The gas turbine protection system is comprised of a number of sub–systems, several of which operate during each normal start–up and shutdown. The oth-er systems and components function strictly during emergency and abnormal operating conditions. The most common kind of failure on a gas turbine is the failure of a sensor or sensor wiring; the protection systems are set up to detect and alarm such a failure.
If the condition is serious enough to disable the protection completely, the turbine will be tripped.
Protective systems respond to the simple trip signals such as pressure switches used for low lube oil pres-sure, high gas compressor discharge prespres-sure, or similar indications. They also respond to more com-plex parameters such as overspeed, overtempera-ture, high vibration, combustion monitor, and loss of flame. To do this, some of these protection systems and their components operate through the master control and protection circuit in the SPEEDTRON-IC control system, while other totally mechanical systems operate directly on the components of the turbine. In each case there are two essentially inde-pendent paths for stopping fuel flow, making use of both the fuel control valve (FCV) and the fuel stop valve (FSV). Each protective system is designed in-dependent of the control system to avoid the
possi-GE Power Systems
FUNDAMENTALS OF SPEEDTRONIC 26 MARK VI CONTROL SYSTEM
Fund_Mk_VI
bility of a control system failure disabling the protective devices. See Figure 25.
VIBRATION
PROTECTION GAS FUEL
CONTROL VALVE
Figure 25 Protective Systems Schematic
id0036V
A hydraulic trip system called Trip Oil is the primary protection interface between the turbine control and protection system and the components on the tur-bine which admit, or shut–off, fuel. The system con-tains devices which are electrically operated by SPEEDTRONIC control signals as well as some to-tally mechanical devices.
Besides the tripping functions, trip oil also provides a hydraulic signal to the fuel stop valves for normal start–up and shutdown sequences. On gas turbines equipped for dual fuel (gas and oil) operation the system is used to selectively isolate the fuel system not required.
Significant components of the Hydraulic Trip Cir-cuit are described below.
Inlet Orifice
An orifice is located in the line running from the bearing header supply to the trip oil system. This ori-fice is sized to limit the flow of oil from the lube oil system into the trip oil system. It must ensure ade-quate capacity for all tripping devices, yet prevent reduction of lube oil flow to the gas turbine and other equipment when the trip system is in the tripped state.
Dump Valve
Each individual fuel branch in the trip oil system has a solenoid dump valve (20FL for liquid, 20FG for gas). This device is a solenoid–operated spring–re-turn spool valve which will relieve trip oil pressure only in the branch that it controls. These valves are normally energized–to–run, deenergized–to–trip.
This philosophy protects the turbine during all
nor-GE Power Systems
27 FUNDAMENTALS OF SPEEDTRONIC MARK VI CONTROL SYSTEM
Fund_Mk_VI
mal situations as well as that time when loss of dc power occurs.
Figure 26 Trip Oil Schematic – Dual Fuel
id0056 STOP VALVE
Check Valve & Orifice Network
At the inlet of each individual fuel branch is a check valve and orifice network which limits flow out of that branch. This network limits flow into each branch, thus allowing individual fuel control with-out total system pressure decay. However, when one of the trip devices located in the main artery of the system, e.g., the overspeed trip, is actuated, the check valve will open and result in decay of all trip pressures.
Pressure Switches
Each individual fuel branch contains pressure switches (63HL–1,–2,–3 for liquid, 63HG–1,–2,–3 for gas) which will ensure tripping of the turbine if the trip oil pressure becomes too low for reliable op-eration while operating on that fuel.
Operation
The tripping devices which cause unit shutdown or selective fuel system shutdown do so by dumping the low pressure trip oil (OLT). See Figure 26. An
in-dividual fuel stop valve may be selectively closed by dumping the flow of trip oil going to it. Solenoid valve 20FL can cause the trip valve on the liquid fuel stop valve to go to the trip state, which permits clo-sure of the liquid fuel stop valve by its spring return mechanism. Solenoid valve 20FG can cause the trip valve on the gas fuel speed ratio/stop valve to go to the trip state, permitting its spring–returned closure.
The orifice in the check valve and orifice network permits independent dumping of each fuel branch of the trip oil system without affecting the other branch. Tripping all devices other than the individu-al dump vindividu-alves will result in dumping the totindividu-al trip oil system, which will shut the unit down.
During start–up or fuel transfer, the SPEEDTRON-IC control system will close the appropriate dump valve to activate the desired fuel system(s). Both dump valves will be closed only during fuel transfer or mixed fuel operation.
The dump valves are de–energized on a “2–out–
of–3 voted” trip signal from the relay module. This helps prevent trips caused by faulty sensors or the failure of one controller.
