Figure 1. Loss of loadby overspeed.

Process Safety—Evermore

How Important Is Control?As well as inflicting serious or fatal injuries to personnel, a runaway turbinecan impose a tremendous financial burden on a company. A microproces-sor-based control system can render these machines efficient, reliable, andsafe.

Larry L. Fisher, International Minerals & Chemical Corp., Sterlington, La. 71280Richard L. Feeney, Transamerica Délavai, Inc., Trenton, N.J.

There are three areas of steam turbine controls: 1. overspeedtrip control; 2. governor speed control; and 3. microprocessorcontrol. The first two could be the subjects of a separate articleif one was to thoroughly describe the functions and themathematical formulas which generate the final values for theproper design of these controls. Microprocessor control rep-resents some of the latest technology available and is basicallyone master control that can control the first two.

Governor speed control and overspeed trip control are twovery distinct functions. The latter really has no function untilthe unexpected happens and the governoring control systemis unable to control. When the unexpected happens and theoverspeed trip control fails to function properly, the resultscan be catastrophic to equipment or people.

This article focuses on the utilization of electronics in thecontrol of speed, because for every reason not to utilize elec-tronic systems there is more than one reason to utilize them.The use of electronics to control speed is certainly not new(especially in the utility industry); however, for various rea-sons the processing industry has been reluctant to utilizeelectronics for these functions on a large scale. As with anysystem, the design must be carefully engineered to avoid op-erational problems. Some of the changes that have come aboutin the past few years can improve safety, efficiency and reli-ability.

Overspeed trip controlAPI Standard 612(1) defines trip speed as the speed at

which the independent, emergency overspeed device operates

to shut off steam to the turbine. It shall be approximately110% of the maximum continuous speed. How good shouldprotection be to prevent overspeed? In an actual situationwhen a turbine has experienced a loss of load, it can't be goodenough and certainly should prevent what happened hi Figure1. Two big questions to consider when designing an overspeedtrip function are:

1. How much speed can the rotor withstand before damageoccurs and at what speed will complete failure of componentparts occur?

2. What is the maximum speed the rotor will accelerate tobefore the speed starts to slow once the emergency overspeeddevice activates to shut off steam to the turbine?

The design of the rotor dictates its ability to withstandoverspeed. For example, a rotor with removable wheels wouldnot withstand overspeed as well as a rotor with integral wheels,since wheel bores would tend to open up with increased speed.Blade root designs, tenon and shroud designs, metallurgy, etc.,all contribute to how well a rotor can withstand an overspeed.As a general rule of thumb, turbine manufacturers say thatapproximately 125% rated speed could occur without damageto the rotating element. The prediction of when a part failsrequires some very detailed calculations, but one example ofa turbine that a lot of ammonia plants are running today is:1) running speed, 3,560 rpm; 2) maximum continuous, 4,100rpm; 3) wheels loose, 5,600 rpm; and 4) destruction, 7,500rpm.

Unfortunately, many factors can effect the maximum speedbut the primary factor that can be calculated is how fast aparticular rotor can change speed based on tune constants.

125

Rotor time constants usually range from 0.5 s for an extremelyfast rotor to 8-10 s for a slow rotor. If a rotor with a time con-stant of 0.5-1 s suddenly experienced an instantaneous lossof load and inlet steam was not shut off, it would accelerateto 125% rated speed in less than 0.1-0.2 s. In real numbers, ifrated speed was 7,000 rpm, in less than 0.1-0.2 s the rotorwould accelerate to 8,750 rpm. One might challenge that thetrip and throttle valve would have been activated at 110% ofmaximum continuous speed. Assuming everything worked,this is correct but the typical trip and throttle valve takes0.2-0.3 s to close once it receives the signal to close. The rotorin this example would see much more than 8,750 rpm beforeit started to slow down.

The fact that once the trip and throttle valve receives thesignal to activate presents two big problems: 1) there is acertain amount of lag time existing in all mechanisms used tosignal the trip and throttle to actuate; and 2) once the trip andthrottle valve is closed, there is a tremendous amount oftrapped energy in the associated inlet piping and turbinesteam chest that must be released through the turbine andthat alone will continue to drive the rotor to overspeed.

