WIXLIB

The main principle is that control system components shall be type approved and that control systems shall be -e---1.3 Type approval1.3.1 The main hardware components for essential and important control, monitoring and safety systemscovered by the rules of this chapter (see [1.4.2] guidance note) shall be type approved.Guidance note:The requirement normally applies to the following components:—controllers, PLC’s—I/O cards, communication cards—operator stations, computers—network switches, routers, firewalls—other components that may be essential for the control system functionality.Case-by-case approval of the components may, based on suitable documentation, be accepted as an alternative to the typeapproval.See IACS UR (E22, M3, M29, M44, M67) for type approval or documented evidence of compliance according to IACS UR .4 Required compliance documentation1.4.1 Essential and important control, monitoring and safety systems, as specified in the rules, shall meetthe required compliance documentation unless— exemption is given in a Society issued type approval certificate, or— the logic is simple, failure mechanisms easily understood and adequate assessment is possible during planapproval.The compliance documentation procedure consists of:1)plan approval— assessment of manufacturer documentation in accordance with the documentation requirements inthe rules— issuance of approval letter.2)manufacturing survey— visual inspection— verification/witness test of performance according to functional requirements based on approved testprograms— verification/witness test of failure mode behaviour— verification of implementation software quality plan covering life cycle activities, if applicable.3)issuance of compliance documentRules for classification: Ships — DNVGL-RU-SHIP Pt.4 Ch.9. Edition July 2020Control and monitoring systemsDNV GL ASPage 9Part 4 Chapter 9 Section 1Guidance note:

The plan approval normally includes case-by-case document assessment of each delivery, alternatively partly covered bytype approval as specified in class programme DNVGL-CP-0338 Type approval scheme, and class guideline DNVGL-CG-0339Environmental test specification for electrical, electronic and programmable equipment and systems.Manufacturers that are certified according to the approval of manufacturer (AoM) class program for 'System and softwareengineering' (see DNVGL-CP-0507) are considered as pre-qualified for the software development aspects of the manufacturingsurvey. The verification of the software quality plan is therefore omitted from the --1.4.2 The control, monitoring and safety systems that are required to be certified are given in the applicablerules.1.4.3 In addition to the specific certification requirements given in the various rules, the control, monitoringand safety systems listed in Table 2 shall be certified, if fitted.Table 2 Compliance documents required for control systemsObjectCompliancedocumenttypeIssued byMain alarm systemPCSocietyIntegrated control systemPCSocietyCompliancestandard*Additional description* Unless otherwise specified the compliance standard is the rules.Guidance note:For general compliance documentation requirements, see DNVGL-CG-0550 Sec.4.For a definition of the compliance document types, see DNVGL-CG-0550 Guidance Other control, monitoring and safety systems may, when found to have an effect on the safety of the ship, berequired to be certified.Guidance note:This may e.g. be different management systems, see definition in Table 3. For such systems, documentation according to Table 5shall be submitted for approval. During the approval, it will be decided whether or not certification is e---1.5 Software and hardware change handling1.5.1 The requirements in this section apply to software and hardware changes done after the certification,i.e. changes done after approval and issuance of the certificate.Guidance note:Manufacturers that are certified according to DNVGL-CP-0507 System and software engineering are considered pre-qualified forthe requirements of this t-e---1.5.2 Manufacturers or system suppliers shall maintain a system to track changes as a result of defectsbeing detected in hardware and software, and inform users of the need for modification in the event ofdetecting a defect.Rules for classification: Ships — DNVGL-RU-SHIP Pt.4 Ch.9. Edition July 2020Control and monitoring systemsDNV GL ASPage 10Part 4 Chapter 9 Section 1Guidance note:

1.5.4 Software versions shall be identifiable as required in Sec.4.1.5.5 A procedure for how to handle changes (e.g. corrections, modifications, upgrades) in both basic- andapplication software shall be submitted for approval when requested. The procedure shall describe how toensure traceability in the software change handling process for any changes that may be done after thecertification of the system. The general principles of a change handling procedure are illustrated in Figure 1.The procedure shall cover the necessary steps to ensure compliance with at least the following principles:— major modifications which may affect compliance with the rules shall be described and submitted to theSociety for evaluation before the change is implemented onboard— no modification shall be done without the acceptance and acknowledgment by the responsible person onboard— the modified system shall be tested and demonstrated for the responsible person on board— the modification shall be documented (including objective/reason, specification/description, impactanalysis, relevant authorizations, implementation and test procedure, relevant signatures and dates, newincremented SW revision etc.)— a test program for verification of correct installation and correct functioning of the applicable functionsshall be applied— in case the new software upgrade has not been successfully installed, the previous version of the systemshall be available for re-installation and re-testing.Figure 1 General principles of a change handling procedure.1.5.6 If the control system is intended for remote software support from outside the vessel (e.g. remotemaintenance), the functionality shall be described in the system documentation as required in Table 5.Rules for classification: Ships — DNVGL-RU-SHIP Pt.4 Ch.9. Edition July 2020Control and monitoring systemsDNV GL ASPage 11Part 4 Chapter 9 Section 11.5.3 Major changes or extensions in hardware or software of approved systems shall be describedand submitted for evaluation. If the changes are deemed to affect compliance with rules, more detailedinformation may be required submitted for approval and a survey may be required to verify compliance withthe rules.

