Man iSea, Operating Instructions Manual, Page: 24 / 172

Functional safety
22
Read this manual carefully before starting any work!
This is particularly applicable to the chapter “General Safety Instructions”
and the respective safety instructions in the chapters.
3.1 The following development guidelines and principles apply
- Personal protection has top priority (see also general safety instructions)
- Reliability takes precedence over backup function
- Functions – especially those for system monitoring (including error reactions) – must be simple and
manageable
- In favor of maximum availability, staggered fault reactions should be preferred
- A signal path is only classified as “confirmed defective” after clear detection (e.g. after event or time
debouncing)
before reaction mechanisms are activated. Prior to this, the defect is classified as “suspected defective”
- Suitable reaction mechanisms must be defined function-specifically, both in case of “suspected
defective” and in case of “confirmed defective”
- Engine stop is permissible if no other controllable system reaction can be guaranteed due to the system
- At the control unit interface, the respective transmitter (e.g. drive lever control unit, ...) is responsible for
the content of its transmitted messages.
This means that e.g. external torque interventions must be secured by the transmitter control unit. The
engine control system checks the transmission path and the timeliness of the messages
- The technical safety concept is implemented in accordance with the requirements of ISO 26262
3.2 Definition of system scope
The system scope includes the combustion engine with engine control unit in the propulsion train of a ship,
which has access to the shipʼs propeller in case of a closed propulsion train.
The following functional characteristics are assigned to the combustion engine:
- Provision of drive torque
- Provision of braking torque by means of drag resistance of the combustion engine