Steam Turbine Overspeed Protection Failures, Causes and

STEAM TURBINE OVERSPEED PROTECTION FAILURES, CAUSES, AND STRATEGIES TO AVOID THEM

Wallace F. Ebner, PE Chartis

Farmington, CT. USA ABSTRACT There have been a number of failures of overspeed protection schemes in recent years. This paper describes the basic protection schemes and the areas of weakness and provides an overview of the over speed losses that have taken place over the last several years as well as the causes. It presents some of the statistics regarding losses in the last 5 years and discusses some common themes. What does this data tells us? What are ways to improve the chances of avoiding these failures? What can owners and operators do to prevent them at their plants? INTRODUCTION Steam turbine generators continue to power a majority of our electrical grid. These machines of incredible power and the tightest of tolerances have long operated with an impressive reliability. Some turbines placed into service almost 60 years ago continue to operate near to the original performance levels. This is a testament to the designers as well as those who have operated the equipment. Many steam turbine generators will include multiple sections bolted together to form a single rotating assembly which can measure hundreds of feet long. They can be driven by steam generated in fossil fuel fired boilers from natural gas, oil, or coal; in a Heat Recovery Steam Generator (HRSG) using the exhaust from a gas turbine in a combined cycle application; or in a nuclear reactor. Regardless of the source of steam, the steam turbine generator is central piece of equipment in any power plant.

Photo 1.

HMN steam turbine Courtesy of Siemens Are we becoming smarter & better? Over the years the designs have become more exact, material quality has improved, controls have improved, equipment condition monitoring and testing has improved, and non destructive examinations techniques have improved, to help continue the trend of improved reliability. Additionally, the industry’s knowledge regarding common failure modes and failure prevention has increased exponentially. It would seem with better equipment and controls, additional operational condition information and knowledge; we would see a drop in large steam turbine failures. This does not seem to be the case. In fact it seems as though failures have stayed constant or have increased in number over the last several years. A recent review of insurance carrier data indicates that the losses on steam turbines have been increasing over the last 5 years. The failures also are not just on the old units that have been in service for many years but are often on the new steam turbines used in the newest high efficiency combined cycle plants.

1 Copyright © 2012 by ASME

Proceedings of the 2012 20th International Conference on Nuclear Engineering collocated with the

ASME 2012 Power Conference ICONE20-POWER2012

July 30 - August 3, 2012, Anaheim, California, USA

ICONE20-POWER2012-54887

OVERVIEW – OVERSPEED FAILURES ARE OVERSPEED FAILURES STILL OCCURRING? Steam Turbine losses can be split into several general categories: Blade failures from blade integrity issues such as cracking; casing and rotor damage from water induction; bearing and rotor damage from loss of bearing lubricating oil; and unit destruction from failure due to overspeed. The most destructive failure is the overspeed loss, where the rotational speed of the steam turbine increases above operational design to the point where the materials fail and the unit is destroyed. These events, while infrequent, continue to occur on small and larger steam turbines regardless of the vintage, technology level, application, or type of control system (digital, analog, and hydro-mechanical, mechanical) associated with the steam turbine. [1]

Chart 1.

Over Speed20%

Flood3%

Other12%

Oil leak fire5%

Shells5% Gen

7%

Water Induction

8%

Steam path, 5%

Blade failure17%

Lube oil / Brg.15%

Major steam turbine losses break down by cause over 5 years – Chartis (losses over 1 million dollars) The overspeed event occurs when little or no energy is being consumed by the driven equipment, whether a generator, pump or compressor, and too much steam is provided to steam turbine. In such a situation the speed increases rapidly above the design operating speed in such a manner that a unit is driven to a point where the yield strength of the components is exceeded and they fail catastrophically. This can often occur in a very short period of time, in some cases a matter of ten seconds. The destruction often includes snapped rotor shafts, and blades and other pieces being ejected from the machine. Unfortunately, the severe destruction will also damage bearing lube oil supply lines, spraying oil, and may damage a hydrogen cooled generator to where hydrogen is released and an explosion and fire will ensue resulting in damage to the building and surrounding plant equipment. In some cases these failures have led to loss of life.

