TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----

Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-1 of 9---------
STE, BHEL, Hardwar











WRITE UP

ON

TURBINE TRIP SYSTEM ( TTS)




Reference Documents:

1. EPS and OTSS Logics
Doc. No. 41330098502(TAPP3/64110/5539/ED)
2. OTSS & EPS system description
Doc. No. 41330000479(TAPP3/64110/5660/DN)


NPC DOC. NO. TAPP3/64110/5663/DN/R0

01 15.6.02 REVISED W.R.T
PROCONTROL
SYSTEM


BS RANA


BS RANA

00 30.1.02 FIRST ISSUE VK Sd. BSR Sd. A. ALI Sd.
REV DATE REMARKS WORKED CHECKED APPROVED
TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-2 of 9---------
STE, BHEL, Hardwar






Table of Contents Page No.


1 General 3

2 Design and mode of operation
2.1 Mechanical (hydraulic) turbine protection 3
2.1.1 Tripping devices 3-4
2.1.2 Manual mechanical emergency tripping devices 4
2.1.3 Overspeed tripping devices 4
2.1.4 Emergency trip solenoid valves 4
2.1.5 Overspeed trip selection system 4-5
2.2 Configuration 5

3 Protection criteria for emergency tripping by turbine protection
3.1 Essential protection criteria 6
3.1.1 Manual tripping 6
3.1.2 Electrical shaft position protection 6
3.1.3 Electrical low-vacuum protection 6-7
3.1.4 Lube oil pressure protection 7
3.1.5 Fire protection 7
3.1.6 Turbine trip by moisture separator drains system 7
3.1.7 Trip command initiated from ATRS 7
3.2 External protection criteria 7
3.2.1 Turbine trip by reactor protection 8
3.2.2 Mechanical generator protection 8

Fig-1: Functional Diagram - Turbine Trip System 9












TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-3 of 9---------
STE, BHEL, Hardwar
General

The obligatory turbine protection covers the following functions:

- protection of the turboset from inadmissable operating conditions
- it prevents consequently damage in case of plant failure
- it restricts occurring failure to a minimum

If the protective equipment is tripped the steam supply to the turbine is shut
off by closure of the main stop valves.

Further steps follow indirectly; e.g. closure of the control valves by
secondary oil pressure reduction, closure of the extraction swing check
valves by steam flow reversal.



2 Design and mode of operation

The standard turbine protection consists of

- the mechanical (hydraulic) turbine protection and
- the electrical turbine protection

2.1 Mechanical (Hydraulic) turbine protection

The design of the mechanical (hydraulic) turbine protection equipment is in
accordance with the hydraulic break current principle, and consists of

- two tripping devicesMAX51 AA005, MAX51 AA006
- manual trip device MAX52 AA005
- two speed monitors MAY10 AA001, MAY10 AA002
- two solenoid valves for trip initiation (remote trip devices 1/2) MAX52
AA001, MAX52 AA002
- solenoid valves for OTSS MAX52 AA011 to MAX52 AA016

2.1.1 Tripping devices

The tripping devices are employed for rapid reduction of the fluid pressure in
the emergency trip fluid system. Under operating conditions the tripping
device connects the fluid circuit MAX52 with the emergency trip fluid circuit
MAX51 and holds the emergency stop value open stop valve open.

The tripping device is held in the operating position by means of the auxiliary
trip fluid MAX52. If the pressure of the emergency trip fluid circuit (e. g. as a
result of leakage) or of the emergency trip auxiliary fluid circuit (e. g. as a
result of response of an emergency trip criteria) falls below a defined
pressure value the tripping device is moved to the trip position by means of a
TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-4 of 9---------
STE, BHEL, Hardwar
spring. As a result the emergency trip fluid system is connected with the
drain and the emergency tripping stop valves are closed by means of
springs. For start-up the tripping devices are brought to the operating
position by means of start-up auxiliary fluid MAX48. The function of the
tripping devices can be tested by means of the automatic turbine tester.

