1

GER-3658D

INTRODUCTIONThe SPEEDTRONIC™ Mark V Gas Turbine

Control System is the latest derivative in thehighly successful SPEEDTRONIC™ series.Preceding systems were based on automated tur-bine control, protection and sequencing tech-niques dating back to the late 1940s, and havegrown and developed with the available technol-ogy. Implementation of electronic turbine con-trol, protection and sequencing originated withthe Mark I system in 1968. The Mark V system isa digital implementation of the turbine automa-tion techniques learned and refined in morethan 40 years of successful experience, over 80%of which has been through the use of electroniccontrol technology.

The SPEEDTRONIC™ Mark V Gas TurbineControl System employs current state-of-the-arttechnology, including triple-redundant 16-bitmicroprocessor controllers, two-out-of-three vot-ing redundancy on critical control and protec-tion parameters and Software-ImplementedFault Tolerance (SIFT). Critical control and pro-tection sensors are triple redundant and votedby all three control processors. System outputsignals are voted at the contact level for criticalsolenoids, at the logic level for the remainingcontact outputs and at three coil servo valves foranalog control signals, thus maximizing bothprotective and running reliability. An indepen-dent protective module provides triple redun-dant hardwired detection and shutdown onoverspeed along with detecting flame. This mod-ule also synchronizes the turbine generator tothe power system. Synchronization is backed upby a check function in the three control proces-sors.

The Mark V Control System is designed to ful-fill all gas turbine control requirements. Theseinclude control of liquid, gas or both fuels inaccordance with the requirements of the speed,load control under part-load conditions, tem-perature control under maximum capabilityconditions or during startup conditions. In addi-tion, inlet guide vanes and water or steam injec-tion are controlled to meet emissions and oper-ating requirements. If emissions control uses

Dry Low NOx techniques, fuel staging and com-bustion mode are controlled by the Mark V sys-tem, which also monitors the process.Sequencing of the auxiliaries to allow fully auto-mated startup, shutdown and cooldown are alsohandled by the Mark V Control System. Turbineprotection against adverse operating situationsand annunciation of abnormal conditions areincorporated into the basic system.

The operator interface consists of a colorgraphic monitor and keyboard to provide feed-back regarding current operating conditions.Input commands from the operator are enteredusing a cursor positioning device. An arm/exe-cute sequence is used to prevent inadvertent tur-bine operation. Communication between theoperator interface and the turbine control isthrough the Common Data Processor, or <C>, tothe three control processors called <R>, <S> and<T>. The operator interface also handles com-munication functions with remote and externaldevices. An optional arrangement, using aredundant operator interface, is available forthose applications where integrity of the exter-nal data link is considered essential to contin-ued plant operations. SIFT technology protectsagainst module failure and propagation of dataerrors. A panel mounted back-up operator dis-play, directly connected to the control proces-sors, allows continued gas turbine operation inthe unlikely event of a failure of the primaryoperator interface or the <C> module.

Built-in diagnostics for troubleshooting pur-poses are extensive and include “power-up,”background and manually initiated diagnosticroutines capable of identifying both controlpanel and sensor faults. These faults are identi-fied down to the board level for the panel andto the circuit level for the sensor or actuatorcomponents. The ability for on-line replacementof boards is built into the panel design and isavailable for those turbine sensors where physi-cal access and system isolation are feasible. Setpoints, tuning parameters and control constantsare adjustable during operation using a securitypassword system to prevent unauthorized access.Minor modifications to sequencing and theaddition of relatively simple algorithms can be

SPEEDTRONIC™ MARK V GAS TURBINE CONTROL SYSTEM

T. AshleyGE Power SystemsSchenectady, NY

D. Johnson and R.W. MillerGE Drive Systems

Salem, VA

accomplished when the turbine is not operating.They are also protected by a security password.

A printer is included in the control systemand is connected via the operator interface. Theprinter is capable of copying any alpha-numericdisplay shown on the monitor. One of these dis-plays is an operator configurable demand dis-play that can be automatically printed at aselectable interval. It provides an easy means toobtain periodic and shift logs. The printer auto-matically logs time-tagged alarms, as well as theclearance of alarms. In addition, the printer willprint the historical trip log that is frozen inmemory in the unlikely event of a protectivetrip. The log assists in identifying the cause of atrip for trouble shooting purposes.

The statistical measures of reliability and avail-ability for SPEEDTRONIC™ Mark V systems havequickly established the effectiveness of the newcontrol because it builds on the highly success-ful SPEEDTRONIC™ Mark IV system.Improvements in the new design have beenmade in microprocessors, I/O capacity, SIFTtechnology, diagnostics, standardization andoperator information, along with continuedapplication flexibility and careful design formaintainability. SPEEDTRONIC™ Mark V con-trol is achieving greater reliability, faster mean-time-to repair and improved control systemavailability than the SPEEDTRONIC™ Mark IVapplications.

As of May 1994, almost 264 Mark V systemshad entered commercial service and systemoperation has exceeded 1.4 million hours. Theestablished Mark V level of system reliability,including sensors and actuators, exceeds 99.9percent, and the fleet mean-time-between-forced-outages (MTBFO) stands at 28,000hours. As of May 1994, there were 424 gas tur-bine Mark V systems and 106 steam turbineMark V systems shipped or on order.

CONTROL SYSTEM HISTORYThe gas turbine was introduced as an industri-

al and utility prime mover in the late 1940s withinitial applications in gas pipeline pumping andutility peaking. The early control systems werebased on hydro-mechanical steam turbine gov-erning practice, supplemented by a pneumatictemperature control, preset startup fuel limitingand manual sequencing. Independent devicesprovided protection against overspeed, overtem-perature, fire, loss of flame, loss of lube oil andhigh vibration.

Through the early years of the industry, gasturbine control designs benefited from the

rapid growth in the field of control technology.The hydro-mechanical design culminated in the“fuel regulator” and automatic relay sequencingfor automatic startup, shutdown and cooldownwhere appropriate for unattended installations.The automatic relay sequencing, in combinationwith rudimentary annunciator monitoring, alsoallowed interfacing with SCADA (SupervisoryControl and Data Acquisition) systems for truecontinuous remote control operation.