GE Power Systems
FUNDAMENTALS OF SPEEDTRONIC 28 MARK VI CONTROL SYSTEM
Fund_Mk_VI
The signal to the fuel system servovalves will also be a “close” command should a trip occur. This is done by clamping FSR to zero. Should one control-ler fail, the FSR from that controlcontrol-ler will be zero.
The output of the other two controllers is sufficient to continue to control the servovalve.
By pushing the Emergency Trip Button, 5E P/B, the P28 vdc power supply is cut off to the relays control-ling solenoid valves 20FL and 20FG, thus de–ener-gizing the dump valves.
Overspeed Protection
The SPEEDTRONIC Mark VI overspeed system is designed to protect the gas turbine against possible damage caused by overspeeding the turbine rotor.
Under normal operation, the speed of the rotor is controlled by speed control. The overspeed system would not be called on except after the failure of oth-er systems.
The overspeed protection system consists of a pri-mary and secondary electronic overspeed system.
The primary electronic overspeed protection system resides in the <RST> controllers. The secondary electronic overspeed protection system resides in the <XYZ> controllers (in <VPRO>). Both systems consist of magnetic pickups to sense turbine speed, speed detection software, and associated logic cir-cuits and are set to trip the unit at 110% rated speed.
Electronic Overspeed Protection System
The electronic overspeed protection function is per-formed in both <RST> and <XYZ> as shown in Fig-ure 27. The turbine speed signal (TNH) derived from the magnetic pickup sensors (77NH–1,–2, and –3) is compared to an overspeed setpoint (TNKHOS).
When TNH exceeds the setpoint, the overspeed trip signal (L12H) is transmitted to the master protective circuit to trip the turbine and the “OVERSPEED TRIP” message will be displayed on the <HMI>.
This trip will latch and must be reset by the master reset signal L86MR.
TNKHOS SET
AND LATCH
RESET HIGH PRESSURE OVERSPEED TRIP HP SPEED
TNH A
A>B B
<RST> <XYZ>
Figure 27 Electronic Overspeed Trip
TNKHOST SAMPLING RATE = 0.25 SEC
L12H TO MASTER PROTECTION
AND ALARM MESSAGE
id0060
Overtemperature Protection
The overtemperature system protects the gas turbine against possible damage caused by overfiring. It is a backup system, operating only after the failure of the temperature control system.
Figure 29 Overtemperature Protection
id0053
Under normal operating conditions, the exhaust temperature control system acts to control fuel flow when the firing temperature limit is reached. In cer-tain failure modes however, exhaust temperature and fuel flow can exceed control limits. Under such circumstances the overtemperature protection sys-tem provides an oversys-temperature alarm about 14° C (25° F) above the temperature control reference. To avoid further temperature increase, it starts unload-ing the gas turbine. If the temperature should in-crease further to a point about 22° C (40° F) above the temperature control reference, the gas turbine is tripped. For the actual alarm and trip
overtempera-GE Power Systems
29 FUNDAMENTALS OF SPEEDTRONIC MARK VI CONTROL SYSTEM
Fund_Mk_VI
ture setpoints refer to the Control Specifications.
See Figure 29.
Overtemperature trip and alarm setpoints are deter-mined from the temperature control setpoints derived by the Exhaust Temperature Control soft-ware. See Figure 30.
TTKOT3
TTKOT2
TTKOT1 TRIP ISOTHERMAL SET
AND
TRIP TO MASTER PROTECTION AND ALARM MESSAGE ALARM
OVERTEMPERATURE TRIP AND ALARM
SAMPLING RATE: 0.25 SEC.
TTXM
Figure 30 Overtemperature Trip and Alarm
Overtemperature Protection Software
Overtemperature Alarm (L30TXA)
The representative value of the exhaust temperature thermocouples (TTXM) is compared with alarm and trip temperature setpoints. The “EXHAUST TEM-PERATURE HIGH” alarm message will be dis-played when the exhaust temperature (TTXM) exceeds the temperature control reference (TTRXB) plus the alarm margin (TTKOT3) programmed as a Control Constant in the software. The alarm will au-tomatically reset if the temperature decreases below the setpoint.
Overtemperature Trip (L86TXT)
An overtemperature trip will occur if the exhaust temperature (TTXM) exceeds the temperature con-trol reference (TTRXB) plus the trip margin (TTKOT2), or if it exceeds the isothermal trip set-point (TTKOT1). The overtemperature trip will latch, the “EXHAUST OVERTEMPERATURE TRIP” message will be displayed, and the turbine
will be tripped through the master protection circuit.
