cover story

MArtin N. Snow, ICS Triplex, UK, highlights the importAnce of AvailAbility,

reliAbility and sAfety in mAximising the output of a power plAnt.

he pressures of energy conservation, including rising

tariffs for electricity grid systems and support
schemes by governments for upgrades to more efficient processes, have resulted in a shift to cogeneration
even for processes previously not involved with power
generation. Indeed, a cogeneration power plant is
expected to achieve increased productivity by an average
of 30% when compared to a traditional power plant.
The higher costs associated with energy production
and increasing pressure from government regulation
authorities to enforce higher safety integrity levels (SIL)
and comply with the standards such as IEC61508 and
IEC61511 has shifted the focus of the control systems
used in these facilities. ICS Triplex has the unmatched
knowledge and expertise to ensure that any process plant
involved in power generation is not only running to its maximum capacity, but also doing so under RunSafe conditions.

The process industrys

requirements
In todays process industries, cogeneration or combined
cycle is a popular method of generating power by taking
advantage of previously untapped or underutilised energy
resources. While cogeneration can be extremely efficient
there are fundamental differences in the way the process
and power industries have approached operation and
safety issues. Both industries have been faced with
increasing fuel and capital costs as the requirements for
HYDROCARBON ENGINEERING OCTOBER 2004

emission reductions and safety regulations have grown.

Although these two industries have to tackle similar regulatory issues their experience with operations differ greatly,
often being regulated by different government agencies.
Most process industries are not accustomed to running
large scale cogeneration facilities and most power utilities
have little experience in working with the demands and
production swings of a process plant. With the notable
exceptions of process industries that must generate all
their own power, most facilities generate power as a
byproduct.
Similarly, the process and power industries approach
the running and maintenance of their turbines from very
different, often diametrically opposed perspectives. In all
cases a gas turbine is an expensive piece of capital equipment which has safety implications as well as very specific
maintenance requirements. The challenge for the process
industry is to minimise unplanned shutdowns while running
the cogeneration facility to maximum capacity and efficiency. If these very different operating requirements can
be satisfied cogeneration is a viable proposition for many
industrial customers.

The solution
ICS Triplex is a supplier of Triple Modular Redundant
(TMR) control systems. TMR systems have been successfully utilised in the process industries for emergency shutdown, fire and gas, burner management, and critical control applications where safety is the primary concern.
71

turbomachinery train safely and

efficiently while complying with
SIL3/RC6 guidelines.

Figure 1. Cogeneration process with Trusted.

The secret
ICS Triplex has over 35 years of
experience in providing safety and
critical control solutions for
process and power plants. It has
leveraged the common features
between process, traditional
power, cogeneration and combined cycle plants to develop an
extremely powerful turbomachinery control system (TMC). The
T6300 Trusted provides the best
performance, capabilities, specialised I/O and engineering tools
available to the process and
power industries today.

Emergency
shutdown

These applications are typically covered by safety integrity

levels (SIL) that define the level of control and safety precautions that must be applied to the process. TMR systems have extremely high levels of availability and reliability that ensure that the system will function under all conditions to protect plant personnel, the environment and the
capital investment in the plant. As TMR technology has
matured and become more cost effective, these systems
are finding their way into areas where reliability, not safety,
is the primary concern.
The power industry has utilised triplicated control technology to increase the availability and reliability of their turbine control systems to keep expensive power production
systems operating for a number of years. More recently
the power industry has seen the same pressure from government regulatory agencies to apply SIL definitions to
power applications. TMR platforms, already certified in the
process industries, can provide the SIL level certifications
whilst also providing the reliability and availability that the
power industry demands.
ICS Triplex had reached a point where the Trusted
technology is able to provide the most reliable safety solution for SIL applications, and has expanded its offerings for
power production through its turbomachinery control range
of products. The Trusted TMR platform ensures that
thousands of processes worldwide are RunSafe. By
expanding the capabilities of Trusted with the specialised I/O requirements of turbomachinery applications,
ICS Triplex has developed the new T6300 Trusted system. This new TMR turbomachinery control system is a
powerful and cost effective turbine and compressor control
system, regardless of the process size or capacity. The
Trusted TMR controls can run a process or a
72

ESD needs little introduction in

critical control processes, emergency shutdown or burner management. Trusted protects capital investment, allows it to run
safely with no unnecessary shutdowns, protecting production, the
environment and saving lives.
TMR can guarantee no interruptions, and the offer of this and a
select range of features have
made Trusted the only choice
for numerous engineers all over the world in the process
and power generation industries.