This was the basis for introduction of the firstelectronic gas turbine control in 1968. This sys-tem, ultimately known as the SPEEDTRONIC™

Mark I Control, replaced the fuel regulator,pneumatic temperature control and electro-mechanical starting fuel control with an elec-tronic equivalent. The automatic relay sequenc-ing was retained and the independent protectivefunctions were upgraded with electronic equiva-lents where appropriate. Because of its electri-cally dependent nature, emphasis was placed onintegrity of the power supply system, leading to aDC-based system with AC- and shaft-poweredback-ups. These early electronic systems provid-ed an order of magnitude increase in runningreliability and maintainability.

Once the changeover to electronics wasachieved, the rapid advances in electronic sys-tem technology resulted in similar advances ingas turbine control technology (Table 1). Notethat more than 40 years of gas turbine controlexperience has involved more than 5,400 units,while the 26 years of electronic control experi-ence has been centered on more than 4,400 tur-bine installations. Throughout this time period,the control philosophy shown in Table 2 hasdeveloped and matured to match the capabili-ties of the existing technology. This philosophyemphasizes safety of operation, reliability, flexi-bility, maintainability and ease of use, in thatorder.

CONTROL SYSTEM FUNCTIONS

The SPEEDTRONIC™ Gas Turbine ControlSystem performs many functions including fuel,air and emissions control; sequencing of turbinefuel and auxiliaries for startup, shutdown andcooldown; synchronization and voltage match-ing of the generator and system; monitoring ofall turbine, control and auxiliary functions; andprotection against unsafe and adverse operatingconditions. All of these functions are performedin an integrated manner that is tailored toachieve the previously described philosophy in

2

GER-3658D

the stated priority.The speed and load control function acts to

control the fuel flow under part-load conditionsto satisfy the needs of the governor.Temperature control limits fuel flow to a maxi-mum consistent with achieving rated firing tem-peratures and controls air flow via the inletguide vanes to optimize part-load heat rates onheat recovery applications. The operating limitsof the fuel control are shown in Figure 1. Ablock diagram of the fuel, air and emissions con-trol systems is shown in Figure 2. The input tothe system is the operator command for speed

(when separated from the grid) or load (whenconnected). The outputs are the commands tothe gas and liquid fuel control systems, the inletguide vane positioning system and the emissionscontrol system. A more detailed discussion ofthe control functionality required by the gas tur-bine may be found in Reference 1.

The fuel command signal is passed to the gasand liquid fuel systems via the fuel signal dividerin accordance with the operator’s fuel selection.Startup can be on either fuel and transfers

3

GER-3658D

Table 2GAS TURBINE CONTROL PHILOSOPHY

• Single control failure alarms when running or duringstartup

• Protection backs up control, thus independent• Two independent means of shutdown will be available• Double failure may cause shutdown, but will always

result in safe shutdown• Generator-drive turbines will tolerate full-load rejection

without overspeeding• Critical sensors are redundant• Control is redundant• Alarm any control system problems• Standardize hardware and software to enhance relia-

bility while maintaining flexibility

Table 1ADVANCES IN ELECTRONIC CONTROL CONCEPTS

GT17610B

Figure 1.Gas turbine generator controls andlimits

under load are accomplished by transitioningfrom one system to the other after an appropri-ate fill time to minimize load excursions. Systemcharacteristics during a transfer from gas to liq-uid fuel are illustrated in Figure 3. Purging ofthe idle fuel system is automatic and continuous-ly monitored to ensure proper operation.Transfer can be automatically initiated on loss ofsupply of the running fuel, which will bealarmed, and will proceed to completion with-out operator intervention. Return to the origi-nal fuel is manually initiated.

The gas fuel control system is shown schemat-ically in Figure 4. It is a two-stage system, incor-porating a pressure control proportional tospeed and a flow control proportional to fuelcommand. Two stages provide a stable turn-down ratio in excess of 100:1, which is morethan adequate for control under starting and

warm-up conditions, as well as maximum flowfor peak output at minimum ambient tempera-ture. The stop/speed ratio valve also acts as anindependent stop valve. It is equipped with aninterposed, hydraulically-actuated trip relay thatcan trip the valve closed independent of controlsignals to the servo valve. Both the stop ratioand control valves are hydraulically actuated,single-acting valves that will fail to the closedposition on loss of either signal or hydraulicpressure. Fuel distribution to the gas fuel noz-zles in the multiple combustors is accomplishedby a ring manifold in conjunction with carefulcontrol of fuel nozzle flow areas.

The liquid fuel control system is shownschematically in Figure 5. Since the fuel pump isa positive displacement pump, the systemachieves flow control by recirculating excess fuel

4

GER-3658D

GT17603B

Figure 2. Gas turbine fuel control

GT20703B

Figure 3. Dual fuel transfer characteristics gas to liquid

GT17599

Figure 4. Gas fuel control system

from the discharge back to the pump suction.The required turndown ratio is achieved by mul-tiplying the fuel command by a signal propor-tional to turbine speed. The resultant signalpositions the pump recirculation, or bypassvalve, as appropriate to make the actual fuelflow, as measured by the speed of the liquid fuelflow divider, equal the product of turbine speedand fuel command. This approach ensures a sys-tem in which both the liquid and gas fuel com-mands are essentially equal. Fuel distribution tothe liquid fuel nozzles in the multiple combus-tors is achieved via the flow divider. This is aproven mechanical device that consists of care-fully matched gear pumps for each combustor,all of which are mechanically connected to runat the same speed.

Control of nitrogen oxide emissions may beaccomplished by the injection of water or steaminto the combustors. The amount of waterrequired is a function of the fuel flow, the fueltype, the ambient humidity and nitrogen oxideemissions levels required by the regulations inforce at the turbine site. Steam flow require-ments are generally about 40% higher than theequivalent water flow, but have a more benefi-cial effect on turbine performance. Accuracy ofthe flow measurement, control system and sys-tem monitoring meets or exceeds both EPA andall local code requirements. An independent,fast-acting shutoff valve is provided to ensureagainst loss of flame from over-watering on sud-den load rejection.