Overspeed events can and have resulted in loss of life as well cost in excess of 100 million dollars. Surprisingly, these losses are not declining in number but seem to be becoming more frequent. A review of my companies’ loss data for the last 5 years indicates that slightly more than 20% of the major steam turbine losses could be attributed to overspeed incidents. WHAT PREVENTS THE OVERSPEED FAILURE? All steam turbines have overspeed systems. Overspeed Protection systems are the most critical safety feature of the steam turbine. In the simplest form the overspeed protection system must detect when the operating speed is exceeded by a designated percentage (often 10 to 13%) and must close all valves to isolate any and all potential steam supplies. These valves are located on the main steam feed to the steam turbine (commonly called emergency stop valves or throttle trip valves) as well as on other lines such as extraction lines (commonly called non return valves) and reheat lines (commonly called intercept valves). The time from detection to steam isolation is to be on the order of one half second. There have been many mechanical and electrical schemes to accomplish this. On older machines the means were strictly mechanical and hydraulic in nature with the most popular being the mechanical bolt. The mechanical bolt overspeed device consists of a spring-loaded piston (bolt) mounted in a shaft, typically screwed, or bolted to the front of the turbine rotor. When turbine speed reaches an overspeed condition (i.e., 10% above running speed), the bolt centrifugal force overcomes the spring force, the bolt moves out and hits an oil dump valve lever which causes depressurization of the oil supply to all steam valves. This results in all valves immediately closing. On newer units, an electronic overspeed protection system is often provided. Electronic systems are more accurate and measure the speed to within 0.1%. They also have less mechanical moving parts that could wear and/or mal function. The electronic systems will use multiple magnetic speed sensor pickups, with a minimum of 3, to ensure there is adequate redundancy for this critical application. The 3 sensors will provide a signal to 3 individual signal processing units where the signal will be processed to speed value. The 3 processing units will provide a trip signal to 2 redundant trip units when the overspeed condition occurs. The trip units will trip the unit when any 2 of the processing units indicate that the overspeed set point has been reached. This type of controls arrangement is called a 2 of 3 voting scheme and is referred to as a Triple Modular Redundant (TMR) control system. When the 2 of 3 voting is satisfied, the trip units will open an oil dump valve to depressurize the oil system which allows the valves to stay open. The loss of oil pressure closes all


steam valves to eliminate the possibility of further increase in the speed. All turbine manufacturers provide means to periodically check the overspeed protection trip devices. The most complete means is to run the speed of the unit up to the control set point under controlled circumstances and verify that it trips, and at what speeds it trips. Also provided on mechanical hydraulic units is a means to port oil to one side of the trip mechanism which will move the bolt outward and trip the unit at operational speed. Likewise for electronic speed sensor units an electrical signal can be injected to test the trip at a speed well below the actual trip speed. On many larger power generation units there is also another line of defense built into the controls system that controls tripping of the generator breaker. This is called sequential tripping. The scheme makes use of the fact that a steam turbine cannot overspeed as long as it is connected to the grid. As such it is a way to make sure that the emergency stop valves are completely closed and steam is no longer entering the turbine before the breaker is open and the generator is removed from grid connection. In a sequential tripping scheme the steam turbine stop valves are tripped first and the generator circuit breaker only opens when the steam supply and rotational energy has decreased sufficiently to cause the generator reverse power relay to open the breaker. WHAT COMPONENTS CAN FAIL? The most common failure in the overspeed protection system is an emergency stop valve or non return valve not completely closing or binding in the slightly open position. The valves only need to be open a very small amount to be able to provide enough steam to drive the steam turbine and generator to destruction. The second most common failure mode includes the overspeed sensing system, such as the mechanical bolt described above failing to function properly. In this case the hydraulic oil holding the valve open is not released and the valve does not close. Other failure modes include water entering a steam turbine during shut down and failures in the hydraulic / control systems. CASE STUDIES I would like to present 3 cases that will help spotlight some of the ways failures occur. Case 1 This steam plant provides electrical power to a refinery as well as process steam. In the power house there were 4 boilers and 4 turbines. The refinery’s process steam was provided at two pressures from extraction points on the 4 turbines. It was an ordinary Saturday winter evening with 3 of 4 units on the line and one of

