The IS215VPROH2B Turbine Emergency Protection Board is a core, independent component within General Electric's (GE) Mark VI gas and steam turbine control systems, forming the highest safety-level protection architecture. This board is specifically designed for Emergency Overspeed Protection (EOS) and other critical safety backup functions. Its core philosophy is to establish a "last line of defense" that is physically, electrically, and logically completely independent of the main control system. During the operation of turbines, especially large, high-speed rotating equipment like gas and steam turbines, overspeed is one of the most dangerous faults that can lead to catastrophic damage. The VPRO system, particularly its VPROH2B low-power version, exists to ensure reliable tripping and protection of the equipment itself, even if the main control systems (<R>, <S>, <T>) all fail.
The IS215VPROH2B board operates within an independent, Triple Modular Redundant (TMR) Protection Module <P> rack. This module contains three identical VPRO boards, designated R8, S8, and T8 (earlier versions were called X, Y, Z). These three boards work in parallel within a physically isolated enclosure, implementing "2-out-of-3" voting logic. The design allows for power-down, replacement, or maintenance of any single board while the unit is running, without compromising the integrity of the protection system.
The IS215VPROH2B receives signals from dedicated field sensors via the TPRO terminal board, including three independent magnetic speed pickups, synchronizing check voltages, thermocouples, and analog inputs. Simultaneously, it directly controls the final actuators—the trip solenoids (ETDs)—via relay groups on the TREG terminal board. Communication with the main control system is limited to non-critical status monitoring and test command exchange via Ethernet (IONet), ensuring the independence and reliability of protective actions.
Core Functions and Features
The IS215VPROH2B protection board integrates a multi-functional system dedicated to critical protection, with the following core functions and design features:
1. Independent Triple Redundant Emergency Overspeed Protection (Core Mission):
Completely Independent Sensing Channels: The system uses two completely independent sets of speed sensor groups. The first set (3 pickups) is used by the main controller (VTUR) for speed control and primary overspeed protection. The second set (another 3 pickups) is dedicated exclusively to the three VPRO boards in the Protection Module <P>, achieving physical isolation at the sensing level.
"2-out-of-3" Hardwired Voting Architecture: The R8, S8, and T8 VPRO boards within the protection module independently process their assigned speed signals. Any overspeed trip decision must pass a "2-out-of-3" vote. A trip command is issued only if at least two boards independently judge an overspeed condition. This significantly eliminates the possibility of a single board fault causing a false trip (nuisance trip) or failure to trip (missed trip).
Independently Adjustable Trip Setpoints: Users can configure separate trip speed setpoints for Primary Overspeed (main control system) and Emergency Overspeed (VPRO protection system) (OS_Setpoint). The emergency overspeed setpoint is typically set higher as a true backup. Furthermore, VPRO supports Acceleration Trip (Accel_Trip) to detect abnormal speed surges (e.g., sudden load rejection). Even if the absolute speed hasn't exceeded the limit, an excessively high acceleration rate (e.g., exceeding 100%/s) can trigger a trip.
2. Intelligent Speed Monitoring and Discrepancy Diagnostics:
High-Precision Speed Calculation: VPRO calculates speed by measuring the time for gear teeth to pass using a high-precision timer. It supports a pulse frequency range from 2 Hz to 20 kHz with an accuracy of 0.05% of reading.
Speed Difference Protection (SpeedDiffEn): This is a crucial cross-verification function. VPRO continuously compares its own calculated speed with the speed signal (Speed1) received from the main controller via IONet. If the difference exceeds a configured threshold (OS_Diff) for a sustained period, it indicates a major problem with the main system or sensing loop, and VPRO can initiate a trip to prevent loss of protection due to main system measurement error.
Stale Speed Detection (StaleSpdEn): Continuously monitors whether the speed signal from the main controller is "frozen" (unchanged for an extended period). Detection of a frozen signal indicates potential failure in main controller communication or processing, and VPRO can initiate a trip.
3. Comprehensive and Redundant Trip Output Control:
Dual Independent Trip Paths: The trip solenoids (ETDs) are managed jointly by two terminal boards: TRPG (provides the negative power supply) and TREG (provides the positive supply and controls via relays). Either end can independently remove power, de-energizing the solenoid and driving the hydraulic system to close the valves. This provides a dual hardware breakpoint.
