Engine Room Automation: UMS and E0 Systems

The shift from continuously manned engine rooms to periodically unattended machinery space (PUMS) operation was not a product preference: it was a regulatory programme. SOLAS Chapter II-1 Regulations 46 through 53, which entered the Convention through Resolution MSC.47(66) in 1996 and have been amended several times since, define the specific technical conditions under which a machinery space may be declared unattended and what systems must remain active when it is. Class societies translate those regulations into their own notation requirements. DNV calls it E0. Lloyd’s Register calls it UMS. ABS uses ACCU. The names differ; the underlying obligation is the same.

This article covers the complete regulatory and engineering picture: what SOLAS actually requires, what each major class society’s notation demands, how the alarm and monitoring system (AMS), extension alarm, and dead-man alarm work in practice, how bridge control of the main engine is architected, what the integrated automation system (IAS) and power management system (PMS) do, how main-engine safety and slowdown systems are configured, and how cybersecurity obligations under IACS UR E26 and E27 apply from 1 January 2024. For the companion article on engine parameter measurement and SFOC analysis, see Marine Engine Performance Monitoring.

SOLAS Chapter II-1: Regulations 46 to 53 in Detail

SOLAS Chapter II-1 Part E (Regulations 46 to 53) is the international minimum standard for periodically unattended machinery spaces. No class notation can reduce these requirements, though each classification society adds specificity on top of them.

Regulation 46 establishes the general obligation: “Adequate means shall be provided for the safety of an unmanned machinery space.” The regulation specifies that alarm systems, automatic systems, remote control, and manual controls must together allow the machinery space to be left unattended at sea, and that the ship must be capable of being brought to attended operation within 30 minutes. That 30-minute figure is not a recovery time for a casualty: it is the design parameter for how quickly engineering staff can reinstate full local supervision of all running machinery.

Regulation 47 addresses fire safety specifically. In an unattended machinery space a fixed fire-detection system, typically an automatic smoke-detection and heat-detection network, must be capable of raising an alarm on the bridge and in the engineers’ accommodation without requiring a person in the machinery space. The regulation requires automatic stopping of ventilation fans when a fire is detected, as well as the ability to close fire dampers in ventilation ducts remotely. Class-society rules typically require the fire detection system to identify the specific zone in which an alarm has been triggered.

Regulation 48 covers bilge-level monitoring. The machinery space must have bilge-level alarms connected to the alarm system, and where bilge pumps are fitted they must be capable of automatic starting. The regulation requires that high-level alarms be grouped with other machinery alarms at the bridge and duty engineer panels, and that a means exists to discharge bilge water in an emergency.

Regulation 49 specifies the communication requirements: a reliable means of voice communication between the machinery space and the bridge, the navigating bridge, and the engineers’ cabins. VHF is not sufficient on its own; the regulation is interpreted as requiring a fixed intercom system.

Regulation 50 requires that means be provided to maintain safe propulsion during unattended operation, including the ability to control propulsion speed and direction from the navigating bridge.

Regulation 51 addresses the extension alarm system in specific terms. The alarm system must be arranged so that any machinery alarm is communicated to the bridge and to the duty engineer’s cabin, and if not acknowledged within a set period, to a second location (typically a public address system activating in the accommodation). The period before escalation is determined by class-society rules, not by SOLAS directly.

Regulation 52 requires adequate lighting throughout the machinery space for safe attendance in case a person needs to enter the unattended space during an alarm situation.

Regulation 53 addresses the automatic starting of pumps and similar auxiliary machinery. Where a running pump failure creates an unsafe condition, a standby pump must start automatically, and the alarm system must indicate both the failure and the automatic start.

The implementation detail below Regulation 46’s general statement is found in IACS Unified Requirement M40, which translates the SOLAS text into specific engineering criteria that all IACS member societies apply consistently.

IACS Unified Requirement M40

IACS UR M40 is the shared technical baseline that all IACS class societies apply to periodically unattended machinery space installations. It specifies the categories of machinery whose parameters must be continuously monitored, the alarm grouping and response-time requirements, and the criteria for automatic slowdown and shutdown systems.

