GESPEEDTRONIC™ MARK V STEAM TURBINE CONTROL SYSTEM

hydraulic pressure signal, which will cause rapid

closure of all steam admission valves when depressurized. The critical inputs to the ETS can be tested on-line, one at a time, with the help of the lockout valves located immediately to the left of the

final output to the ETS. This diagram shows the

standard offering with an all-electronic overspeed

trip. Optionally, a system with a mechanical overspeed governor can be supplied.

SPEEDTRONIC MARK V

CONTROL CONFIGURATION

Figure 5 shows the configuration for the

SPEEDTRONIC Mark V triple modular redundant (TMR) control system for a medium to large

steam turbine with redundant operator interfaces. 

The core of this system is the three identical controllers called <R>, <S>, and <T>. All critical control algorithms, protective functions, and sequencing are performed by these processors. In so

doing, they also acquire the data needed and generate outputs to the turbine. Protective outputs

are routed through the <P> module consisting of

triple redundant processors <X>, <Y>, and <Z>,

which also provide independent protection for

certain critical functions such as overspeed.

The three control processors, <R>, <S>, and

<T>, acquire data from the triple-redundant sensors as well as from dual or single sensors. A

generic complement of sensors is described in

Table 3. The actual number of sensors will

depend on turbine type. All critical sensors for

continuous controls, as well as protection, are

triple-redundant. Other sensors are dual or single

devices fanned out to all three control processors.

The extremely high reliability achieved by TMR

control systems is due in considerable measure to

the use of triple sensors for all critical parameters,

as it was first demonstrated with the triple-redundant protection system of the EHC Mark II.

MARK V ELECTRONICS

All of the microprocessor-based controls have a

modular design for ease of maintenance. Each 

module or controller contains up to five cards,

including a power supply. Multiple processors

reside in each controller which distribute the processing for maximum performance. Individual

processors are dedicated to specific I/O assignments, application software, communications, etc., 

and the processing is performed in a real-time,

multi-tasking operating system. Communication

between the controller’s five cards is accomplished

with ribbon cables and gas-tight connectors. This

eliminates the traditional computer backplane.

Communication between individual controllers is

performed on high-speed Arcnet links.

Figure 4 shows the standard microprocessor

module.

PRIMARY CONTROLLERS

<R><S><T>

The three controllers <R>, <S>, and <T>, shown

in Figure 5, are physically separate and independent modules that contain all control and protection hardware and software. A failure in any of the

three controllers is automatically diagnosed to the

card level and displayed as an alarm message.

Maintenance personnel can power down the

appropriate controller and replace the defective

card while the turbine is on-line. Redundant sensors are used in control and trip protection systems

to provide a “total system” fault-tolerant design. As 

a result, diagnostics are able to distinguish between

redundant sensor failures and electronics failures.

Three basic forms of voting are used in the control. Figure 6 shows how the first form of voting,

the software implemented fault tolerance (SIFT),

works. At the beginning of each computing time

frame, each controller independently reads its sensors and exchanges this data with the data from

the other two controllers. The median value of

each analog input is calculated in each controller

and then used as the resultant control parameter 

for that controller. Diagnostic algorithms monitor

a predefined deadband for each analog input to

each controller, and if one of the analog inputs

deviates from this deadband, a diagnostic alarm is

initiated to advise maintenance personnel. 

Contact inputs are voted in a similar manner.

Each contact input connects to a single terminal

point and is parallel wired to three contact input

cards in the voted contact input module. Each

card optically isolates the 125 V dc input, and then

a dedicated 80196 processor in each card time

stamps the input to within 1 ms resolution. These

signals are then transmitted to the <R>, <S>, and

<T> controllers for voting and execution of the

application software. This technique eliminates

any single point failure in the software voting system. Redundant contact inputs for certain functions such as low lube oil pressure are connected

to three separate terminal points and then individually voted. With this SIFT technique, multiple

failures of contact or analog inputs can be accepted by the control system without causing an erroneous analog or trip command from any of the

three controllers as long as the failures are not

from the same circuit.

8

F

Figure 6. Software implemented fault tolerance

(SIFT)

A second form of voting is hardware voting of

analog outputs. As illustrated in Figure 7, three

coil servo valves on the steam valve actuators are