Control scheme of security power supply system in DCS

summary:

The security power supply is set up to ensure that the unit can be shut down smoothly when the whole plant is out of power. It mainly provides power for steam turbines, feed water pumps, coal mills, fan lubrication systems and control systems, uninterruptible power supplies (UPS), power and control DC systems, etc. At present, the accident security power supply set up in the power supply system of large-capacity unit plants mostly uses diesel generators as backup power supplies. The control of diesel generators and the switching of security power supplies generally use relay hard wiring control or PLC control. In view of the reliability of DCS, the security power supply system of the 2×600MW units of the first phase of Huaneng Chaohu Power Plant was changed from PLC control to DCS control.

1. Security Power System

Figure 1 shows the safety power supply system of a unit in Huaneng Chaohu Power Plant. Each unit is equipped with MCC A section and MCC B section safety power supplies, which are respectively powered by the turbine PCA section and the turbine PCB section during normal operation. When the safety MCC A section or the safety MCC B section power supply fails, the safety MCC A section or the safety MCC B section is first switched to the boiler PCA section or the boiler PCB section for power supply. If the boiler PCA section or the boiler PCB section power supply also fails or the switching fails, the diesel generator is automatically started, so that the safety MCC A section or the safety MCC B section is powered by the diesel generator.

2. Defects and shortcomings

(1) The security power supply system is controlled by PLC, which has complex wiring. At the same time, the control signal, feedback signal, fault signal and security MCC section bus low voltage signal of the security power supply system are sent to the DCS and the local PLC control system, which makes the secondary circuit complex and reduces reliability. In order to prevent asynchronous closing, the closing signal of the security section incoming switch sent by the DCS must be sent to the local PLC control system for control, which also makes the secondary circuit more complex.

(2) The switching method for restoring normal power supply is the uninterrupted power supply parallel switching method, that is, first close the QF12 (or QF22) switch to restore the power supply of the safety section, and then disconnect the QF1 (or QF2) feeder switch of the safety PC section, which makes the synchronous check circuit and control logic more complicated, and usually the instantaneous power outage method is used for switching.

(3) When the safety section loses power, only the low voltage of the safety section bus is used as the control criterion, which can easily trigger the automatic control program of the diesel generator by mistake. Cutting off the power supply line switch of the safety section increases the risk of power failure in the safety section.

[page]3. Improvement of security power supply system control

3.1 Automatic start control logic

The operation of the system is selected by the operation mode switch. There are two operation mode switches on the DCS, namely the security MCC section A and the security MCC section B. The operation modes are automatic and manual. To prevent asynchronous paralleling caused by misoperation, taking the security MCC section A as an example, after the automatic control mode of the security MCC section A is put into operation, the control logic will prohibit manual operation, that is, the QF11, QF12, QF13, QF14, and QF1 switches cannot be manually operated on the DCS. The conditions for the automatic control mode of the security MCCA section to be put into operation are: the diesel generator is in automatic control mode; the QF1 and QF14 switches are in standby state; the QF11, QF12, and QF13 switches are in the closed position; the security MCCA section is energized; the turbine PCA section is energized; and the boiler PCA section is energized.

When the operation mode switch of the security MCC A section is in the automatic control position, when the normal power supply of the security MCC A section disappears, its automatic control program will run. The automatic control program of the security MCC A section is shown in Figure 2.

(1) Determine whether the A section of the security MCC is de-energized. To prevent misjudgment leading to erroneous switching to the security section, a composite condition is used for judgment, that is, when the busbar of the A section of the security MCC and the busbar of the PCA section of the turbine are at low voltage and the switches QF11 and QF12 are in the closed position, or when the busbar of the A section of the security MCC is at low voltage and QF11 or QF12 is in the tripped position, it is determined that the A section of the security MCC is de-energized.