UR M40 defines a hierarchy of monitoring: parameters where a fault triggers an automatic slowdown (reduction of engine load to a safe level), parameters where a fault triggers an automatic shutdown (stopping the engine), and parameters where a fault triggers an alarm only, leaving action to the engineer. The distinction matters because not all faults warrant an immediate shutdown. A low lubricating oil pressure on the main engine triggers a slowdown first, then a shutdown if the pressure does not recover, rather than an immediate full shutdown that could leave the vessel without propulsion in a dangerous sea state.

The requirement also specifies alarm grouping. Individual equipment alarms may be numerous, but the system must present grouped alarms at the bridge and duty cabin in a way that does not overwhelm the observer. UR M40 adopts the framework established in IMO Resolution A.1021(26) (Code on Alerts and Indicators, adopted 2009), which defines four alarm priorities: category A (immediate danger, requires immediate action), category B (potential danger, requires prompt attention), category C (abnormal condition, requires attention), and category D (information). Class-society implementations may use different labels but map to the same four-tier structure.

IACS Unified Requirement E10: Alarm Systems

IACS UR E10 governs the design of shipboard alarm systems specifically. It requires that an alarm system be able to handle simultaneous alarms from multiple sources without losing any alarm, that all active alarms be retained in a log accessible for survey, and that the system distinguish between acknowledged and unacknowledged alarms. The standard requires a minimum of 30 days of alarm history storage.

UR E10 also addresses the alarm inhibit function: some operators inhibit alarms during maintenance or known abnormal operating modes. The standard requires that inhibited alarms be tracked separately, displayed as such, and not suppressed from the log. An inhibited alarm that would otherwise be category A cannot simply disappear: the system must record that it was inhibited, by whom, and for how long.

Class Society UMS Notations Compared

The table below summarizes the primary UMS/E0 notations across the five largest IACS class societies. All are built on SOLAS Ch.II-1 Regs.46-53 and IACS M40; differences are in labeling, survey scope, and supplementary capability tiers.

DNV E0 is defined in DNV Rules for Ships, Part 4, Chapter 9 (Control and Monitoring Systems). The notation requires a dead-man alarm with a maximum acknowledgment interval of 30 minutes, an extension alarm system that escalates unacknowledged alarms within 2 minutes, automatic fire detection and automatic bilge pump start, and bridge control of the main engine including remote emergency stop. DNV’s sister notation ECO covers vessels where propulsion, energy management, and cargo handling are integrated into a single optimized control platform.

ABS ACCU is described in ABS Rules for Building and Classing Marine Vessels, Part 4, Chapter 3. ABS additionally offers the AMS (Alarm and Monitoring System) notation, which sits below ACCU and certifies the alarm infrastructure independently of whether full UMS is sought. The notation structure allows a shipowner to certify the monitoring hardware before the full automation system is complete. ABS ACCU requires the same 30-minute restoration capability as SOLAS, plus specific requirements for automatic fuel-oil purifier changeover and automatic oil-mist detection on the crankcase. Both are verified by /calculators/class-abs-accu and /calculators/class-abs-ams on this site.

BV AUT-UMS is defined in Bureau Veritas Rules for Steel Ships, Part C, Chapter 3. BV uses a parallel notation AUT-CCS for ships with a centralized control station, which BV defines as a control room equipped to manage both machinery and cargo operations. The AUT-CCS requirement specifies that all cargo-system alarms must be routed to the same extension alarm path as machinery alarms during unattended periods.

ClassNK MO (M0) is defined in ClassNK’s Rules and Guidance for the Survey and Construction of Steel Ships, Part N. ClassNK uses both “MO” and the numeric “M0” in different documentation contexts; they refer to the same notation. ClassNK’s survey of the notation includes a sea-trial phase in which the engineer-on-call response procedure is tested with a live simulated alarm cascade.

You can verify BV AUT-UMS parameters with the BV AUT-UMS calculator and the full E0/UMS criteria check with Engine Room UMS / E0 Criteria Check.

The Alarm and Monitoring System

The alarm and monitoring system (AMS) is the data-collection and alert backbone of an automated engine room. It reads sensors, compares readings against preset limits, generates alarms, logs all events, and presents information to operators on the engine control room (ECR) displays and the bridge alarm panel.

