At six or eleven kilovolts, a fault does not wait for you to make a mistake twice. This chapter works through the reasoning behind each step of the access procedure, not just the sequence itself, and closes with three worked examples on sizing, testing and detection.
Ships used to run everything at a few hundred volts because that was simple and safe enough for the loads on board. That stopped being true once electric propulsion and large hotel loads pushed installed power into the megawatts. The relationship that forces the change is straightforward: for a balanced three-phase supply, power is the product of voltage, current and power factor (scaled by √3), so for a fixed power, current falls in direct proportion as voltage rises.
Current, not voltage, is what drives conductor size and I²R loss. Halving the current for the same power lets you halve the copper cross-section for the same current density, and because loss goes with the square of current, it cuts resistive loss to a quarter. Run the numbers up to a factor of fifteen — roughly the ratio between 440 V and 6.6 kV — and the loss difference for an identical cable becomes 225-fold, which is the kind of number that changes a ship's fuel bill and generator sizing, not just its cable schedule.
That saving comes at a cost: HV plant needs more insulation, more clearance, a more disciplined switching procedure, and it introduces the arc-flash hazard covered later in this chapter. Below a few megawatts of installed power, that overhead outweighs the saving and LV stays the sensible choice. Above it — large cruise ships, diesel-electric and gas-electric propulsion, drillships, some ice-going tonnage — the economics tip decisively toward 3.3, 6.6 or 11 kV distribution, with LV retained downstream of transformers for lighting, small motors and general services.
HV isn't chosen for its own sake — it's chosen because current, not voltage, is what costs you in copper and heat, and above a certain installed power the arithmetic stops being close.
LV distribution on board is normally an insulated (IT) system: neither line is deliberately connected to earth, so a single fault from one phase to the hull does not, by itself, create a return path large enough to trip anything or endanger anyone. The system carries on supplying power with one fault present — which matters when that supply is steering gear or navigation lighting — while an insulation monitoring device simply alarms so the fault can be found and cleared in an orderly way.
HV systems give that continuity up deliberately. The star point of an HV generator or transformer is connected to earth through a neutral earthing resistor (NER), sized to allow a controlled, limited current to flow the moment a single earth fault occurs, rather than none at all.
The reasoning is about what a fault at HV actually looks like. Left unearthed, or earthed too solidly, an arcing HV fault can either fail to draw enough current for protection to see it cleanly, or draw so much that the fault energy itself becomes destructive before anything can clear it. A resistor in the neutral path pins the fault current to a known, moderate value — large enough that time-graded protection can detect it selectively and trip only the faulted circuit, small enough that the fault doesn't turn into an uncontrolled arc flash or a burnt-out stator before the breaker opens. Continuity is traded for the certainty of a fast, selective, contained trip — the opposite emphasis from the LV philosophy, and the reason LV reasoning about riding through a single fault must not be carried across to HV plant.
The NER isn't there to stop current flowing in a fault — it's there to make sure the current that does flow is exactly the amount protection needs to find it, and nothing more.
The sequence — isolate, lock off, prove the tester, prove dead, prove the tester again, discharge, apply earths, and only then work — reads like a checklist, but every step is answering a specific way people have been killed.
Isolation means physically opening and securing the source of supply so it cannot be closed again by anyone else, by an automatic function, or by an out-of-step synchronising system — not simply switching off at a control desk, which can usually be undone from the same desk. Locking off, with a unique key or padlock held by the person doing the work, is what converts "switched off" into "isolated": nobody, including the person who opened the breaker, can now re-energise the circuit without deliberately defeating the lock.
Proving dead has to be done with an approved HV voltage indicator, and the tester itself is proved against a known live source immediately before and immediately after the test on the equipment — never just before. A tester that has failed internally, or whose lead has come adrift, reads exactly like a dead circuit; testing it against a proving unit afterwards is the only way to know the "dead" reading just taken was real and not a faulty instrument.
Discharging and earthing are kept as separate, later steps because a de-energised HV cable is not necessarily a safe one. Cable and winding capacitance stores real charge while the system is live, and that charge remains on the conductor after the supply breaker has opened, with no current flowing to reveal it. Discharging bleeds that stored energy off safely, and applying earths afterwards clamps the circuit at zero volts and gives any fault arriving from elsewhere on the system a solid path to trip on, rather than a path through whoever is working on it.
Every step in the sequence exists because the previous one, on its own, has fooled someone before — switched-off looked isolated, a dead reading looked trustworthy, and a de-energised cable looked safe to touch.
An authorised person is not simply someone who understands HV systems — it is a specific, written appointment, naming an individual for a particular vessel's HV installation, that gives them, and only them, the authority to operate HV switchgear, issue a permit to work, and accept an installation back into service afterwards. Competence and authorisation are different things: an ETO who thoroughly understands the switchboard but has not been formally appointed in writing has no more authority to operate it than a visitor.