the 4 plant boilers off line for tube work. On a weekend evening only a few operators were scheduled on. The control room operator noticed that unit 1 generator had a sudden loss of excitation voltage, and before the operator could investigate the generator protective relays removed the unit from the line. The unit speed remained steady at first and then increased slowly and did not seem to be dropping. He sent another operator out to trip the turbine, who upon arriving at the front standard found the unit already tripped and pulling the trip level did not seem to reduce the speed. The speed continued to increase slowly and then started to rise at an alarming rate. In the next 30 seconds the unit reached over 160% of rated speed and the rpm indicator was pegged. In the next few seconds there was a shattering boom and the turbine floor was turned into a debris field as the unit started to come apart. A fire erupted at the rear of the High Pressure turbine section where an oil line had parted. In addition to feeding the fire, the oil continued down into a cable tray and to the cellar floor below. Because of a recent HVAC system upgrade of the control room that took make up air from the turbine deck, within 2 minutes the control room was filled with smoke and the operators had to evacuate without tripping the sister unit or initiating the manual deluge valve. The fire spread throughout the cellar and ran along the cable trays to engulf the DCS room and the medium and high voltage switchgear rooms. Soon al power was lost and the plant was black and on fire. Following a thorough investigation it was determined that an extraction valve had stuck slightly open and back fed extraction steam to the turbine to a point of destruction. The valve had been maintained at each turnaround in the past, but had been eliminated from the turnaround list and placed on an extended schedule. It had not been inspected for 5 years. The investigation team cited as a root cause, the failure to identify the check valve as a piece of critical equipment.

Photo 2.

Check valve not seated led to overspeed Case 2 This plant had suffered for some time with an oxide blush build up on the throttle / trip valve stem. On this OEM’s design, the throttle trip valve is the primary


means to isolate the steam flow in an overspeed situation. They had discussed the oxide blush build up with the OEM and were contemplating trying other materials less susceptible to this form of oxidation. The operators had learned to live with and work around this problem. During startup it was often required to use a hydraulic jack to break the valve off its seat to bring the steam turbine up to speed. The valve would function properly once it was opened. They were some what alarmed when they experienced a near miss about 6 months prior to the failure when the speed increased after the unit trip although it slowly decreased to stand still. Plans were made for additional work on the valves. In fact an outage to replace the valve parts was planned for just before the failure, but was postponed due to problems ordering parts. It was a normal day at the plant when the unit was removed from the line by the operator. After the breaker was opened, the speed increased to over 6000 rpm in just 39 seconds. The generator retaining rings failed first followed by multiple catastrophic center line failures. Due to a sudden release of hydrogen from the generator, a hydrogen explosion followed. The explosion blew out a section of the turbine room wall, which fell on the unit transformer, which ruptured and spilled oil, and another fire ensued. After inspection it was found that one throttle valve and several governor valves, down stream of the throttle valve, did not fully close. The throttle valve was held open by an oxide build up and the governor valves discs were held from closing by a step worn on a governor valve stem. The cause of the failure was that steam isolation valves did not close, but the root cause was the plant’s failure to understand the risks of operating with sticky valves. Case 3 This multi unit plant was in a capacity restricted region and was continually required to operate at near full capacity. The yearly check of the mechanical overspeed bolt trip device was performed on all units per statutory requirements. It came due and was planned for the back shift at a time when the system load had dropped off. The particular unit had experienced an overspeed event about 6 months earlier and since that time the oil trip test had resulted in lower trip pressures. On the day of the failure, the operator went to the front standard and performed the overspeed in the fashion that had become common practice at the plant, although not according to procedure. The overspeed bolt failed to function. The short cut that the operators has been accustomed to using, removed a back up protective trip that would have functioned even though the overspeed bolt failed to operate. This along with a governor control system software change made at the plant accelerated the unit at uncontrolled rate of acceleration. When the operator noticed that the unit had reached the trip speed with out

tripping he tried to stop the acceleration by lowering the control valves with a manual control. This proved to be too little to late, and unit destruction occurred at approximately 150% of the rated speed. The unit was completely destroyed. The cause of the failure was a failure of the overspeed trip to function, but the root cause was the change to control scheme and failure to follow proper operation procedures.