Fortunately, in the process industry where there are mostlyturbine/compressor and turbine/pump applications, the terminstantaneous loss of load is rather ambiguous. In the worsesituation of a coupling failure (which today is rare), therewould in all probability be a 1-2 s delay before 100% full loadloss was sensed. Turbine driven generators, however, aredifferent in that full-load loss could be established in smallfractions of a second.

The important issue here is that things happen very fastduring an overspeed situation. A few years ago, a fatality wasrecorded in the ammonia industry when a turbine explodedon overspeed. A calculation showed an identical rotor couldoverspeed to destruction hi 4.78 s assuming a 100% loss of loadand the rate of energy input was constant. Mechanical over-speed trip mechanisms have been around for many years andwill certainly be around for many more, but they do presentsome very definite disadvantages as:

1. They have moving and wearing parts.2. Redundancy cannot be incorporated.3. Settings are difficult There probably has been more time

wasted (usually at a critical time when a plant is being broughton stream) setting mechanical overspeed trips than any othermaintenance function on a steam turbine.

4. Trip set points cannot be changed while the turbine isoperating.

5. The trip set point in most cases can be verified only when

Figure 2.Electronic trip system

for fan drive.126

the turbine is uncoupled. Once the unit is put on Une, this setpoint can be assumed only until the right opportunity presentsitself to shut the unit down. This in reality may be severalyears.

6. Mechanical trips have to incorporate several mechanicallinkages to trip the steam flow to the turbine. These linkageswill wear and it's not uncommon for operations to "wire up"one of these to keep it from inadvertently tripping if there hasbeen a problem in this respect.

7. Mechanical overspeed trips create additional overhungweight on the rotor. This additional overhung weight maypresent rotor dynamic problems. Also, since this type of tripbody is screwed onto the shaft, extreme care must be exer-cised to keep runouts less than 0.0015.

8. The mechanical plunger that must move outward fromthe rotating shaft can stick due to corrosion or oil sludgeproblems.

None of these disadvantages are inherent in an electronictrip system. The major disadvantage is that an electronicsystem is no better than the electrical power source that op-erates them. For this reason, power for these systems must beinstrument power on an uninterruptible power source. If aUPS system is not part of a plant electrical system, back-uppower can be incorporated with the use of battery packs. Itshould be noted that the overspeed trip system should be in-dependent of the electronic governoring system with eachhaving its own back-up power. There are also self-powered tripsystems available; with these, no AC or DC power is requiredsince the trip derives both signal and power from the signalsource which is the magnetic pick-up. The use of magneticpick-ups for signal source will be discussed thoroughlylater.

Figure 2 illustrates an application on a fan drive where theoverspeed trip is strictly electronic with no mechanical over-speed trip. When this system sees an overspeed situation, anelectronic signal is converted in an electro/pneumatic trans-ducer and through a pneumatic actuator closes the governorvalve. At the same time, the pneumatic pressure that isholding the block valve in the main stream line open isdumped through a quick release air valve. Both valves closein fractions of a second once the overspeed set point is ex-ceeded. Since the governor valve is not designed to be a posi-tive shut-off valve, a control valve in the main steam line tothe turbine should be a must when the mechanical trip valveis eliminated. The valve trim for this valve should be ANSIClass 5 to insure a very tight shut-off.

The other option is a combination electronic/mechanicaltrip system where generally the electronic trip point is setslightly above the mechanical trip point. The only point worthmentioning is that this system still has all the disadvantagesof a mechanical trip system. A dual electronic trip systemwould provide better protection.

Governor speed controlAPI 612 under Section 3.4.2 (controls) states that:"(3.4.2.3) Unless otherwise specified, the speed governor

shall control the turbine at all speeds within the specifiedrange. Other control modes (such as those for extraction/induction machines) shall be mutually agreed upon betweenthe vendor and purchaser.

"(3.4.2.4) Governor systems shall be designed to preventthe unit from exceeding the turbine trip speed with an in-stantaneous loss of rated load."

Speed governors basically fall into four categories: 1) me-chanical shaft, 2) mechanical/hydraulic, 3) electrical/hy-draulic, and 4) electrical/pneumatic. Although there are stillsome mechanical shaft governors running today, for allpractical purposes they are obsolete. A potential new systemunder development which looks very promising is an elec-tronic/electrical governor. The electronic governor willtransmit a signal to an electric motor through a power am-

Figure 3. Typical oil relay governor.

plifier that in turn will position the steam admission valve, asdetailed later.