Relay Group Voting Control: The TREG terminal board hosts 12 relays. Among these, 9 Emergency Trip Relays (ETRs) are divided into three groups of three, each controlled by the R8, S8, and T8 VPRO boards respectively. Each group controls one trip solenoid. The trip command must pass voting logic both within the VPROs and among the relay groups, ensuring action reliability.
Economizing Resistors and Economizing Relays (KE): Each trip solenoid circuit is串联 (connected in series) with an economizing resistor (10 Ω, 70 W) and an Economizing Relay (KE). During normal operation, the KE relay is energized, shorting out the resistor, allowing the solenoid to receive full voltage to remain energized. At the instant a trip is commanded, the KE relay de-energizes first, forcing current through the limiting resistor for about 0.1 seconds before the ETR opens to complete the trip. This reduces coil heating and energy consumption during long-term operation and minimizes arcing at the relay contacts during opening.
4. Backup Synchronizing Check and Generator Protection:
VPRO integrates a Backup Synchronizing Check function. It receives two independent Potential Transformer (PT) signals (115 Vrms) from the generator and bus side via the TPRO terminal board.
It employs Phase-Locked Loop (PLL) technology to accurately measure the magnitude difference, frequency difference, and phase angle difference between the two voltages. Phase measurement accuracy is better than ±1 degree at nominal voltage and frequency.
The synchronizing check results from the three VPRO boards are voted via a relay (e.g., K25A on TTUR). A close command or permissive is issued only if all three boards judge that synchronizing conditions are met, providing a critical backup safety interlock for automatic synchronizing.
5. Auxiliary Monitoring and Protection Inputs:
Thermocouple Inputs: Supports up to 9 thermocouple inputs (E, J, K, T types), typically used for backup exhaust overtemperature protection on gas turbines. A trip can be initiated if the exhaust temperature exceeds the setpoint (OwTemp_Trip). Specifications are similar to the VTCC board, featuring cold junction compensation and self-diagnostics.
Analog Inputs: Provides 3 analog inputs. One is selectable between 4-20 mA, ±5 V dc, and ±10 V dc; the other two are 4-20 mA inputs. These can monitor other critical process parameters (e.g., pressure, flow) and serve as trip conditions.
Trip Interlock Inputs: Provides up to 7 dry contact inputs for receiving trip signals from other protection systems (e.g., high vibration, low lube oil pressure, manual emergency stop buttons). Can be configured for direct trip or conditional trip modes.
6. High-Reliability Design and Online Maintenance Capability:
Independent Power Supplies: Each VPRO board, and the protection module as a whole, is equipped with independent onboard power supplies, converting 125 V DC from the Power Distribution Module (PDM) to the required 5 V DC and 28 V DC. The triple power supply design eliminates single-point power failure risk.
Online Testing Functions: Each trip solenoid can be tested online via controller software. During a test, a single solenoid can be de-energized without affecting the other two, verifying its mechanical and electrical circuit integrity. Offline overspeed simulation tests are also supported.
Modularity and Hot-Swap: Due to the triple redundancy design, the entire protection module allows for the removal and replacement of any single VPRO board while the unit is running, without interrupting system protection.
Working Principle
The working principle of the IS215VPROH2B system is a closed-loop safety chain integrating independent sensing, parallel processing, redundant voting, and safe execution.
1. Independent Signal Acquisition and Processing:
Speed Signals: Sine wave signals from the second set of three dedicated Magnetic Pickups (MPUs) for EOS protection are sent via long cables (up to 300m) to the TPRO terminal board. After noise suppression, they are fed into the dedicated high-speed pulse input ports of the R8, S8, and T8 VPRO boards (via J5/J6 connectors). Each VPRO board independently and synchronously counts and times its assigned pulses, using high-precision algorithms to calculate turbine speed (PR1/2/3) and acceleration (PR1/2/3_Accel) in real-time.
Synchronizing and Analog Signals: Signals like generator/bus PT voltages, thermocouples, and analog inputs are paralleled and distributed on the TPRO terminal board to all three VPRO boards (e.g., three thermocouples go to R, S, T respectively). Each board independently performs A/D conversion, filtering, and engineering value calculation.