Emissions control using Dry Low NOx com-bustion techniques relies on multiple-combus-tion staging to optimize fuel/air ratios andachieve thorough premixing in various combi-nations, depending on desired operating tem-perature. The emissions fuel control system reg-

ulates the division of fuel among the multiple-combustion stages according to a schedule thatis determined by a calculated value of the com-bustion reference temperature. The control sys-tem also monitors actual combustion systemoperation to ensure compliance with therequired schedule. Special provisions are incor-porated to accommodate off-normal situationssuch as load rejection.

The gas turbine, like any internal combustionengine, is not self-starting and requires an out-side source of cranking power for startup. Thisis usually a diesel engine or electric motor com-bined with a torque converter, but could also bea steam turbine or gas expander if externalsteam or gas supplies are available. Startup viathe generator, using variable frequency powersupplies, is used on some of the larger gas tur-bines. Sufficient cranking power is provided tocrank the unfired gas turbine at 25% to 30%speed, depending on the ambient temperature,even though ignition speed is 10% to 15%. Thisextra cranking power is used for gas path purg-ing prior to ignition, for compressor water wash-ing, and for accelerated cooldown.

A typical automatic starting sequence isshown in Figure 6. After automatic systemchecks have been successfully completed andlube oil pressure established, the crankingdevice is started and, for diesel engines, allowedto warm up. Simple-cycle gas turbines with con-ventional upward exhausts do not require purg-ing prior to ignition and the ignition sequencecan proceed as the rotor speed passes throughfiring speed. If ignition does not occur beforethe 60 second cross-firing timer times out, thecontrols will automatically enter a purgesequence, as described later, and then attemptto refire.

However, if there is heat recovery equipment,or if the exhaust ducting has pockets wherecombustibles can collect, gas path purgingensures a safe light-off. When the turbine reach-es purge speed, this speed is held for the neces-sary purge period, usually sufficient to ensurethree to five volume changes in the gas path.Purge times will vary from one minute to as longas 10 minutes in some heat recovery applica-tions. When purging is completed, the turbinerotor is allowed to decelerate to ignition speed.This speed has been found to be optimum fromthe standpoint of both thermal fatigue duty onthe hot gas path components, as well as offeringreliable ignition and cross firing of the combus-tors.

The ignition sequence consists of turning on

5

GER-3658D

GT17604

Figure 5. Liquid fuel control system

ignition power to the spark plugs and then set-ting firing fuel flow. When flame is detected bythe flame detectors, which are on the oppositeside of the turbine from the spark plugs, igni-tion and cross-firing are complete. Fuel isreduced to the warm-up value for one minuteand the starting device power is brought to max-imum. If successful ignition and cross firing arenot achieved within an appropriate period oftime, the control system automatically revertsback to the purge sequence, and will attempt asecond firing sequence without operator inter-vention. In the unlikely event of incompletecross firing, it will be detected by the combus-tion monitor as a high exhaust temperaturespread prior to loading the gas turbine.

After completion of the warm-up period, fuelflow is allowed to increase and the gas turbinebegins to accelerate faster. At a speed of about30% to 50%, the gas turbine enters a predeter-mined program of acceleration rates, slower ini-tially, and faster just before reaching runningspeed. The purpose of this is to reduce the ther-mal-fatigue duty associated with startup.

At about 40% to 85% speed, turbine efficien-cy has increased sufficiently so that the gas tur-bine becomes self sustaining and external crank-ing power is no longer required. At about 80%to 90% speed, the compressor inlet guide vanes,which were closed during startup to preventcompressor surge, are opened to the full-speed,no-load position.

As the turbine approaches running speed,synchronizing is initiated. This is a two or three

step process that consists of matching turbinegenerator speed, and sometimes voltage, to thebus, and then closing the breaker at the pointwhere the two are in phase within predeter-mined limits.

Turbine speed is matched to the line frequen-cy with a small positive differential to preventthe generator breaker from tripping on reversepower at breaker closure. In the protective mod-ule, triple-redundant microprocessor-based syn-chronizing methods are used to predict zero-phase angle difference and compensate forbreaker closing time to provide true zero angleclosure. Acceptable synchronizing conditionsare independently verified by the triple-redun-dant control processors as a check function.

At the completion of synchronizing, the tur-bine will be at a spinning reserve load. The finalstep in the starting sequence consists of auto-matic loading of the gas turbine generator, ateither the normal or fast rate, to either a prese-lected intermediate load, base load or peakload. Typical starting times to base load areshown in Table 3. Although the time to full-speed no-load applies to all simple cycle gas tur-bines, the loading rates shown are for standardcombustion and may vary for some Dry LowNOx systems.

Normal shutdown is initiated by the operatorand is reversible until the breaker is opened andthe turbine operating speed falls below 95%.The shutdown sequence begins with automaticunloading of the unit. The main generatorbreaker is opened by the reverse power relay at

6

GER-3658D

GT17606D

Figure 6. Typical gas turbine starting characteristics

about 5% negative power, which drives the gasturbine fuel flow to a minimum value sufficientto maintain flame, but not turbine speed. Thegas turbine then decelerates to about 40% to25% speed, where fuel is completely shut off. Asbefore, the purpose of this “fired shutdown”sequence is to reduce the thermal fatigue dutyimposed on the hot gas path parts.

After fuel is shut off, the gas turbine coastsdown to a point where the rotor turning systemcan be effective. The rotor should be turnedperiodically to prevent bowing from unevencooldown, which would cause vibration on sub-sequent startups. Turning of the rotor for cool-down or maintenance is accomplished by aratcheting mechanism on the smaller gas tur-bines, or by operation of a conventional turninggear on some larger gas turbines. Normal cool-down periods vary from five hours on the small-er turbines to as much as 48 hours on some ofthe larger units. Cool down sequences may beinterrupted at any point for a restart if desired.

Gas turbines are capable of faster loading inthe event of a system emergency. However, ther-mal fatigue duty for these fast load starts is sub-stantially higher. Therefore, selection of a fastload start is by operator action with the normalstart being the default case.