The mechanical/hydraulic governor in Figure 3 is a typicalou relay governoring system applied to all sizes of turbines butprimarily on single-stage units. This provides good speedcontrol and certainly would meet API 3.4.2.3 previouslymentioned. However, this system could not keep a turbinefrom accelerating to overspeed as mentioned in API 3.4.2.4if an overspeed situation existed. The big disadvantage of amechanical/hydraulic system is that there are a lot of wearing,moving parts. Also since hydraulics are involved, oil levels inthe governors themselves must be maintained. Figure 4 isanother example of a mechanical/hydraulic governor thatconsists of a trip and throttle valve, a speed governor, steamadmission nozzle valves, and a servomotor which operates thenozzle valves. As with Figure 3, its speed control is very good.But even though the response time for closing the admissionvalve would be faster with this system in an overspeed situa-tion, it would not be fast enough to control speed upon 100%loss of load. Also, as before, there is still a lot of moving,wearing parts involved.

In the electrical/hydraulic governing system, Figure 5, anactuator mounted on the main servomotor responds to speedgovernor drive signals, converting these signals to mechanicalmovement of the servomotor relay (pilot) valve. This move-ment, through linkage and hydraulic amplification by theservomotor, operates and adjusts the positioning of the tur-bine steam nozzle valves. This system does not have a me-chanical overspeed trip. Dual redundant overspeed trip relaysare utilized with the trip set points about 5% of rated speedapart. This system provides extremely good turbine speedcontrol and actual test data on similar systems, and controlsspeed upon instantaneous loss of load. It should be noted thatthe term "control speed" does not mean there will be no in-crease in speed. The speed in all reality will increase 1 to 2%of the initial set point before absolute control has been es-tablished. Another big advantage of this system is that manymoving, wearing parts have been eliminated, especially on the

Figure 5.Electrical/hydraulicgovernor.

Figure 6.No governordrive partsare needed.

Figure 4. An example ofmechanical/hydraulic governor.

127

turbine rotor in that no governor drive parts are necessary.The only part on the turbine rotor is a 60-tooth gear to gen-erate the speed signal. Five magnetic pick-ups, two for gov-ernor speed input, two for the overspeed trip relays, and onefor a tach driver are mounted as shown in an actual installa-tion in Figure 6.

Figure 7. Latest speed control deYiee.

Figure 7 represents some of the latest technology in con-trolling steam turbine speed. The system is still electrical/hydraulic; but unlike the system in Figure 5, the movementof the steam admission values is dramatically different. In thissystem, electric speed control signals operate a servoamplifierwhich operates into servoactuators that move the admissionvalves controlling steam flow to the turbine. 1,200 psig (8.3MPa) oil pressure, from the compressor seal oil pump dis-charge and through an accumulator, is used to operate theseservoactuators. These valves have an 2-in. (51-mm) stroke asdesigned for this application from full open to full closed andwill stroke in 0.1 s. Since the response time of these admissionvalves to change position is so fast, when they receive achanging speed signal in all probability a very small increasein speed above the set point would be noticed if there was asudden loss of load.

This system hi all probability comes closer to fulfilling API3.4.2.4 than any other governoring system available today.During an actual four-hour mechanical spin test with theturbine running unloaded, the only speed change above orbelow the set point was the 1 rpm resolution of the digital ta-chometer. This system is under development to change fromelectrical/hydraulic to electronic/electrical. In this configu-ration, the speed set signal would be sent through a poweramplifier to an electric motor that would position the valve.This would eliminate the use of oil to position these valves.But testing to date has shown the stroke tune to be 0.2 to 0.3s which is not as good as the hydraulic system. Future materialand engineering changes may improve the system.

The final system to be discussed is the electrical/pneumaticthat was applied to a fan unit that originally had a mechani-cal/hydraulic system. The reasons for retrofit were twofold:1) mechanical overspeed trip linkages were a constant prob-lem; and 2) a need existed for a governoring system that would,upon sensing a reduction in fan speed below an underspeedset point, start up the back-up drive unit automatically.Shortly after the system was placed in service, it was realizedsome changes were needed to improve the reliability of thesystem. The first problem was that the pneumatic actuatoras shown in Figure 8 was not a good application for this servicefor two reasons:

1. Although it provided reasonably good speed control,under certain load conditions it was not powerful enough toovercome the pressure forces within the governor valve andwould allow slight swings in speed.

