1625-0047 Stat/Authority

§ 61.40–3

46 CFR Ch. I (10–1–00 Edition)

§ 61.40–3 Design verification testing.
(a) Tests must verify that automated
vital systems are designed, constructed, and operate in accordance
with all applicable requirements of
part 62 of this subchapter. The tests
must be based upon the failure analysis, if required by § 62.20–3(b) of this
subchapter, functional performance requirements, and the Periodic Safety
tests of § 61.40–6.
(b) Tests must be performed immediately after the installation of the
automated equipment or before the
issuance of the initial Certificate of Inspection.
§ 61.40–6 Periodic safety tests.
(a) Periodic Safety tests must demonstrate the proper operation of the
primary
and
alternate
controls,
alarms, power sources, transfer override arrangements, interlocks, and
safety controls. Systems addressed
must include fire detection and extinguishing, flooding safety, propulsion,
maneuvering, electric power generation and distribution, and emergency
internal communications.
(b) Tests must be conducted at periodic intervals specified by the Coast
Guard to confirm that vital systems
and safety features continue to operate
in a safe, reliable manner.
NOTE: Normally, these tests are conducted
annually.

§ 61.40–10 Test procedure details.
(a) Test procedure documents must
be in a step-by-step or checkoff list format. Each test instruction must specify equipment status, apparatus necessary to perform the tests, safety precautions, safety control and alarm setpoints, the procedure to be followed,
and the expected test result.
(b) Test techniques must not simulate monitored system conditions by
mis-adjustment, artificial signals, improper wiring, tampering, or revision of
the system unless the test would damage equipment or endanger personnel.
In the latter case, the use of a synthesized signal or condition applied to
the sensor is acceptable if test equipment is maintained in good working
order and is periodically calibrated to
the satisfaction of the Officer in

Charge, Marine Inspection. Other test
techniques must be approved by the
Commandant (G–MSE).
[CGD 80–064, 49 FR 32193, Aug. 13, 1984, as
amended by CGD 95–072, 60 FR 50463, Sept. 29,
1995; CGD 96–041, 61 FR 50728, Sept. 27, 1996]

PART 62—VITAL SYSTEM
AUTOMATION
Subpart 62.01–General Provisions
Sec.
62.01–1
62.01–3
62.01–5

Purpose.
Scope.
Applicability.

Subpart 62.05–Reference Specifications
62.05–1

Incorporation by reference.

Subpart 62.10–Terms Used
62.10–1

Definitions.

Subpart 62.15–Equivalents
62.15–1 Conditions under which equivalents
may be used.

Subpart 62.20–Plan Submittal
62.20–1
62.20–3
62.20–5

Plans for approval.
Plans for information.
Self-certification.

Subpart 62.25–General Requirements for
All Automated Vital Systems
62.25–1 General.
62.25–5 All control systems.
62.25–10 Manual alternate control systems.
62.25–15 Safety control systems.
62.25–20 Instrumentation, alarms, and centralized stations.
62.25–25 Programable systems and devices.
62.25–30 Environmental design standards.

Subpart 62.30–Reliability and Safety
Criteria, All Automated Vital Systems
62.30–1 Failsafe.
62.30–5 Independence.
62.30–10 Testing.

Subpart 62.35–Requirements for Specific
Types of Automated Vital Systems
62.35–1 General.
62.35–5 Remote propulsion control systems.
62.35–10 Flooding safety.
62.35–15 Fire safety.
62.35–20 Oil-fired main boilers.
62.35–35 Internal combustion engine starting systems.
62.35–40 Fuel systems.

292

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00292

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.05–1

62.35–50 Tabulated monitoring and safety
control requirements for specific systems.

Subpart 62.50–Automated Self-propelled
Vessel Manning
62.50–1 General.
62.50–20 Additional requirements for minimally attended machinery plants.
62.50–30 Additional requirements for periodically unattended machinery plants.
AUTHORITY: 46 U.S.C. 3306, 3703, 8105; E.O.
12234, 45 FR 58801, 3 CFR, 1980 Comp., p. 277;
49 CFR 1.46.
SOURCE: CGD 81–030, 53 FR 17838, May 18,
1988, unless otherwise noted.

Subpart 62.01—General Provisions
§ 62.01–1 Purpose.
The purpose of this part is to make
sure that the safety of a vessel with
automated vital systems, in maneuvering and all other sailing conditions,
is equal to that of the vessel with the
vital systems under direct manual operator supervision.
§ 62.01–3 Scope.
(a) This part contains the minimum
requirements for vessel automated
vital systems. Specifically, this part
contains—
(1) In subpart 62.25, the general requirements for all vital system automation;
(2) In subpart 62.30, the criteria used
to evaluate the designed reliability and
safety of all automated vital systems;
(3) In subpart 62.35, the minimum additional equipment, configuration, and
functional
requirements
necessary
when certain vital systems are automated; and
(4) In subpart 62.50, the minimum additional requirements when automated
systems are provided to replace specific personnel or to reduce overall
crew requirements.
§ 62.01–5 Applicability.
(a) Vessels. This part applies to selfpropelled vessels of 500 gross tons and
over that are certificated under subchapters D, I, or U and to self-propelled
vessels of 100 gross tons and over that
are certificated under subchapter H.
(b) Systems and equipment. Except as
noted in § 62.01–5(c), this part applies to

automation of vital systems or equipment that—
(1) Is automatically controlled or
monitored;
(2) Is remotely controlled or monitored; or
(3) Utilizes automation for the purpose of replacing specific personnel or
to reduce overall crew requirements.
(c) Exceptions. This part does not
apply to the following systems and
equipment unless they are specifically
addressed or unless their failure would
degrade the safety and reliability of
the systems required by this part:
(1) Automatic auxiliary heating
equipment (see part 63 of this subchapter).
(2) Steering systems (see subparts
58.25 and 111.93 of this chapter).
(3) Non-vital and industrial systems.
(4) The communication and alarm
systems in part 113 of this chapter.
(d) Central control rooms. The requirements of subpart 62.50 only apply to
vessels automated to replace specific
personnel or to reduce overall crew requirements, except where the main
propulsion or ship service electrical
generating plants are automatically or
remotely controlled from a control
room. In this case, § 62.50–20(a)(3) (except the provision in paragraph 62.50–
20(a)(3)(ii) relating to electrical power
distribution), (b)(3), (c), (e)(1), (e)(2),
(e)(4), and (f)(2) apply, regardless of
manning.
[CGD 81–030, 53 FR 17838, May 18, 1988, as
amended by USCG–2000–7790, 65 FR 58460,
Sept. 29, 2000]

Subpart 62.05—Reference
Specifications
§ 62.05–1

Incorporation by reference.