A typical AMS on a modern large vessel monitors between 500 and 1,500 individual parameters. On a very large container ship with two auxiliary boilers, multiple diesel generators, and a large two-stroke main engine, the total monitored point count can exceed 2,000. The system scans each point on a cycle that IACS E10 requires to be fast enough to detect the fastest-changing parameter: exhaust-gas temperatures change within seconds on a load step, while ballast tank levels change over hours. Most modern systems use a scan cycle of 1 to 5 seconds for safety-critical parameters and 30 to 60 seconds for slow-moving process variables.

Alarm setpoints divide into two types. Hard setpoints are fixed at the commissioning stage and require a class-approved parameter change to modify: main engine lubricating oil low-pressure alarm is a hard setpoint because it directly relates to a SOLAS-required protective function. Soft setpoints are operator-adjustable within a defined range and include items like fuel-oil service tank low-level warning, which an operator may adjust temporarily during bunkering.

The AMS database records every alarm activation, every operator acknowledgment, and every setpoint change. Surveyors review this log at annual and special surveys. A pattern of repeated short-duration alarms followed by rapid acknowledgment, without corrective action appearing in the maintenance log, is a survey finding that triggers investigation. Class societies train their surveyors specifically to read AMS logs as a diagnostic tool.

The Extension Alarm System and Engineer-on-Call Alarm

The extension alarm system (EAS) and the engineer-on-call (dead-man) alarm are distinct systems with related but separate functions. Both operate only when the engine room is formally declared unattended: the UMS mode is activated by the chief engineer through a physical key or controlled software action, and this activation is logged.

When UMS mode is active, all category A and category B alarms from the AMS are simultaneously transmitted to:

• The bridge alarm panel (continuous audible and visual display)
• The duty engineer’s cabin panel (same audible and visual display)
• Any other nominated alarm locations (typically the officers’ mess and a deck alarm in the accommodation)

If an alarm is not acknowledged within the escalation time (2 minutes under DNV E0; class societies set this between 1 and 3 minutes), the extension alarm system activates a general alarm that sounds throughout the accommodation. The intent is that regardless of where the duty engineer is located, they cannot miss a critical alarm.

The dead-man alarm is separate. It requires the duty engineer to actively confirm their status at intervals not exceeding the time set in the class rules, which is typically 30 minutes in DNV E0 and similar across other societies. The engineer must physically press a reset button on a panel in the accommodation or engine room. If 30 minutes pass without a reset, the alarm sounds first in the duty cabin and then on the bridge. If that alarm is not acknowledged, it escalates further. The system protects against the scenario where the duty engineer has become incapacitated during the unattended period.

SOLAS does not specify the exact interval: the 30-minute figure comes from IACS UR M40 and class-society rules. The International Chamber of Shipping’s guidance (referenced in IMO circulars) recommends testing the dead-man alarm system at every watch change.

Bridge Control of the Main Engine

SOLAS Ch.II-1 Reg.50 requires bridge control of propulsion. In practice this means the bridge controls must allow the officer of the watch to command propulsion speed and direction without entering the engine room. The engineering detail of how this is implemented is substantial.

The bridge control system transmits speed and direction commands from the bridge telegraph (or joystick for controllable-pitch propeller vessels) to the main engine control system via a dedicated hardwired and/or network-based link. The main engine’s electronic governor responds to speed commands; the fuel injection and turbocharging respond automatically. A redundant communication path, typically a separate cable run from the bridge to the ECR, must exist so that a single cable fault does not isolate bridge control.

SOLAS requires that if bridge control is lost, propulsion is not lost with it. The ECR must be able to take over immediately, and the bridge must receive a clear alarm indicating that bridge control has transferred. On most modern vessels this transfer is automatic: the system detects a bridge-control communication failure and switches to ECR local control within 5 to 10 seconds, sounding an alarm on both panels.

Emergency bridge control of the main engine includes remote emergency stop capability. SOLAS Ch.II-1 requires a means to stop the main engine from the bridge independent of the normal control path. On a large slow-speed two-stroke engine this is achieved through a dedicated shutdown relay that cuts fuel injection and activates the starting-air interlock, bypassing the normal control sequence. This relay must be testable during port or sea trial without bringing the engine to a full unplanned stop: most ships use a function test mode in which the relay is activated but a blocking interlock prevents the actual fuel cutoff.

