Turbine overspeed testing

Turbine overspeed events lead to costly and dangerous catastrophic failures. Therefore the overspeed system has to be periodically tested to ensure the system has the adequate response time to protect the turbines, plants and personnel.

Below are excerpts from the paper, "Turbine overspeed systems and required response times" by Scott L Taylor of Woodward and Sheldon S Smith of American Electric Power at the 2009 Turbomachinery Symposium in Houston.

Regular, periodic testing is the only way to ensure a protection system is working. In some cases, without exercising the system, mechanical components may become stuck rendering the protection system inoperable. Regular testing of stop or trip valves is generally recommended on a weekly or monthly basis where possible. Additionally it is recommended to shut down with the trip valve(s) whenever possible.

One of the largest owner/operators of power generation equipment requires annual testing on large machines. For mechanical bolts a minimum of two tests are required. If the trip speed of the second test is higher than the first, then a third test is required. Electronic systems can be tested at lower speed. Where there are exceptions to this rule the specific test requirements would have to be recommended by the turbine OEM.

Another very large owner/operator allows low speed trips for testing but requires a “full stress” (full speed) test after any front standard work that could affect speed sensors, wiring, and gap.

Specific test recommendations will come from OEMs and insurance carriers and each owner/operator will establish test requirements for a specific unit. There are a number of studies that discuss testing frequency based on recorded failure probability either across the industry or for a given site. These procedures should not be considered static. As more experience is gained with the unit or as the unit is modified, these procedures, test scope, and test intervals, should be reexamined. Also, as root causes of incidents of all units are examined and shared, new best practices may be recognized.

Low Speed Testing

On generator applications, the full overspeed test point exerts tremendous forces on the rotating components of the turbine and generator. This can lead to increased maintenance costs in the long run so there is some incentive to perform the overspeed system test at a lower rpm.

On compressor or pump applications, it is often (but not always) physically impossible to achieve the overspeed setpoint with the compressors or pumps connected. So users perform overspeed tests with the units uncoupled. Uncoupling and recoupling is a labor intensive process. When uncoupled, the rotational inertia of the system is greatly reduced. This means the control dynamics for the normal system and the uncoupled system are different. This may require entering a different set of dynamics or retuning the governor system for testing (and making sure the original governing system dynamics are restored when the test is complete). In some cases special functions have been added to the governing system to support additional modes for uncoupled testing. Again, there is a risk that the modes of operation be specified or selected correctly.

In both of the above cases there are compelling reasons to perform at least some of the tests of the overspeed protection system at a lower speed. But, insurance carriers and corporate testing requirements must also be met. Some sites require validation of the trip system functionality at full speed but then allow lower speed tests provided no changes are made in the system, particularly with the speed pickup, brackets, or sensing gear that could affect the ability to properly sense speed. There are some specific case examples that demonstrate the value of full speed testing.

Trip System Testing While Running

Many units run for long periods of time, multiple years, between outages. So there may be extended periods of time where actual trip testing cannot be performed. To ensure reliability and availability of the overspeed protection system, periodic partial system testing is performed. This may include confirming mechanical/hydraulic operation of a part of the trip system or performing some simulated test on part of the electronic system while the trip circuit is partially blocked. Ideally the systems should be designed with enough redundancy that protection is not compromised during the test process (but this is not always the case).

In some systems it is possible to do some level of valve testing either at rated or reduced load conditions. While this is valuable, and in some cases necessary to ensure the operation of the valve, it does not guarantee a proper seating of the valve. So there is still a case for a full functional trip test (although this need not be from full trip speed).

Risks of Testing

An overspeed event requires three components:

• Loss of load,
• Failure of the control, and
• Failure of the overspeed protections system.

During an overspeed test the unit is not loaded and the control may be partially compromised by operating above normal operational speeds and, where driving equipment is uncoupled, with a significantly reduced inertia. The overspeed test requires putting the protection system into an abnormal state—either by changing setpoints, overriding normal governor limits, and possibly operating with a different set of system dynamics. So the last line of defense may be the very protection system that is being tested to confirm its functionality. A significant number of overspeed incidents, by some estimates nearly half, occur during testing. Obviously some preliminary testing is required prior to performing a full overspeed test. This may include performing a low speed test prior to full speed testing.

After a successful test is performed it is equally important that the system be restored to the normal operating state. A second set of tests, such as simulated speed testing if the setpoint was changed, should be performed to confirm the system is correctly restored to its normal operating conditions.

INCIDENTS AND ROOT CAUSE ANALYSIS

In one case a boiler feedpump turbine (BFPT) was tested at less than full overspeed trip for years. The setpoint was dialed down for the test and then reset. A safety audit required a full speed test. At 8000 rpm the unit did not trip and an emergency trip was selected. Next year the trip failed again. The third year the controls group got involved. The trip system electronics and program appeared to be correct. When the turbine was tested, above 6200 rpm the overspeed device started to miss pulses and the sensed speed dropped but not enough to trigger loss of speed sensed logic. Work was done by the OEM on the front standard and on the sensing wheel and the unit worked. Although the exact cause of the problem was not identified, one thought is that the rotor shifted slightly at high speeds and that only in those conditions would the speed signal be partially lost. Tests with a frequency generator to simulate speed would not have exposed this problem.

In another case a BFPT was tripped for no apparent reason. Just prior to this, another BFPT had tripped and the distributed control systems (DCS) increased the demand to the second BFPT. It picked up speed and tripped. It was not immediately obvious that an overspeed had occurred. On analysis of the data it was recognized that it tripped at the mechanical overspeed trip setpoint. The electronic governor setpoint was scaled as 0 to 10,000 rpm when the operating range was only around 8000 rpm. The controllers protected overspeed were set to 105 percent of this total range (not 105 percent of the normal maximum operating point). On this unit additional instrumentation was added to annunciate the overspeed bolt trip and the controller was rescaled to the proper operating range.

It is critical that the industry look to and share incidents and root cause analysis to determine how to prevent the repetition of mistakes.

RESPONSE TIME TESTING

API 612 (2005) 16.3.4.6 states, “The response time of the overspeed shutdown system shall be recorded to confirm compliance with the requirements of 12.3.1.1.” But this is in a list of optional tests that may be performed as shop tests and not a regular test requirement.

A great deal of emphasis is placed on overspeed testing but this is done under controlled conditions. Speed is raised slowly to the trip point. This confirms the overspeed trip setpoint but does nothing to confirm the dynamic response of the trip system. This factor is as critical as the setpoint.

The authors have shown that the response time of the entire trip system is critical to the protection of the turbine and that relatively small variations (undetectable to an operator) are very significant. Since the timing of these electrohydraulic circuits is so important and the systems so complex, the need to periodically record the trip time and then trend those response times to identify any progressive degradation in the system seems obvious. In the past, achieving a resolution of 1mS to evaluate the response time of a trip system would require specialized equipment but today this is readily available from sequence of event (SOE) cards in DCS systems and programmable logic controller (PLC) systems.

Periodic trip system response time testing, as with the overspeed setpoint testing, is needed to ensure the overspeed prevention system is operating as designed and that the required level of equipment and personnel protection is provided.