(a) Certain material is incorporated
by reference into this part with the approval of the Director of the Federal
Register. To enforce any edition other
than the one listed in paragraph (b) of
this section, notice of the change must
be published in the FEDERAL REGISTER
and the material made available to the
public. All approved material is on file
at the Office of the Federal Register,
Washington, DC 20408 and at Marine
Safety and Environmental Protection

293

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00293

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.10–1

46 CFR Ch. I (10–1–00 Edition)

(G–MSE), U.S. Coast Guard Headquarters Building, 2100 Second Street
SW., Washington, DC 20593–0001.
(b) The material approved for incorporation by reference in this part is:
Rules for Building and Classing Steel
Vessels, 1986, issued by the American
Bureau of Shipping. This document is
available from: American Bureau of
Shipping, ABS Plaza, 16855 Northchase
Drive, Houston, TX 77060. Sections affected by this incorporation by reference are: 62.25–1(c), 62.25–5(a), 62.25–
30(a)(1), (a)(2), (a)(3), (a)(5), 62.35–5(d),
62.35–35(a), 62.35–40(c), 62.35–50, 62.50–
30(c), and 62.50–30(k).
[CGD 81–030, 53 FR 17838, May 18, 1988, as
amended by CGD 95–072, 60 FR 50463, Sept. 29,
1995; CGD 96–041, 61 FR 50728, Sept. 27, 1996;
CGD 97–057, 62 FR 51044, Sept. 30, 1997; USCG–
2000–7790, 65 FR 58460, Sept. 29, 2000]

Subpart 62.10—Terms Used
§ 62.10–1 Definitions.
(a) For the purpose of this part:
Alarm means an audible and visual
indication of a hazardous or potentially hazardous condition that requires attention.
Automated means the use of automatic or remote control, instrumentation, or alarms.
Automatic control means self-regulating in attaining or carrying out an
operator-specified equipment response
or sequence.
Boiler low-low water level is the minimum safe level in the boiler, in no
case lower than that visible in the gage
glass (see § 52.01–110 of this chapter,
Water Level Indicators).
Engineering Control Center (ECC)
means the centralized engineering control, monitoring, and communications
location.
Failsafe means that upon failure or
malfunction of a component, subsystem, or system, the output automatically reverts to a pre-determined
design state of least critical consequence. Typical failsafe states are
listed in Table 62.10–1(a).
TABLE 62.10–1(a)—TYPICAL FAILSAFE STATES
System or component
Cooling water valve .............
Alarm system .......................

Preferred failsafe state
As is or open.
Annunciate.

TABLE 62.10–1(a)—TYPICAL FAILSAFE
STATES—Continued
System or component

Preferred failsafe state

Safety system ......................
Burner valve .........................
Propulsion speed control .....
Feedwater valve ..................
Controllable pitch propeller ..
Propulsion safety trip ...........
Fuel tank valve ....................

Shut down, limited, or as is &
alarm.
Closed.
As is.
As is or open.
As is.
As is & alarm.
See § 56.50–60(d).

Flooding safety refers to flooding detection, watertight integrity, and
dewatering systems.
Independent refers to equipment arranged to perform its required function
regardless of the state of operation, or
failure, of other equipment.
Limit control means a function of an
automatic control system to restrict
operation to a specified operating
range or sequence without stopping the
machinery.
Local control means operator control
from a location where the equipment
and its output can be directly manipulated and observed, e.g., at the switchboard, motor controller, propulsion engine, or other equipment.
Manual control means operation by
direct or power-assisted operator intervention.
Monitor means the use of direct observation, instrumentation, alarms, or
a combination of these to determine
equipment operation.
Remote control means non-local automatic or manual control.
Safety trip control system means a
manually or automatically operated
system that rapidly shuts down another system or subsystem.
System means a grouping or arrangement of elements that interact to perform a specific function and typically
includes the following, as applicable:
A fuel or power source.
Power conversion elements.
Control elements.
Power transmission elements.
Instrumentation.
Safety control elements.
Conditioning elements.

Vital system or equipment is essential
to the safety of the vessel, its passengers and crew. This typically includes, but is not limited to, the following:
Fire detection, alarm, and extinguishing systems.

294

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00294

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.20–5

Flooding safety systems.
Ship service and emergency electrical generators, switchgear, and
motor control circuits serving vital
electrical loads.
The emergency equipment and systems listed in § 112.15 of this chapter.
Propulsion systems, including those
provided to meet § 58.01–35.
Steering systems.

Subpart 62.15—Equivalents
§ 62.15–1 Conditions
under
equivalents may be used.

which

(a) The Coast Guard accepts a substitute or alternate for the requirements of this part if it provides an
equivalent level of safety and reliability. Demonstration of functional
equivalence must include comparison
of a qualitative failure analysis based
on the requirements of this part with a
comparable analysis of the proposed
substitute or alternate.

Subpart 62.20—Plan Submittal
§ 62.20–1

Plans for approval.

(a) The following plans must be submitted to the Coast Guard for approval
in accordance with § 50.20–5 and § 50.20–
10 of this chapter:
(1) A general arrangement plan of
control and monitoring equipment,
control locations, and the systems
served.
(2) Control and monitoring console,
panel, and enclosure layouts.
(3) Schematic or logic diagrams including functional relationships, a
written description of operation, and
sequences of events for all modes of operation.
(4) A description of control or monitoring system connections to non-vital
systems.
(5) A description of programable features.
(6) A description of built-in test features and diagnostics.
(7) Design Verification and Periodic
Safety test procedures described in
subpart 61.40 of this chapter.
(8) Control system normal and emergency operating instructions.

§ 62.20–3 Plans for information.
(a) One copy of the following plans
must be submitted to the Officer in
Charge, Marine Inspection, for use in
the evaluation of automated systems
provided to replace specific personnel
or to reduce overall crew requirements:
(1) Proposed manning, crew organization and utilization, including routine
maintenance, all operational evolutions, and emergencies.
(2) A planned maintenance program
for all vital systems.
(b) One copy of a qualitative failure
analysis must be submitted in accordance with § 50.20–5 of this chapter for
the following:
(1) Propulsion controls.
(2)
Microprocessor-based
system
hardware.
(3) Safety controls.
(4) Automated electric power management.
(5) Automation required to be independent that is not physically separate.
(6) Any other automation that, in the
judgement of the Commandant, potentially constitutes a safety hazard to
the vessel or personnel in case of failure.
NOTE: The qualitative failure analysis is
intended to assist in evaluating the safety
and reliability of the design. It should be
conducted to a level of detail necessary to
demonstrate compliance with applicable requirements and should follow standard qualitative analysis procedures. Assumptions, operating conditions considered, failures considered, cause and effect relationships, how
failures are detected by the crew, alternatives available to the crew, and possible
design verification tests necessary should be
included. Questions regarding failure analysis should be referred to the Marine Safety
Center at an early stage of design.

§ 62.20–5 Self-certification.
(a) The designer or manufacturer of
an automated system shall certify to
the Coast Guard, in writing, that the
automation is designed to meet the environmental design standards of § 62.25–
30. Plan review, shipboard testing, or
independent testing to these standards
is not required.
(b) [Reserved]
NOTE: Self-certification should normally
accompany plan submittal.