SOE and turbine overspeed protection

Trusted offers extremely fast response time for turbine
control, emergency shutdown and burner management.
Sequence of event (SOE) capture at the I/O card level
gives true 1 ms data capture while the speed monitor modules allow overspeed protection in under 20 ms, protecting
the turbine and operations personnel.
With a real 1 ms sequence of event resolution (regardless of system size) for each alarm threshold, analogue or
digital, input or output point, configured at the module to
give unprecedented troubleshooting capability, allows for
accurate resolution of process and system level alarms.

OPC
Trusted contains the OPC server package (OLE for
process control) that enables control systems integrators
and vendors to add top class fault tolerant technology as a
simple add on subsystem. There are no limitations on
Trusted communications. Up to eight communications
modules with a total of 16 independent ethernet and 32
serial connections are supported, far exceeding its competitors communication capabilities.
The OPC server, developed by ICS Triplex, meets the
OPC alarms and events standard (V2.0). The server
resides on the system host network and makes the information in Trusted available to OPC clients in DCS or
SCADA packages.
OPC client connections are made by simply dragging
and dropping tag names from one system window to the
other. Physical connection is made by a single or dual
redundant ethernet link within which all the redundancy
HYDROCARBON ENGINEERING OCTOBER 2004

management is designed.
By creating an industry standard, open link into the
Trusted system for DCS, Graphics, SCADA or similar
applications, ICS Triplex offers system designers a solution without the restrictions of a proprietary interface, or
the complexity of intelligent MODBUS gateways. Project
costs are minimised and system performance is increased.

make it so ideal for critical applications (highlighted for

ESD), Trusted offers the best solution for burner management.
Furthermore, the new sister product T6300 Trusted
system consists of all the previously mentioned characteristics as well as state of the art turbine and compressor
control functions.

SOE and time stamping

Turbomachinery control

Facilities provided by the OPC server include collection

and transfer of sequence of event data at defined intervals,
recognition of incoming time stamps and automatic time
stamping of any untimed data. Data is time stamped to
1 ms resolution and all tags are updated every 10 ms or
less.
Designed to be simple for systems integrators to use,
the OPC server provides an automatic link to the ICS
Triplex IEC1131 toolset, so that changes to the application
software are automatically decoded to provide up to date
tag references for each Trusted controller. As well as
status, the OPC server allows transfer of the 1 ms resolution SOE data generated by the Trusted I/O modules.
Other time saving features include online monitoring of
polled tag values and a comprehensive tree view of available controllers. Any existing or future OPC V2.0 compatible client will communicate correctly with Trusted faulttolerant technology.

IRIG-B
The Trusted safety system also offers IRIG-B time synchronisation, making it possible to receive satellite signals
and keep to timing between the ED system and the DCS
clock. In fact, all Trusted systems can be synchronised
to any IRIG-B time source for synchronisation between all
the events across the site to a few milliseconds.

Certification to SIL 3
Both traditional and cogeneration power plants involve the
use of steam and gas turbines. The process requires that
the safety integrity level (SIL) three is met by the systems
used for ESD and BMS. Trusted is certified by TV as
IEC61508 compliant and suitable for applications up to
SIL3/RC3, the highest possible rating for fault tolerant systems. Trusted uses RunSafe 3-3-2-0 fault tolerant
control (first fault, fault tolerant; second fault, fault tolerant;
third fault, failsafe) to virtually eliminate spurious trips due
to safety system faults.