— a particular procedure for the remote SW maintenance operation shall exist— no remote access or remote SW modification shall be possible without the acceptance andacknowledgement by the responsible person on board— the security of the remote connection shall be ensured by preventing unauthorized access, e.g. password,and other means of verification, and by protecting the data being transferred (e.g. by encryptionmethodologies)— before the updated software is put into realtime use, the integrity of the new software shall be verified byappropriate means— the remote session shall be logged in accordance with the above procedure for change handling, see[1.5.5].1.6 Assumptions1.6.1 The rules of this section are based on the assumptions that the personnel using the equipment to beinstalled on board are familiar with the use of, and able to operate this equipment.2 Definitions2.1 General termsTable 3 Definitions – General termsTermDefinitionalarmfor warning of an abnormal condition and is a combined visual and audible signal, wherethe audible part calls the attention of personnel, and the visual part serves to identify theabnormal conditionback-up control systemscomprise all equipment necessary to maintain control of essential functions required forthe craft's safe operation when the main control systems have failed or malfunctioned(HSC Code 11.1.2)includes all components necessary for control and monitoring, including sensors andactuators.control and monitoringsystemIn this section, the term or is short for control and monitoring system. A system includesall resources required, including:— the field instrumentation of one or more process segments— all necessary resources needed to maintain the function including system monitoringand adequate self-check— all user interfaces.is an alarm system, which shall be provided to operate from the engine control room orthe maneuvring platform, as appropriate, and shall be clearly audible in the engineers'accommodationengineers' alarmSee SOLAS Ch. II-1/38Guidance note:The engineers' alarm is normally an integrated part of the extension alarm system, but maybe a separate --Rules for classification: Ships — DNVGL-RU-SHIP Pt.4 Ch.9. Edition July 2020Control and monitoring systemsDNV GL ASPage 12Part 4 Chapter 9 Section 1The following requirements apply supplementary to [1.5.5], and shall be part of the procedure required in[1.5.5]:

essential control andmonitoring systemis the mechanical equipment (machinery, pumps, valves, etc.) or environment (smoke,fire, waves, etc.) monitored and/or controlled by a control and monitoring systemis a system which needs to be in continuous operation for maintaining the vessel'spropulsion and steering. Examples of services are given in Ch.8 Sec.13. Additional classnotations may extend the term essential services. Such extensions, if any, can be found inthe relevant rule sections (hereafter called essential system).Guidance note:The objective for an essential function is that it should be in continuous operation. Howeverthe rules do not in all respects fulfil this objective as single failures may lead to unavailabilityof a e---comprises all instrumentation that forms an integral part of a process segment to maintaina function.The field instrumentation includes:field instrumentation— sensors, actuators, local control loops and related local processing as required tomaintain local control and monitoring of the process segment— user interface for manual operation (when required).Other equipment items do not, whether they are implemented locally or remotely, belongto the field instrumentation. This applies to data communication and facilities for dataacquisition and pre-processing of information utilised by remote systems.important control andmonitoring systemis a system supporting services which need not necessarily be in continuous operationfor maintaining the vessel's manoeuvrability, but which are necessary for maintaining thevessels functions as defined in Pt.1 Ch.1 Sec.1 [1.2], or other relevant parts of the rules.Additional class notations may extend the term important services. Such extensions, ifany, can be found in the relevant rule sections (hereafter called important system).independent systemssee Sec.2 [1.2.1]is a combination of computer based systems which are interconnected in order to allowcommon access to sensor information and command/control functions.An integrated control system may contain any combination of monitoring, alarm, controland safety functions.Guidance note:integrated control systemA system containing only monitoring and alarm functions is normall

This document supersedes the July 2019 edition of DNVGL-RU-SHIP Pt.4 Ch.9. Numbering and/or title of items containing changes are highlighted in red colo