Gas turbine generators that are equippedwith diesel engine starting devices are optionallycapable of starting in a blacked out conditionwithout outside electrical power. Lubricating oilfor starting is supplied by the DC emergencypump powered from the unit battery. This bat-tery also provides power to the DC fuel forward-ing pump for black starts on distillate. The tur-bine and generator control panels on all unitsare powered from the battery. An inverter sup-

plies the AC power required for ignition and thelocal operator interface. Power for the coolingsystem fans is obtained from the main generatorthrough the power potential transformer afterthe generator field is flashed from the battery atabout 50% speed. The black start option uses aDC battery-powered turning device for rotorcooldown to ensure the integrity of the blackstart capability.

As mentioned, the protective function acts totrip the gas turbine independently from the fuelcontrol in the event of overspeed, overtempera-ture, high rotor vibration, fire, loss of flame orloss of lube oil pressure. With the advent ofmicroprocessors, additional protective featureshave been added with minimum impact on run-ning reliability due to the redundancy of themicroprocessors, sensors and signal processing.The added functions include combustion andthermocouple monitoring, high lube oil headertemperature, low hydraulic supply pressure,multiple control computer faults and compres-sor surge for the aircraft-derivative gas turbines.

Because of their nature or criticality, someprotective functions trip the stop valve throughthe hardwired, triple-redundant protective mod-ule. These functions are the hardwired over-speed detection system, which replaces themechanical overspeed bolt on some units, themanual emergency trip buttons, and “customerprocess” trips. As previously mentioned, the pro-tection model performs the synchronizationfunction to close the breaker at the properinstant. It also receives signals from the flamedetectors and determines if flame is on or off. Ablock diagram of the turbine protective system isshown in Figure 7. It shows how loss of lube oil,hydraulic supply, or manual hydraulic trip will

7

GER-3658D

Table 3SIMPLE CYCLE PACKAGE POWER PLANT STARTING TIMES

result in direct hydraulic actuation of the stopvalves.

Interfacing to other application-specific tripfunctions is provided through the three controlprocessors, the hardwired protection module orthe hydraulic trip system. These trip functionsinclude turbine shutdown for generator protec-tive purposes and combined-cycle coordinationwith heat recovery steam generators and single-shaft STAG™ steam turbines. The latter ishydraulically integrated as shown in Figure 7.Other protective coordination is provided asrequired to meet the needs of specific applica-tions.

SPEEDTRONIC™ MARK VCONTROL CONFIGURATION

The SPEEDTRONIC™ Mark V control systemmakes increased use of modern microprocessorsand has an enhanced system configuration. Ituses SIFT technology for the control, a newtriple-redundant protective module and a signif-icant increase in hardware diagnostics.Standardized modular construction enhancesquality, speed of installation, reliability and easeof on-line maintenance. The operator interfacehas been improved with color graphic displaysand standardized links to remote operator sta-

8

GER-3658D

GT20784B

Figure 7. Protective system block diagram; SPEEDTRONIC™ Mark V turbine control

GT20781B

Figure 8. Standard control configuration

tions and distributed control systems (DCS).Figure 8 shows the standard SPEEDTRONIC™

Mark V control system configuration. The topblock in the diagram is the Interface DataProcessor called <I>. It includes a monitor, key-board, and printer. Its main functions are driv-ing operator displays, managing the alarm pro-cess and handling operator commands. <I> alsodoes system configuration and download, off-line diagnostics for maintenance, and imple-ments interfaces to remote operator stationsand plant distributed control systems.

The Common Data Processor, or <C>, collectsdata for display, maintains the alarm buffers,generates and keeps diagnostic data, and imple-ments the common I/O for non-critical signalsand control actions. Turbine supervisory sensorssuch as wheelspace thermocouples come direct-ly to <C>. The <I> processor communicates with<C> using a peer-to-peer communication linkwhich permits one or more <I> processors. <C>gathers data from the control processors by par-ticipating on the voting link.

At the core of SPEEDTRONIC™ Mark V con-trol are the three identical control processorscalled <R> <S> and <T>. All critical control algo-rithms, turbine sequencing and primary protec-tive functions are handled by these processors.They also gather data and generate most of the

alarms.The three control processors accept input

from various arrangements of redundant tur-bine and generator sensors. Table 4 lists typicalredundant sensor arrangements. By extendingthe fault tolerance to include sensors, as withthe Mark IV system, the overall control systemavailability is significantly increased. Some sen-sors are brought in to all three control proces-sors, but many, like exhaust thermocouples, aredivided among the control processors. The indi-vidual exhaust temperature measurements areexchanged on the voter link so that each controlprocessor knows all exhaust thermocouple val-ues. Voted sensor values are computed by eachof the control processors. These voted values areused in control and sequencing algorithms thatproduce the required control actions.

One key output goes to the servo valves usedin position loops as shown in Figure 9. Theseposition loops are closed digitally. RedundantLVDTs (Linear Variable DifferentialTransformers, a position sensor) produce a sig-nal proportional to actuator position. Each con-trol processor measures both LVDT signals andchooses the higher of the two signals. This valueis chosen because the LVDT is designed to havea strong failure preference for low voltage out-put. The signal is compared with the position

9

GER-3658D

Table 4CRITICAL REDUNDANT SENSORS

Parameter Type Function Usage NumberSpeed Mag. Pickup CTL & PROT Dedicated 3 to 6Exhaust temperature T.C. CTL & PROT Dedicated 13 to 27Generator output Transducer Control Dedicated 3Liquid fuel flow Mag. pickup Control Dedicated 3Gas fuel flow Transducer Control Dedicated 3Water flow Mag. pickup Control Dedicated 3Actuator stroke LVDT Control Shared 2/ActuatorSteam flow Transducer Control Shared 1Vibration Seismic probe Protection Shared 8 to 11Flame Scanner Protection Shared 4 to 8Fire Switch Protection Shared 17 to 21Control oil pressure Switch Protection Shared 3L.O. pressure Switch Protection Shared 3L.O. temperature Switch Protection Shared 3Exh. frame blwr. Switch Protection Shared 2Filter delta p. Switch Protection Shared 3

Notes:1. Dedicated sensors: one-third are connected to each processor2. Shared sensors are shared by processors3. Thee number of exhaust thermocouples is related to the number of combustors4. Vibration and fire detectors are related to the physical arrangement5. Generator output are redundant only for “constant settable droop” systems6. Dry Low NOx has four flame detectors in each of two zones

command and the error signal passed through atransfer function and a D/A converter to a cur-rent amplifier. The current amplifier from eachcontrol processor drives one of the three coils.The servo valve acts on the sum of the ampereturns. If one of the three channels fails, themaximum current that one failed amplifier candeliver is overridden by the combined signalsfrom the remaining two good amplifiers. Theresult is that the turbine continues runningunder control.

