I have been asked to look at the blackout of a refinery. It happened during a grid collapse when the frequency dropped to zero. Before the refinery could go into island mode, one of its main GE gas turbines tripped on High Exhaust temperature. It was operating in droop mode. It would have been taking full load from 49.4 Hz (50Hz system) and tripped circa 48-48.5Hz approx 3 seconds after moving to full load.

Question: Why could the MkVI not control the load on the machine / to avoid the high exhaust temp trip and just maintain full load output ?

Its a Frame 6 Nominally rated 47MW. Prior to the event it was loaded 39MW, with 19MW being exported to the grid.

Any pointers / advice ? Could this trip have been avoided ?

and

The islanding action was initiated at 47.5Hz. This was set because of grid compliance for power generators which may be less appropriate for a refinery that has a dual function to provide power to the grid from its cogen plant but also a responsibility to continue to operate its own process and successfully survive a collapsing grid frequency (it has enough own generation and load shedding).

Has anyone got knowledge of examples where a utility has accepted higher setting from a refinery/power generator for the underfrequency trip ?

Cheers,

Paul

 

@PAUL,

One thing which would help your analysis would be to know if the machine was being operated in what's called Pre-Selected Load Control Mode, which is an outer loop to Droop Speed Control that is often (mis-)used to prevent a machine from "drifting" from a desired load setpoint.

It would also be helpful to know what the machine load was when the grid frequency was decreasing. ONE of the (many) functions of Droop Speed Control is to try to change load during a grid frequency disturbance to try to help support grid stability. For example, if the grid frequency increases above nominal the a machine operating at Part Load (less than rated load for the given operating conditions) Droop Speed Control would sense the change in frequency (machine speed, actually, which is directly related to frequency) and would REDUCE load to prevent the frequency from increasing more in an attempt to help stabilize the grid and grid frequency. If the frequency decreases it means there is less generation available than necessary to support the load while maintaining grid frequency. So, Droop Speed Control increases the load of the machine to try to accept some of the load on the grid that isn't being properly supplied--again, in an effort to help support grid frequency and stability.

HOWEVER, for the majority of GE-design heavy duty gas turbines with Mark* turbine control systems there is a little bug that causes the change in load brought about by a change in grid frequency and makes an OPPOSITE change in load to try to return the load to the Pre-Selected Load Control setpoint (or reference or command). This sets up a hunting situation for the Mark* as Droop Speed Control and Pre-Selected Load Control are both trying to change load--one in an attempt to support grid frequency and grid stability and the other in a misguided attempt to maintain a constant load.

GE has a couple of software fixes for this, and sometimes they are properly implemented--and sometimes they are not.

So, let's presume the load on the machine increased relatively quickly as the grid frequency started to decrease AND Pre-Selected Load Control (or some version of remote (third-party controller) load control) was not enabled and active--or was cancelled when the grid frequency dropped below a certain level. The Mark* would increase fuel flow to try to increase the load on the machine to attempt to help stabilize the grid and grid frequency. If the grid frequency decrease happened very quickly, fuel flow would be increased very quickly. If the machine was already operating close to the maximum allowable load for the machine condition and ambient conditions this sudden increase in fuel flow-rate could cause an exhaust over-temperature alarm and/or trip. The fuel flow is increased in response to a difference in speeds--the machine speed reference and the machine actual speed. Under normal operating conditions, the machine speed reference is stable and not changing--and we don't know a lot about the full control scheme possibly working with or trying to control gas turbine load--but presuming the machine speed reference was not changing the difference would result from a decrease in machine actual speed (because of the frequency decrease) which would increase the fuel flow to the machine. The faster the grid frequency/actual machine speed decreased the faster the fuel flow would increase. And depending on what the machine exhaust temperature was at the time the grid disturbance started it's very possible the machine was already operating near the maximum allowable exhaust temperature.

To make matters even more complicated, if the machine was exhausting into an HRSG (boiler) to produce steam at Part Load then the IGVs would probably have been partially closed to try to maximize gas turbine exhaust temperature (and steam production and temperature by the HRSG) so it wouldn't take much of an increase in fuel flow to cause enough of a rise in exhaust temperature to result in an exhaust overtemperature alarm and/or trip.

Finally, if the machine has DLN-I combustors then the IGVs are often used to help stabilize combustion--which results in elevated exhaust temperatures, so the gas turbine exhaust is often close to the maximum allowable exhaust temperature (as is the case when using the IGVs to maximize exhaust temperature AND HRSG steam production) and an exhaust overtemperature alarm and trip levels aren't that far above the machine's operating conditions.