295

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00295

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.25–1

46 CFR Ch. I (10–1–00 Edition)

Subpart 62.25—General Requirements for All Automated Vital
Systems
§ 62.25–1 General.
(a) Vital systems that are automatically or remotely controlled must be
provided with—
(1) An effective primary control system;
(2) A manual alternate control system;
(3) A safety control system, if required by § 62.25–15;
(4) Instrumentation to monitor system parameters necessary for the safe
and effective operation of the system;
and
(5) An alarm system if instrumentation is not continuously monitored or
is inappropriate for detection of a failure or unsafe condition.
(b) Automation systems or subsystems that control or monitor more
than one safety control, interlock, or
operating sequence must perform all
assigned tasks continuously, i.e., the
detection of unsafe conditions must
not prevent control or monitoring of
other conditions.
(c) Vital control and alarm system
consoles and similar enclosures that
rely upon forced cooling for proper system operation must meet section
41.23.2 of the American Bureau of Shipping’s ‘‘Rules for Building and Classing
Steel Vessels.’’
§ 62.25–5 All control systems.
(a) Controls for engines and turbines
equipped with jacking or turning gear
must meet section 41.21.4 of the American Bureau of Shipping’s ‘‘Rules for
Building and Classing Steel Vessels.’’
(b) Automatic control systems must
be stable over the entire range of normal operation.
(c) Inadvertent grounding of an electrical or electronic safety control system must not cause safety control operation or safety control bypassing.
§ 62.25–10 Manual alternate control
systems.
(a) Manual alternate control systems
must—
(1) Be operable in an emergency and
after a remote or automatic primary
control system failure;

(2) Be suitable for manual control for
prolonged periods;
(3) Be readily accessible and operable; and
(4) Include means to override automatic controls and interlocks, as applicable.
(b) Permanent communications must
be provided between primary remote
control locations and manual alternate
control locations if operator attendance is necessary to maintain safe alternate control.
NOTE: Typically, this includes main boiler
fronts and local propulsion control.

§ 62.25–15

Safety control systems.

(a) Minimum safety trip controls required for specific types of automated
vital systems are listed in Table 62.35–
50.
NOTE: Safety control systems include automatic and manual safety trip controls and
automatic safety limit controls.

(b) Safety trip controls must not operate as a result of failure of the normal electrical power source unless it is
determined to be the failsafe state.
(c) Automatic operation of a safety
control must be alarmed in the machinery spaces and at the cognizant remote control location.
(d) Local manual safety trip controls
must be provided for all main boilers,
turbines, and internal combustion engines.
(e) Automatic safety trip control systems must—
(1) Be provided where there is an immediate danger that a failure will result in serious damage, complete
breakdown, fire, or explosion;
(2) Require manual reset prior to renewed operation of the equipment; and
(3) Not be provided if safety limit
controls provide a safe alternative and
trip would result in loss of propulsion.
§ 62.25–20 Instrumentation,
and centralized stations.

alarms,

(a) General. Minimum instrumentation and alarms required for specific
types of automated vital systems are
listed in Table 62.35–50.
(b) Instrumentation Location. (1) Manual control locations, including remote
manual control and manual alternate

296

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00296

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.25–20

control, must be provided with the instrumentation necessary for safe operation from that location.
NOTE: Typically, instrumentation includes
means to monitor the output of the monitored system.

(2) Systems with remote instrumentation must have provisions for the installation of instrumentation at the
monitored system equipment.
(3) The status of automatically or remotely controlled vital auxiliaries,
power sources, switches, and valves
must be visually indicated in the machinery spaces or the cognizant remote
control location, as applicable.
NOTE: Status indicators include run, standby, off, open, closed, tripped, and on, as applicable. Status indicators at remote control
locations other than the ECC, if provided,
may be summarized. Equipment normally
provided with status indicators are addressed
in Table 62.35–50 and subparts 58.01, 56.50, and
112.45.

(4) Sequential interlocks provided in
control systems to ensure safe operation, such as boiler programing control or reversing of propulsion diesels,
must have summary indicators in the
machinery spaces and at the cognizant
control location to show if the interlocks are satisfied.
(5) Instrumentation listed in Table
62.35–50 must be of the continuous display type or the demand display type.
Displays must be in the ECC or in the
machinery spaces if an ECC is not provided.
(c) Instrumentation details. Demand
instrumentation displays must be
clearly readable and immediately
available to the operator.
(d) Alarms. (1) All alarms must clearly distinguish among—
(i) Normal, alarm, and acknowledged
alarm conditions; and
(ii) Fire, general alarm, CO2/halon,
vital machinery, flooding, engineers’
assistance-needed,
and
non-vital
alarms.
(2) Required alarms in high ambient
noise areas must be supplemented by
visual means, such as rotating beacons,
that are visible throughout these
areas. Red beacons must only be used
for general or fire alarm purposes.
(3) Automatic transfer to required
backup or redundant systems or power

sources must be alarmed in the machinery spaces.
(4) Flooding safety, fire, loss of
power, and engineers’ assistance-needed alarms extended from the machinery spaces to a remote location must
not have a duty crewmember selector.
NOTE: Other alarms may be provided with
such a selector, provided there is no off position.

(5) Automation alarms must be separate and independent of the following:
(i) The fire detection and alarm systems.
(ii) The general alarm.
(iii) CO2/halon release alarms.
(6) Failure of an automatic control,
remote control, or alarm system must
be immediately alarmed in the machinery spaces and at the ECC, if provided.
(e) Alarm details. (1) All alarms
must—
(i) Have a manual acknowledgement
device (No other means to reduce or
eliminate the annunciated signal may
be provided except dimmers described
in paragraph (g)(2) of this section);
(ii) Be continuously powered;
(iii) Be provided with a means to test
audible and visual annunciators;
(iv) Provide for normal equipment
starting and operating transients and
vessel motions, as applicable, without
actuating the alarm;
(v) Be able to simultaneously indicate more than one alarm condition, as
applicable;
(vi) Visually annunciate until the
alarm is manually acknowledged and
the alarm condition is cleared;
(vii) Audibly annunciate until manually acknowledged;
(viii) Not prevent annunciation of
subsequent alarms because of previous
alarm acknowledgement; and
(ix) Automatically reset to the normal operating condition only after the
alarm has been manually acknowledged and the alarm condition is
cleared.
(2) Visual alarms must initially indicate the equipment or system malfunction without operator intervention.
(3) Power failure alarms must monitor on the load side of the last supply
protective device.
(f) Summarized and grouped alarms.
Visual alarms at a control location
that are summarized or grouped by

297

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00297

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.25–25

46 CFR Ch. I (10–1–00 Edition)

function, system, or item of equipment
must—
(1) Be sufficiently specific to allow
any necessary action to be taken; and
(2) Have a display at the equipment
or an appropriate control location to
identify the specific alarm condition or
location.
(g) Central control locations. (1) Central control locations must—
(i) Be arranged to allow the operator
to safely and efficiently communicate,
control, and monitor the vital systems
under normal and emergency conditions, with a minimum of operator confusion and distraction;
(ii) Be on a single deck level; and
(iii) Co-locate control devices and instrumentation to allow visual assessment of system response to control
input.
(2) Visual alarms and instruments on
the navigating bridge must not interfere with the crew’s vision. Dimmers
must not eliminate visual indications.
(3) Alarms and instrumentation at
the main navigating bridge control location must be limited to those that
require the attention or action of the
officer on watch, are required by this
chapter, or that would result in increased safety.
§ 62.25–25 Programable
devices.