The permit to work is the record that turns a verbal understanding into an unambiguous, checkable one. It identifies the plant by name, the points at which it has been isolated and locked, the earths that have been applied and where, the hazards the receiving person needs to know about, and a validity period. It is issued by the authorised person to the person who will actually do the work, and it is that same authorised person who cancels it and confirms the plant is clear before restoring supply — the loop is closed by the same authority that opened it.
The value of this formality is removing ambiguity at the one moment ambiguity is dangerous: when more than one person might reasonably believe someone else has already made the equipment safe. A permit that names names, plant, isolation points and earths in writing leaves no room for two people to each assume the other checked.
A permit doesn't make the plant safe — the isolation, proving and earthing do that. The permit's job is to make sure everyone agrees, in writing, that it's been done.
An insulation resistance tester applies a DC test voltage across the insulation and measures the resulting current, then simply divides one by the other. What makes the reading interesting is that the current it measures isn't one steady thing — it's the sum of three components that behave very differently over time: a capacitive charging current that dies away within the first second or two, a slower absorption current caused by polarisation within the insulating material itself, which can take many minutes to decay, and a steady leakage or conduction current flowing through any continuous path — moisture, carbon tracking, contamination — across or through the insulation.
In clean, dry insulation the absorption current keeps falling well past the first minute, so the measured resistance keeps climbing as the test goes on. In insulation that has absorbed moisture or picked up conductive contamination, the leakage component dominates from early on and the reading plateaus quickly. The polarisation index captures that shape rather than the absolute number, which is what makes it more diagnostic than a single-point reading on its own — a low reading could just mean a cold morning, but a reading that refuses to climb over ten minutes means something is actually wrong with the insulation.
HV machines are tested at a higher DC voltage than LV ones — 5 kV against 1 kV is typical — because the test needs to stress the insulation somewhere near the electrical stress it actually sees in service to be a meaningful check, not because a higher number is inherently more thorough. And because that test voltage has just charged the winding's own capacitance, the machine needs discharging and earthing afterwards exactly as it would after any HV switching operation, before anyone goes near the terminals.
PI is a measure of shape, not size — it tells you whether resistance kept improving over the test, which a single reading, however large, can't tell you on its own.
Arc flash is a different hazard from electric shock, and it's easy to under-rate because nothing has to be touched for it to hurt you. If a fault or a switching error strikes an arc through the air at HV, the arc itself has very low impedance, so the fault current flowing through it can be extremely high; that current, driven through an ionised air path, releases its energy in milliseconds as intense heat, a pressure wave, blinding light and molten metal thrown outward from the point of the fault. None of that requires contact with a live conductor — standing in front of an open panel when it happens is enough.
Switching operations are a disproportionate source of arc-flash incidents, because that's when a fault condition — a mechanism that hasn't fully closed, a residual fault on a circuit being energised, a maintenance error left behind — is most likely to be discovered by the switchgear itself. Racking a breaker in or out, closing onto a fault, or operating equipment with a door open all raise the exposure. The habits that manage the risk are correspondingly simple: keep switchgear doors and covers closed wherever the design allows switching without opening them, stand to the side rather than directly in front when operating a breaker, and treat the manufacturer's stated PPE requirements as genuine minimums rather than paperwork.
It's worth being clear that the neutral earthing resistor discussed earlier limits earth-fault current, but it does nothing for a phase-to-phase or three-phase arcing fault, which draws on the full fault level of the system. Arc-flash risk at HV switchgear is therefore a live consideration on every switching operation, not just a residual risk left over after an insulation failure.
Arc flash is a proximity hazard, not a contact one — the reason for standing clear and keeping doors shut is that the danger radiates outward from the fault; it doesn't wait to be touched.
The three examples below work through the numbers behind the ideas above: why current (and therefore loss) scales the way it does between LV and HV, how a polarisation index reading is actually judged, and how a neutral earthing resistor's value connects to whether protection will actually see a fault at the far end of the system.
A 3000 kW propulsion load at 0.85 power factor can be supplied either from a 6.6 kV HV switchboard or, hypothetically, from a 440 V LV switchboard. Find the full-load current in each case, and show how the I²R loss in an identical cable would compare between the two.
Propulsion load, P = 3000 kW Power factor, cos φ = 0.85 Option A: 6.6 kV three-phase supply Option B: 440 V three-phase supply Same conductor (same resistance per metre) assumed for the loss comparison
Find the full-load current in each case, and show how the I²R loss in an identical cable would compare between the two
Set up the current equation.
For a balanced three-phase load, power, voltage and current are related through P = √3·V·I·cos φ — the √3 comes from the geometry of a balanced three-phase system, not from anything voltage-specific. Rearranging for current gives I = P ÷ (√3·V·cos φ).
Calculate the full-load current at 6.6 kV.