If the ambient was hot, and there was no inlet air cooling in operation, AND the machine's axial compressor wasn't clean and the inlet air filters were also dirty and/or something was causing the exhaust back-pressure to be higher than normal then the machine was likely operating very close to the exhaust overtemperature alarm and trip levels.

There are really a LOT of factors which could contribute to a machine operating near maximum allowable exhaust temperature (IGV Exhaust Temperature Control, also called Combined Cycle Control; DLN-I combustion systems; Pre-Selected Load Control in operation (without one of the OEM software fixes installed and working properly); machine conditions (ambient temperature; exhaust duct back pressure; axial compressor (and IGV) cleanliness)) that could factor into the situation. There may also have been some grid voltage fluctuations and phase imbalances which played a role in the situation--we don't know. And, really, high-speed data (much faster than once-per-second) is really required for a proper in-depth analysis of a situation like this.

Under normal operating conditions--even when grid frequency deviates from normal within a "reasonable" window of operation--the Mark* turbine control system can often sense an exhaust overtemperature condition and limit fuel flow appropriately. BUT, there's a LOT about the way the machine was being operated AND the actual timing of the grid frequency collapse(!) that we don't know. This is offered to try to help understand what may have contributed to the situation, and no offer of further help with analysis of this particular situation over this forum is implied (simply too difficult to get complete information and answers--and more importantly, actionable data, from the event). The Mark* is a fine turbine control capable of responding appropriately to lots of disturbances under reasonable circumstances. A grid frequency collapse is not one of them. We also don't know what the load on the machine was immediately before the breaker tripped (and actionable data--from a graph or chart where the data was collected at a rate faster than once-per-second) would be required to understand that. (By the way, some electrical protective relay manufacturers have stores of prior data available that a lot of people don't know about--this would be current, voltage and load, primarily.)

A lot of sites, like refineries, will have some kind of PMS (Power Management System) in case they intend to operate while separated from a grid and that often includes some kind of load-shedding scheme to try to limit the load on the machines still generating power after a grid separation to try to help prevent overloading the machines (which can result in an exhaust overtemperature alarm and/or trip.) And we don't know if the site has one or if it operates reliably or if it was in operation (I know of more than one site where the PMS wasn't in service for one of several (questionable) reasons.)

Tips, hints or tricks for preventing a similar occurrence? Foremost, don't operate the machine continuously in Pre-Selected Load Control. It's not necessary, but convincing operators and their supervisors the machine won't "run away" and they won't lose their jobs is friggin' impossible. (Ask me how I know....) And, really, a comprehensive understanding of what actually occurred would be the best way to determine a possible course of action.

As for what utilities will and won't accept--well, that's "negotiable" in most parts of the world. Even in more industrialized parts of the world negotiations can lead to some surprising results.

 

Thank you very much WTF for such a comprehensive response. Quite a lot to unpick there and indeed I will engage further with the technicians at site to try to address some of the issues. It appears it is the set up on this individual machine because the (only other) second machine in parallel did not trip on high exhaust temps. It survived a few more seconds until after the islanding breaker opened but then tripped for "unclear reasons" (possibly loss of auxiliaries due to undervoltage but this not yet proven). And yes, since they are Cogen machines they exhaust into a HRSG. BTW load prior to grid Hz drop was circa 38MW. I just received Hz and load and temp chart ::

 

@Paul O,

One thing I completely forgot to mention is that when a heavy duty gas turbine is synchronized to a grid with other machines and the grid frequency decreases the gas turbine's speed will decrease--which will decrease the amount of air flowing through the machine (axial compressors move the most air when they are running at or very near rated speed; decrease the speed of the axial compressor and the air flow through it will also decrease). The decrease in air flow will cause the exhaust temperature to increase--even if there is no change in fuel flow! Now--when the control system is trying to increase fuel flow to try to increase load AND the air flow through the machine is decreasing then the exhaust temperature is going to increase--sometimes very quickly. You can see from the chart that the speed was decreasing, and the load was decreasing and the exhaust temperature which had been increasing slightly as the frequency was decreasing (the graph doesn't show what happened as the frequency initially started to decrease!) nor does it have a vertical axis for the exhaust temperature.