systems

and

(a) Programable control or alarm
system logic must not be altered after
Design Verification testing without the
approval of the cognizant Officer in
Charge, Marine Inspection (OCMI). (See
subpart 61.40 of this subchapter, Design
Verification Tests). Safety control or
automatic alarm systems must be provided with means, acceptable to the
cognizant OCMI, to make sure setpoints remain within the safe operating range of the equipment.
(b) Operating programs for microprocessor-based
or
computer-based
vital control, alarm, and monitoring
systems must be stored in non-volatile
memory and automatically operate on
supply power resumption.
(c) If a microprocessor-based or computer-based system serves both vital
and non-vital systems, hardware and

software priorities must favor the vital
systems.
(d) At least one copy of all required
manuals, records, and instructions for
automatic or remote control or monitoring systems required to be aboard
the vessel must not be stored in electronic or magnetic memory.
[CGD 81–030, 53 FR 17838, May 18, 1988; 53 FR
19090, May 26, 1988]

§ 62.25–30 Environmental
standards.

design

(a) All automation must be suitable
for the marine environment and must
be designed and constructed to operate
indefinitely under the following conditions:
(1) Ship motion and vibration described in section 41.37 of the American
Bureau of Shipping’s ‘‘Rules for Building and Classing Steel Vessels.’’
NOTE: Inclination requirements for fire and
flooding safety systems are described in
§ 112.05–5(c) of this chapter.

(2) Ambient air temperatures described in section 41.29.1 and 41.29.2 of
the American Bureau of Shipping’s
‘‘Rules for Building and Classing Steel
Vessels.’’
(3) Electrical voltage and frequency
tolerances described in section 41.29.3
of the American Bureau of Shipping’s
‘‘Rules for Building and Classing Steel
Vessels.’’
(4) Relative humidity of 0 to 95% at
45 °C.
(5) Hydraulic and pneumatic pressure
variations described in section 41.39.3e
of the American Bureau of Shipping’s
‘‘Rules for Building and Classing Steel
Vessels.’’
NOTE: Considerations should include normal dynamic conditions that might exceed
these values, such as switching, valve closure, power supply transfer, starting, and
shutdown.

(b) Low voltage electronics must be
designed with due consideration for
static discharge, electromagnetic interference, voltage transients, fungal
growth, and contact corrosion.

298

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00298

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.35–5

Subpart
62.30—Reliability
and
Safety Criteria, All Automated
Vital Systems
§ 62.30–1

Failsafe.

(a) The failsafe state must be evaluated for each subsystem, system, or
vessel to determine the least critical
consequence.
(b) All automatic control, remote
control, safety control, and alarm systems must be failsafe.
§ 62.30–5

Independence.

§ 62.30–10

Subpart 62.35—Requirements for
Specific Types of Automated
Vital Systems
§ 62.35–1

(a) Single non-concurrent failures in
control, alarm, or instrumentation systems, and their logical consequences,
must not prevent sustained or restored
operation of any vital system or systems.
(b)(1) Except as provided in paragraphs (b)(2) and (b)(3) of this section,
primary control, alternate control,
safety control, and alarm and instrumentation systems for any vital system must be independent of each other.
(2) Independent sensors are not required except that sensors for primary
speed, pitch, or direction of rotation
control in closed loop propulsion control systems must be independent and
physically separate from required safety control, alarm, or instrumentation
sensors.
(3) The safety trip control of § 62.35—
5(b)(2) must be independent and physically separate from all other systems.
(c) Two independent sources of power
must be provided for all primary control, safety control, instrumentation
and alarm systems. Failure of the normal source of power must actuate an
alarm in the machinery spaces. One
source must be from the emergency
power source (see part 112 of this chapter, Emergency Lighting and Power
Systems) unless one of the sources is—
(1) Derived from the power supply of
the system being controlled or monitored;
(2) A power take-off of that system;
of
(3) An independent power source
equivalent to the emergency power
source.

Testing.

(a) Automated vital systems must be
tested in accordance with subpart 61.40
of this chapter.
(b) On-line built-in test equipment
must not lock out or override safety
trip control systems. This equipment
must indicate when it is active.

General.

(a)
Minimum
instrumentation,
alarms, and safety controls required
for specific types of automated vital
systems are listed in Table 62.35–50.
(b) Automatic propulsion systems,
automated electric power management
systems, and all associated subsystems
and equipment must be capable of
meeting load demands from standby to
full system rated load, under steady
state and maneuvering conditions,
without need for manual adjustment or
manipulation.
§ 62.35–5 Remote
systems.

propulsion

control

(a) Manual propulsion control. All vessels having remote propulsion control
from the navigating bridge, an ECC or
maneuvering platform, or elsewhere
must have a manual alternate propulsion control located at the equipment.
NOTE: Separate local control locations may
be provided for each independent propeller.

(b) Centralized propulsion control
equipment. Navigating bridge, ECC, maneuvering platform, and manual alternate control locations must include—
(1) Control of the speed and direction
of thrust for each independent propeller controlled;
(2) A guarded manually actuated
safety trip control (which stops the
propelling machinery) for each independent propeller controlled;
(3) Shaft speed and thrust direction
indicators for each independent propeller controlled;
(4) The means to pass propulsion orders required by § 113.30–5 and § 113.35–3
of this chapter; and

299

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00299

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.35–10

46 CFR Ch. I (10–1–00 Edition)

(5) The means required by paragraph
(d) of this section to achieve control location transfer and independence.
(c) Main navigating bridge propulsion
control. (1) Navigating bridge remote
propulsion control must be performed
by a single control device for each
independent propeller. Control must include automatic performance of all associated services, and must not permit
rate of movement of the control device
to overload the propulsion machinery.
(2) On vessels propelled by steam turbines, the navigation bridge primary
control system must include safety
limit controls for high and low boiler
water levels and low steam pressure.
Actuation of these limits must be
alarmed on the navigating bridge and
at the maneuvering platform or ECC.
(3) On vessels propelled by internal
combustion engines, an alarm must annunciate on the navigating bridge and
at the maneuvering platform or ECC, if
provided, to indicate starting capability less then 50% of that required by
§ 62.35–35(a). If the primary remote control system provides automatic starting, the number of automatic consecutive attempts that fail to produce a
start must be limited to reserve 50% of
the required starting capability.
(d) Control location transfer. Control
location transfer must meet sections
41.19.3 and 41.19.4 of the American Bureau of Shipping’s ‘‘Rules for Building
and Classing Steel Vessels.’’ Manual alternate propulsion control locations
must be capable of overriding and operating independent of all remote and
automatic control locations.
(e) Control system details. (1) Each operator control device must have a detent at the zero thrust position.
(2) Propulsion machinery automatic
safety trip control operation must only
occur when continued operation could
result in serious damage, complete
breakdown, or explosion of the equipment. Other than the overrides mentioned in § 62.25–10(a)(4) and temporary
overrides located at the main navigating bridge control location, overrides of these safety trip controls are
prohibited. Operation of permitted
overrides must be alarmed at the navigating bridge and at the maneuvering
platform or ECC, as applicable, and

must be guarded against inadvertent
operation.
(3) Remote propulsion control systems must be failsafe by maintaining
the preset (as is) speed and direction of
thrust until local manual or alternate
manual control is in operation, or the
manual safety trip control operates.
Failure must activate alarms on the
navigating bridge and in the machinery
spaces.
[CGD 81–030, 53 FR 17838, May 18, 1988; 53 FR
19090, May 26, 1988]