The trip function will be latched in and the master re-set signal L86MR1 must be true to rere-set and unlatch the trip.
Flame Detection and Protection System
The SPEEDTRONIC Mark VI flame detectors per-form two functions, one in the sequencing system and the other in the protective system. During a nor-mal start–up the flame detectors indicate when a flame has been established in the combustion cham-bers and allow the start–up sequence to continue.
Most units have four flame detectors, some have two, and a very few have eight. Generally speaking, if half of the flame detectors indicate flame and half (or less) indicate no–flame, there will be an alarm but the unit will continue to run. If more than half in-dicate loss–of–flame, the unit will trip on “LOSS OF FLAME.” This avoids possible accumulation of an explosive mixture in the turbine and any exhaust heat recovery equipment which may be installed.
The flame detector system used with the SPEED-TRONIC Mark VI system detects flame by sensing ultraviolet (UV) radiation. Such radiation results from the combustion of hydrocarbon fuels and is more reliably detected than visible light, which va-ries in color and intensity.
The flame sensor is a copper cathode detector de-signed to detect the presence of ultraviolet radiation.
The SPEEDTRONIC control will furnish +24Vdc to drive the ultraviolet detector tube. In the presence of ultraviolet radiation, the gas in the detector tube ionizes and conducts current. The strength of the current feedback (4 – 20 mA) to the panel is a pro-portional indication of the strength of the ultraviolet radiation present. If the feedback current exceeds a threshold value the SPEEDTRONIC generates a logic signal to indicate ”FLAME DETECTED” by the sensor.
The flame detector system is similar to other protec-tive systems, in that it is self–monitoring. For exam-ple, when the gas turbine is below L14HM all channels must indicate “NO FLAME.” If this condi-tion is not met, the condicondi-tion is annunciated as a
GE Power Systems
FUNDAMENTALS OF SPEEDTRONIC 30 MARK VI CONTROL SYSTEM
Fund_Mk_VI
“FLAME DETECTOR TROUBLE” alarm and the turbine cannot be started. After firing speed has been reached and fuel introduced to the machine, if at least half the flame detectors see flame the starting sequence is allowed to proceed. A failure of one de-tector will be annunciated as “FLAME DETECTOR TROUBLE” when complete sequence is reached
and the turbine will continue to run. More than half the flame detectors must indicate “NO FLAME” in order to trip the turbine.
Note that a short–circuited or open–circuited detec-tor tube will result in a “NO FLAME” signal.
28FD SPEEDTRONIC Mk VI Flame Detection
NOTE: Excitation for the sensors and signal processing is performed by SPEEDTRONIC Mk VI circuits
28FD
Figure 31 SPEEDTRONIC Mk VI Flame Detection TBAI
VAIC
Vibration Protection
The vibration protection system of a gas turbine unit is composed of several independent vibration chan-nels. Each channel detects excessive vibration by means of a seismic pickup mounted on a bearing housing or similar location of the gas turbine and the driven load. If a predetermined vibration level is
ex-ceeded, the vibration protection system trips the tur-bine and annunciates to indicate the cause of the trip.
Each channel includes one vibration pickup (veloc-ity type) and a SPEEDTRONIC Mark VI amplifier circuit. The vibration detectors generate a relatively low voltage by the relative motion of a permanent magnet suspended in a coil and therefore no excita-tion is necessary. A twisted–pair shielded cable is
GE Power Systems
31 FUNDAMENTALS OF SPEEDTRONIC MARK VI CONTROL SYSTEM
Fund_Mk_VI
used to connect the detector to the analog input/out-put module.
The pickup signal from the analog I/O module is in-putted to the computer software where it is compared with the alarm and trip levels pro-grammed as Control Constants. See Figure 32.
When the vibration amplitude reaches the pro-grammed trip set point, the channel will trigger a trip signal, the circuit will latch, and a “HIGH VIBRA-TION TRIP” message will be displayed. Removal of the latched trip condition can be accomplished only by depressing the master reset button (L86MR1) when vibration is not excessive.
FAULT
AUTO OR MANUAL RESET L86AMR
Figure 32 Vibration Protection
id0057 L39TEST
When the “VIBRATION TRANSDUCER FAULT”
message is displayed and machine operation is not interrupted, either an open or shorted condition may be the cause. This message indicates that mainte-nance or replacement action is required. With the
<HMI> display, it is possible to monitor vibration levels of each channel while the turbine is running without interrupting operation.
Combustion Monitoring
The primary function of the combustion monitor is to reduce the likelihood of extensive damage to the gas turbine if the combustion system deteriorates.