2. Protection Logic Judgment and Intra-Board Voting:
Each VPRO board compares its calculated speed with the user-configured Emergency Overspeed Trip Setpoint (OS_Setpoint). Simultaneously, it checks if acceleration exceeds limits and evaluates the speed signal difference and status received from the main controller.
For synchronizing checks, overtemperature protection, analog limit violations, etc., each board also independently executes its configured protection logic, generating a "preliminary trip decision" status.
3. Triple Redundant System-Level Voting:
This is the core safety mechanism of the VPRO system. The R8, S8, and T8 boards exchange their respective protection status information via dedicated, isolated backplane or point-to-point connections, separate from the main control network.
For each trip output (e.g., the ETR1 relay controlling solenoid #1), the final "actuate" command requires at least two VPRO boards to vote "trip required." The system implements strict "2-out-of-3" hardware and logic voting. This ensures that any fault in a single VPRO board (whether sensor error, processor failure, or software runaway) cannot unilaterally cause a false trip. Conversely, as long as two boards function correctly, protection remains effective, preventing a failure to trip.
4. Safe Output Driving and Execution:
The voted trip command acts upon the corresponding Emergency Trip Relay (ETR) on the TREG terminal board.
Trip Sequence: When a trip condition is met: 1) First, the corresponding Economizing Relay (KE) de-energizes, causing current to flow through the series economizing resistor. The solenoid coil voltage drops but is maintained for a short period. 2) Immediately after (milliseconds), the Emergency Trip Relay (ETR) opens, completely cutting off the 125 V DC power to that solenoid. The de-energized solenoid causes its pilot hydraulic valve to actuate, leading to depressurization of the main hydraulic circuit, which drives the steam or fuel valves to close rapidly, shutting down the turbine.
Status Feedback and Diagnostics: VPRO continuously monitors the driver coil current (drive feedback) and the actual state of the output contacts (contact feedback) for each ETR and KE relay. It also monitors the health of the 125 V DC power supply to the solenoids. Any mismatch between "command" and "actual feedback," or loss of power, immediately triggers detailed diagnostic alarms and is indicated on the front panel LEDs (RUN green flash, FAIL red steady, STATUS orange steady), ensuring faults are promptly identified.
5. Safe Interface with the Main Control System:
VPRO communicates with the main controller (VCMI) via IONet Ethernet. This communication is primarily used for:
Reporting VPRO's own health status, diagnostic information, and calculated data like speed to the main controller.
Receiving online test commands, speed reference values (for speed difference comparison), and control watchdog signals from the main controller.
Key Point: This communication network is not used for transmitting real-time trip decisions. Trip decisions are made entirely independently within the protection module. Communication failure does not hinder VPRO's ability to execute its protection functions, adhering to the "fail-safe" principle of safety systems. In fact, if communication loss causes the "Control Watchdog" (ContWdogEn) to time out, VPRO may initiate a trip because it cannot confirm the main controller is still functioning.
Key Differences from VPROH1A/H1B Versions
As a low-power optimized version, the main functional differences of VPROH2B compared to VPROH1A/H1B are:
No Support for Second TREG Board: IS215VPROH2B omits support for connecting a second TREG terminal board (which would allow control of more trip solenoids) via the J4 connector. This means a single VPROH2B board can manage at most one TREG board and its associated 3 trip solenoids. Applications requiring a second TREG board must use VPROH1A or VPROH1B.
Power Consumption Optimization: By streamlining part of the driver circuitry (for the second TREG), overall power consumption is reduced, potentially aiding cabinet cooling and power load planning.
Application and Summary
The IS215VPROH2B Turbine Emergency Protection Board is an indispensable "guardian" in the safety architecture of modern large gas and steam turbines. It transcends the scope of conventional control systems, constituting a dedicated Safety Instrumented System (SIS) aligned with high Safety Integrity Level (SIL) principles. Its value lies not only in providing Emergency Overspeed Protection but, more importantly, in establishing a true "safety hard boundary" through its thorough triple redundant isolation design, hardwired safety outputs, and architecture independent of the control network.
In application, the VPRO system forms a deep "protection interlocking" relationship with the main control system (VTUR, etc.): the main system handles precise control and primary protection, while VPRO serves as an independent, trustworthy backup. They mutually monitor each other through mechanisms like speed difference comparison and watchdog timers. Failure in either can be detected by the other and may initiate a safety action, significantly enhancing the overall system's fault tolerance and safety.