The minimum propulsion power calculator is relevant here: it quantifies the power level below which a vessel loses the ability to maintain steerage, which is the practical lower boundary of any bridge-commanded slowdown.

Safety Systems: Slowdown and Shutdown

Main-engine safety systems operate in two tiers: slowdown (automatic reduction to a safe power level) and shutdown (complete engine stop). The distinction is preserved because a shutdown at sea in adverse conditions may be more dangerous than continuing to run at reduced power.

Slowdown triggers typically include:

• Main lubricating oil pressure below the slowdown setpoint (a value above the shutdown setpoint, giving time for recovery)
• Jacket cooling water temperature above the slowdown setpoint
• Piston cooling water outlet temperature above limit
• Scavenge air temperature above limit
• Turbocharger speed above limit

Shutdown triggers typically include:

• Lubricating oil pressure below the shutdown setpoint after slowdown has not resolved the condition
• Engine overspeed (typically set at 115% of rated speed; the protection is independent, using a dedicated overspeed trip device)
• Loss of crankcase pressure (detection of oil mist in the crankcase, indicating a potential crankcase explosion precursor)
• High-high cooling water temperature
• Thrust bearing high temperature

The oil-mist detector (OMD) deserves specific attention. Crankcase explosions have caused fatal casualties on merchant vessels. IACS Unified Requirement M10 requires oil-mist detectors on two-stroke and four-stroke engines above a certain cylinder bore (100 mm for two-stroke, 200 mm for four-stroke). The detector must activate a slowdown, not merely an alarm, because by the time oil mist is detectable the risk of ignition is already elevated and continued high-power operation increases it further.

The overspeed trip is required to be a mechanical device independent of the electronic control system, so that a software failure cannot prevent the overspeed protection from operating. On modern electronically controlled engines (MAN ME, Wärtsilä RT-flex) the mechanical trip is supplemented by an electronic protection layer, but the mechanical trip remains the safety backup.

The Integrated Automation System

The integrated automation system (IAS) is the supervisory platform that sits above individual machinery control systems, consolidating their data and controls into a unified operator interface. Where an AMS monitors and alarms, an IAS also provides remote control, trend analysis, condition monitoring, and integration with ship management functions.

A modern IAS typically consists of:

• Multiple operator workstations in the ECR, each capable of full system control
• A mimic panel at the bridge showing summary machinery status
• Server hardware (often redundant) running the database, historian, and alarm processing
• Communications infrastructure to field devices (local equipment PLCs, sensor interfaces, drives)
• A separate network segment for external connectivity (ship-to-shore data transfer)

The IAS communicates with field devices over industrial protocols. NMEA 0183 and NMEA 2000 handle navigation instruments. Modbus, Profibus, and IEC 61162-series protocols handle machinery instrumentation. Modern installations increasingly use OPC-UA (OPC Unified Architecture, IEC 62541) as a common data exchange layer between the IAS server and field systems, which simplifies integration when machinery from multiple vendors needs to report to a single display.

IEC 60092-504 (Electrical Installations in Ships: Special Features, Control and Instrumentation) and IEC 60092-302 set the electrical and signal-quality requirements for sensor systems and monitoring equipment. These standards specify insulation requirements, screening of signal cables against interference from main propulsion cables, and the power supply arrangements for alarm systems (which must maintain operation during a main switchboard fault).

The IAS historian is a time-series database that stores all monitored parameter values, typically at a 1-second resolution for critical parameters and 10-second to 60-second resolution for slower variables. On a vessel with 1,000 monitored points at 1-second resolution, raw data accumulates at roughly 4 GB per day before compression. Modern systems apply lossless compression that typically reduces storage by a factor of 8 to 12, giving practical long-term storage at moderate hardware cost. The historian data is the primary input to shore-based remote monitoring platforms.

The Power Management System

The power management system (PMS) manages the ship’s electrical power generation, load distribution, and generator starting and stopping to match power supply to demand safely. On a vessel with multiple diesel generators, the PMS prevents overload on any running generator, automatically starts additional generators as load increases, sheds non-essential loads when a generator trips, and stops excess generators during low-load periods to reduce fuel consumption and running hours.

