An auxiliary engine that trips is an inconvenience the standby unit picks up the load, and the ship carries on. A main engine that trips is a completely different kind of problem: a ship in a narrow channel, in heavy traffic, or in confined waters doesn’t get to simply “lose propulsion” without consequences.
That difference is exactly why main engine protection is built around a deliberately layered philosophy, rather than the simple logic you might expect. This post covers that layering alarm, slowdown, and shutdown the one trip that’s never allowed to be overridden, and the bridge override system that exists specifically because stopping the main engine can sometimes be more dangerous than the fault that triggered the alarm in the first place.
Three Tiers, Not One
Most main engine protection parameters aren’t simply “on or off.” They’re built around three distinct levels, each triggering a different response:
Tier | What happens | Purpose |
Alarm | Audible/visual warning,no automatic action on the engine itself | Alerts the watch that a parameter has moved outside normal range |
Slowdown | Engine speed/load automatically reduced | Buys time and reduces stress on the affected system without losing propulsion entirely |
Shutdown | Fuel cut off,engine stopped | Reserved for conditions where continued running presents immediate, serious danger |
That middle tier slowdown is doing a lot of the real work in this system. It’s the layer that lets the engine keep running, just less aggressively, while whoever’s on watch figures out what’s actually wrong, rather than jumping straight from “parameter out of range” to “no propulsion at all.”
This is the philosophy that makes the whole system make sense: SOLAS requires that shutdown of the propulsion system not be automatically activated except where it would avoid serious damage, complete breakdown, or explosion. Almost everything else defaults to a slowdown, or an alarm alone, specifically because an unplanned loss of propulsion is itself is a serious navigational hazard in a channel, during a port approach, or anywhere with traffic or limited sea room nearby.
A real incident makes this concrete: a vessel inbound in a channel had an automatic slowdown trigger from a cracked jacket cooling water cover on one unit. With traffic nearby, the crew activated the slowdown override to maintain manoeuvring way, cleared the traffic situation in consultation with the pilot, then brought the engine to stop in a controlled manner rather than letting the automatic system cut power immediately in a position where losing propulsion suddenly would have been considerably more dangerous than the actual mechanical fault.
That’s the whole point of the layered system in one example: the fault was real, but the automatic response needed a human judgment call layered on top of it, not a blind shutdown.
Every other automatic slowdown or shutdown can, by design, be overridden from the bridge; Overspeed is the one exception, and deliberately so.
An engine running away past its design speed risks a genuinely catastrophic mechanical failure : a flying piston, burst turbocharger, structural damage to rotating machinery all happening fast enough that there’s no useful window for a human judgment call in the moment. Unlike a slow temperature rise or a gradually falling pressure, overspeed is the one condition where the automatic trip has to win every time, with no override path available at all.
Exact set points vary by engine maker and class society, but every parameter on this list exists to guard against a specific, known failure mode not as a generic safety margin.
Parameter | Alarm / Slowdown / Shutdown | What it’s actually protecting against |
Main bearing / crankcase lube oil pressure | Low → Low-low (usually slowdown, rarely shutdown) | Insufficient oil pressure starves bearings of lubrication, leading to rapid wear or a wiped bearing under running load |
Jacket cooling water temperature | High → High-high | Overheating cylinder liners and cylinder heads, risking thermal distortion, cracking, and breakdown of the lubricating oil film |
Jacket cooling water pressure | Low → Low-low | A pressure drop signals a leak, pump failure, or blockage any of which leads directly to the overheating above if not caught early |
Piston cooling oil outlet temperature | High → High-high | Indicates the piston isn’t being adequately cooled internally, risking piston crown cracking or seizure against the liner |
Scavenge air temperature | High → High-high | Hot scavenge air reduces the air charge density reaching the cylinder, hurting combustion efficiency and raising the risk of a scavenge space fire from oil deposit ignition |
Scavenge air pressure | Low | Insufficient air for proper combustion, often pointing to a turbocharger or air cooler problem upstream |
Exhaust gas temperature (cylinder-to-cylinder deviation) | High deviation | A single cylinder running hotter than its neighbours points to a developing combustion or injection fault in that specific unit, before it becomes severe enough to damage the unit outright |
Turbocharger lube oil pressure | Low → Low-low | Turbocharger bearings run at very high speed with tight clearances; oil starvation here fails fast and can send metal debris into the intake or exhaust system |
Turbocharger overspeed | Shutdown (on some installations) | Protects against rotor flying apart at excessive speed |
Thrust bearing temperature | High → High-high | The thrust bearing carries the entire propeller thrust load; overheating here risks a failure that can let the shaft move axially and damage the engine or stern tube |
Fuel oil pressure | Low | Insufficient fuel pressure causes irregular injection, misfiring, and uneven cylinder loading |
Starting air pressure | Low | Confirms enough reserve air remains for a safe number of start attempts, particularly relevant before manoeuvring |
Control air pressure | Low | Loss of control air can affect governor response and various pneumatically actuated safety devices across the engine |
Axial vibration (shaft/thrust detector) | High | Excessive axial movement of the shaft line often signals a developing thrust bearing or coupling problem before temperature alone would show it |
Oil mist in crankcase (OMD) | High → Shutdown (maker-dependent) | Rising oil mist concentration is an early sign of a bearing running hot enough to vaporise oil a direct precursor to a crankcase explosion |
Engine overspeed | Shutdown, no override | A runaway engine risks catastrophic mechanical failure a flying piston, burst turbocharger, or structural damage within seconds |
Remote control system failure | Alarm only | Alerts the watch that automatic/remote control has been lost, requiring a changeover to local control rather than leaving the engine unmonitored by its normal control path |
Notice how rare an unconditional shutdown actually is on this list. Most parameters top out at a slowdown, precisely because the safety philosophy treats sudden loss of propulsion as its own hazard to be weighed against the mechanical risk of continuing to run.