§ 62.35–10 Flooding safety.
(a) Automatic bilge pumps must—
(1) Be provided with bilge high level
alarms that annunciate in the machinery spaces and at a manned control location and are independent of the pump
controls;
(2) Be monitored to detect excessive
operation in a specified time period;
and
(3) Meet all applicable pollution control requirements.
(b) Remote controls for flooding safety equipment must remain functional
under flooding conditions to the extent
required for the associated equipment
by § 56.50–50 and § 56.50–95 of this chapter.
(c) Remote bilge level sensors, where
provided, must be located to detect
flooding at an early stage and to provide redundant coverage.
§ 62.35–15 Fire safety.
(a) All required fire pump remote
control locations must include the controls necessary to charge the firemain
and—
(1) A firemain pressure indicator; or
(2) A firemain low pressure alarm.
§ 62.35–20 Oil-fired main boilers.
(a) General. (1) All main boilers, regardless of intended mode of operation,
must be provided with the automatic
safety trip control system(s) of paragraphs (h)(1), (h)(2)(i), (h)(2) (ii), and (i)
of this section to prevent unsafe conditions after light off.
(2) Manual alternate control of boilers must be located at the boiler front.
(3) A fully automatic main boiler
must include—
(i) Automatic combustion control;
(ii) Programing control;

300

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00300

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.35–20

(iii) Automatic feedwater control;
(iv) Safety controls; and
(v) An alarm system.
(4) Following system line-up and
starting of auxiliaries, fully automatic
main boilers must only require the operator to initiate the following sequences:
(i) Boiler pre-purge.
(ii) Trial for ignition of burners subsequent to successful initial burner
light-off.
(iii) Normal shutdown.
(iv) Manual safety trip control operation.
(v) Adjustment of primary control
setpoints.
(5) All requirements for programing
control subsystems and safety control
systems must be met when a boiler—
(i) Automatically sequences burners;
(ii) Is operated from a location remote from the boiler front; or
(iii) Is fully automatic.
(6) Where light oil pilots are used, the
programing control and burner safety
trip controls must be provided for the
light oil system. Trial for ignition
must not exceed 15 seconds and the
main burner trial for ignition must not
proceed until the pilot flame is proven.
NOTE: Light oil is defined in§63.05–75(a) of
this chapter.

(b) Feedwater control. Automatic
feedwater control subsystems must
sense, at a minimum, boiler water level
and steam flow.
(c) Combustion control. Automatic
combustion control subsystems must
provide—
(1) An air/fuel ratio which ensures
complete combustion and stable flame
with the fuel in use, under light off,
steady state, and transient conditions;
and
(2) Stable boiler steam pressure and
outlet temperatures under steady state
and transient load conditions; and
(3) A low fire interlock to prevent
high firing rates and superheater damage during boiler warm up.
(d) Programing control. The programing control must provide a programed sequence of interlocks for the
safe ignition and normal shutdown of
the boiler burners. The programing
control must prevent ignition if unsafe
conditions exist and must include the

following minimum sequence of events
and interlocks:
(1) Prepurge. Boilers must undergo a
continuous purge of the combustion
chamber and convecting spaces to
make sure of a minimum of 5 changes
of air. The purge must not be less than
15 seconds in duration, and must occur
immediately prior to the trial for ignition of the initial burner of a boiler.
All registers and dampers must be open
and an air flow of at least 25 percent of
the full load volumetric air flow must
be proven before the purge period commences. The prepurge must be complete before trial for ignition of the initial burner.
NOTE: A pre-purge is not required immediately after a complete post-purge.

(2) Trial for ignition and ignition. (i)
Only one burner per boiler is to be in
trial for ignition at any time.
(ii) Total boiler air flow during light
off must be sufficient to prevent pocketing and explosive accumulations of
combustible gases.
(iii) The burner igniter must be in position and proven energized before admission of fuel to the boiler. The igniter must remain energized until the
burner flame is established and stable,
or until the trial for ignition period
ends.
(iv) The trial for ignition period must
be as short as practical for the specific
installation, but must not exceed 15
seconds.
(v) Failure of the burner to ignite
during a trial for ignition must automatically actuate the burner safety
trip controls.
(3) Post-purge. (i) Immediately after
normal shutdown of the boiler, an
automatic purge of the boiler equal to
the volume and duration of the
prepurge must occur.
(ii) Following boiler safety trip control operation, the air flow to the boiler must not automatically increase.
Post purge in such cases must be under
manual control.
(e) Burner fuel oil valves. Each burner
must be provided with a valve that is—
(1) Automatically closed by the burner or boiler safety trip control system;
and
(2) Operated by the programming
control or combustion control subsystems, as applicable.

301

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00301

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.35–35

46 CFR Ch. I (10–1–00 Edition)

(f) Master fuel oil valves. Each boiler
must be provided with a master fuel oil
valve to stop fuel to the boiler automatically upon actuation by the boiler
safety trip control system.
(g) Valve closure time. The valves described in paragraphs (e) and (f) of this
section must close within 4 seconds of
automatic detection of unsafe trip conditions.
(h) Burner safety trip control system.
(1) Each burner must be provided with
at least one flame detector.
(2) The burner valve must automatically close when—
(i) Loss of burner flame occurs;
(ii) Actuated by the boiler safety trip
control system;
(iii) The burner is not properly seated
or in place; or
(iv) Trial for ignition fails, if a programing control is provided.
(i) Boiler safety trip control system. (1)
Each boiler must be provided with a
safety trip control system that automatically closes the master and all
burner fuel oil valves upon—
(i) Boiler low-low water level;
(ii) Inadequate boiler air flow to support complete combustion;
(iii) Loss of boiler control power;
(iv) Manual safety trip operation; or
(v) Loss of flame at all burners.
(2) The low-low water level safety
trip control must account for normal
vessel motions and operating transients.
§ 62.35–35 Internal combustion engine
starting systems.
(a) The starting system for propulsion engines and ship service generator
prime movers required to automati-

cally start must meet sections 34.23.3,
34.37.2, and 34.39 of the American Bureau of Shipping’s ‘‘Rules for Building
and Classing Steel Vessels,’’ except the
sections referenced therein.
§ 62.35–40 Fuel systems.
(a) Level alarms. Where high or low
fuel tank level alarms are required,
they must be located to allow the operator adequate time to prevent an unsafe condition.
(b) Coal fuels. (1) Controls and instrumentation for coal systems require special consideration by the Commandant
(G–MSE).
(2) Interlocks must be provided to ensure a safe transfer of machinery operation from one fuel to another.
(c) Automatic fuel heating. Automatic
fuel heating arrangements must meet
section 41.78.1 of the American Bureau
of Shipping’s ‘‘Rules for Building and
Classing Steel Vessels.’’
(d) Overflow prevention. Fuel oil day
tanks, settlers, and similar fuel oil
service tanks that are filled automatically or by remote control must be provided with a high level alarm that annunciates in the machinery spaces and
either an automatic safety trip control
or an overflow arrangement.
[CGD 81–030, 53 FR 17838, May 18, 1988, as
amended by CGD 95–072, 60 FR 50463, Sept. 29,
1995; CGD 96–041, 61 FR 50728, Sept. 27, 1996]

§ 62.35–50 Tabulated monitoring and
safety control requirements for specific systems.
The
minimum
instrumentation,
alarms, and safety controls required
for specific types of systems are listed
in Table 62.35–50.