The PMS operates continuously and is not limited to UMS periods. However, its importance increases during unattended operation because an engineer cannot manually start a standby generator in time to prevent a blackout from a running generator trip. The PMS must respond to a generator fault within approximately 1 to 3 seconds to shed non-essential loads and start the standby generator before the bus voltage has collapsed completely.

Load shedding is organized into tiers. Non-essential loads (hotel lighting circuits, some HVAC zones, non-critical pumps) are shed first. Critical loads (bilge pumps, fire pumps, steering gear) are protected and cannot be shed. The sequence is pre-programmed into the PMS and approved at class survey; changes require a documented parameter change with class approval.

The PMS interacts with the main engine directly on vessels where the shaft generator is used for electrical supply. On a large slow-speed two-stroke vessel running a power take-off (PTO) shaft generator, the PMS must coordinate shaft generator output with the diesel alternators, managing the transition when the main engine changes speed or when the shaft generator trips. This coordination is complex enough that shaft generator management is typically a separate software module within the IAS/PMS.

The automation alarm rate calculator is relevant for PMS design review: it quantifies the alarm rate that the PMS generates during load-shedding events and helps assess whether the alarm rate complies with IMO A.1021(26) limits.

Cybersecurity: IMO MSC-FAL.1/Circ.3 and IACS UR E26/E27

Marine automation cybersecurity moved from advisory guidance to mandatory certification on 1 January 2024, when IACS Unified Requirements E26 and E27 took effect for ships contracted on or after that date.

IMO MSC-FAL.1/Circ.3 (Guidelines on Maritime Cyber Risk Management, 2017) was the foundational IMO document: it provided guidance and required, via Resolution MSC.428(98), that cyber risk be addressed within the ISM Safety Management System by the first annual Document of Compliance verification after 1 January 2021. MSC.428(98) did not specify technical controls: it required that the SMS address cyber risk, leaving the content of that address to the company’s own risk assessment.

IACS UR E26 and E27 change this. They are binding on IACS member societies, which means all major class societies have incorporated them into their classification rules.

IACS UR E26 (Cyber Resilience of Ships) defines 15 functional requirements that every newbuilding must meet. These include network segmentation between OT (operational technology, meaning machinery control and navigation) and IT (information technology, meaning business and communications systems), authentication controls on all systems capable of remote access, procedures for software updates and patch management, and a vulnerability disclosure process. The requirement covers all systems connected to a network: AMS, IAS, PMS, BNWAS, VDR, ECDIS, and any other networked system. The class society surveys the implementation at the new-construction stage and at each special survey.

IACS UR E27 (Cyber Resilience of On-board Systems and Equipment) places obligations on equipment suppliers. Vendors must provide a software bill of materials (SBOM) for every product, document all network interfaces, identify known vulnerabilities at delivery, and commit to a patch and update process for the product’s lifetime. A class surveyor can now ask the AMS vendor for the SBOM and check it against known vulnerability databases. This changes the commercial relationship between shipyards, equipment suppliers, and class societies in a fundamental way.

The practical implication for automation engineers is that the OT network on a ship contracted after 1 January 2024 must be designed with segmentation in mind from the outset. Connecting an IAS workstation directly to the vessel’s satellite communications link without a firewall and demilitarized zone (DMZ) no longer passes class. The IACS E26 cybersecurity calculator and IACS E27 calculator on this site quantify the compliance parameters for both requirements.

For ships contracted before 1 January 2024, IMO MSC-FAL.1/Circ.3 and MSC.428(98) still apply via the ISM system, and several class societies have introduced voluntary cyber notations (DNV CYBER, ABS CYBReg, BV CYBER-M, ClassNK CYBERcomp) that a shipowner can obtain through a technical audit.

Smart Ship and Remote Monitoring

The term “smart ship” is used across the industry without a consistent definition. For the purposes of this article it means a vessel on which the IAS historian sends real-time or near-real-time machinery data to a shore-based monitoring platform, where engineers and data analysts can review trending, identify developing faults, and advise the ship’s crew before an in-service failure occurs.