2.1.2 Manual mechanical emergency tripping device

The manual emergency tripping device permits manual emergency tripping of
the turbo set by the operating staff in the event of faults or shutdown of the
turbine. In addition to manual mechanical tripping remote electrical tripping
from the control room is possible. Thus two mode of tripping are not
associated with any defined protection criteria.

On operation of a manual emergency tripping device on the turbine the
emergency trip auxiliary fluid system is connected to the outflow and turbine
emergency trip is initiated by means of the emergency trip device.

2.1.3 Overspeed tripping devices

The overspeed tripping devices protect the turbine against overspeed which
could cause the rotor to burst as a result of excessive centrifugal force.

Two flybolts arranged eccentrically in the shaft are maintained in the rest
position by means of a spring in spite of the centrifugal force. If, as a result
of overspeed, the centrifugal force exceeds the spring force, the bolts move
abruptly to the trip position and operate the tripping device by mean of a
latch thus connecting the emergency trip auxiliary fluid system with the
outflow. The function of the overspeed trip devices may be tested by means
of the automatic turbine tester.

2.1.4 Emergency Trip Solenoid Valves

These solenoid valves (MAX52,AA001, AA002) serve as interface between the
mechanical-hydraulic and the electrically (hydraulic) turbine protection
equipment. Proper operation of the trip value can be checked by the ATT.

2.1.5 Overspeed Trip Selection System (OTSS)

In the event of a load rejection, turbine control valve should close properly in
line with automatic controls. Otherwise there is a possibility for the steam
from MSR to go to LP turbine and cause overspeeding of the turbine. The
OTSS is responsible for detecting faults in the closed loop control system and
initiating turbine trip when an overspeed limit of 106% is reached.

The OTSS contains a system during operation and a system during test in 2-
out-of-3 logic each.
In further details on OTSS refer system description for OTSS.
TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-5 of 9---------
STE, BHEL, Hardwar


2.2 Configuration

Two trip solenoids MAX52AA001 & MAX52AA002 are provided in the
hydraulic circuit, which get trip signals from the electrical system.
Actuation of any one solenoid is sufficient to trip the turbine.
The electrical system is configured as a 2-channel system. Each channel is
realized in a local bus. Both the local buses are completely independent of
each other and input modules, processor module and output modules
reside on each.
Each channel having two processors (PR05) with one processor in hot
standby mode .Trip signals from sensors/field instruments are
conditioned & distributed to both the channels (local buses ) via
hardwired modules. Realisation of 2 out of 3 trip logic is carried out in the
local bus. On detection of a fault in any one of the input signals to a
channel, the configuration for that channel changes from 2 out of 3 to 1
out of 2 and is annunciated . Further failure in a channel changes the
configuration to 1 out of 1. Trip signal from each of the local buses acts on
3 relays in 2 out of 3 combination realized in Protection relay cabinet .

Both the channels are tested periodically even while the turbine is
running through ATT program. Cyclic testing is done automatically at
preset intervals and can be blocked from the ATT cabinet, if desired. The
testing can also be initiated manually from the cabinet. Only one channel
can be tested at a time. Online testing is done by simulating the trip
signals and it determines faults in the input modules, processor
modules, output modules or the trip relays. These faults can be
acknowledged from the cabinet. Next cycle test can only be carried out
after acknowledging of the fault.

Once initiated, the trip signal keeps the trip solenoids energized unless
and until the following conditions are fulfilled :

i) Command signal from the individual trip initiating circuit ceases.

ii) Both the ESVs are closed or trip fluid pressure (sensed by three
pressure switches in 2 out of 3 logic) is less than 2 Kg/Cm or SGC ATT
safety device Startup: ( Seal in turbine trip 1 ) or( Seal in turbine trip 2 ) is
made OFF.








TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-6 of 9---------
STE, BHEL, Hardwar
3 Protection criteria for emergency tripping by turbine protection

The protection criteria can be subdivided into:

- essential protection criteria
- additional protection criteria
- other protection criteria.