The SIFT system ensures that the output fuelcommand signals to the digital servo stay instep. As a result, almost all single failures willnot cause an appreciable bump in the con-trolled turbine parameter. Diagnostics of LVDTexcitation voltage, LVDT outputs that disagree,and current not equalling the commandedvalue make it easy to find a system problem, sothat on-line repair can be initiated quickly.

An independent protective module <P> isinternally triple redundant. It accepts speed sen-sors, flame detectors and potential transformerinputs to perform emergency electronic over-speed, flame detection and synchronizing func-tions. Hardware voting for <P> solenoid outputs

is accomplished on a trip card associated withthe module. The trip card merges trip contactsignals from the emergency overspeed, the maincontrol processors, manual trip push buttonsand other hardwired customer trips.

Overspeed and synchronization functions areindependently performed in both the triple-redundant control and triple-redundant protec-tive hardware, which reduces the probability ofmachine overspeed or out of phase synchroniz-ing to the lowest achievable values.

SPEEDTRONIC™ Mark V control providesinterfaces to DCS systems for plant control fromthe <I> processor. The two interfaces availableare Modbus Slave Station and a standard ether-net link, which complies with the IEEE-802.3specification for the physical and medium accesscontrol (MAC) layers. A GE protocol is availablefor use over the ethernet link. A hardwiredinterface is also available.

Table 5 lists signals and commands availableon the interfacing links. The table includes anoption for hard-wired contacts and 4-20 ma sig-nals intended to interface with older systemssuch as SCADA remote dispatch terminal units.The wires are connected to the I/O module

10

GER-3658D

GT20782AFigure 9. Digital servo position loops

associated with <C>.The “stage link” that interconnects the <C>

processor with the <I> processor is anextendible Arcnet link that allows daisy chainingmultiple gas turbines with multiple <I> proces-sors. Thus a single gas turbine can be controlledfrom multiple <I> processors, or a single <I>processor can control multiple gas and steamturbines. For multi-unit configurations, the <I>processor can be equipped with plant load con-trol capability that will allow plant level manage-ment of all units for both real and reactivepower. The <I> processor, or OperatorInterface, is shown in Figure 10.

In process plants where maintaining the linkto the DCS is essential to keeping the plant on-line, two <I> processors are used to obtainredundant links to the DCS system. For criticalinstallations, a redundant <C> processor option,referred to as the <D> processor, is available thatensures that no single hardware failure caninterrupt communications between the gas tur-bine and the DCS system.

A specially configured PC is available to act asa “historian,” or <H> processor, for the gas tur-bine installation. All data available in the Mark Vdata base can be captured and stored by the his-torian. Analog data is stored when the valueschange beyond a settable deadband, and eventsand alarms are captured when they occur. Inaddition, data can be requested periodically oron demand in user definable lists. The historianis sized so that about a month’s worth of data fora typical four unit plant can be stored on line,and provisions are included for both archivingand restoring older data. Display optionsinclude a full range of trending, cross-plottingand histogram screens.

Compliance with recognized standards is animportant aspect of SPEEDTRONIC™ Mark Vcontrols. It is designed to comply with severalstandards including:

• ETL — Approval has been obtained forlabeling of the Mark V control panel, withETL labeling of complete control cabs

• CSA/UL — Approval has been obtainedfor the complete SPEEDTRONIC™ Mark Vcontrol panel

• UBC — Seismic Code Section 2312 Zone 4• ANSI — B133.4 Gas Turbine Control and

Protection System• ANSI — C37.90A Surge Withstand

11

GER-3658D

Table 5INTERFACING OPTIONS

Hardwired• Connects to common “C” processor I/O• Commands to turbine control

– Turbine start/stop– Turbine fast load– Governor set point raise/lower– Base/Peak load selection– Gas/Distillate fuel selection– Generator voltage (VARS) raise/lower– Generator synchronizing inhibit/release

• Feedback from turbine control– Watts, VARS and volts (analog for meters)– Breaker status– Starting sequence status– Flame indication– On temperature control indication

• Alarm management– RS232C data transmission only, from <1>

Modbus link• Turbine control is Modbus slave station• Transmission on request by master, 300 to 19,200

baud• Connects to interface processor (I)• RS232C link layer• Commands available

– All allowable remote commands are available– Alarm management

• Feedback from turbine control– Most turbine data available in the I data base

GT22904

Figure 10. Mark V operator interface

HARDWARE CONFIGURATION

The SPEEDTRONIC™ Mark V gas turbinecontrol system is specifically designed for GE gasand steam turbines, and uses a considerablenumber of CMOS and VLSI chips selected tominimize power dissipation and maximize func-tionality. The new design dissipates less powerthan previous generations for equivalent panels.Ambient air at the panel inlet vents should bebetween 32 F and 72 F (0 C and 40 C) with ahumidity between 5 and 95%, non-condensing.The standard panel is a NEMA 1A panel that is90 inches high, 54 inches wide, 20 inches deep,and weighs approximately 1,200 pounds. Figure11 shows the panel with doors closed.

For gas turbines, the standard panel runs on125 volt DC unit battery power, with AC auxil-iary input at 120 volt, 50/60 Hz, used for theignition transformer and the <I> processor. Thetypical standard panel will require 900 watts ofDC and 300 watts of auxiliar y AC power.Alternatively, the auxiliary power can be 240 voltAC 50 Hz, or it can be supplied from an option-al black start inverter from the battery.

The power distribution module conditionsthe power and distributes it to the individual

power supplies for the redundant processorsthrough replaceable fuses. Each control modulesupplies its own regulated DC busses via AC/DCconverters. These can accept an extremely widerange of incoming DC, which makes the controltolerant of significant battery voltage dips, suchas those caused by starting a diesel crankingmotor. All power sources and regulated bussesare monitored. Individual power supplies can bereplaced while the turbine is running.