(2) The security MCC A section switches to the backup power supply of the boiler PCA section and issues a QF12 switch tripping command, and the QF12 switch has tripped. Confirm that the boiler PCA section is energized and the QF13 switch is in the closed position, otherwise, an instruction to start the diesel generator set is issued; an instruction to close the QF14 switch is issued and the QF14 switch has been closed, otherwise, an instruction to start the diesel generator set is issued.

(3) Determine if the security MCC A section has lost power again. The security MCC A section busbar and the boiler PCA section busbar are under voltage and the QF13 and QF14 switches are in the closed position. The security MCC A section busbar is under voltage, or the QF13 or QF14 switch is in the tripped position and the QF13 and QF14 switch protection is not activated (if the QF13 or QF14 switch protection is activated, the diesel generator automatic control program will be exited). It is determined that the security MCC A section has lost power again.

(4) After the starting diesel generator set issues the QF14 switch tripping command, the QF14 switch has tripped; after the starting diesel generator set command is issued and the diesel generator set starts, the QF01 switch immediately closes automatically and the safety PC section is energized.

(5) The power supply of security MCC section A is switched to security PC section. Confirm that QF12 and QF14 switches are in the tripped position and QFO1 is in the closed position. Issue the command to close the QF1 switch, and security MCC section A is energized.

3.2 Automatic shutdown control logic

(l) Determine whether the system is energized After receiving the energized signal from the PCA section of the steam turbine, it can be determined that the system is energized. However, to prevent misjudgment, a delay of 120 seconds is required to confirm whether the PCA section of the steam turbine is energized.

(2) Switch the security MCC section A to normal power supply mode with the QF11 switch in the closed position. The DCS issues a QF1 switch trip command and confirms receipt of the QF1 switch trip feedback signal. The DCS issues a QF12 switch closing command and confirms receipt of the QF12 switch closed feedback signal and the security MCC section A is energized.

(3) Stop the diesel generator set. Safety MCC section A and safety MCC section B are energized and the QF1 and QF2 switches are in the tripping position. Delay 3 minutes to shut down the diesel generator set.

3.3 Manual control logic

Switch the security MCC A section operation mode switch to manual control mode on the DCS. In manual control mode, you can manually conduct a synchronous grid-connected test on the diesel generator, or manually switch the security MCCA section to the boiler PCA section backup power supply, or manually switch the security MCC A section to the diesel generator set power supply, etc.

To prevent asynchronous paralleling due to misoperation, the interlocking logic between switches needs to be set on the DCS. When the security MCC section A is in manual control mode and the QF1 switch is in the tripping position, the manual closing function of the QF11, QF12, QF13, and QF14 switches is blocked; when the security MCC section A is in manual control mode and the QF01 and QF2 switches are in the tripping position and the QF12 switch is in the closed position, or when QF1 is in the closed position and the QF12 and QF14 switches are in the tripping position, the manual closing function of the QF1 switch is blocked.

4. Dealing with problems during debugging

4.1 DCS and diesel generator interface

(1) Automatic start In the diesel generator set control circuit, the automatic start command of the diesel generator set should be a continuous high-level signal. Once the high-level signal disappears, the diesel generator set will shut down. In this regard, a 24VDC self-holding start relay is added to the system. After the pulse signal sent by the DCS to start the diesel generator set disappears, the self-holding start relay will keep the command signal as a continuous high-level signal to maintain the operation of the diesel generator.

(2) Automatic shutdown The automatic shutdown pulse signal sent by the DCS is mainly used to stop and trip the diesel generator output switch. In order to expand the number of output contacts, a 24VDC shutdown relay is added to the system. The DCS sends an automatic shutdown pulse signal to trigger the relay to operate. A pair of normally closed contacts of the action relay is used to release the self-holding start relay to stop the diesel generator set, a pair of normally open contacts is connected to the diesel generator output switch tripping circuit, and another pair of normally closed contacts is connected to the diesel generator output switch closing circuit to prevent the switch from repeatedly tripping and closing. In addition, it should be noted that the width of the DCS automatic shutdown pulse signal should be greater than the time required for the diesel generator to shut down.