The monitor does this by examining the exhaust temperature thermocouples and compressor dis-charge temperature thermocouples. From changes that may occur in the pattern of the thermocouple readings, warning and protective signals are gener-ated by the combustion monitor software to alarm and/or trip the gas turbine.
This means of detecting abnormalities in the com-bustion system is effective only when there is in-complete mixing as the gases pass through the turbine; an uneven turbine inlet pattern will cause an uneven exhaust pattern. The uneven inlet pattern could be caused by loss of fuel or flame in a combus-tor, a rupture in a transition piece, or some other combustion malfunction.
The usefulness and reliability of the combustion monitor depends on the condition of the exhaust thermocouples. It is important that each of the ther-mocouples is in good working condition.
Combustion Monitoring Software
The controllers contain a series of programs written to perform the monitoring tasks (See Combustion Monitoring Schematic Figure 33). The main moni-tor program is written to analyze the thermocouple readings and make appropriate decisions. Several different algorithms have been developed for this depending on the turbine model series and the type of thermocouples used. The significant program constants used with each algorithm are specified in the Control Specification for each unit.
GE Power Systems
FUNDAMENTALS OF SPEEDTRONIC 32 MARK VI CONTROL SYSTEM
Fund_Mk_VI
COMBUSTION MONITOR ALGORITHM
MEDIAN
Figure 33 Combustion Monitoring Function Algorithm (Schematic)
The most advanced algorithm, which is standard for gas turbines with redundant sensors, makes use of the temperature spread and adjacency tests to differ-entiate between actual combustion problems and thermocouple failures. The behavior is summarized by the Venn diagram (Figure 34) where:
TRIP IF S1 & S2
ALSO TRIP IF:
Figure 34 Exhaust Temperature Spread Limits
id0050
Sallow is the “Allowable Spread”, based on aver-age exhaust temperature and compressor dis-charge temperature.
S1, S2 and S3 are defined as follows:
a. SPREAD #1 (S1): The difference between the highest and the lowest thermocouple reading b. SPREAD #2 (S2): The difference between the highest and the 2nd lowest thermocouple reading
c. SPREAD #3 (S3): The difference between the highest and the 3rd lowest thermocouple reading
The allowable spread will be between the limits TTKSPL7 and TTKSPL6, usually 17° C 〈30° F) and 53° C (125° F). The values of the combustion moni-tor program constants are listed in the Control Speci-fications.
The various controller processor outputs to the
<HMI> cause alarm message displays as well as ap-propriate control action. The combustion monitor outputs are:
Exhaust Thermocouple Trouble Alarm (L30SPTA)
If any thermocouple value causes the largest spread to exceed a constant (usually 5 times the allowable
GE Power Systems
33 FUNDAMENTALS OF SPEEDTRONIC MARK VI CONTROL SYSTEM
Fund_Mk_VI
spread), a thermocouple alarm (L30SPTA) is pro-duced. If this condition persists for four seconds, the alarm message “EXHAUST THERMOCOUPLE TROUBLE” will be displayed and will remain on until acknowledged and reset. This usually indicates a failed thermocouple, i.e., open circuit.
Combustion Trouble Alarm (L30SPA)
A combustion alarm can occur if a thermocouple value causes the largest spread to exceed a constant (usually the allowable spread). If this condition per-sists for three seconds, the alarm message “COM-BUSTION TROUBLE” will be displayed and will remain on until it is acknowledged and reset.
High Exhaust Temperature Spread Trip (L30SPT)
A high exhaust temperature spread trip can occur if:
“COMBUSTION TROUBLE” alarm exists, the second largest spread exceeds a constant (usual-ly 0.8 times the allowable spread), and the low-est and second lowlow-est outputs are from adjacent thermocouples
“EXHAUST THERMOCOUPLE TROUBLE”
alarm exists, the second largest spread exceeds a constant (usually 0.8 times the allowable spread), and the second and third lowest outputs are from adjacent thermocouples
the third largest spread exceeds a constant (usu-ally the allowable spread) for a period of five minutes
If any of the trip conditions exist for 9 seconds, the trip will latch and “HIGH EXHAUST TEMPERA-TURE SPREAD TRIP” message will be displayed.
The turbine will be tripped through the master pro-tective circuit. The alarm and trip signals will be dis-played until they are acknowledged and reset.
Monitor Enable (L83SPM)
The protective function of the monitor is enabled when the turbine is above 14HS and a shutdown sig-nal has not been given. The purpose of the “enable”
signal (L83SPM) is to prevent false action during normal start–up and shutdown transient conditions.
When the monitor is not enabled, no new protective actions are taken. The combustion monitor will also
When the monitor is not enabled, no new protective actions are taken. The combustion monitor will also