2. The physical mounting of these units on the governorvalves created a high vibration on them. Mechanical linkageshad to be constantly watched for abnormal wear. This prob-lem was eliminated when a new actuator as shown in Figure9 was installed. This unit is relatively simple; there are fewmoving parts or linkages and it is considerably more powerful

for governor valve position control.The second problem was that although this system was

connected to a UPS power system, there were some noisespikes in the incoming power. For this reason we installedfilters on the incoming power to the governor. This is a verypositive move, regardless of the power source.

The third problem was the setting of the gap for the mag-netic pick-ups. To insure that the signal from these pick-upsis strong, it must be set within 0.015-0.020 of the rotatingtoothed gear. On these particular units there was no way touse a feeler gauge to measure this gap since there was no accessonce the unit was reassembled. A simple amplifier was in-stalled to insure a strong signal. These pick-ups can now beeasily set far enough away from the rotating gear to avoiddamage on start-up by feel only.

The final change was the results of an operational changein that one of these drivers is a condensing turbine and theother is a back-pressure turbine. During different periods ofthe year, it was beneficial to swap units for a better steambalance. Originally the system was wired to talk in one di-rection. The new wiring change allows either driver to comeon automatically regardless which one is operational at thetime of an underspeed on the fan.

Figure 8. Pneumatic actuator.

128Figure 9. Simple power actuator.

VOTEA

ACTUATOR

Figure 10. Fault tolerant system.

Microprocessor controlBecause the various control schemes have been developed

to a highly sophisticated level, we should now consider anumber of options not available until the last few years. Tomeet the reliability requirements of the modern process plant,we must go beyond a simple mechanical or electric governorand look in the direction of today's latest technology, themicroprocessor-based control devices. Microprocessors(multiple microprocessors working together) can perform allthe following functions when used for turbine/compressor/generator applications with the appearance of doing every-thing at once.

• Monitoring and annunication• Automatic sequencing• Load/speed control« Historical records• Predictive maintenance• Safety and reliability« Flexibility and availabilityThe minicomputer utilizes its multitask capabilities and

performs each task one at a time (but at a very high rate).Some industrial systems function at a 1-millsecond samplingrate, but most are not that fast. Through proper management(software), however, we can schedule these multitask capa-bilities in relation to a defined system of priorities with theability to interrupt if a higher priority function requires im-mediate attention.

Figure 11. Fault tolerant voting.

ERROR LOO

HARDWARE BASED VOTING & ERROR LOG.

VOTES ALL I/O AND EVERY COMPUTATIONAL RESULT.

AN EXCESSIVE ERROR RATE MARKS CHANNEL AS BAD.

Today we can look for a "fault tolerant-fail opertional"system based on minicomputer utilizing three separate centralprocessing units, or kernals, Figure 10. The reason for usingthree (or more) CPU's is to permit the "voting" of variousfunctions, particularly the output functions. Some of the moresophisticated systems will now synchronize the three CPU'sthroughout the computational functions and select the ma-jority result each step of the way. The CPU that does not agreewith the majority is cycled several times to see if it is still inconflict. If so, it is isolated from the other controls and asuitable alarm is initiated, Figure 11. The remaining sectionsof the system continue to function in a synchronized (fail-safe)voting mode, Figure 12.

At this point it is anticipated that the failed component willbe repaired and the complete system returned to operation.If, however, another failure occurs before the repair can bemade and the remaining two CPU's do not agree, the equip-ment is shut down in a fail-safe mode.

Despite of its many advantages, a series of limits must beconsidered very carefully. The same high degree of reliabilitymust be specified for the input sensors and the devices thatperform the control function (actuators). Those parts of thecontrol loop can be approached in the same manner as thecomputational section. Through the use of redundant, solid-state sensors, it is possible to increase the level of reli-ability.