The Interface Data Processor, particularly aremote <I>, can be powered by house power.This will normally be the case when the centralcontrol room has an Uninterruptible PowerSupply (UPS) system. AC for the local <I> pro-cessor will normally be supplied via a cable fromthe SPEEDTRONIC™ Mark V panel or alterna-tively from house power.

The panel is constructed in a modular fash-ion and is quite standardized. A picture of thepanel interior is shown in Figure 12, and themodules are identified by location in Figure 13.Each of these modules is also standardized, anda typical processor module is shown in Figure14. They feature card racks that tilt out so cardscan be individually accessed. Cards are connect-ed by front-mounted ribbon cables which can beeasily disconnected for service purposes. Tiltingthe card rack back in place and closing the frontcover locks the cards in place.

Considerable thought has been given to therouting of incoming wires to minimize noiseand crosstalk. The wiring has been made moreaccessible for ease of installation. Each wire iseasily identified and the resulting installation isneat.

The panels are made in a highly standardizedmanufacturing process. Quality control is anintegral part of the manufacturing; only thor-oughly tested panels leave the factory. By having

12

GER-3658D

RDC26449-2-5

Figure 11. Mark V turbine control panel

RDC26449-2-8

Figure 12. Panel internal arrangement

a highly controlled process, the resulting mod-ules and panels are very consistent and repeat-able.

SOFTWARE CONFIGURATIONImproved methods of implementing the

triple-modular redundant system center on SIFTtechnology and result in a more robust control.SIFT involves exchanging information on thevoter link directly between <R>, <S>, <T> and<C> controllers. Each control processor mea-sures all of its input sensors so that each sensorsignal is represented by a number in the con-troller. The sensor numbers to be voted aregathered in a table of values. The values of allstate outputs, such as integrators, for example,the load setpoint, are added to the table. Eachcontrol processor sends its table out on the voterlink and receives tables from the other proces-sors. Consider the <R> controller: it outputs itstable to and receives the tables from the <S> and<T> controllers. Now all three controller tableswill be in the <R> processor, which selects the

median value for each sensor and integratoroutput, and uses these voted outputs in all sub-sequent calculations. <S> and <T> follow thesame procedure.

The basic SIFT concept brings one sensor ofeach kind into each of <R>, <S> and <T>. If asensor fails, the controller with the failed trans-ducer initially has a bad value. But it exchangesdata with the other processors and when the vot-ing takes place, the bad value is rejected.Therefore, a SIFT-based system can tolerate onefailed transducer of each kind. In previous sys-tems, one failed transducer was likely to causeone processor to vote to trip. A failure of a dif-ferent kind of transducer on another controllercould cause a turbine trip. This does not hap-pen with SIFT because the input data isexchanged and voted.

<C> is also connected to the voter link. Iteavesdrops while all three sets of variables aretransmitted by the control processors and calcu-lates the voted values for itself. If there are anysignificant disagreements, <C> reports them to<I> for operator attention and maintenanceaction. If one of the transducers has failed, itsoutput will not be correct and there will be a dis-agreement with the two correct values. <C> willthen diagnose that the transducer or partsimmediately associated with it have failed andwill post an alarm to <I>.

Voting is also performed on the outputs of allintegrators and other state variables. Byexchanging these variables, fewer bumps in out-put are caused when a failure or a repair takesplace. For instance, if a turbine is set to run onisochronous speed control with an isolated load,an integrator compares the frequency of thegenerator with the nominal frequency reference(50 Hz or 60 Hz). Any error is integrated to pro-duce the fuel command signal. If one computercalculates an erroneously high fuel command,nothing happens because the processors willexchange the fuel command and vote and allwill use the correct value of fuel command.When the processor is repaired and put back inservice, its fuel command will initially be set tozero. But as soon as the first data is exchangedon the voter link, the repaired control processorwill output the voted value that will be from oneof the running processors so no bump in fuelflow will occur. No special hardware or softwareis needed to keep integrated outputs in step.

Since only one turbine is connected to eachpanel, the triple-redundant control informationmust be recombined. This recombination isdone in software or, for more critical signals, in

13

GER-3658D

GT20783A

Figure 13. Module map of panel interior

GT21533A

Figure14. Typical processor module

dedicated voting hardware. For critical outputs,such as the fuel command, the recombination ofthe signals is done by the servo valve on the tur-bine itself as previously explained.

For example, up to four critical 4 ma to 20 maoutputs are voted in a dedicated electronic cir-cuit. The circuit selects the median signal foroutput. It takes control power for the electronicsand the actual output current from all three sec-tions such that any two control sections will sus-tain the correct output. Non-critical outputs aresoftware voted and output by the I/O associatedwith <C>.

Logic outputs are voted by dedicated hard-ware relay driver circuits that require two orthree “on” signals to pick up the output relay.Control power for the circuit and output relay istaken from all three control sections.

Protective functions are accomplished by thecontrol processors and, for overspeed, indepen-dently by the Protective Module <P> as well.Primary speed pickups are wired to the controlprocessors and used for both speed control andprimary overspeed protection. The trip com-mands, generated by the primary overspeed pro-tective function in the control processors, eachactivate a relay driver. The driver signals are sentto the trip card in the protective model whereindependent relays are actuated. Contacts fromeach of these three primary protective trip relaysare voted to cause the trip solenoid to drop out.Separate overspeed pickups are brought to theindependent protective module. Their relaycontacts are wired in a voting arrangement tothe other side of the trip solenoid and indepen-dently cause the trip solenoid to drop out ondetection of overspeed.

The <I> processor is equipped with a harddisk which keeps the records that define the sitesoftware configuration. It comes from GE withthe site-specific software properly configured.For most upgrades, the basic software configura-tion on the disk is replaced with new softwarefrom the GE factory. The software is quite flexi-ble and most required alterations can be madeon site by qualified personnel. Security codeslimit access to the programs used to change con-stants and sequencing, do logic forcing, manualcontrol and so forth. These codes are under thecontrol of the owner so that if there is a need tochange access codes, new ones can be estab-lished on site. Basic changes in configuration,such as an upgrade to turbine capability,requires that the new software be compiled in<I> and downloaded to the processor modules.The information for <C> is stored in EEPROM

there. The information for the control proces-sors is passed through <C> and stored in EEP-ROM in <R>, <S> and <T>. Once the downloadis complete, the <I> processor can fail and theturbine will continue to run properly, acceptingcommands from the local backup display while<I> is being repaired.