Photo 3.

Steam turbine after an overspeed – from internet What are some common elements of these failures?

In all three cases some mechanical equipment failed.

In all 3 cases a near miss or abnormal situation occurred prior to the loss, but went unnoticed or no action was taken. If action was taken after the first occurrence the failures could have been avoided.

In all three cases, operators and management had lived with improper procedures that developed at the plant.

In all three cases they could have taken action to avoid the failure.

In all three cases the damage was extensive and a fire resulted.

In all three cases there was a failure to understand the treat these critical safety protective system with proper respect.

In all three cases a recommendation was made for procedural changes and operator training.

WHAT ARE THE ELEMENTS OF A GOOD OVERSPEED PREVENTION PROGRAM? Good Management is the key to avoiding overspeed incidents When the insurance inspector arrives for the annual plant survey and the time comes to talk about the steam turbine, often the first question asked is, “When was the last time you tested the overspeed trip?” While testing is important perhaps the first question should be, “Tell me about your overspeed protection program?” As we see


in the case of these failures, the root cause of the failures would not be identified by trip device testing. The most important element of the overspeed protection program is not the overspeed device or testing of the overspeed device or even the valves, but is good plant management and operations. A good overspeed prevention program includes:

1. The most important first step is to know all the pieces of the entire overspeed protection system. A thorough understanding and appreciation of the importance of each component and part of the overspeed protection system is critical. MANAGEMENT MUST KNOW THE SAFETY CRITICAL EQUIPMENT.

2. The second step is to know what regulatory statutes, or standards govern how overspeed protection systems are handled.

3. Once the overspeed system components are identified, an overspeed prevention plan must be developed to insure all parts of the system are set correctly, functioning completely, are maintained properly, and operated competently. The operator’s part to play in overspeed prevention can not be over scored. Operators must understand how to identify abnormal functioning and what steps to take. They must know what actions to take in normal and emergency situations. Management must have a plan and procedures that address all safety critical equipment. This must include a complete set of emergency action procedures of what operators should do in the case of an overspeed.

WHAT DOES AN OVERSPEED PREVENTION PLAN INCLUDE? An overspeed prevention plan must address certain key tasks and discrete plans. These include, monitoring the overspeed system, testing that the overspeed system is operating properly, inspecting all overspeed safety critical equipment, and maintaining the overspeed system. All elements of the overspeed prevention plan must be translated into operational procedures. Training is required in all aspects of these tasks. CRITICAL ATTENTION MUST BE PAID TO SAFETY CRITICAL SYSTEMS, Monitor Operators must constantly be monitoring the overspeed protection system. API and IEC guidelines require that safety control systems be monitored on regular basis.

Monitoring the quality of the hydraulic oil Monitor that all circuits and logics paths are fully

functional (typically weekly) Monitor that all speed sensors are functioning

Monitor that any test results are satisfactory Comparison trending of results

A failure to monitor a system may well result in the unit not having reliable overspeed protection or no protection at all. For example if there is even a minor change in the oil trip test result immediate action should be taken. If a speed sensor probe fails, action should be taken within 8 hours or the unit should be shut down. Test It is important that each plant has a documented plan for testing the overspeed safety equipment. Testing the mechanical overspeed trip device alone is not adequate. The testing must include all components of the overspeed trip system. This includes:

