Sketch arrangement: Two identical hydraulic power units (motors/pumps) and control, each providing 50% of the full steering torque, arranged so that either unit alone can produce full rudder movement:

• Two separate hydraulic circuits (A and B), each with: a motor-driven pump, a control/telemotor unit, a 3-way directional (four-way) control valve, and connecting lines to a common or twin ram of the rudder actuator.
• The two rams (actually two hydraulic force/actuator cylinders or one cylinder with two pistons) are coupled so that both units act on the same rudder stock. Each unit is capable, on its own (one ram taking the load), of meeting SOLAS requirement for full rudder angle (35 deg port to 35 deg starboard) and speed from 35 to 30 deg in 28 seconds, and also to steer at max service speed.
• On failure/ tripping of one unit, the other unit automatically takes over (changeover is automatic to prevent loss of steering) and drives the ram to rams that are still pressurised (the non-faulty circuit), giving specified angle/speed from a single unit.
• Independent telemotor control for each unit with automatic changeover; power from independent electrical circuits/sources.

Description: This arrangement satisfies the single-failure criterion, i.e., if one power actuating system (one 50% unit) fails, the remaining unit continues to steer the ship with the required performance, and a failure within the control system or power supply of one set does not make the other set ineffective. The two units are cross-connected at the actuator so that they share a common rudder stock but are hydraulically independent.

• Run only at reduced but full-service capability: one unit gives the required rudder angle but at reduced actuating capacity; maintain reduced speed and manoeuvre with caution, expecting slower rudder rates.
• Confirm the automatic changeover/ manual changeover to the live unit is correct; ensure the failed unit is isolated (motor off, valves set) to hold pressure.
• Check the working (live) ram oil level/pressure and topping-up arrangement; the live ram must be kept full of oil to avoid cavitation and loss of power.
• Monitor the live unit temperature and take measures to prevent overheating of its pump/ motor; arrange cooling if needed.
• Keep the rudder stock centre/ area clear; do not obstruct steering.
• Because only one ram carries the load, the live ram and its actuating cylinder/ hanger must be checked for excessive temperature and vibration; avoid prolonged continuous operation at maximum angle.
• Keep a continuous watch on the steering, and if possible reduce to a manoeuvring condition, inform bridge and maintain emergency alarm readiness.
• Carry out a running test at the earliest safe opportunity to confirm the single-unit performance is available, and restore the second unit as soon as possible.

1. Simulation test (changeover test): Simulate failure of one unit (e.g. trip/main-fault the unit switch, or open its circuit) and verify that the other unit automatically supplies the full specified movement; check that the changeover is automatic and within time limits.
2. Functional/ operational test: With only one unit in service (the other isolated), drive the rudder from hard-over to hard-over and verify rudder angle and speed meet SOLAS (full 35 deg, and 35 to 30 deg in 28 s at service speed; and equivalent for the auxiliary steering).
3. Check the continuous/ manual control: verify both the main (telemotor/ electric control) and the emergency/ auxiliary control are able to operate the live unit.
4. Power supply test: Trip one power feeder (or remove one motor circuit) and verify the other unit remains energised and operates; confirm the automatic reconnection/ alternative source.
5. Alarm test: Confirm that failure of one side raises audible/visual alarms on the bridge and in the engine room/ steering flat.
6. Pressure and leak test: Run the emergency/main pump at load and confirm pressure build-up and no leakage at seals/rams/valves on the affected circuit.
7. Redundancy verification: Confirm by the arrangement that a fault in one control system does not prevent the operation of the other unit (operation of the second control if the first fails).