185 MW Emergency Trip System ETS 1

[wayuu1981]

Hello,

The company where I work is hiring a Chinese EPC Contractor for a new 164 net MW, CFB Boiler coal fired utility (185 gross MW), the turbine will be condensing type with reheat, 3600 rpm, HP-IP-LP sections, all directly coupled to generator.

We have many steam turbines in operation, manufactured by companies such as Mitsubishi, Westinghouse and KWU, but all of them are more than 20 years old.

For the new plant, we requested turbine mechanical protections, in addition to other electrical and/or electronic protections in the control system; these mechanical protections will trip the turbine in case of low vacuum, overspeed, high thrust and low oil pressure and will be set to operate only if the other protections fail.

We requested these mechanical protections because we have them in our "old" plants, but the EPC Contractor says that they are not needed and no new turbines use them anymore, is that true? Can our company rely the turbine safety only on the electronic devices (the turbines I know have both). By the way, I'm a mechanical engineer so I'm not familiar with such electronic devices; I'm only concerned about keeping or not the mechanical devices.

Thanks in advance for your help.

Javier Guevara E.
Projects, Mechanical Engineer

 

[ScottyUK]

A mechanical overspeed trip is the last line of defence (except maybe the control room blast wall). In my opinion you would have to be crazy not to use one.

The others... I'm used to mechanical devices such as switches providing those functions, and tripping the unit by dumping the EH oil pressure. No electronics involved there. The turbine control system would usually attempt to perform some mitigating action, but it was under-pinned by a simpler system of relays, levers, and valves if it lost control.


----------------------------------

If we learn from our mistakes I'm getting a great education!

 

[byrdj]

The removal of the emergancy govenor (over speed trip) is one of the last mechanical hold outs I will have to give up on. Yes, they are doing away with the mechanical emergancy governor and the insurance companies agree.

However, I would question the trip times to ensure that the time it takes to trip will protect the unit from damage. Assuming an acceleration of 10%per second on load reject, a few 100 msec is a lot of speed. I even get the impression that the old standard of the primary governor should prevent OST has been overlooked and they recomend the all electronic trip set lower

 

[stgrme]

Electronic trips are reliable and are quite common on new turbine-generators. However, you need redundancy in your trips.

For overspeed, I suggest that you use one electronic overspeed trip and one mechanical overspeed trip, or two electronic overspeed trips. If you use two electronic overspeed trips, ensure that the two trip trains (circuits) are independent.

As for the other trips, I suggest redundant trips, or two-out-of-three logic.

Best of luck!

 

[JJPellin]

We no longer allow mechanical overspeed systems on new turbines. They are a risk of false trip and provide little or no additional protection. An API ovderspeed trip system is tripple redundant and fail-safe. The speed governor will also include overspeed trip protection which is fully independent of the overspeed trip system. The mechanical system is a false sense of security and a risk of unnecessary trip. I would not allow a new, critical steam turbine to come into the plant with a mechanical trip system. A typical mechanical system on a steam turbine is not fully independant. I uses an oil dump valve to trip the same valve as the electronic system. So, if you had a failure in that valve, you would still have no protection. Even for existing older turbine, we expect to convert all of them to fully electronic systems over the next decade or so.

Johnny Pellin

 

[ccfowler]

A most interesting and enlightening discussion. Being a certified geezer, I admit to instinctively favoring ScottyUK's and byrdj's recommendations, but I have seen some less-than-perfectly maintained trip governors (on auxiliary turbines--not main turbines). These troubled (and troublesome) trip governors could (and did) cause some serious operational problems during troubled circumstances. The primary problems arose from trip governor mechanical designs that almost encouraged unintentionally improper adjustments or repairs. I have never seen any such problems with trip governors on main turbines.

No small part of my skepticism regarding electronic controls arises from their apparent tendency to go from "leading-edge, state-of-the-art" to "obsolete" while being transported from their manufacturing facility to their intended installation site.

In balance, I would want to take a careful look and the whole steam cycle design, the "directly connected" auxiliary load, the control system design (and logic), overspeed tolerance of the turbine, and the plant's function and needs before deciding on whether or not a mechanical trip governor should be included or need not be included. Elimination of the mechanical trip governor on smaller turbines probably make a great deal of sense. The subject 185 MW turbine is definitely in the size range where I would want to be very cautious about eliminating the mechanical trip governor as a last-line-of-defense. The inclusion of electronic trip governor functions is certainly an excellent idea to minimize the risk of a "full-blown trip" when a "controlled excursion" could be made possible by electronic control functions.

Admittedly knowing nothing of the subject plant design beyond the initial posting, I am inclined to speculate that it is likely to have enough "stored energy" within the cycle components (boiler drums, piping, feedwater heaters, ...) and a sufficiently modest directly connected auxiliary load (powered from the generator side of the main breaker) that serious overspeed is likely in case of an episode of full load rejection. Electonic controls could serve to avoid a full-blown trip by proactively popping power relief valves to dump enough stored energy keep the turbine within its tolerable speed range. By doing this, the generator can be either reasonably quickly be re-synchronized and restored to operation or else be shut down in an orderly manner.

Valuable advice from a professor many years ago: First, design for graceful failure. Everything we build will eventually fail, so we must strive to avoid injuries or secondary damage when that failure occurs. Only then can practicality and economics be properly considered.