Lastly, when a machine is running at or near full load the exhaust temperature is already very close to the maximum allowable exhaust temperature. The exhaust overtemperature alarm (which we don't know when it was annunciated) is only something like 25 degrees F above the maximum allowable exhaust temperature and the exhaust overtemperature trip is only something like 15 degrees F above the alarm. And we're talking about exhaust temperatures near 1100 deg F at or near full load.

(47MW is kind of high for a GE-design Frame 6 heavy duty gas turbine. Are you thinking the generator's nameplate rating is the rated output of the machine? Gas turbine generators are almost always rated at a higher output than the gas turbines themselves for a number of reasons (gas turbine output increases above gas turbine nameplate when the ambient air temperature is less than nameplate). Just wondering.)

If the data came from a Mark* VI HMI running Toolbox/ToolboxST and Trender/Trend Recorder (or the History Display, which records data in the same format as Trender/Trend Recorder) the little "ticks" on the graph lines indicate actual recorded data. The lines between the ticks are interpolated. And the ticks seem to be about a second apart--which is poor resolution for trying to analyze this event.

 

Again, many thanks WTF. I will need to check more on rating data and site ambient at the time etc.
For me, a big question mark is that its sister IDENTICAL machine running in parallel - also in droop - survived until after the 47.5Hz islanding and did not trip on high exhaust temp but other causes (to be investigated more).
That alone suggests there was some difference in tuning between the machines.
Anyway you have been incredibly helpful and I really appreciate the time and effort you put in to guiding "amateurs" such as myself.
Cheers
Paul

 

Forgot to say - the sister was sharing the load so almost same on each machine before Hz drop GT1 - 36MW (and 103 t/hr HRSG production), GT 2 - 38MW (and 109 t/hr HRSG production). I am going to site next week and will see if I can dig up more data.

 

You mentioned load shedding. That makes me suspect some sort of “remote” load control as far as the Mark* VI is concerned. Which could explain a lot, or not.

One of the machines may have been getting commands from the PMS to vary load when synchronized to the grid and the other may have just been at Part Load with a constant load setpoint from either the PMS or the Mark* VI HMI.

Lots of unknowns, that wouldn’t be related to tuning. Tuning is something that GE machines don’t generally require—UNLESS there is some non-standard sequencing. Or someone mucked with something they shouldn’t have been mucking with….

GE’s droop speed control is pretty bulletproof by itself with standard parameters. It really is pretty much the gold standard of droop speed control. Except for the little gotcha called Pre-Selected Load Control…. during grid frequency disturbances.

When the grid frequency drives axial compressor speed down which decreases air flow through the machine that can lead the exhaust overtemperature conditions, alarms but not usually trips. The Mark* turbine controls get blamed—undeservedly so—for lots of ills and evils that are literally out of its control. Sure—it has LOTS of wires and LOTS of flashing LEDS and that alone makes it the first suspect whenever something happens that shouldn’t happen in (in the opinion of inexperienced operators and plant managers). We also don’t know what other alarms—Process and Diagnostic—that were active and/or annunciated during the event.

Islanded operation is very much misunderstood, as is Isochronous Speed Control AS IS Droop Speed Control. Droop is, honestly, a simple concept—ingenious, actually—that is taken for granted and blamed for a lot of things both real and perceived. )Mostly perceived.) There is a perception in the business of power generation that prime mover controls can’t operate “properly” without a PMS and I’ve seen many PMSs that were extremely poorly programmed and caused more problems than they solved.

Automation—contrary to popular belief and sales propaganda—IS NOT the answer to all problems. Especially when it comes to island power plant operation. Many talented and Smart Control system programmers know very little about power generation, Droop- or Isochronous Speed Control and parallel operation of multiple prime movers and generators. This leads to some problematic PMSs and misplaced blame for the prime mover control systems they interact with. The PMS programmers believe their programming to be solid and don’t really understand the prime mover controls or operation and so they blame the prime mover control system. Usually, there isn’t a prime mover control system OEM representative around to stick up for the control system, and often they, too, don’t fully understand Droop- and Isochronous Speed Control either—because GE’s implantations just “work” without much tuning or adjustment.

 

@Paul O,

Don't forget to ask whether or not the machine(s) have some version of DLN-I (Dry Low NOx version 1) combustors.

Get as much information as you can about the load-shedding scheme and if it's a part of some overall, external power management system (PMS) that sends commands to the machines when synchronized to the grid and also when not synchronized to the grid. Of particular interest would be what happens when the grid frequency starts decreasing below some preset level--does the scheme possibly open the utitlity tie breaker/connection? (Or, if it doesn't--should it?)