Changes in control constants can be accom-plished on-line in working memory. For exam-ple, a new set of tuning constants can be tried. Ifthey are found to be satisfactory, they can beuploaded for storage in <I> where they will beretained for use in any subsequent softwaredownload. <I> also keeps a complete list of vari-ables that can be displayed and printed.

The most critical algorithms for protection,control and sequencing have evolved over manyyears of GE gas turbine experience. These basicalgorithms are in EPROM. They are tuned andadapted with constants that are field adjustable.By protecting these critical algorithms frominadvertent change, the performance and safetyof the complete fleet of GE gas turbines is mademore secure.

OPERATION ANDMAINTENANCE

The operator interface is comprised of a VGAcolor graphics monitor, keyboard and printer.The functions available on the operator inter-face are shown in Table 6.

Displays for normal operation center aroundthe unit control display. It shows the status ofmajor selections and presents key turbineparameters in a table that includes the variablename, value and engineering units. A list of theoldest three unacknowledged alarms appears onthis screen. The operator interface also supportsan operator-entered list of variables, called auser defined display, where the operator cantype in any turbine-generator variable and it willbe added to the variable list. Commands thatchange the state of the turbine require an armactivate sequence to avoid accidental operation.The exception is setpoint incrementing com-mands, which are processed immediately and donot require an arm-activate sequence.

Alarm management screens list all the alarmsin the chronological order of their time tags.The most recent alarm is added to the top of thedisplay list. The line shows whether the alarmhas been acknowledged or not, and whether thealarm is still active. When the alarm conditionclears, the alarm can be reset. If reset is selectedand the alarm has not cleared, the alarm does

14

GER-3658D

not clear and the original time tag is retained.The alarm log prints alarms in their arrival

sequence, showing the time tags which are sentfrom the control modules with each alarm.Software is provided to allow printing of otherinformation, such as copying of text screens, or

making a listing of the full text of all alarms orturbine variables. When the printer has beenrequested to make such an output, it will formfeed, print the complete list and form feedagain. Any alarms that happened during thetime of printing were stored and are now print-ed. An optional alternative is to add a secondprinter, dedicating one to the alarm log.

Administrative displays help with various taskssuch as setting processor real time clocks andthe date. These displays will include the selec-tion of engineering units and allow changingbetween English and metric units.

There are a number of diagnostic displaysthat provide information on the turbine and onthe condition of the control system. A partial listof the diagnostics available is presented in Table7. The trip diagnostic screen traps the actual sig-nal condition that caused a turbine trip. Thisdisplay gives detailed information about theactual logic signal path that caused any trip. It isaccomplished by freezing information about thelogic path when the trip occurs. This is particu-larly useful in identifying the original source oftrouble if a spurious signal manages to causeone of the control processors to call for a tripand does not leave a normal diagnostic trail. InSPEEDTRONIC™ Mark V controls, all trips areannunciated and information about the actuallogic path that caused the trip is captured. Inaddition to this information, contact inputs areresolved to one millisecond, which makes thissequence of events information more valuable.

The previously mentioned comparison of vot-ing values is another powerful diagnostic tool.Normally these values will agree and significantdisagreement means that something is wrong.Diagnostic alarms are generated whenever thereis such a disagreement. Examination of theserecords can reveal what has gone wrong with thesystem. Many of these combinations have specif-ic diagnostics associated with them and the soft-ware has many algorithms that infer what hasgone wrong from a pattern of incoming diag-nostic signals. In this way the diagnostic alarmwill identify as nearly as possible what is wrong,such as a failed power supply, blown fuse, failedcard, or open sensor circuit.

Some of the diagnostics are intended toenhance turbine-generator monitoring. Forinstance, reading and saving the actual closingtime of the breaker is an excellent diagnostic onthe health of the synchronizing system. An out-put from the flame detectors which shows theeffective ultraviolet light level is another newdiagnostic routine. It is an indicator of degrada-

15

GER-3658D

Table 6OPERATOR INTERFACE FUNCTIONS

• Control– Unit control– Generator control (or load control)– Alarm management– Manual control (examples)

• Preselected load setpoint• Inlet guide vane control• Isochronous control• Fuel stroke reference• Auxiliary control• Water wash• Mechanical overspeed test

• Data (examples)– Exhaust temperatures– Lube oil temperatures– Wheelspace temperatures– Generator temperatures– Vibration– Timers and event counters– Emission control data– Logical status

• Contracts in• Relay out• Internal logic

– Demand display• Periodic logging

• Administrative–– Set time/date– Select scale units– Display identification numbers– Change security code• Maintenance/Diagnostics– Control reference– Configuration tools– Tuning tools

• Constant change routines– Actuator auto-calibrate– Trip display– Rung display– Logic forcing– Diagnostic alarms– Diagnostic displays

• Off-line• On-line

– System memory access

tion in the ultraviolet flame detection system.In another example, the contact input circuits

can be forced to either state and then be inter-rogated to ensure that the circuit functions cor-rectly without disturbing their normal opera-tion. The extent of this kind of diagnostics hasbeen greatly increased in SPEEDTRONIC™

Mark V control over previous generations. Thislevel of monitoring and diagnostics makes main-tenance easier and faster so that the control sys-tem stays in better repair. A properly maintainedpanel is highly fault-tolerant and makes systemsstarting and running reliability approach 100%.

Once the diagnostic routines have located afailed part, it may be replaced while the turbinecontinues to run. The most critical function ofthe diagnostics is to identify the proper controlsection where the problem exists. Wrong identi-fication could lead to powering down a goodsection and result in a vote to trip. If the failedsection is also voting to trip, the turbine will trip.A great deal of effort has been put into identify-ing the correct section. To affect the repair, thecorrect section is powered down. The module isopened and tilted out, the offending card locat-ed, cables disconnected, card replaced andcables reconnected. The rack is closed andpower is reapplied to the module. The modulewill then join in with the others to control theturbine and the fault tolerance is restored.