 

[ScottyUK]

Many of the big machines have a number of independant systems:
[li]the main electronic control system which has control of both the governors and main stop valves, plus a solenoid valve on the EH system which dumps oil back the the reservoir;[/li]
[li]An independent electronic system which can dump the EH oil pressure;[/li]
[li]A mechanical flyweight and striker asseembly which dumps the EH oil pressure.[/li]
The main control system typically has a two stage response to an overspeed event, depending on how fast the speed is rising and how high it rises:
[li]Command the the governors to rapidly close, leaving the MSVs open, until the speed decays to a value near sync idle at which point the governors open up a little to leave the machine ready to re-synchronise. This is not a turbine 'trip' and normally occurs in response to a load dump (full load rejection) event.[/li]

[li]Dump the EH oil pressure, tripping the unit.[/li]

There are probably major differences in volve arrangements between big utility class machines and auxiliary drive machines such as Johnny works with. The large units may have eight governors and two or four main stops, plus interceptor valves for reheat, all controlled by one system.


----------------------------------

If we learn from our mistakes I'm getting a great education!

 

[byrdj]

another aspect of the all electic, multipe channel trip logic "front standards" designs that I have observed, the design is to be trip tolerant, that is don't trip if only one channel indicates. In order to achieve this logic, the ETS header pressure is drained, but the supply is not isolated. In one particulair design, the orificed supplied was adjustable.

An aurgument that I just used that did not go over to well when discussing replacement of a mechanical/hydrualic TBWD trip with Prox probs
"The discussion about replacing with BN is somewhat depressing, how can any one think a piece of thread rod with a plactic cap and wires out the back is as beautiful as the piston follower, pilot valve sensing device. Add to that a motor driven remote testing gear box and you are replacing a work of art"

 

[JJPellin]

My experience with (relatively) smaller turbines (<20,000 HP) adds one more reason to eliminate the mechanical overspeed trip system. If it has a mechanical system, then it must be tested. Testing to overspeed with the mechanical system adds risk that is not otherwise necessary. But, the level of complexity and sophistication described in some of the previous replies is beyond my experience and I will defer to the experts in those areas.

Johnny Pellin

 

[rmw]

CCFowler,

The wife had to come into the room and see what I was laughing so loudly about while reading your post.

"..troubled circumstances.." succinctly put, in a nut-shell.

Your second paragraph may be the real indictment of modern electronics. No mechanical system goes obsolete, or has a "card" or "board" go bad. But many have suffered as you described.

There is no perfect solution.

rmw

 

[ccfowler]

JJPellin,

Mechanical trip governors can be satisfactorily tested on a test stand. There is no need to over-speed the turbine to test the trip governor.

As I indicated earlier, I am less than thrilled with the configuration of some of the mechanical trip governors that I have seen on turbines of the size range that are of greatest concern to you. I do not need to stretch my imagination to understand the nature of your reasons for avoiding troublesome devices. Indeed, I tend to agree with your position.

I've had more than enough practical experience with electronics (good, bad, and indifferent) to be thoroughly impressed with their many benefits and their many problems. With steam turbines of substantially larger size (50 MW +), I like the idea of plenty of redundant systems, but I would still prefer to keep the mechancal trip governor for the rare times when all the nifty electronics manage to develop their little case of "hiccups" or "sniffles."

I have found the "N + 1 rule" for computer systems to be the most important one. This applies in the general form of "if you have N backups, when it really matters, you really need to have had N + 1 backups." The mechanical trip governor on a main turbine provides that ever-so-important "+ 1."

It is one thing to see an auxiliary turbine system come unglued, and quite another to see a main turbine come apart. I've seen both, and the reality is that "bigger is much badder!" No mechanical disaster is desirable, but bigger ones are much less desirable.

Valuable advice from a professor many years ago: First, design for graceful failure. Everything we build will eventually fail, so we must strive to avoid injuries or secondary damage when that failure occurs. Only then can practicality and economics be properly considered.

 

[ccfowler]

I should clarify my previous post a bit. None of the turbine damage episodes were the result of overspeed, just something (usually metallurgical) going bad at normal speed. Still the damage was most impressive in all cases.

I've known many cases where all of the more elegant controls for turbine speed failed to quite keep the situation in proper order, and the mechanical trip governor served its proper role of avoiding catastrophic consequences. Usually, the more elegant controls were able to keep things in good order, but in the cases where they were not quite up to the task, there was always a significant number of people present (everyone in the potential danger zone plus everyone cogizant of the potential consequences) who were thoroughly relieved that the mechanical trip governor was on duty and utterly reliable in performing its function. Yes, much commotion and extra work followed the trips, but everyone was always relieved to not be dealing with the results of a catastrophic overspeed event.

Valuable advice from a professor many years ago: First, design for graceful failure. Everything we build will eventually fail, so we must strive to avoid injuries or secondary damage when that failure occurs. Only then can practicality and economics be properly considered.

 

[abeltio]

Most OEM's have eliminated the mechanical overspeed bolt and replaced it with two sets of independent triple redundant speed pickups, one set for control and protection, the other one for protection only.

The classification societies (Lloyd's, ABS, BV, NV) have accepted this change and so do the insurance companies.

The change happened in the early nineties, when the first units were coming out of the factories without the "overspeed bolt" system.


ON THE OTHER HAND,
If the unit in question has the kind of redundancy required by the classification societies, insurance and LOCAL AUTHORITIES then it is ok to eliminate the mechanical protection.

I.e. it is not up to the EPC to eliminate it based on OPINION.
Such a deviation from the specs, which should already been approved by the classification society, insurance company and LOCAL AUTHORITIES, has to be approved by all of them again.

So, in this case if I was the Project Manager would aske the EPC to seek and obtain all the approvals from all relevant parties and authorities and then it would be ok.

Otherwise, the owner runs the risk of forfeiting the permits to run the plant because it is lacking the required protections.
Reclassifying the new protection scheme would be a very expensive and time consuming process.

saludos.
a.