Fault-tolerant logic design of single-point temperature protection system

In order to ensure the safe operation of large-capacity thermal power units, the requirements for the protection control system of the units are getting higher and higher. At present, due to process limitations, the turbine bearing temperature protection, turbine return oil temperature protection and other systems usually can only use single-point temperature measurement, but because the temperature measuring element is prone to poor contact or broken wires, the temperature protection system is prone to malfunction, which seriously affects the safe and economical operation of the unit.

In order to improve the reliability of the temperature protection system, a fault-tolerant design can be adopted in the logic design of the temperature protection, that is, the faults that are prone to occur in the temperature measurement link during operation should be considered as much as possible, and erroneous temperature signals should be identified through pre-set logical measures to prevent the protection system from malfunctioning.

1 Fault-tolerant logic design

1.1 Solution 1

Fault-tolerant logic design scheme 1 adopts temperature change rate bad point locking logic (Figure 1).

As shown in Figure 1, this scheme sets the change rate of the temperature signal. When the temperature measurement circuit is normal, a protection trip signal will be issued when the return oil temperature of the turbine bearing is greater than the set value Hl (75°C). When the temperature measurement circuit is abnormal: (1) When the temperature measurement point is judged to be a bad point, the temperature protection trip output signal is shielded; (2) When the change rate of the temperature signal exceeds a certain limit (H:, °C/s), the SR trigger is set to 1, and the temperature protection function automatically exits. When the fault of the measurement point is eliminated, the protection control system can be reset automatically or manually to put the temperature protection function back into operation.

1.2 Solution 2

Fault-tolerant logic design scheme 2 adopts delay, high-high limit, and low-low limit bad point lockout logic (Figure 2).

As shown in Figure 2, this solution adds upper and lower limit judgments to the temperature signal, and the protection is output after a delay of 1 second (to prevent interference). When the temperature measurement circuit is normal, when the bearing return oil temperature is greater than the set value Hl (75°C), a protection trip signal will be issued after a delay of 1 second. When the temperature measurement circuit is abnormal: (1) When the measuring point is a bad point, the protection output signal is shielded; (2) When the measured value of the temperature signal is far from the working area, such as when the auxiliary bearing return oil temperature is higher than the upper limit H (150°C) or lower than the lower limit L (0°C), the protection output signal will be shielded.

In addition, a temperature protection switching switch can be set to prevent false operation of the temperature protection during maintenance. It can also be used to temporarily exit the protection when the displayed value of the temperature measuring point fluctuates up and down (the thermal resistor has poor contact) to prevent false operation of the protection.

In order to ensure the safe operation of large-capacity thermal power units, the requirements for the protection control system of the units are getting higher and higher. At present, due to process limitations, the turbine bearing temperature protection, turbine return oil temperature protection and other systems usually can only use single-point temperature measurement, but because the temperature measuring element is prone to poor contact or broken wires, the temperature protection system is prone to malfunction, which seriously affects the safe and economical operation of the unit.

In order to improve the reliability of the temperature protection system, a fault-tolerant design can be adopted in the logic design of the temperature protection, that is, the faults that are prone to occur in the temperature measurement link during operation should be considered as much as possible, and erroneous temperature signals should be identified through pre-set logical measures to prevent the protection system from malfunctioning.

1 Fault-tolerant logic design

1.1 Solution 1

Fault-tolerant logic design scheme 1 adopts temperature change rate bad point locking logic (Figure 1).

As shown in Figure 1, this scheme sets the change rate of the temperature signal. When the temperature measurement circuit is normal, a protection trip signal will be issued when the return oil temperature of the turbine bearing is greater than the set value Hl (75°C). When the temperature measurement circuit is abnormal: (1) When the temperature measurement point is judged to be a bad point, the temperature protection trip output signal is shielded; (2) When the change rate of the temperature signal exceeds a certain limit (H:, °C/s), the SR trigger is set to 1, and the temperature protection function automatically exits. When the fault of the measurement point is eliminated, the protection control system can be reset automatically or manually to put the temperature protection function back into operation.

1.2 Solution 2

Fault-tolerant logic design scheme 2 adopts delay, high-high limit, and low-low limit bad point lockout logic (Figure 2).

As shown in Figure 2, this solution adds upper and lower limit judgments to the temperature signal, and the protection is output after a delay of 1 second (to prevent interference). When the temperature measurement circuit is normal, when the bearing return oil temperature is greater than the set value Hl (75°C), a protection trip signal will be issued after a delay of 1 second. When the temperature measurement circuit is abnormal: (1) When the measuring point is a bad point, the protection output signal is shielded; (2) When the measured value of the temperature signal is far from the working area, such as when the auxiliary bearing return oil temperature is higher than the upper limit H (150°C) or lower than the lower limit L (0°C), the protection output signal will be shielded.

In addition, a temperature protection switching switch can be set to prevent false operation of the temperature protection during maintenance. It can also be used to temporarily exit the protection when the displayed value of the temperature measuring point fluctuates up and down (the thermal resistor has poor contact) to prevent false operation of the protection.