TABLE 62.35–50—MINIMUM SYSTEM MONITORING AND SAFETY CONTROL REQUIREMENTS FOR
SPECIFIC SYSTEMS (NOTE 1)
System

Service

Instrumentation

Alarm

Safety control

Main (Propulsion) boiler

(1 ) .............................
Supply casing and
uptakes.
Burner flame ............
Burner seating ..........
Trial for ignition ........
Control power ...........
..................................
Burner valve .............
Low fire interlock ......
Program control
interlock.
(2 ) .............................

(1 ) .............................
..................................

(1 ) .............................
Fire ...........................

..................................
..................................

(2)

Status .......................
..................................
Status .......................
Available (pressure)
..................................
Open/closed .............
Status .......................
Status .......................

Failure ......................
Failure ......................
Failure ......................
Failure (low) .............
..................................
..................................
..................................
..................................

Burner auto trip ........
......ditto ....................
......ditto ....................
......ditto ....................
Manual trip ...............
..................................
..................................
..................................

(3)
(3)
(3)
(3)

(2 ) .............................

(2 ) .............................

..................................

(4, 5)

Main (Propulsion steam)
turbine.

Notes

302

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00302

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.35–50

TABLE 62.35–50—MINIMUM SYSTEM MONITORING AND SAFETY CONTROL REQUIREMENTS FOR
SPECIFIC SYSTEMS (NOTE 1)—Continued
System
Main propulsion, diesel
Main propulsion, remote
control.

Main propulsion, electric
Main propulsion, shafting.

Main propulsion, controllable pitch propeller.
Generators ....................

Auxiliary boiler ...............
Gas turbine ...................
Engines and turbines ....
Fuel oil ..........................

Bilge ..............................

Machinery space CL.3
W.T. doors.
Fire detection ................
Fire main .......................
Personnel ......................
General, control and
alarm systems.

Redundant auxiliary,
system, power supply.
1 See
2 See
3 See
4 See
5 See
6 See
7 See
8 See
9 See

Service

Instrumentation

Alarm

Safety control

..................................
(1 ) .............................
..................................
..................................

..................................
(1 ) .............................
..................................
..................................

..................................
(1 ) .............................
..................................
Failure ......................

Manual trip ...............
..................................
Manual trip ...............
......ditto ....................

Auto safety trip override.
Starting power ..........
Location in control ....
Shaft speed/direction/pitch.
Clutch fluid ...............
4
( ) .............................
Stern tube oil tank
level.
Line shaft bearing ....
..................................

..................................

Activated ..................

..................................

Pressure (voltage) ....
Status .......................
(3 ) .............................

Low ...........................
Override ...................
(3 ) .............................

Limit ..........................
..................................
(3 ) .............................

Pressure ...................
(4 ) .............................
..................................

Low ...........................
(4 ) .............................
Low ...........................

..................................
(4 ) .............................
..................................

Temperature .............
Forced lubrication
Pressure.
Pressure ...................

High ..........................
Low ...........................

..................................
..................................

High, Low .................

..................................

High ..........................
(1 ) .............................
Low ...........................

..................................
..................................
..................................

..................................
Emergency ...............
Turbogenerator ........
..................................
Diesel .......................
..................................
..................................
(8 ) .............................
Jacking/turning gear
(9 ) .............................
Remote/auto fill level

Temperature .............
(1 ) .............................
Starting pressure/
voltage.
..................................
(5 ) .............................
(1,6) ...........................
..................................
(1,7) ...........................
..................................
Run ...........................
(8 ) .............................
Engaged ...................
(9 ) .............................
..................................

Tripped .....................
(5 ) .............................
(1,6) ...........................
..................................
(1,7) ...........................
..................................
Trip ...........................
(8 ) .............................
..................................
(9 ) .............................
High ..........................

Hi. press. leakage
level.
Pump remote control
Pump auto control ....
Level .........................
..................................

..................................

High ..........................

..................................
(5 ) .............................
(6 ) .............................
Manual trip ...............
(7 ) .............................
Manual trip ...............
..................................
(8 ) .............................
..................................
..................................
Auto trip or overflow
arrangement.
..................................

Run ...........................
Run ...........................
..................................
Open/closed .............

..................................
Excessive operations
High/location ............
..................................

..................................
..................................
..................................
..................................

Machinery spaces ....
..................................
Deadman ..................
Power supply ...........

..................................
Pressure ...................
..................................
Available (pressure)

Space on fire ............
Low ...........................
Fail to acknowledge
Failure (low) .............

..................................
..................................
..................................
..................................

System function .......
Console air conditioning.
Built in test equipment.
Sequential interlock ..
Safety control ...........
..................................

..................................
..................................

Failure ......................
Failure ......................

..................................
..................................

Hydraulic oil .............
..................................
Ship service .............
..................................

Active .......................

..................................

..................................

Activated ..................
..................................
Status .......................

..................................
Activated ..................
Auto transfer ............

..................................
Auto trip/limit ............
..................................

Notes
(4, 5)

(2)
(6)

(7)

(5)
(12)
(5)
(8)

(9)
(10)

(11)

(11)

ABS Table 41.1.
ABS Table 41.1, except Shaft Rollover.
§ 113.37 of this chapter.
subparts 111.33 and 111.35 of this chapter.
subparts 112.45 and 112.50 of this chapter.
§ 111.12–1(c) of this chapter.
§ 111.12–1 (b), (c) of this chapter.
§ 58.10–15(g) of this chapter.
ABS Table 41.1, ‘‘Additional Services.’’

