridge; before returning to UMS, verify the approved-procedure conditions, including alarms, personnel on call and defects.
Connect the event to follow-up. Know the onboard records, failure report and PMS links: times, observed facts, actions, results, established or still suspected causes, limitations and the person responsible for follow-up. Closure requires the prescribed verification; corrective work needs to remain traceable.

A planned test has a different context from an actual failure. Simulation, safe conditions, communications and acceptance criteria follow the authorised method. Where that method requires it, measure the time relevant to the applicable requirement; do not simulate a blackout to apply an invented interval.

Practical Example

Learning scenario. The main supply is lost while the ship is underway. The emergency generator is running, but the bridge reports that propulsion is unavailable. The recorded sequence shows a cooling alarm before a main generator stops: this is a clue to verify, not yet an established cause.

The familiarisation discussion asks readers to identify which services are actually supplied and how the bridge and engine room communicate. Engineer officers assess the abnormality and recovery under the ship’s procedure; emergency-generator starting is not described as full restoration. A defective standby unit or a missing spare remains visible, together with authorised measures and follow-up.

Information to reconstruct	Useful evidence
Event and initial state	Actual times, alarms/protective trips, units and functions involved.
Recovery	Actions actually taken, results and verified functions; updates to the bridge.
Closure and follow-up	Established cause distinguished from a hypothesis, remaining defects, report/PMS links and verification after correction.

The scenario assigns no recovery times or operating thresholds. An actual case published by AMSA shows how cooling defects and a known unavailable emergency generator can aggravate a blackout: it is a lesson about reliability and defect management, not a universal restart model. AMSA, blackout and grounding case.

What Typically Goes Wrong

Under recovery pressure, “generator running”, “voltage present” and “propulsion available” can become the same statement. The bridge then receives an incomplete picture while an essential function or a standby unit remains unavailable. A reset can also make the sequence harder to understand if the observations are not preserved.

Another mistake is treating a periodic test as complete blackout preparedness: a measured time alone does not show that personnel know the roles, services supplied or the procedure after a failed start. The 45-second criterion does not become a monthly interval, and restored voltage does not automatically permit a return to UMS.

Common Mistakes Mistake Library

Mistake	Consequence	How to Avoid It
Reporting “fully restored” solely because the emergency generator starts.	The bridge and watch may rely on propulsion, steering or auxiliaries that remain unavailable.	Report the connected source, verified services and limitations separately.
Repeating resets or restarts without assessing alarms and protective trips.	The failure may recur and its cause becomes harder to reconstruct.	Use the failed-start branch of the procedure and preserve observations useful for diagnosis.
Assuming a standby unit is ready without evidence of its condition.	Recovery may depend on defective equipment or an unusable spare.	Connect availability to checks, tests and defect/PMS status; verify the actual availability of prescribed spares.
Using 45 seconds as a universal monthly test.	The test regime is not derived from the configuration and applicable sources.	Distinguish the performance criterion, passenger/cargo provision and ship’s test programme.
Closing the event or returning to UMS because voltage and alarms appear normal.	Defects, inhibitions or corrective follow-up may be hidden from the next watch.	Verify functions and mode conditions; record limitations, responsibility and follow-up before prescribed closure.

What the PSCO Checks

Familiarity with procedures can be checked in addition to the presence of documents. The 2025 PSC procedures include responsible personnel’s familiarity with emergency and standby sources, starting methods, actions after failed attempts, blackout procedures and load sharing. IMO A.1206(34), appendix 7, part 2, §§1.3.1–1.3.2.

Consistency between the arrangement, accessible instructions and personnel’s ability to explain their duties.
Actual condition of essential machinery and standby units; declared defects, repairs and limitations.
Links between tests/maintenance, recorded outcomes and corrective action; follow-up of any blackouts.

The scope and demonstrations depend on the inspection. Preparation does not mean causing a blackout without an authorised method or memorising a universal manoeuvring list.

Operational Tips

At watch handover, describe available functions and limitations, rather than only “generator running”.
Use the same equipment identifiers in alarms, the failure report, PMS and spare requests.
Keep the established cause distinct from a hypothesis and connect follow-up to verification after the work.
Review standby tests, open defects and needed spares after the event through the SMS/PMS and assigned personnel.
For UMS, check mode conditions, alarms/inhibitions and personnel on call in the ship’s procedure; for inventories, use the ship’s spare strategy.

Preparation checklist

To prepare a familiarisation discussion or exercise:

Current blackout procedure, electrical diagram and list of supplied services accessible.
Roles, calls and information exchanged between bridge and engine room understood.
Emergency power distinguished from main generation, standby supply and propulsion/steering availability.
Prescribed branch after a failed start or protective trip identified, without improvising resets or overrides.
Standby status, defects and availability of relevant spares traceable.
Method, safe conditions and criteria of the planned test distinguished from actual failure response.
Records, PMS follow-up and conditions for closure or return to UMS understood.

FAQ

Do 45 seconds mandate a monthly test?

No. The limit concerns the specific emergency-generator provisions in SOLAS II-1/42.3.1.2 and 43.3.1.3. The complete periodic test and its method/interval follow the requirements and instructions applicable to the ship.

Does every ship have the same recovery sequence?

No. The electrical arrangement, propulsion, automation and applicable requirements determine the ship’s plan. This page teaches readers to understand it; it gives no universal breaker positions or restart order.

Does the emergency generator always restore propulsion?

Its starting demonstrates only part of the status. The services actually supplied and the recovered functions must be verified under the approved arrangement; available power, auxiliaries and propulsion are distinct elements.

Can UMS resume as soon as alarms disappear?

Acknowledgement or disappearance of an alarm does not demonstrate that the cause has been removed. Returning to the mode follows the ship’s procedure conditions, with verification of functions, defects/inhibitions and personnel on call.