A parameter and a set point don’t mean much without knowing what failure each one is actually standing guard over. Here’s the reasoning behind the ones most commonly covered:
Low oil pressure means bearings aren’t getting adequate film lubrication. Left unaddressed, this leads directly to bearing wipeout and, in severe cases, a crankcase explosion from the resulting heat. This is one of the few parameters that can reach shutdown level, since the consequence of ignoring it is severe and fast-developing.
Excessive jacket water temperature signals the cylinder liner and cylinder head aren’t being cooled adequately, risking thermal stress, cracking, and accelerated liner wear. A slowdown reduces heat generation immediately while the actual cooling fault is investigated.
Each piston’s cooling oil return temperature is a direct window into how well that specific unit’s piston crown is being cooled. A high reading on one cylinder specifically (rather than the whole engine) often points to a partially blocked telescopic pipe or restricted flow to that unit alone.
High scavenge air temperature reduces the density of air entering the cylinder, degrading combustion efficiency, and can also indicate a fouled or failing turbocharger/air cooler. It’s as much an efficiency and combustion-quality alarm as a protection alarm.
Rather than an absolute value, this compares each cylinder’s exhaust temperature against the others. A cylinder running noticeably hotter or cooler than its neighbours points to a combustion problem specific to that unit fuel valve, injection timing, or a mechanical fault well before it shows up as an absolute overheat.
Turbocharger bearings run at extremely high rotational speed, and oil starvation here fails far faster and more destructively than a main bearing would at the same relative oil pressure loss; a turbocharger bearing seizure can shed debris into both the intake and exhaust systems.
The thrust bearing is absorbing the full axial thrust of the propeller pushing back through the shaft. Overheating here threatens the one bearing standing between normal propulsion and the propeller shaft working its way axially into the engine itself.
Covered above as the one unconditional trip protecting against genuinely catastrophic rotating machinery failure with no safe window for a judgment call.
Detects oil mist concentration rising from a bearing running hot enough to vaporise oil, the classic precursor to a crankcase explosion. Treated as seriously as any alarm on the engine for exactly that reason.
A few more commonly fitted alarms worth knowing:-
The table above covers the parameters most commonly discussed when explaining the alarm/slowdown/shutdown tiers isn’t the complete list. A real main engine’s monitoring system covers considerably more ground, organised here by the system each alarm is actually protecting.