303

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00303

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.50–1

46 CFR Ch. I (10–1–00 Edition)

NOTES ON TABLE 62.35–50:
1. The monitoring and controls listed in
this table are applicable if the system listed
is provided or required. References to ABS
Table 41.1 apply to the ‘‘Operation,’’ ‘‘Display,’’ ‘‘Alarm,’’ and ‘‘Notes’’ 1 through 12,
except the reference to ACCU in Note 11.
2. Safety limit controls must be provided
in navigating bridge primary propulsion control systems. See § 62.35–5(c).
3. Safety trip controls and alarms must be
provided for all main boilers, regardless of
mode of operation. See § 62.35–20(a).
4. Loss of forced lubrication safety trip
controls must be provided, as applicable.
5. Override of overspeed and loss of forced
lubrication pressure safety trip controls
must not be provided. See § 62.35–5(e)(2).
6. Transfer interlocks must be provided.
7. Semiconductor controlled rectifiers
must have current limit controls.
8. Interlocks must be provided. See § 62.25–
5(a).
9. See subparts 113.10, 161.002, and fire protection requirements of the applicable subchapters. The use of thermal detectors alone
is subject to special consideration by the
Commandant (G–MSE). Flame detectors may
only be used in conjunction with smoke or
heat detectors.
10. See § 62.50–20(b)(1).
11. Alarms and controls must be failsafe.
See § 62.30–1.
12. Vital auxiliary boilers only. Also see
part 63.
[CGD 81–030, 53 FR 17838, May 18, 1988; 53 FR
19090, May 26, 1988, as amended by USCG–
2000–7790, 65 FR 58461, Sept. 29, 2000]

Subpart 62.50—Automated Selfpropelled Vessel Manning
§ 62.50–1 General.
(a) Where automated systems are
provided to replace specific personnel
in the control and observation of the
engineering plant and spaces, or reduce
overall crew requirements, the arrangements must make sure that under
all sailing conditions, including maneuvering, the safety of the vessel is
equal to that of the same vessel with
the entire plant under fully attended
direct manual supervision.
(b) Coast Guard acceptance of automated systems to replace specific personnel or to reduce overall crew requirements is predicated upon—
(1) The capabilities of the automated
systems;
(2) The combination of the personnel,
equipment, and systems necessary to

ensure the safety of the vessel, personnel, and environment in all sailing
conditions, including maneuvering;
(3) The ability of the crew to perform
all operational evolutions, including
emergencies such as fire or control or
monitoring system failure;
(4) A planned maintenance program
including routine maintenance, inspection, and testing to ensure the continued safe operation of the vessel; and
(5) The automated system’s demonstrated reliability during an initial
trial period, and its continuing reliability.
NOTE: The cognizant Officer in Charge, Marine Inspection, (OCMI) also determines the
need for more or less equipment depending
on the vessel characteristics, route, or trade.

(c) Equipment provided to replace
specific personnel or to reduce overall
crew requirements that proves unsafe
or unreliable in the judgment of the
cognizant Officer in Charge, Marine Inspection, must be immediately replaced or repaired or vessel manning
will be modified to compensate for the
equipment inadequacy.
§ 62.50–20 Additional requirements for
minimally
attended
machinery
plants.
NOTE: Minimally attended machinery
plants include vessel machinery plants and
spaces that are automated, but not to a degree where the plant could be left unattended. Emphasis is placed on the centralized remote control and monitoring of the
machinery plant and machinery spaces.

(a) General. (1) Navigating bridge propulsion control must be provided.
(2) An ECC must be provided and
must include the automatic and remote control and monitoring systems
necessary to limit the operator’s activity to monitoring the plant, initiating
programed control system sequences,
and taking appropriate action in an
emergency.
(3) The ECC must include control and
monitoring of all vital engineering systems, including—
(i) The propulsion plant and its auxiliaries;
(ii) Electrical power generation and
distribution;
(iii) Machinery space fire detection,
alarm, and extinguishing systems; and

304

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00304

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 62.50–20

(iv) Machinery space flooding safety
systems, except the valves described in
paragraph (e)(4) of this section.
(4) ECC control of vital systems must
include the ability to place required
standby systems, auxiliaries, and
power sources in operation, unless
automatic transfer is provided, and to
shut down such equipment when necessary.
NOTE: ECC remote control need not include
means for a single operator to bring the
plant to standby from a cold plant or dead
ship condition or controls for non-vital systems or equipment.

(b) Alarms and instrumentation. (1) A
personnel alarm must be provided and
must annunciate on the bridge if not
routinely acknowledged at the ECC or
in the machinery spaces.
(2) Continuous or demand instrumentation displays must be provided at the
ECC to meet the system and equipment
monitoring requirements of this part if
the ECC is to be continuously attended. If the watchstander’s normal
activities include maintenance, a roving watch, or similar activities in the
machinery spaces but not at the ECC,
both alarms and instrumentation must
be provided.
(3) All required audible alarms must
annunciate throughout the ECC and
machinery spaces.
(c) Fire detection and alarms. An approved automatic fire detection and
alarm system must be provided to
monitor all machinery spaces. The system must activate all alarms at the
ECC, the navigating bridge, and
throughout the machinery spaces and
engineers’ accommodations. The ECC
and bridge alarms must visually indicate which machinery space is on fire,
as applicable.
NOTE: For purposes of this part, the specific location of fires that are not in machinery spaces need not be indicated.

(d) Fire pumps. (1) The ECC must include control of the main machinery
space fire pumps.
(2) Remote control of a required fire
pump must be provided from the navigating bridge. Where one or more fire
pumps is required to be independent of
the main machinery space, at least one
such pump must be controlled from the
navigating bridge.

(e) Flooding safety. (1) Machinery
space bilges, bilge wells, shaft alley
bilges, and other minimally attended
locations where liquids might accumulate must be monitored from the ECC
to detect flooding angles from vertical
of up to 15° heel and 5° trim.
(2) The ECC must include the controls necessary to bring at least one
independent bilge pump and independent bilge suction required by
§ 56.50–50(e) of this chapter into operation to counter flooding.
(3) Where watertight doors in subdivision bulkheads are required in the
machinery spaces, they must be Class 3
watertight doors and must be controllable from the ECC and the required
navigating bridge control location.
(4) Controls must be provided to operate the sea inlet and discharge valves
required by § 56.50–95(d) of this chapter
and the emergency bilge suction required by § 56.50–50(f). These controls
must be arranged to allow time for operation in the event of flooding with
the vessel in the fully loaded condition.
Time considerations must include detection, crew response, and control operation time.
(f) Communications. (1) A means must
be provided at the ECC to selectively
summon any engineering department
member from the engineering accommodations to the ECC.
(2) The voice communications system
required by § 113.30–5(a) of this chapter
must also include the engineering officers’ accommodations.
(g) Electrical systems. (1) The ECC
must include the controls and instrumentation necessary to place the ship
service and propulsion generators in
service in 30 seconds.
(2) The main distribution and propulsion switchboards and generator controls must either be located at the
ECC, if the ECC is within the boundaries of the main machinery space, or
the controls and instrumentation required by part 111 of this chapter must
be duplicated at the ECC. Controls at
the switchboard must be able to override those at the ECC, if separate. Also
see § 111.12–11(g) and § 111.30–1(a)(4) regarding switchboard location.
(h) Maintenance program. (1) The vessel must have a planned maintenance

305

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00305

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

§ 62.50–30

46 CFR Ch. I (10–1–00 Edition)

program to ensure continued safe operation of all vital systems. Program
content and detail is optional, but
must include maintenance and repair
manuals for work to be accomplished
by maintenance personnel and checkoff
lists for routine inspection and maintenance procedures.
(2) The planned maintenance program must be functioning prior to the
completion of the evaluation period for
reduced manning required by § 62.50–
1(b)(5).
(3) Maintenance and repair manuals
must include details as to what, when,
and how to troubleshoot, repair and
test the installed equipment and what
parts are necessary to accomplish the
procedures. Schematic and logic diagrams required by § 62.20–1 of this part
must be included in this documentation. Manuals must clearly delineate
information that is not applicable to
the installed equipment.
[CGD 81–030, 53 FR 17838, May 18, 1988; 53 FR
19090, May 26, 1988; 53 FR 24270, June 28, 1988]

§ 62.50–30 Additional requirements for
periodically unattended machinery
plants.
NOTE: Periodically unattended machinery
plants include machinery plants and spaces
that are automated to the degree that they
are self-regulating and self-monitoring and
could safely be left periodically unattended.
Emphasis is placed on providing systems
that act automatically until the crew can
take action in the event of a failure or emergency. Requirements are in addition to those
of a minimally attended machinery plant.