2 Comparison of Fault-Tolerant Logic Design Schemes

At present, many power plants use thermal resistor signals to generate switch quantities in DCS to replace temperature switches for temperature interlock protection. In the temperature protection function, the quality judgment of the measurement point is the key to ensure the correct action of the protection and avoid false action of the protection. The main reasons for incorrect measurement of the thermal resistor temperature measurement circuit are as follows:

(l) Electromagnetic interference of the circuit, which is characterized by rapid changes in the measurement signal, short action time, and is an occasional event;

(2) Poor circuit contact, characterized by sudden changes in the measurement signal or deviations from normal values. If not repaired, this phenomenon will persist for a long time.

(3) A wire break occurs in the circuit, which is characterized by a sudden change in the measurement signal that cannot be restored.

In the thermal resistor input module, there is generally an automatic hardware detection function. When there is a power outage, module type error, transmitter failure, thermal resistor input disconnection, or hardware circuit failure, the module will issue a hardware alarm and use this point as a bad point to exit the logic operation, thereby avoiding temperature protection malfunctions caused by stuck parts. The fault-tolerant logic of Figures 1 and 2 are designed with this function.

If the fault-tolerant logic design scheme 1 is adopted, as long as the temperature change rate limit (H2) is set appropriately, the logic can effectively prevent the protection from malfunctioning in the case of interference or disconnection; for poor contact, the logic can only prevent the protection from malfunctioning when the temperature change rate is large. However, it is difficult to determine the setting of the H2 value. If it is too large, the logic loses its fault-tolerant meaning and cannot effectively prevent the protection from malfunctioning. If it is too small, the protection function will be locked when the temperature changes normally, causing the protection to refuse to operate.

Figure 3 is a feedwater pump curve for tripping when the working oil temperature of the hydraulic coupling of the No. 4 electric feedwater pump of a unit of Zhoushan Langxi Power Generation Co., Ltd. (Zhoushan Power Plant) is high. During the process of switching from the No. 4 electric feedwater pump to the No. 3 feedwater pump, due to the failure of the No. 4 electric feedwater pump check valve to close normally, the feedwater entered the No. 4 electric feedwater pump, causing the No. 4 electric feedwater pump to reverse, causing the working oil temperature of the hydraulic coupling of the feedwater pump to rise sharply. The temperature change data is shown in Table 1.

As can be seen from Figure 3 or Table 1, in some periods, the temperature change rate of the hydraulic coupling of the No. 4 electric feedwater pump is large, and the temperature change rate is different in different periods, and the values ​​are very different, which shows that the H2 value is difficult to set. In addition, if the fault-tolerant logic design scheme 1 is selected, other related parameters need to be set. Taking Zhoushan Power Plant as an example, its No. 1 125MW unit and No. 2 135MW unit control systems both use the NETWORK-6000 DCS manufactured by the British Continental Company. When setting the parameters of the temperature change rate logic lock, it is necessary to pay attention to the following: (l) There is a first-order filter time parameter in the thermal resistor input channel module. If the time is set too large, even if the input temperature signal changes greatly, the module output will change slowly. At this time, if the temperature change rate logic is used, the control meaning will be lost. Therefore, the system default first-order filter time parameter needs to be modified during configuration, and it can be set smaller or set to 0.

(2) The SampTime parameter value of the NETWORK-6000 DCS rate of change module should be small enough to track all valid process variable (PV) changes, but not so small that the calculation results in a zero rate (due to rounding errors).

Scheme 2 sets H and L to lock the protection signal output when the temperature measurement point wiring is poorly connected, short-circuited or disconnected. L can generally be set to 0℃, because the temperature of the unit is generally higher than 0℃ when it is working normally; H is set with the temperature that may be reached after Hl delays for 1s as the reference point. If the bearing return oil temperature protection value is 75℃, H can be set to about 150℃ (twice the protection value).

Therefore, it is particularly important to select logical scheme 1 and make appropriate parameter settings, while the parameter settings of scheme 2 are relatively simple.

In actual applications, the appropriate fault-tolerant logic design scheme can be selected according to the physical characteristics and importance of the equipment. For example, when the turbine bearing return oil temperature is high enough to trip the turbine, the turbine monitoring value will change greatly, which may cause the protection to operate first. In addition, the turbine bearing return oil temperature is the temperature after the lubricating oil cools the bearing, which lags behind the actual bearing temperature and changes slowly, so it is advisable to adopt scheme 1. For some auxiliary machines with redundant configuration (1 unit in operation and 1 unit in standby), as well as forced draft fans and induced draft fans (although both units are working when the unit is running), if the bearing working oil of one fan is only protected by temperature when it is working, it is easy to cause the protection to refuse to operate, so scheme 2 is adopted.

3 Conclusion

At present, Zhoushan Power Plant has selected Scheme 1 for turbine bearing temperature protection and Scheme 2 for some auxiliary machine bearing temperature protection based on the actual operation conditions of the units. More than two years of practical application have shown that the selection of the above logic schemes not only ensures that the protection does not refuse to operate, but also greatly reduces the number of false protection operations, thus ensuring the safe and stable operation of the units.