[page]4.2 Load switching

When the security MCC section A and the security MCC section B lose power at the same time, in order to prevent the two sections of load from being put into operation at the same time, causing the diesel generator started for protection to stop running, or the load current is too large to cause tripping due to the decrease in the diesel generator output voltage during the load switching process, the automatic switching control logic of QF1 and QF2 switches is set so that as long as any one of the QF1 and QF2 switches is closed, the other switch will be closed with a delay of 10s, which is equivalent to putting the security load into operation in two times.

4.3 Safety section power failure judgment criteria

Usually, the low voltage of the security section bus is used as the criterion for the power failure protection of the security section. When the voltage of the security section bus is normal and the diesel generator set is in automatic control mode, if the PT of the security section bus is withdrawn for some reason or is accidentally touched or pulled by humans, the automatic control program of the diesel generator will be mistakenly started, and the power supply line switch of the security section will be cut off, thereby increasing the risk of power failure of the security section. In this regard, a composite condition is used as the criterion for the power failure of the security section: the voltage of the security section bus and the PC section bus of the steam turbine is low and the QF11 and QF12 switches are in the closed position, or the voltage of the security section bus is low and the QF11 or QF12 switches are in the tripping position and the QF11 and QF12 switch protection is not actuated, then the power failure of the security section will be actuated.

4.4 Protection lock

In the case of low voltage in the security section busbar and the QF11 or QF12 switch in the tripping position and the QF11 and QF12 switch protection not being actuated, the power outage in the security section is caused by the switch tripping in error. To prevent the power-off security MCC section A or security MCC section B busbar from being impacted again, the protection action signal will cause the diesel generator automatic control program to exit operation. After the unit was put into operation, the security MCC section A working power supply line switch QF12 tripped, and the security standby power supply line switch QF14 did not automatically close, causing the security MCC section A to lose power, IC, ID coal mills, etc. to trip, and the unit load dropped from 389MW to 300MW. On-site inspection revealed that the MT12N1 working power supply line switch QF12 of the security MCC A section displayed the AP LED alarm (the automatic protection trip signal of the QF12 switch control unit (overtemperature or control unit damage, etc.) was on, and the main contact of the circuit breaker was overheated during operation, causing the circuit breaker to automatically protect. In response to this, the automatic control logic of the diesel generator was modified to cancel the locking of the protection action signal of the working power supply circuit of the security MCC A and security MCC B sections, that is, when the security MCC section loses power, regardless of whether the power supply line switch is protected or not, the backup power supply line switch is automatically closed; if the backup power supply line switch is protected, the diesel generator exits the automatic control mode.

4.5 Low Voltage Relay Selection

Usually, DY-32 or DY-33 voltage relays are used as power bus low voltage protection relays. Since these two types of relays are electromagnetic overvoltage relays, they are not allowed to be in a closed state for a long time after exceeding the action value, otherwise the electromagnetic mechanism will be in a vibrating state for a long time, causing the relay contacts to shake, arc, and stick, affecting the automatic starting of the diesel generator set. In this regard, DY-37 electromagnetic low voltage relays or JY-156 integrated circuit low voltage relays are used instead.

V. Conclusion

(1) The DCS hardware has complete functions and fast response speed. Its input/output module can be easily connected to the diesel generator control without any secondary safety protection problems.

(2) The DCS-controlled security power supply system is simple to program and easy to use, and has an offline simulation program running function, which is convenient for detecting the correctness of the control program; the control logic can be configured online, and operation and maintenance are convenient.

(3) Using DCS to control the security power supply can share the real-time data of the DCS security power supply system without adding cables and control equipment; because the input/output module margin in the DCS design is large, existing resources can be used.

(4) The secondary control circuit is simplified, and reliability and safety are improved.

(5) Automatic control of the safety power supply switching is realized, making the operation of the safety power supply system switch and the self-starting of the diesel generator set faster and more reliable.