Steam inlet valves main steam & reheat for freedom of movement

Non return valves for freedom of movement Speed sensing equipment Associated mechanical linkages and oil circuits Associated electrical relays and circuits Overspeed trip devices Electronic trip system processing software/

hardware Associated breakers

The steam inlet valves should be tested frequently to insure they are free to close without binding. All steam turbine manufacturers will provide a means to test the valves for freedom without removing the unit from the grid connection. For units that operate regularly, recommended practices would be between weekly to monthly, depending on the unit. Likewise, if the plant has a mechanical bolt type trip, it must also be verified to function freely. Most manufacturers will provide a means to direct oil to one side of the trip bolt on a temporary basis which provides the force to overcome the spring force of the trip mechanism and allow the trip bolt to function without actually being in an overspeed condition. This is sometimes referred to as an oil trip test or “simulated trip test”. Electronic trip system can also be tested via a set point change in electronic signal which will test the trip function without removing the unit without actually raising the unit to the full trip speed. Most newer systems will exercise the trip function, but block the final trip signal to the valves. The overspeed system must be periodically tested at the trip set point speed. For mechanical or bolt trip devices this will verify the trip set point which can shift over time For electronic trip systems all speed sensing probes must be verified as functional at the trip speed. This is important to insure that the speed is properly being sensed and the tripping actions are completed. It is particularly important to perform a test after an outage where the overspeed trip system has been disturbed.


Testing of an overspeed protection system must be approached with the utmost care and caution. The test should be planned ahead of time with operators properly trained and the test reviewed before it is done. The test should be approached as if the trip system will not work. Here are some suggested items that should be included in a proper overspeed test procedure.

A formal written operations procedure is to have been written and approved

A simulated overspeed test using the oil system should immediately precede the test

If the unit has a sequential tripping scheme, verify and document that the sequential trip scheme is functional.

The machine is to be in smooth operating condition and have no major defects in the rotating components

There are to be no faults in the speed sensing or the protective systems (verify system diagnostics)

Insure an accurate speed indication is available. An independent calibrated speed sensing is to be used unless a calibrated digital system is provided and verified

Ensure any precautions provided by the OEM have been adhered to.

During the test the following steps should be followed to insure a safe overspeed test: [8]

Hold a pre test meeting and briefing to review the procedure & insure all know the proper trip speed and their respective assignments.

Valve stroke testing should be performed Trip the unit from rated speed no load or below

rated speed. Verify all valves close & speed reduces and that all trip channels function properly with no annunciations, alarms or flags

Re latch the unit and test the trip lever / emergency push button and verify all channels work

The manual emergency trip must be manned by someone who can see the speed of the unit and is in contact with the operator controlling the speed.

Verify that the speed signal indication has been calibrated and is in agreement with the unit speed.

Ensure the boiler is stable and has steadied out. Ensure that the supply steam is kept to a

minimum. In a controlled manner, following any

precautions noted in the OEM manual, raise the speed to the rated trip speed, monitoring all operational parameters. (On some newer

control systems the trip test is automated and the ramp speed up to the trip set point is controlled by the control system.)

Record the speed that trip occurs. Manually trip the unit if for any reason the trip

set speed is reached and unit has not tripped. How often should the unit be tested? When determining how often to overspeed test, the operators need to be aware of any statutory requirements to perform the testing. For example some countries and some states in the US will require an annual overspeed test. Most insurance carriers will also expect to see an annual overspeed test. It interesting to note that the requirements of how often to perform an overspeed test at overspeed conditions, varies widely around the world. For example in England the practice is to conduct overspeed tests every six months while in Asia the practice is typically once every 4 years. Most statutory boards and insurance companies will suggest that you follow the manufacture’s recommendation. The manufactures that I have talked with recommend a yearly test of the overspeed trip. Absent a regulatory requirement many operators will perform the actual overspeed test in line with the major inspection of the turbine. So, how often should one perform an overspeed test? There seems to be a wide debate. There is no cook book answer, but each unit needs to be evaluated on it own merit and a decision made for the unit. This decision should be documented and followed. Here are some criteria for consideration:

