Two recent unrelated field events at separate sites had a common factor: A single point of failure originating in one device out of a redundant set. Together, they offer an opportunity to tighten up start sequences and avoid failures to start, noted Abel Rochwarger, chief engineer, Gas Turbine Controls Corp.
The first case involves a site with four simple-cycle frame gas turbines, the second a site with two aero GTs in combined cycle.
Ambient temperature TCs. At the frame site, a high differential among ambient-temperature thermocouples (TCs) was causing a “not ready to start” situation. Ambient temperature is measured with three TCs in the inlet filter house having a centerline oriented north-south. When the sun is in the West, the west-side thermocouple (W-TC) reads higher than the other two. This creates a differential that is interpreted as a “failure” resulting in a “not ready to start” status.
Examination of the inlet filter house revealed that the W-TC (photo at left), was much closer to the wall than the east-side thermocouple (E-TC, photo at right). The third thermocouple was on the centerline. The W-TC reading was affected by the proximity to the inlet-filter sidewall.
There were two compounding problems. The first is sub-optimal location of the thermocouples. For ambient-temperature measurement, it should be acceptable to install all three thermocouples about 2 ft apart in the center of the filter house. The second is that the sequence used a “no high differential” as a permissive to start—that is, a high differential would result in a “not ready to start” condition.
Thus, one thermocouple reading much differently than the other two resulted in a “not ready to start,” a single point of failure.
Two-part solution. The first recommendation is that, at first opportunity, the site should locate E-TC and W-TC closer to the center of the inlet filter housing, about two feet from the centerline TC. This has the added advantage of allowing maintenance on all three without maneuvering a step ladder while also avoiding the nuisance alarm during sunny periods of the day.
The second recommendation is to replace the “no high differential” from the permissives-to-start with a “two out of three TCs failed.” Having triple redundant TCs use the differential between the highest and lowest reading to determine start readiness does not make sense. With this simple mod, when one TC fails, the site gets an alarm but will still remain ready to start; two failed TCs will interrupt the start sequence.
Speed pickups on aero GTs. At the second site, during startup, one of the two LP-compressor speed pickups feeding the control core (not the protective) was spiking to 128% (max scale) momentarily, but long enough to trip the unit. The spikes occurred only during startup and at below 40% speed.
Site personnel changed the speed pickup, rechecked all the wiring, shields, and wiring and shield terminations, and, as expected, found nothing damaged, loose, or wrong. Yet the situation persisted. Curiously, after the spike induced the first overspeed trip, the operator could restart the unit, consistently, with no second spike.
Other specialists could not find any physical evidence of malfunction, or wiring errors, either, so the sequencing was investigated. These units have two, not three, control speed pickups per shaft. A high-select block, the higher of the two speed pick-ups, determines the LP-compressor shaft speed.
If one of the two speed pickups spikes, even momentarily, the high-select block will read the spike as the shaft’s speed and trip the unit. This is the single point of failure.
However, there is a selectable option with better functionality for checking I/O status. When the signals are within acceptable limits, the output can be the average (Avg) instead of the maximum (Max) of the two input signals (the “high select” block). This method will also detect high differential and discard the first “too high or too low” device using the other device’s value as the block’s output through the Max function instead of Avg. If both devices read too high or too low, the block detects an “all devices failed” condition.
This not-so-widely-used block, compared with the “high select” block, allows the unit to survive the speed spike without a trip during the start. The corresponding one-bad-signal alarm is dropped during the momentary spike.
After making this mod, the units have gone through several starts without trips.
Wrapping up. It is not clear why the OEM’s sequence considered the “no-differential” as a permissive to start with three physical redundant thermocouples, or why the TCs were located so close to the walls. Why the OEM used the “high select” block instead of the alternative one at the aero site is also a mystery. But independent review can discover valid options to resolve single-point-of-failure conditions.