Shore-based remote monitoring has been technically possible since satellite connectivity costs dropped to practical levels in the 2010s. What changed after 2020 is the integration: early systems transmitted compressed data files daily or weekly; modern systems transmit streaming data at 1-minute or 1-second resolution for the most critical parameters, with local edge computing on the vessel doing the first level of analysis and transmitting only anomalies and summaries during high-latency or low-bandwidth satellite windows.

The bandwidth constraint remains real. A very large vessel with 1,000 monitored points transmitting at 1-second resolution without edge compression would require roughly 3.6 MB per hour of raw data, or about 86 MB per day. Inmarsat Fleet Xpress, the most widely deployed maritime broadband service, offers committed information rates of 256 kbps to 1 Mbps, which is sufficient for compressed data but not for uncompressed high-resolution streams across all points simultaneously. Edge computing devices on the vessel prioritize what to transmit: safety-critical parameter deviations are transmitted immediately; historical trend data is transferred during lower-cost communication windows.

MAN Energy Solutions’ COSSMOS platform, Wärtsilä’s Voyage Performance Center, and ABB’s Ability Marine Advisory System are examples of vendor-specific remote monitoring services. Each uses proprietary data formats and communication protocols, which creates interoperability challenges when a vessel has a MAN main engine, a Wärtsilä diesel generator, and an ABB IAS. IACS UR E26 requires that network interfaces be documented, which indirectly pressures vendors toward published interface specifications, but a common open protocol for remote machinery monitoring does not yet exist in the industry.

IEC 61162-460 (Maritime navigation and radio-communication equipment and systems: Multiple talker and multiple listener, Networked devices) addresses network integrity for marine electronics and is increasingly referenced in class-society IAS requirements for the network layer between the IAS and navigation systems.

Fire Detection Integration in Unattended Spaces

The marine fire detection and fixed fire fighting systems article covers fire systems in full. For automation, the key integration point is that the fire detection system in the machinery space must feed its alarms into the AMS extension alarm path. A fire alarm in an unattended machinery space that sounds only at a local panel in the engine room is not compliant with SOLAS Reg.47: it must also appear at the bridge.

The fire detection system and the AMS are typically separate systems with different manufacturers, connected by a hardwired relay interface: the fire panel’s zone-alarm relay closes, which inputs to the AMS as a discrete alarm. This interface must be tested at each survey. The test involves activating a detector in each zone and confirming that the correct alarm appears on both the fire panel and the AMS displays within the time specified in IACS UR E10.

Engine room fire detection systems on UMS ships typically include a combination of optical smoke detectors (for flammable liquid vapor fires), heat detectors (for high-temperature events that produce little smoke), and sometimes air-sampling systems (aspirating smoke detectors that draw air through a pipe network to a central detector). Air-sampling systems are increasingly preferred for machinery spaces because they detect very low concentrations of smoke early, before a developing fire has reached visible smoke levels.

Bilge Alarm and Automatic Pump Management

SOLAS Reg.48 requires bilge-level alarms in machinery spaces and, where fitted, automatic bilge pump activation. The practical implementation involves float switches or electronic level sensors in the bilge wells, wired to the AMS. When the high-level alarm activates, the AMS alerts the duty engineer via the extension alarm path; when the high-high-level alarm activates, the automatic pump start sequence engages.

The automatic pump start is not unconditional. SOLAS Marpol Annex I requires that no oily mixture be discharged to the sea unless it has been processed through an oily water separator with 15 ppm alarm. The automatic bilge pump is therefore connected to the oily water separator, not directly to the sea discharge. If the OWS is not running or is in fault, the automatic pump routes to the bilge holding tank. The OWS 15 ppm alarm calculator covers the detection threshold requirements in detail.

The bilge system automation also includes high-level alarms for the bilge holding tank, the oil residue tank, and the bilge water treatment unit. All of these must appear in the AMS. A surveyor reviewing the AMS log will look specifically for patterns of bilge pump activation and OWS operation: frequent bilge pump activations without corresponding OWS operation records are a compliance signal that warrants investigation.