Are there regulatory requirements? Are there any Manufacturer recommendations

for the unit? Insurance carrier’s recommendations Capacity factor; how many hours a year does

the unit operate? What has been the operational history? What have past tests results look like? When was the last major inspection? Are there any compromised components on the

rotor, such as minor flaws or minor indications? What other testing is being performed, simulated

testing etc. Inspect & Maintain Inspection of the steam stop valves is very important. As noted above, valve malfunction is the leading cause of overspeed failures. Valve malfunctions can occur from:

bent stems oxide build up on stems or bushings valve part wear from particle erosion part and linkage wear oil debris or contamination impacting oil relay

operation


The only means to insure correct operation is periodic disassembly, inspection, and maintenance activities. It is also important to note that operations may at time focus on the main steam stop valves but forget to inspect the non return valves. Many overspeed failures have occurred from faulty non return valves. Again, the frequency of valve inspection has also been a point of much discussion and inspection intervals have been stretched out. It is clear that inspection and maintenance of safety critical steam valves that protect units from sudden massive destruction must not be deferred. In the vast majority of overspeed losses a failure to properly inspect and maintain safety critical valves which provide protection from overspeed, has been the major cause of the incident. The best practice recommended for these valve inspections is 2 years. For units that have a low capacity factor the inspections should be based on unit maintenance history and equivalent operating basis. Can older mechanical systems be improved? While mechanical overspeed devices were the standard for many years, they also have a number of moving parts and the set point speed can drift or be inconsistent. Since the 1980s manufacturers have been providing units with digital electronic overspeed systems. The reliability, accuracy, redundancy, testing, and monitoring capabilities of the electronic system is much better than mechanical trip schemes. Since that time a robust retro fit market has also developed with a number of suppliers offering overspeed protection electronic trip systems. These retro fits should comply with API 670 as appropriate. This standard recommends that a Triple Modular Redundant (TMR) or a Dual Redundant (DR) control scheme with system monitoring be utilized for the protective system. The IEC standard recommends these systems be SIL 3 compliant. SIL 3, as defined in IEC 65108 means that no one single failure will render the safety system inoperable and the system will have a probability of a dangerous failure of between10 -4 to 10-3. While an electronic overspeed system upgrade will not completely eliminate the risk of an overspeed failure; it will offer many benefits as well as reduce risk. An upgrade of a mechanical hydraulic system to an electronic system will increase speed sensing accuracy, set point repeatability, and system reliability, as well as reduce the risk of failure. CONCLUSION Despite great strides in equipment design, materials, and testing, overspeed failures still occur at a surprising rate. The failures continue to occur on small and larger steam turbines regardless of the vintage, technology level, application, or type of control system (digital, electronic, mechanical) associated with the steam turbine. The best method of prevention is management

awareness and a prevention program that pays critical attention to this critical safety system. The program must include proper monitoring, testing, inspecting, and maintaining the critical components of the overspeed protection system. A formal over speed prevention program will greatly reduce the risk of an overspeed failure. References 1. Latcovich, J st al; 2005 Maintenance and Overhaul of Steam Turbines IMIA – WGP 42 (05) 2. Product specification 85562 (rev1) - Woodward ProTech 203 3. Description of speed/load control and overspeed protection GEK 100446A 1995 GE Power systems Schenectady, NY 4. POWER PLANT TURBINE #1 FIRE 17 JANUARY 2009 2009 FIRST TECHNICAL REPORT – not published 5. Turbine-Generator Overspeed Failure and Explosion 2008 Exponent - not published 6. Mutama, K 2011 Steam Turbine valve testing, inspection and maintenance to avoid overspeed events Enertech Dec. 2011 7. Davis, B Steam Turbine Overspeed Trip System posted on the Web 8. Hart, Simon, Nov. 2011 Required steps for a success overspeed test; Chartis Guideline unpublished 8. API Standard 670 Machinery Protection systems, 5th edition 2010 9. IEC Standard 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems 2005 10. ISO Standard 10437 Petroleum, petrochemical and natural gas industries - Steam turbines - Special-purpose applications 5th edition 2003 11. Turbine Overspeed Trip Modernization: Requirements and Implementation Guidance, EPRI, Palo Alto, CA: 2006. 1013461


Documents

Steam Turbine Overspeed Protection Failures, Causes and