Calculate the full-load current for the same load at 440 V.
Compare the two.
The voltage ratio is 6,600 ÷ 440 = 15, and current is inversely proportional to voltage for a fixed power and power factor, so the LV current should be exactly 15 times the HV current — which the figures above confirm. Cable I²R loss for a given conductor rises with the square of current, so carrying the same load at LV rather than HV would mean 15² times the copper loss in an identical cable.
AnswerAt 6.6 kV the load draws ≈308.7 A instead of ≈4,631 A at 440 V — and an identical cable carrying it would dissipate 225 times more heat at LV. This is the economic case for HV above a few megawatts.
The trap: forgetting the √3 (or the power factor) when converting between power and current for a three-phase system — it throws every downstream figure out by a consistent, easily-missed factor.
During a scheduled shutdown, an ETO carries out an insulation resistance test on a 6.6 kV, three-phase induction motor using a 5 kV DC megger, ahead of putting the machine back into service. Resistance is recorded at 1 minute and again at 10 minutes. Assess whether the winding is fit to re-energise.
Machine: 6.6 kV, three-phase induction motor Insulation resistance tester: 5 kV DC megger Resistance at 1 minute, R₁min = 200 MΩ Resistance at 10 minutes, R₁₀min = 500 MΩ Winding temperature steady throughout the test
Understand what's being measured.
The megger's reading climbs during the test because the current it detects is the sum of a fast-decaying capacitive charging current, a slower absorption current caused by polarisation of the insulating material, and a steady leakage/conduction current through any moisture or contamination. In clean, dry insulation the absorption current keeps falling well past one minute, so resistance keeps climbing; in damp or contaminated insulation, leakage dominates early and the reading plateaus.
Calculate the polarisation index.
Check the absolute value too.
A healthy shape can still sit on a low base number, so it's worth sanity-checking R₁min itself against the rule-of-thumb minimum some designers use for rotating machines — roughly the rated voltage in kV plus one, expressed in MΩ.
R₁min of 200 MΩ is well over an order of magnitude above that guideline figure.
And the PI of 2.5 clears the usual 2.0 threshold, so both checks agree the winding is dry and clean.
AnswerPI = 2.5 with R₁min = 200 MΩ — insulation is dry and clean; the motor may be released to re-energise.
The trap: walking away once the PI looks healthy — the megger has just charged the winding's own capacitance to 5 kV DC, so it must be discharged and earthed before anyone touches the terminals, exactly as after a switching operation.
A 6.6 kV three-phase system has its neutral earthed through a resistor (NER), designed to limit a solid earth fault at the switchboard to 400 A. Size the resistor, then check whether earth-fault protection (minimum pickup 40 A) will still detect a fault at the remote end of the longest feeder, where the fault-loop resistance adds a further 2.47 Ω.
System: 6.6 kV three-phase, neutral earthed through a resistor (NER) Design earth-fault current limit at the switchboard, I_limit = 400 A Additional fault-loop resistance to a remote feeder end, R_f = 2.47 Ω Earth-fault protection minimum pickup setting = 40 A
Size the resistor.
The NER sits between the star point and earth, so in a solid single-phase-to-earth fault it sees essentially the full phase voltage across it. Sizing it to the wanted limiting current gives its resistance.
Check detection at the far end of the system.
Not just at the switchboard. A fault at the remote end of a long feeder sees the NER in series with the resistance of the fault loop itself (cable plus arc), which reduces the current that actually flows.
317.5 A is still comfortably above the 40 A minimum pickup.
So the relay will operate even for the worst-case, highest-impedance fault location on this feeder — which is the whole point of choosing a limiting current in the first place: low enough to limit damage, high enough to stay detectable everywhere on the system.
AnswerR_NER ≈ 9.53 Ω; even at the remote end of the feeder the fault current is ≈317.5 A, well clear of the 40 A pickup setting — protection remains sensitive across the whole system.
The trap: checking only the fault current at the switchboard busbars and assuming it's representative — fault-loop impedance at the far end of the longest feeder is what actually tests whether the protection settings are sensitive enough.
HV = above 1 kV3.3 / 6.6 / 11 kV typical on boardP = √3·V·I·cos φSame power, ×15 voltage → ÷15 currentR_NER = V_phase ÷ I_fault(limit)Sizes the neutral earthing resistorProve tester → test → prove testerConfirms the instrument, not just the circuitIsolate ≠ switch offIsolation is proven, locked and earthedDischarge before earthingCable/winding capacitance holds a charge after supply is removedIR test: 5 kV for HV machines, 1 kV for LVTest voltage matched to service stressPI = R₁₀min ÷ R₁min≥ 2 indicates dry, clean insulationPermit to work names one authorised personRemoves ambiguity over who controls the isolationArc flash ≠ shock hazardBurn/blast risk exists without contact