Bearing Temperature Monitoring

Bearing temperature monitoring is a core AMS function for both main bearings and auxiliary equipment bearings. IACS UR M40 requires continuous monitoring of main engine crosshead bearings, main bearings, and thrust bearing temperatures on slow-speed two-stroke engines. Medium-speed four-stroke engines require monitoring of main and crankpin bearing temperatures.

The alarm setpoints for bearing temperatures are established by the engine builder and approved by class at construction. Typical values for a large slow-speed two-stroke main engine are a high-temperature alarm at 70 to 80°C and a slowdown trigger at 80 to 85°C above ambient, with the precise figures depending on the bearing design, lubrication oil type, and engine load range. The bearing temperature alarm calculator quantifies these setpoints against the relevant class requirements.

Thrust bearing temperature monitoring is particularly important during acceleration and deceleration maneuvers, when the axial load on the bearing changes rapidly. The AMS trend display for thrust bearing temperature over a voyage typically shows characteristic peaks at departure and arrival port maneuvers. A surveyor or remote monitoring engineer can use these peaks to assess whether bearing clearances and lubrication are adequate.

Auxiliary Engine Monitoring and Control

Diesel generator monitoring and control is a substantial subset of the IAS/AMS. Each running generator must have its electrical parameters (voltage, frequency, current, power factor) monitored alongside its mechanical parameters (lube oil pressure, cooling water temperature, exhaust gas temperature, fuel oil pressure). The PMS manages load sharing between running generators, auto-starts standby generators on load increase or running generator fault, and load-sheds non-essential consumers on bus fault.

The bridge navigational watch alarm system (BNWAS) is a navigation-side safety system, but it has a structural parallel to the dead-man alarm in the engine room. Both require periodic human confirmation of continued alertness; both escalate to general alarm if confirmation is not given. The BNWAS calculator and SOLAS BNWAS criteria checker cover the navigation-side requirements. The BNWAS wiki article covers the regulatory basis in detail.

The diesel generators are also subject to SOLAS requirements for emergency source of electrical power. SOLAS Ch.II-1 Reg.44 requires an emergency generator capable of starting in a blackout condition and supplying specified emergency loads. The AMS must monitor the emergency generator’s readiness status and alarm if the emergency generator is unavailable (fuel level low, maintenance mode active, or starting battery discharged). This alarm must appear on the bridge even when the engine room is attended.

Electrical Standards: IEC 60092 and IEC 61162

IEC 60092 (Electrical Installations in Ships) is the primary international standard for marine electrical equipment and installation. The parts relevant to automation and monitoring are:

• IEC 60092-302: Control and instrumentation; covering signal levels, power supply requirements, and EMC standards for sensors and monitoring equipment
• IEC 60092-504: Special features: control and instrumentation; covering the design requirements for machinery control systems including redundancy, fault tolerance, and independence of safety systems
• IEC 60092-507: Main and emergency switching stations; covering switchboard design and protection requirements relevant to PMS operation

IEC 61162 (Maritime navigation and radio-communication equipment and systems) covers the data communication protocols used between the IAS and navigation instruments:

• IEC 61162-1: NMEA 0183 single talker, multiple listeners (position, heading, speed data from GPS, compass, log)
• IEC 61162-2: NMEA 0183 high-speed single talker
• IEC 61162-3: Serial data instrument network (NMEA 2000)
• IEC 61162-450: Multiple talker and multiple listener networking (used for IAS-to-ECDIS links)
• IEC 61162-460: Network security extension

These standards are referenced in class-society rules and are required to be met by IAS and AMS equipment suppliers. Type approval of automation systems includes testing against the applicable IEC 60092 and IEC 61162 sections.

Maintenance, Calibration, and Survey

The AMS and IAS are class-surveyed systems. At each annual class survey the surveyor reviews the alarm log, checks calibration records for critical sensors, tests the extension alarm and dead-man alarm in the unattended mode, confirms that the fire detection interface is functional, and verifies that setpoints match the approved values. Discrepancies between approved setpoints and as-found settings are deficiencies that must be corrected before the survey certificate is issued.

