Failed Mill Start

The following incident resulted in a unit trip due to the rapid decay of final steam temperature which activated a protection system to guard the steam turbine against damage due to water carryover. The incident is chosen for a discussion of the disturbances that occurred due it showcasing a known “failed” mill-start trip event that is capable of leading to a sequence of events culminating in an eventual unit trip. The mill start failed in the sense that the mill initially fired correctly, but tripped within a short period after being put in service. There has been some expansion done as part of the already finalised internal investigation report for this event [36].

Figure 6: Failed Mill-Start and Trip at Low Steam Flow Rate

From Figure 6 it can be seen that A mill (magenta) starts firing at minimum loading while C mill (blue) is already in service which increases the total firing rate (red). There is also a corresponding increase in steam flow rate (cyan) and pressure (green), as the machines load is increased with the increase in firing and pressure build-up.

0 5 10 15 0 5 10 15 20 25 Time [min]

Steam Flow Rate [kg/s] Mill A [kg/s] Mill C [kg/s] Mill Total [kg/s] Steam Press [MPa]

37

Figure 7: Process and Control Response to Failed Mill Start

From Figure 7 it can be seen that the spray water valve (green) shows no initial response when mill firing is increased. After approximately a minute the controller respond due to the temperature increase in final steam (red). Then, due to an untimely mill trip, the mill loading is decreased again. This unfortunately coincides with the spray water valve position peaking. The heat energy transferred is then reduced once again to a similar rate as before the mill introduction. Now the superheater inlet temperature (black) is about 35 °C lower due to the control effort and the steam flow rate having increased. The final steam temperature will drop alarmingly due to these disturbance responses constructively interfering (constructive additive responses). The machine will trip on high rate of temperature decay protection.

The events occurred roughly 7 minutes apart and at 17-20 kg/s steam flow the first order time constant representing the system response is also about 7-9 minutes. Generally, the controller will have its peak reaction in terms of spray water response at this time. The quenching of the final steam temperature has just about started taking effect, evident by the arrested rate of increase. This response is still in its transient phase and will continue to drop towards the setpoint for at least another 7-9 minutes even if spray water valves were immediately closed fully. The general first order response of changes in firing would be as little as 3-5 minutes. This behaviour is explored more in 3.2. These transients will therefore align in dropping the final steam temperature drastically. 0 5 10 15 300 350 400 450 500 550 Time [min]

Spray Water Valve [%] Final SH Inlet Temp [°C] Final Steam Outlet Temp [°C] Hypothetical Response [°C]

0 50 100 %

38

A hypothetical response (magenta) is also shown on the trend that is based on the ratio change of fuel input (energy in) and steam flow rate (energy out). This hypothetical response does not take the closed loop negative feedback into account. Negative feedback still cannot react faster than the process delay permits. The hypothetical response only shows a feedforward element as it is expected to influence the process. It is also not meant to provide an analytical control solution to the event. A hypothetical response is constructed based on what a human operator would expect the control system to do, having perfect hindsight, more process variables at his disposal, and a estimated idea of how the system would respond. The controllers that will be designed and tested based on this knowledge will later be evaluated on this same event.

The hypothetical response proposes that the superheater inlet temperature setpoint should be decreased at the start of the mill firing increase and the response should increase again as soon as the mill trips. This should compensate for the heat energy imbalance that occurs. The transient should be much less severe and should not result in a unit trip. The ideal response also compensates for the reduction in the main steam flow rate that would have driven the temperature up even further. This drives the setpoint up as the steam flow increases. This provides a controller behaviour that is initially lowering the inlet temperature earlier, while the final steam temperature is rising. It then starts increasing the setpoint again as soon as steam flow rate increases, removing more energy. Again, when the mill trips it also increases the setpoint based on less energy being available. These transient conditions are all known and does not require waiting for a change in final steam temperature in order to respond.

A short discussion needs to be made here around concurrent controllers that maintain operation of other processes in the plant. An event, like the one analysed, does not easily occur without other process controllers also failing to control certain parameters. As one example; The unit coordinator is a controller that maintains an energy balance between the boiler and the turbine. If this balance is maintained, firing changes and steam flow rate are matched fairly quickly to avoid disturbances of many processes, including the final steam temperature. This controller can be seen from the response not to have been active at the time. This was due to operator error, but will not be discussed in more detail here. Incorrect or suboptimal operation of the steam temperature controller is therefore not at the root of this trip event. It is however analysed since it can be shown that despite this condition, the final steam temperature controller itself can react to

39

the same process parameters used by the unit coordinator. In this way a trip condition might be avoided, despite maloperation of other controllers or processes in the plant.