Burner management systems

A boiler furnace in operation can give rise to a number of
situations that require a high reliability and high availability
safety system in order to avoid explosions. These include:
" An interruption to the fuel, air or ignition energy supplied to the burners.
" Ignition of accumulated of fuel from leakage in an
unused furnace.
" Failing to light off, without the required purging, repeatedly.
" Complete furnace flameout due to build-up of explosive
fuel and air.
Processes involving burners usually follow the guidelines set by the National Fire Protection Association
(NFPA)1. ICS Triplex offers burner management solutions
through the Trusted 2 product that is specifically certified
to NFPA, ensuring such processes are RunSafe. More
specifically, Trusted offers a system that is NFPA compliant and running under fail safe conditions ensuring that
the boiler will not shut down unless it is necessary. With
panels for manual startup in addition to all the features that
HYDROCARBON ENGINEERING OCTOBER 2004

The lack of compressors or turbines as a result of maintenance and downtime can have a staggering effect on production. Turbomachinery, if not properly managed, can
consume a significant amount of a companys profits,
resulting in excessive energy consumption and high maintenance costs.
A single T6300 Trusted can handle compressor/turbine control applications of any size, making it a truly
integrated turbomachinery control system. This adaptability/scalability reduces overall system complexity and cost
while its TMR architecture and advanced control features
result in energy savings, operation simplicity and high reliability. Further to the Trusted features essential to ESD
and BMS, the T6300 Trusted features:

Compressor control
" Advanced surge control. Op point tracking, lookup
table curve fit and adaptive gain, all of which contribute
to the ability to safely operate the compressor close to
the surge limit line.
" Incipient surge detection/control: SurgeGard. Detects
fluidic oscillations that occur as a precursor to surge.
The incipient surge detection is independent of the
compressor performance map. SurgeGard provides for
a wider operating window, permits close operation to
the actual surge line, identifies/corrects shifts in the
surge line and facilitates surge point testing.
" Integrated process/capacity control. Includes capacity
control and pressure override control; coordinated
action between performance control and anti-surge
control; simple selection of capacity control type (suction pressure, discharge pressure, pressure ratio and
flow).
" Load sharing optimisation. Combination of equal distance load balancing (scheme operates compressors
an equal percentage from their respective SCL) and
load optimisation results in maximum load share efficiency.
" Fallback algorithms. Allows for continued safe operation in the event of a critical transmitter failure (critical
transmitters include flow, suction pressure and discharge pressure).

Turbine control
" Turbine speed control. The turbine governor function
can be incorporated into the Trusted control system
simplifying hardware, providing a totally integrated
solution.
" Turbine overspeed protection. Nine independent pulse
inputs and up to six discrete outputs for over speed and
acceleration protection. As many as three turbine trains
can be protected on each speed monitor module. TMR
speed modules are independent of the Trusted
processor and provide very fast overspeed protection
(under 20 ms) regardless of system loading.
" Automated startup, sequencing and shutdown:
Startup/shutdown sequences, process interlocks,
purge and warmup cycles can be incorporated and
coordinated between stages/sections and the process.
The process can be put online quickly and consistently.
73