Alarm | Purpose |
Main/crankcase LO pressure low | Protects main and big-end bearings from running without adequate oil film |
Turbocharger LO pressure low | Protects turbocharger bearings, which run at very high rotational speed |
Turbocharger LO level low | Catches a developing leak or consumption problem before pressure itself drops |
Oil mist concentration high (OMD) | Early warning of a bearing overheating badly enough to vaporise oil a precursor to crankcase explosion |
Crankcase relief door lifted | Confirms a crankcase explosion relief event has actually occurred |
Cylinder lubricator no-flow / feed fault | Flags a lubricator unit or feed line that’s stopped delivering oil to a cylinder |
Alarm | Purpose |
Jacket cooling water temperature high | Warns of inadequate heat removal from the cylinder liner and head |
Jacket cooling water pressure/flow low | Catches a pump or circulation fault before temperature itself climbs |
Piston cooling oil/water outlet temperature high | Flags inadequate cooling at the piston, risking crown or ring damage |
Piston cooling flow low (per unit) | Identifies a specific cylinder with restricted or lost cooling flow |
Alarm | Purpose |
Fuel oil supply pressure low | Warns of inadequate fuel delivery, risking irregular combustion |
Fuel oil viscosity abnormal | Flags fuel outside the correct viscosity range for proper atomisation |
High-pressure fuel pipe leakage | Detects leakage into the double-wall space around high-pressure fuel lines, a known fire risk area |
Fuel rack/index at maximum | Signals the engine is being pushed toward or beyond its load limit |
Alarm | Purpose |
Scavenge air temperature high | Can indicate turbocharger fouling or declining charge air cooling |
Scavenge space temperature high (fire alarm) | Specifically detects a scavenge space fire, a distinct and serious hazard from general high temperature |
Exhaust gas temperature deviation (cylinder to cylinder) | Flags one cylinder running hotter or cooler than its neighbours, often an early combustion fault indicator |
Exhaust gas temperature after turbocharger high | Monitors overall turbocharger and combustion health downstream |
Starting air pressure low | Confirms enough reserve starting air remains for a reliable start |
Control air pressure low | Protects the pneumatic control functions the engine’s automation depends on |
Alarm | Purpose |
Thrust bearing temperature high | Protects the single bearing taking the full propulsive thrust load |
Axial/torsional vibration high | Flags developing shafting or torsional vibration damper problems |
Turning gear engaged interlock | Prevents a start attempt while turning gear is still meshed |
Alarm | Purpose |
Remote control system failure | Alerts that bridge or ECR control of the engine has been lost or degraded |
Governor/ECU failure | Flags a fault in the speed/fuel control system itself |
Reversing failure | Confirms a reversing sequence did not complete as commanded |
Emergency stop activated | Confirms when and from where an emergency stop was actually triggered |
This is still a representative organisation rather than a universal checklist; the exact parameter list, and which tier (alarm, slowdown, shutdown) each one triggers, is set by the specific engine manufacturer and the classification society’s approved safety system documentation for that vessel. Always treat the ship’s own approved alarm list as the authoritative reference.
Because a slowdown or shutdown happening at the wrong moment can itself be dangerous, SOLAS requires:
The override exists for exactly the scenario in the incident above: a real fault, but a moment where losing propulsion immediately would create a worse situation than continuing to run briefly under watch. It’s not a way to ignore the alarm it’s a deliberate, logged decision to accept a known mechanical risk for a limited time, in exchange for retaining manoeuvring capability through a dangerous moment.
A few structural features exist across virtually every main engine monitoring and alarm system, worth Knowing:
Main engine alarms and trips aren’t built around a single “stop the engine if something’s wrong” rule they’re built around a layered judgment call, baked into the automation itself: alarm first, slowdown as the default serious response, and shutdown reserved for the genuinely narrow set of conditions where continued running risks real damage or danger. Overspeed stands alone as the one trip nobody gets to override, for good reason. Everything else exists specifically so a human being, with better situational awareness than any sensor, can make the final call on whether retaining propulsion through a dangerous moment is worth accepting a known mechanical risk logged, alarmed, and deliberate, never silent.
An alarm is a warning with no automatic action on the engine. A slowdown automatically reduces engine speed or load while keeping it running. A shutdown cuts fuel and stops the engine entirely, reserved under SOLAS for conditions that would otherwise risk serious damage, complete breakdown, or explosion.
Because an unplanned loss of propulsion is itself a serious navigational hazard, particularly in confined waters or traffic. The override lets the bridge retain propulsion through a dangerous moment while accepting a known mechanical risk. Overspeed is excluded because a runaway engine can fail catastrophically within seconds, leaving no safe window for a human decision.
The override itself must be alarmed and logged, making it a deliberate, visible decision rather than something that happens silently. It temporarily suppresses the automatic slowdown or shutdown response (aside from overspeed) while the underlying fault condition still exists and continues to be monitored.
It’s the system’s ability to flag which alarm among several triggers first, when one fault cascades into multiple related alarms. This helps identify the actual root cause rather than treating every alarm in the cascade as an equally significant separate event.
Because doing so could mask a genuinely new and unrelated problem developing right after the first one was acknowledged. Alarm systems are specifically designed so that accepting one alert never suppresses the system’s ability to raise the next one.
Disclaimer :- The opinions expressed in this article belong solely to the author and may not necessarily reflect those of Merchant Navy Decoded. We cannot guarantee the accuracy of the information provided and disclaim any responsibility for it. Data and visuals used are sourced from publicly available information and may not be authenticated by any regulatory body. Reviews and comments appearing on our blogs represent the opinions of individuals and do not necessarily reflect the views of Merchant Navy Decoded. We are not responsible for any loss or damage resulting from reliance on these reviews or comments.
Reproduction, copying, sharing, or use of the article or images in any form is strictly prohibited without prior permission from both the author and Merchant Navy Decoded.
Decoded Discount Alert! up to 50% OFF
Decoded Discount Alert! up to 50% OFF
Use Coupon Code Deep50