Sensor calibration intervals are set by the class-approved maintenance plan. Typical intervals for safety-critical sensors (lubricating oil pressure transducers, bearing temperature detectors, overspeed trip devices) are 12 months for calibration check and 36 months for full bench calibration. Overspeed trip devices must be physically tested, which involves slowly increasing engine speed to the trip setpoint during a controlled test: most modern engines have an overspeed test mode that allows this test without running the engine to actual overspeed.

Software version management is a survey obligation under IACS UR E26 for new buildings. The class surveyor records the software version of the AMS, IAS, and PMS at the new-construction survey. Any subsequent software update, including security patches, must be logged and may require class notification or approval depending on the scope of the change. A change to alarm setpoints embedded in firmware requires class approval; a change to the display skin does not.

The planned maintenance system compliance calculator is relevant for AMS maintenance planning: it quantifies the compliance rate for calibration and testing intervals against the approved maintenance plan.

Limitations

This article describes the international regulatory framework and class-society requirements as they are written. Several important practical constraints are not fully represented in the regulatory text.

Flag-state variations. SOLAS sets the minimum; flag states may impose additional requirements. Some open registries apply SOLAS as written with no additions. Flag states with large national fleets (Japan, Norway, Greece by registry of ships operating under their effective control) often require compliance with additional circulars or guidance that goes beyond the SOLAS baseline.

Pre-2024 installations. IACS UR E26 and E27 apply to ships contracted on or after 1 January 2024. The vast majority of the world fleet was contracted before this date. Those vessels are subject to MSC.428(98) ISM obligations and, if they have class cyber notations, to those notation requirements, but not to the full E26/E27 technical specification.

Alarm setpoint authority. IACS M40 defines the categories of parameters requiring shutdown or slowdown protection, but the specific numerical setpoints are determined by the engine builder and approved by class at construction. These values vary between engine families and individual engine configurations. Nothing in this article should be used as an actual setpoint source: consult the engine builder’s approved documentation and the class-approved parameter list for the specific vessel.

UMS does not mean unmanned. A ship with an E0 or UMS notation is not an autonomous vessel. Engineering officers remain on board, remain on call 24 hours a day, and perform regular rounds of the machinery space. The notation means the space need not have a continuously present human observer: it does not mean the space is unsupervised or that engineering watch-keeping obligations are eliminated.

Remote monitoring data quality. Shore-based remote monitoring depends on the quality of the data transmitted from the vessel. Sensor calibration drift, incorrect alarm setpoints, and data transmission gaps all degrade the value of shore-based analysis. Remote monitoring supplements the on-board crew; it does not replace them.

Cybersecurity threat evolution. IACS UR E26 and E27 were written against the threat environment of 2022 to 2023. Cybersecurity threats evolve faster than regulatory cycles. The UR requirements represent a baseline, not a ceiling: a thorough risk assessment for a specific vessel’s operational profile may identify additional controls that are necessary but not yet mandatory.

See Also

• Marine Engine Performance Monitoring for cylinder pressure analysis, SFOC measurement, and exhaust gas temperature trending
• Marine Bridge Equipment and Integrated Bridge Systems for ECDIS, BNWAS, and bridge-automation integration
• BNWAS: Bridge Navigational Watch Alarm System for the navigator-side dead-man alarm regulatory basis
• Marine Auxiliary Engines and Generators for diesel generator design and maintenance
• Marine Electrical Generation and Distribution for switchboard, bus, and power distribution systems
• Marine Spare Parts and Maintenance Management for planned maintenance system integration
• SOLAS Chapter II-1: Construction, Subdivision and Stability for the full SOLAS Ch.II-1 text and structure
• Marine Fire Detection and Fixed Fire Fighting Systems for fire detection system design in UMS spaces
• Engine Room UMS / E0 Criteria Check
• BV AUT-UMS Calculator
• ABS ACCU Notation Calculator
• ABS AMS Notation Calculator
• DNV E0 Notation Calculator
• Automation Alarm Rate Calculator
• Bearing Temperature Alarm Calculator
• OWS Alarm 15 ppm Calculator
• IACS E26 Cybersecurity Calculator
• IACS E27 Cybersecurity Calculator
• Minimum Propulsion Power Calculator
• Planned Maintenance System Compliance Calculator
• BNWAS Watch Alarm Calculator
• SOLAS BNWAS Criteria Checker