3.1 Essential protection criteria

Those protection criteria which are absolutely necessary to ensure safe
operation of the turbo set and are specified by the turbine manufacturer are
designated essential protection criteria. these are:

- Manual emergency trip (see 2.1.1)
- Overspeed tripping device (see 2.1.3)
- Electrical shaft position protection
- Electrical low vacuum protection
- Lube oil pressure protection
- Fire protection
- Protection from OTSS
- MSR drain level protection
- Trip command from ATRS

3.1.1 Manual emergency tripping

Remote manual electrical (emergency) tripping allow shut down of the
turboset by the operating personnel (see also Clause 2.1.2).

3.1.2 Electrical Shaft position protection

A too big axial displacement of the turbine shaft may be caused by excessive
wear or damage of thrust bearing pads. In the event the axial displacement
exceeds the limits set during errection. The turbine will be tripped. The axial
shift is measured in both the direction (+/-) using three inductive probes.
These measured signals are fed to a protection cabinet in 2-out-of-3 logic for
further realization. The protection system upto trip relays are checked by
ATT.

For further information see system description for Electronic protection
system 2-out-of-3 and functional diagram YMAY20 Turbine Protection.

3.1.3 Electrical low Vacuum protection

Electrical low vacuum protection is employed to protect the condenser and
the low pressure blading against excessive condenser pressure. Excessive
condenser pressure could occur in the condenser in case of loss of circulating
water supply or excessive air leakage into the condenser.
TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-7 of 9---------
STE, BHEL, Hardwar
The projection system is 2-out-of-3 design so that the healthiness up to trip
relays can be checked with ATT.

3.1.4 Lube oil pressure protection

If the lubricating oil pressure decreases to 1.2 kg/cm2. oil supply to the
bearing is endangered; for this reason the turbine is tripped in order to
permit repair of the oil supply system after the turbine has run down. The
lube oil pressure setpoint for electrical trip has been selected so that after
actuation of protection bearing oil supply, by means of the emergency pump,
is ensured during shutdown of the turboset. The lube oil pressure protection
employs a 2-out of 3 logic. Refer functional diagram YMAY20 for further
information.

3.1.5 Fire protection

Within the framework of fire protection measures turbine emergency trip is
initiated in order to interrupt supply of oil by the main oil pump, which is
driven by the turbine shaft, as quickly as possible. Fire protection measures
may be initiated by means of the special fire protection pushbuttons provided
for the turbine of automatically by the "low level in oil tank" signal. The fire
protection is of two channel design. In consequence emergency tripping is
effected by means of two channels. Automatic initiation of fire protection
occurs when two out of the three level switches in the oil tank respond.

3.1.6 Turbine trip by moisture separator drains system

In the event of a turbine load rejection only a small quantity of drains and
steam is permitted to remain in the moisture separator in order to prevent
excessive overspeeding of the turbine. If the level of water in any MSR rise
above a specified limit, the turbine is tripped automatically.
For further details refer system description turbine trip by Moisture separator
drains system.

3.1.7 Trip command initiated from ATRS

Trip command signal initiated from SHUTDOWN program Step-3 of TURBINE
SUBLOOP CONTROL in ATRS.

3.2 External protection criteria

"External protection criteria" are like the essential protection criteria
absolutely necessary. These criteria, however, comprise faults external to the
turbine and are employed for protection of plant components not directly
associated with the turbine.

These criteria are:
- reactor protection system
TAPP3/64110/5663/DN/R0---------------------------- -----4-13300-00-483-----
Rev. 01
-------------------------------------------------------------------------------------------- Sheet no.-8 of 9---------
STE, BHEL, Hardwar
- mechanical generator protection

3.2.1 Rector protection system

On actuation of reactor protection, tripping of the turbine system is initiated
in order to prevent impermissible pressure reduction in steam system. In the
absence of such an emergency tripping of the turbine, the turbine and
primary/secondary steam systems are endangered as result of sudden
change of temperature. The protection is built in 2-out-of-3 concept.

3.2.2 Mechanical generator protection

In order to avoid damage to generator ancillaries and to the generator
emergency tripping of the turbine is initiated on response of the mechanical
generator protection. A 2-out-of-2 circuit is employed for signal processing;
two channel tripping is employed utilizing a 1-out of-2 circuit. The protection
circuit is tested periodically. On failure of a channel the actuation signal for
the defective channel is simulated.