(a) General. The requirements of this
section must be met in addition to
those of § 62.50–20 of this part.
(b) Automatic transfer. Redundant
vital auxiliaries and power sources
must automatically transfer to the
backup units upon failure of operating
units.
(c) Fuel systems. The fuel service and
treatment system(s) must meet section
41.77.1 of the American Bureau of Shipping’s ‘‘Rules for Building and Classing
Steel Vessels.’’
(d) Starting systems. Automatic or remote starting system receivers, accumulators, and batteries must be automatically and continuously charged.
(e) Assistance-needed alarm. The engineer’s assistance-needed alarm (see

subpart 113.27 of this chapter) must annunciate if—
(1) An alarm at the ECC is not acknowledged in the period of time necessary for an engineer to respond at
the ECC from the machinery spaces or
engineers’ accommodations; or
(2) An ECC alarm system normal
power supply fails.
(f) Remote alarms. ECC alarms for
vital systems that require the immediate attention of the bridge watch officer for the safe navigation of the vessel must be extended to the bridge. All
ECC alarms required by this part must
be extended to the engineers’ accommodations. Other than fire or flooding
alarms, this may be accomplished by
summarized visual alarm displays.
(g) ECC alarms. All requirements of
this part for system or equipment monitoring must be met by providing both
displays and alarms at the ECC.
(h) Fire control station. A control station for fire protection of the machinery spaces must be provided outside
the machinery spaces. At least one access to this station must be independent of category A machinery
spaces, and any boundary shared with
these spaces must have an A–60 fire
classification as defined in § 72.05 of
this chapter. Except where such an arrangement is not possible, control and
monitoring cables and piping for the
station must not adjoin or penetrate
the boundaries of a category A machinery space, uptakes, or casings. The fire
control station must include—
(1) Annunciation of which machinery
space is on fire;
(2) Control of a fire pump required by
this chapter to be independent of the
main machinery spaces;
(3) Controls for machinery space
fixed gas fire extinguishing systems;
(4) Control of oil piping positive shutoff valves located in the machinery
spaces and required by § 56.50–60(d);
(5) Controls for machinery space fire
door holding and release systems, skylights and similar openings;
(6) The remote stopping systems for
the machinery listed in § 111.103 of this
chapter; and
(7) Voice communications with the
bridge.

306

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00306

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T

Coast Guard, DOT

§ 63.01–3

(i) Oil leakage. Leakages from high
pressure fuel oil pipes must be collected and high levels must be alarmed
at the ECC.
(j) Maintenance program. The maintenance program of § 62.50–20(h) must include a checkoff list to make sure that
routine daily maintenance has been
performed, fire and flooding hazards
have been minimized, and plant status
is suitable for unattended operation.
Completion of this checkoff list must
be logged before leaving the plant unattended.
(k) Continuity of electrical power. The
electrical plant must meet sections
41.75.1 and 41.75.3 of the American Bureau of Shipping’s ‘‘Rules for Building
and Classing Steel Vessels’’ and must—
(1) Not use the emergency generator
for this purpose;
(2) Restore power in not more than 30
seconds; and
(3) Account for loads permitted by
§ 111.70–3(f) of this chapter to automatically restart.
[CGD 81–030, 53 FR 17838, May 18, 1988; 53 FR
19090, May 26, 1988]

PART 63—AUTOMATIC AUXILIARY
BOILERS
Subpart 63.01—General Provisions
Sec.
63.01–1
63.01–3

Purpose.
Scope and applicability.

Subpart 63.05—Reference Specifications
63.05–1

Incorporation by reference.

Subpart 63.10—Miscellaneous Submittals
63.10–1 Test procedures and certification report.

Subpart 63.15—General Requirements
63.15–1
63.15–3
63.15–5
63.15–7
63.15–9

General.
Fuel system.
Strainers.
Alarms.
Inspections and tests.

Subpart 63.20—Additional Control System
Requirements
63.20–1 Specific
ments.

control

system

require-

Subpart 63.25—Requirements for Specific
Types of Automatic Auxiliary Boilers
63.25–1
63.25–3
63.25–5
63.25–7
63.25–9

Small automatic auxiliary boilers.
Electric hot water supply boilers.
Fired thermal fluid heaters.
Exhaust gas boilers.
Incinerators.

AUTHORITY: 46 U.S.C. 3306, 3703; E.O. 12234,
45 FR 58801, 3 CFR, 1980 Comp., p. 277; 49 CFR
1.46.
SOURCE: CGD 88–057, 55 FR 24238, June 15,
1990, unless otherwise noted.

Subpart 63.01—General Provisions
§ 63.01–1

Purpose.

This part specifies the minimum requirements for safety for each automatic auxiliary boiler, including its design, construction, testing, and operation.
§ 63.01–3 Scope and applicability.
(a) This part contains the requirements for automatic auxiliary boilers,
including their controls, control system components, electrical devices,
safety devices, and accessories. Types
of automatic auxiliary boilers which
are covered include large and small
automatic auxiliary boilers, automatic
heating boilers, automatic waste heat
boilers, donkey boilers, miniature boilers, electric boilers, fired thermal fluid
heaters, automatic incinerators, and
electric hot water supply boilers. Automatic auxiliary boilers are classified
by their service, control systems, pressure and temperature boundaries, heat
input ratings, and firing mediums as
follows:
(1) Automatic auxiliary boilers listed
in Table 54.01–5(A) of this chapter
which reference this part for regulation
of their automatic controls.
(2) Automatic control systems for
automatic auxiliary boilers having a
heat input rating of less than 12,500,000
Btu/hr. (3.66 megawatts)(20 gph).
(3) Electric hot water supply boilers
(heaters) containing electric heating
elements rated at 600 volts or less.
(4) Exhaust gas boilers, and their
controls and accessories used to heat
water and/or generate steam.
(5) Incinerators (and their control
systems) used for the generation of
steam and/or oxidation of ordinary

307

VerDate 112000

10:41 Oct 18, 2000

Jkt 190175

PO 00000

Frm 00307

Fmt 8010

Sfmt 8010

Y:\SGML\190175T.XXX

pfrm08

PsN: 190175T