Should the fault be in the <I> or <C> proces-sor, it is likely that the operator display will stopor go blank and commands can no longer besent by the operator to the turbine from <I>.

This upsets the operator much more than it dis-turbs the control processors or turbine. A back-up display is provided to handle this situation. Ithappens very infrequently, and repair of thenormal operator interface will usually be accom-plished in less than three hours. Optionalredundant <I> processors make the use of theback-up display even more unlikely. The gas tur-bine control is completely automatic and needslittle human intervention for starting, running,stopping or tripping once a sequence is initiat-ed.

The back-up display provides for a minimumset of control commands: start, stop, raise loadand lower load. It reports all process alarms bynumber. Since the alarm text can be altered onsite in <I>, a provision is included to print thealarms with their internal alarm numbers. Thislist is used to look up the alarm name from thealarm number. The same is true for data points;however, a preselected list of key data points areprogrammed into the back-up panel that displaythe short symbol name, value and engineeringunits. The control ships from the factory withthis limited list of key parameters established forthe back-up display.

CONTROL SYSTEMEXPERIENCE

The SPEEDTRONIC™ Mark V TurbineControl System was initially put into service inMay 1992 on one of three industrial generatordrive MS9001B gas turbines. The system was sub-sequently put into utility service on two peakinggas turbines to obtain experience in daily start-ing service in order to develop a starting reliabil-ity assessment in addition to the continuousduty running reliability assessment. Generalproduct line shipments of the Mark V System onnew unit production commenced early in 1993,with new installations starting up throughoutthe second half of that year.

Today, virtually all turbine shipments includeMark V Turbine Controls. This includes 424 newgas turbines and 106 new steam turbines eithershipped or on order. In addition, almost 80existing units have been committed toretrofitted SPEEDTRONIC™ Mark V TurbineControl Systems, however, the bulk of these aredesigned as Simplex rather than the triple-redundant systems associated with new units.This is due to the floor space available in retrofitapplications. Reliability of the in service fleet,subsequent to commissioning and after accumu-lating more than 1.4 million powered opera-

16

GER-3658D

Table 7MONITORING AND DIAGNOSTICS

• Power– Incoming power sources– Power distribution– All control voltages– Battery ground, non-interfering with other ground

detectors• Sensors and actuators

– Contact inputs circuits can force and interrogate– Open thermocouple– Open and short on seismic vibration transducers– LVDT excitation voltage– Servovalve current feedback loopback test– 4/20 MA control outputs — loopback testing– Relay driver; voting current monitor– RTD open and short

• Protective– Flame detector; UV light level count output– Synchronizer — phase angle at closure– Trip contact status monitor

• Voted data

tional hours on 264 units, has been as expected.Indicated MTBFO (mean time between forceoutages) is in excess of 28,000 hours for the sys-tem, which includes control panel, sensors, actu-ators and all intervening wiring and connectors.This performance is shown relative to the rest ofthe electronic control history in Figure 15.

Why is the Mark V system so much better thanits predecessors? First, there are fewer compo-nents to fail and fewer types of components inthe control panel. (This also means that thereare fewer spares to stock.) Two-out-of-threeredundancy on critical functions and compo-nents ensures that failures, which are less likelyto begin with, are also less likely to cause a tur-bine trip. Extensive built-in diagnostics and theability to replace almost any component whilerunning further minimize exposure time, whilerunning with a failed component when thepotential to trip resulting from a double failure,is highest. Finally, the high degree of standard-ized, yet still flexible, software and hardwareallowed a much greater degree of automatedmanufacturing and testing, substantially lower-ing the potential for human error, and increas-ing the repeatability of the process.

The Mark V system is a further improvementover the Mark IV system. Although the two-out-of-three voting philosophy is retained, its imple-mentation is improved and made more robustthrough use of SIFT techniques. Componentsand types of components have been furtherreduced in number. Standardization of hard-

ware and software has been carried several stepsfurther, but flexibility has also been increased.Greater degrees of automated manufacturingand testing have been complimented by greateruse of computer-aided engineering to standard-ize the generation and testing of software andsystem configuration. Thus, it is fully expectedthe Mark V system will further advance the con-tinuing growth of gas turbine control systemstarting and running reliability.

SUMMARYThe SPEEDTRONIC™ Mark V Gas Turbine

Control System is based on a long history of suc-cessful gas turbine control experience, with asubstantial portion using electronic and micro-processor techniques. Further advancements inthe goals of starting and running reliability andsystem availability will be achieved by logical evo-lution of the unique architectural features devel-oped and initially put into service with the MarkIV system. Flexibility of application and ease ofoperation will also grow to meet the needs ofgenerator and mechanical drive systems, in pro-cess and utility operating environments, and inboth peaking and base load service.

17

GER-3658D

GT21537B

Figure 15. Control system reliability

REFERENCES1. Rowen, W.I., “Operating Characteristics of

Heavy-Duty Gas Turbines in Utility Service,”ASME Paper No. 88-GT-150, presented at theGas Turbine and Aeroengine Congress,Amsterdam, Netherlands, June 6-9, 1988.

18

GER-3658D

© 1996 GE Company

LIST OF FIGURES

Figure 1. Gas turbine generator controls and limitsFigure 2. Gas turbine fuel controlFigure 3. Dual fuel transfer characteristics gas to liquidFigure 4. Gas fuel control systemFigure 5. Liquid fuel control systemFigure 6. Typical gas turbine starting characteristicsFigure 7. Protective system block diagram; SPEEDTRONIC™ Mark V turbine controlFigure 8. Standard control configurationFigure 9. Digital servo position loopsFigure 10.Mark V operator interfaceFigure 11.Mark V turbine control panelFigure 12.Panel internal arrangementFigure 13.Module map of panel interiorFigure 14.Typical processor moduleFigure 15.Control system reliability

LIST OF TABLES

Table 1. Advances in electronic control conceptsTable 2. Gas turbine control philosophyTable 3. Simple cycle package power plant starting timesTable 4. Critical redundant sensorsTable 5. Interfacing optionsTable 6. Operator interface functionsTable 7. Monitoring and diagnostics

GER-3658D