" Auxiliary controls: lube

RunSafe: The definition
and seal oil systems,
The term RunSafe is used to encapsulate some of the attributes of Trusted techprocess auxiliaries and
nology, attributes which benefit the user by helping to achieve greater process uptime
safety interlocks can easand easier management/maintenance of a safety system, therefore ensuring the highily be incorporated into the
est possible availability and reliability.
Trusted system.
" Process interlocks: comA RunSafe system:
munications between con" Is designed with fault tolerance where no single fault can cause a spurious shuttrol and machinery protecdown.
tion applications within
" Despite faults, will never fail to danger.
Trusted are easy to
" Is designed to be safe for energised and de-energised philosophies.
establish and with the
" Can withstand multiple fault and continue safe operation.
capacity for thousands of
" Does not need to be programmed to shutdown if a repair is not made.
I/O points, process inter" Identifies problems in the field devices to allow repair before failure.
locks are easy to imple" Provides detailed diagnosis of field device and environmental conditions.
ment.
" Allows diagnosis of system health from anywhere in the world.
" Control strategy flexibility.
Extensive library of control
functions allows for cusUmbria, central Italy. The plant is a 370 MW combined
tom defined strategy and adapts to any field condition.
cycle power plant, owned by ENEL Power. It was designed
The results
with the unusual combination of one gas and two steam
" Energy savings. Controlling the compressor/turbine up
turbines, making it the first plant of this size to utilise this
to safe but minimal distances from operating/equiptype of technology.
ment constraints (surge points, temperature and presThe requirements of ENEL Power for an emergency
sure limits) maximises the operating window and
shutdown system that was compatible with the DCS sysreduces energy consumption.
tem supplied by Emerson Process Management specified
" Increased performance. Dynamic decoupling, energy
that Ethernet/OPC links were also used with the gas and
consumption based load sharing and advanced
steam turbines, the gas station and the electrical protecprocess adaptation optimises overall compressor train
tion hardware. ICS Triplex supplied a Trusted system of
performance.
640 IOs, which not only covered the requirements of the
" System availability. Fault tolerant configuration and
end user but also made it possible to save space and minhardware ensures uninterrupted control and minimise costs, through the SmartSlot feature of the product.
imises/eliminates the effect of hardware and transmitBy making the T6300 Trusted system compatible
ter failure. Incipient surge control override provides
with
the original Trusted system, ICS Triplex has given
additional security by sensing and controlling fluidic
the end user the option to make any adjustments to this
oscillations before the compressor reaches the actual
plant and not have to worry about adding in more consurge point.
trollers. With one additional module added to fit into the
" Flexibility. Preconfigured firmware with a large library of
Trusted system, complete safety and turbine control can
configurable functions allows for successful adaptation
be achieved.
to existing process and piping conditions (there is no

"

"

"

"

custom programming required). Compressors and turbines are part of dynamic processes and therefore
require continuous multiloop interactive control with the
capability of practical unlimited modification capability.
Simplified compressor operation. Automatic lineup,
auto startup and shutdown, auto load sharing/optimisation, alarm management and fallback transfer all
minimise operator interaction requirements and simplify operation.
Longer compressor life. Minimising surge spikes during process upsets and during compressor startup
and shutdown will increase compressor life. The fast
response and look ahead features of the controls
also provide reliable surge spike detection and prevention.
Improved operator interface. P/PC integrated compressor and turbine control allows operation maintenance
engineering to view and analyse all compressor data.
This provides useful information regarding incidents
and disturbances during process upsets and during
startup and shutdown conditions.
API 612/API 670 compliance. The independence of the
speed monitor module enables separate TMC functionality from the processors other functions, so the
system complies with the appropriate standards.

Pietrafitta Nuova power plant

An interesting case is the Pietrafitta Nuova power plant in
HYDROCARBON ENGINEERING OCTOBER 2004

Tavazzano
The very fast response time of the Trusted system,
which is required for shutdown of the gas supply should
the gas turbine overspeed, led ICS Triplex Italy to win the
order to supply the ESD systems for the Spanish owned
ENDESA power station located 20 km south of Milan.
The project included the revamp of the two groups:
Modulo 5 and Modulo 6 to a combined cycle producing
780 MW and 390 MW respectively. ICS Triplex Italy
worked with the contractors ENELPOWER to supply two
ESD Trusted Systems. 750 I/Os have been allocated for
Modulo 5 and 650 I/Os for Modulo 6. Both will be connected via a redundant OPC link to the DCS systems supplied by ABB Energy Automation. A third Trusted system
of 120 I/Os will be supplied for fire fighting.
The Tavazzano project strictly required that the
response time of 200 ms not be exceeded for a system of
700 I/Os. This combined with the 1 ms SOE and the synchronisation features of the Trusted system made it the
ideal choice for this project.

References
1.

2.

NFPA 8501 Single Burner Boiler Operation. NFPA 8502 Prevention of

Furnace Explosions/Implosions in Multiple Burner Boilers. EN 50156
Electrical Equipment for Furnaces.
Certified by TUV to SIL3/RC3 AK6. NFPA 72C for Fire and Gas.
NFPA 8501 Single Burner Boiler Operation. NFPA 8502 Prevention of
Furnace Explosions/Implosions in Multiple Burner Boilers EN 50156
Electrical Equipment for Furnace.________________________#

75