SensorsAs with the computational section, it is mandatory to seek

the highest level of reliability for each of the process sensors.We must procure high-quality devices which have an MTBF(mean time between failure) in excess of 50,000 hours and thenprovide a status monitor. This monitor gives a continualreadout of the health or status of each sensor's physical,electrical and operational criteria. This is a positive way ofsaying that we will monitor and report the condition of eachinput sensor. Should a sensor be detected that is not withinthe specified operating limits, we would initiate a suitablealarm and, if specified, deactivate that function of the mini-computer.

Using solid-state sensors which generally have a smallleakage current in the shut-off condition gives us a means ofdetecting a wire break, power failure, or other form of sensorfailure such as a diaphragm failure or probe rub. Anotherfailure could be that the measured variable is outside thenormal control range and this could be classified as an alarmcondition.

The use of "live zero" sensors precludes the use of routine129

taant* TO no« cowuna

Figure 12.Synchronizedvoting mode.

switches and other contact-type sensors. This is also a stepforward in the direction of improved reliability, since we nolonger have to worry about dirty or arcing contacts, or loosewires that only show up when the contacts attempt to changestate.

For sensing functions that are very critical to the operationof the unit, it will be necessary to use multiple (redundant)sensors. For example, the loss of the lube oil header pressuresensor could jeopardize safe operation so we would require aminimum of two sensors.

With a minicomputer system it is no longer necessary tohave a separate sensor for alarm, trip, interlock, remote in-dication, etc. All of these functions are now handled withinthe minicomputer through the proper software commands.

ActuatorsIn a normal steam turbine control system, there are only a

few "critical" actuators that will seriously affect the operationof turbine. These fall into two catagories:

• Safety trip• Speed control (Load, pressure, etc., are the controlled

variables, however, the turbine responds primarily throughchanges in speed.)

Safety trip actuators are usually connected to valves in thehydraulic system which hold the main steam stop valves openfor normal operation. In the event of a need to stop or trip theunit, there will be one or more solenoids. The most reliablearrangement is the use of the dual coil, direct-acting solenoidvalves and to provide for on-line testing of the trip system. Itis desirable to furnish two identical trip valves.

Speed control actuators for steam turbines are relativelysmall electro-hydraulic devices which interface the electroniccontrols to the high force requirements of the turbine controlvalves.

It is desirable to make these actuators as reliable as possiblesince this constitutes the final control device. We have in-creased the level of electronics reliability by multiple-channelmonitoring, voting their outputs and then sending a signal toan actuator. This signal becomes the single most critical cir-cuit. How do we improve reliability? Redundancy! It is nec-essary to furnish actuators which can accept two (or more)separate control signals and feedback the actuator response.In the event of a failure of the primary signal circuit, the re-maining systems can assume control with no loss of service.Repair then becomes a scheduling problem, not a forcedoutage.

In conclusionA runaway turbine can impose a tremendous financial

burden on an operating company. More important, it caninflict serious or fatal injury on personnel when it destructson overspeed. Minicomputer systems have the advantage ofbeing constructed with standard hardware and components,and utilizing the great potential through the use of simplesoftware changes. These control systems provide very highreliability, standard hardware and the ability to be veryflexible merely by changing a few software programs. The useof microprocessors is increasing at a very high rate; electroniccontrol systems have a great deal to offer in this importantfunction of a steam turbine, but each application must beproperly evaluated to insure the best control possible.

AcknowledgmentI would like to thank H. Senn, instrument supervisor at

IMC Corp.'s Fertilizer Group, for his assistance in preparingthis article. #

Literature cited1. API Standard 612, "Special-Purpose Steam Turbines For Refinery Ser-

vices," 2nd Ed. (June, 1979).

L. Fisher is responsible for the Mechanical Special-ities Group of IMC Corp. The holder of a B.S. degreefrom Indiana State Univ., he is responsible for thepreparation of machinery specifications, testing in-stallation, machinery analysis, and predictive main-tenance programs.

R. L. Feeney is a supervisor in the Controls Engi-neering Section of Transamerica Délavai, Inc. Re-sponsible for developing electro-hydraulic retrofitsystems and "fault tolerant fail operational" micro-processor-based systems for steam turbine/feed pumpunits, he earned his B.S. degree in engineering at theU.S. Naval Academy and M.B.A. at Rider College.

130