The IS220PPROH1A is a critical component within GE's Mark VIe control system, representing a specific model of the Backup Turbine Protection (PPRO) I/O pack. This module is designed to provide redundant protection functions independent of the main control system, ensuring reliable execution of safety-critical operations such as turbine overspeed protection and generator synchronizing checks in the event of a primary control failure. The PPROH1A incorporates a BPPB processor board, offering high reliability and real-time performance suitable for various turbine types, including gas turbines and steam turbines. Its design complies with industrial control standards and ensures stable operation in harsh environments, with an operating temperature range of -30°C to 65°C.
The IS220PPROH1A is typically deployed in a Triple Modular Redundant (TMR) configuration, working in conjunction with SPRO, TPROH#C, or TREA terminal boards. It connects to emergency trip boards (e.g., TREG, TREL, TRES) via cables with DC-37 pin connectors. The module also supports Ethernet communication (IONet) for status monitoring and data exchange with the main controller. As the core of the backup protection system, the PPROH1A possesses both hardware and firmware-based overspeed detection capabilities and integrates numerous diagnostic and monitoring functions. This ensures the system can respond promptly to abnormalities, preventing equipment damage or safety incidents.
Detailed Functional Description
The IS220PPROH1A provides several key protection functions covering speed monitoring, logic judgment, relay control, and interaction with the main control system. Its main functions are detailed below:
1. Overspeed Protection
Overspeed protection is one of the core functions of the IS220PPROH1A. The module receives three speed signals from magnetic pickups (MPUs), corresponding to the High-Pressure (HP), Intermediate-Pressure (IP), and Low-Pressure (LP) shafts. Overspeed detection is implemented in both hardware and firmware. The hardware overspeed protection is based entirely on programmable logic circuits, independent of software, with a response time of less than 60 ms. Its setpoint (OSHW_Setpoint) is loaded only during module power-up, ensuring effective operation even if the firmware fails. A hardware overspeed trip requires two consecutive shaft revolutions to exceed the setpoint, preventing false trips.
Firmware overspeed protection is based on processor calculations and supports dynamic setpoint adjustment. Users can set the overspeed threshold via configuration parameters, and both online and offline test modes are supported. Additionally, while the PPROH1A configuration may include parameters for the "Rate-Based Overspeed" (RBOS) feature, it is crucial to note that the RBOS function is NOT supported on the PPROH1A hardware itself; this feature is only available in the PPROS1B model. If RBOS is enabled in the configuration for a PPROH1A, the system will generate an error and prevent the module from going online.
2. Acceleration and Deceleration Detection
The module calculates the rate of speed change (acceleration/deceleration) for each shaft in real-time. A trip is triggered if these values exceed configured thresholds. Acceleration calculation is based on the difference between two consecutive speed samples over a configurable time window (10–100 ms). Deceleration detection uses a fixed threshold of 100%/second. This function captures abnormal turbine dynamics, such as sudden load loss or mechanical seizure.
3. LP Shaft Locked Detection
For multi-shaft turbines, the IS220PPROH1A provides LP shaft locked detection. If the HP shaft speed is above the minimum speed threshold while the LP shaft speed remains zero, the module identifies this as an LP shaft locking anomaly and generates a trip signal. This function prevents equipment damage caused by shaft misalignment.
4. Emergency Stop (E-Stop) Monitoring
The IS220PPROH1A monitors the E-Stop signal from the TREG or TREA terminal board. Once E-Stop is activated, the module immediately cross-trips the main control system and inhibits the trip relays from energizing. The E-Stop status is reported in real-time via feedback signals (KESTOP#_Fdbk), ensuring the system remains in a safe state.
5. Speed Difference Detection
The module compares its own calculated pulse rate (RPM) with the speed signal (Speed1) provided by the main control system. If the difference exceeds a set threshold (based on a percentage of rated speed) for three consecutive sample periods, a speed difference trip is triggered. This function detects main control speed signal failure or communication anomalies.
6. Main Control Watchdog and Communication Monitoring
The IS220PPROH1A receives a "device heartbeat" signal from the main controller via IONet. If no heartbeat update is detected for five consecutive data frames, a main control communication loss is determined, triggering a watchdog trip. Simultaneously, the module monitors the Ethernet frame synchronization status. Consistent frame number errors will also trigger a protective action.
7. Synchronizing Check Function (K25A)
The IS220PPROH1A supports synchronizing check between the generator and the utility bus. The module calculates voltage, frequency, phase angle, and slip based on two PT inputs (generator side and bus side). When all parameters are within the set windows (e.g., frequency difference ≤ 0.27 Hz, phase difference ≤ 10°) and the synchronizing permit signal (SynCk_Perm) is active, it energizes the K25A relay, allowing the circuit breaker to close. This function also includes a dead bus closing bypass logic.
8. Servo Suicide Relay Control (K4CL)
In simplex control systems, the IS220PPROH1A can drive the K4CL relay to force fuel valves or steam valves closed. This function is typically disabled during online overspeed tests to prevent unintended activation.
9. Trip and Economizing Relay Outputs
The module provides three Emergency Trip Relay (ETR1–ETR3) drive commands and supports control for three Economizing Relays (KE1–KE3). The economizing relays are used to introduce series resistance into the trip solenoid coil path after pickup, reducing the holding current and extending device life.
10. Self-Diagnostics and Status Indication
The IS220PPROH1A features comprehensive self-diagnostics, including:
Power-up Self-test: Checks RAM, flash memory, Ethernet ports, and other hardware.
Power Supply Monitoring: Continuously monitors internal power supply status.
Feedback Current Check: Verifies consistency in the relay drive circuits.
Hardware Matching Check: Confures compatibility between the terminal board, acquisition board, and processor board.
The front panel has six LED indicators displaying Run Status, E-Stop, Overspeed, Watchdog, Sync, and Option status. A rotating LED mode can also be configured, providing a visual indication of system time synchronization status across a TMR set.
Working Principle Explained
The protection logic of the IS220PPROH1A is based on the collaboration of hardware circuits, programmable logic, and firmware. Its working principle is explained from three aspects: system architecture, signal flow, and logic processing.
1. System Architecture and Signal Flow
The IS220PPROH1A module plugs directly into the SPRO, TPROH#C, or TREA terminal board, exchanging data via a DC-62 pin connector. Speed signals from MPU sensors are conditioned by the terminal board before entering the module's pulse rate input channels. PT voltage signals enter the module's analog input channels either through a fanned distribution circuit (TPRO) or directly (SPRO).
Internally, the BPPB processor board executes protection algorithms, while the dedicated application board (BPRO) handles hardware-level logic, such as hardware overspeed comparison and relay driving. All input signals are digitized and processed by the firmware for logical decisions. Output signals control the trip solenoids via relay driver circuits. The module exchanges Signal Space data with the main control system over IONet for status monitoring and parameter configuration.
2. Overspeed Protection Principle
Hardware overspeed detection is implemented entirely in programmable logic, bypassing the processor. The speed pulse signal is converted to RPM using the PRScale parameter and compared against the preset OSHW_Setpoint. If two consecutive revolution periods indicate overspeed, a hardware trip signal (OS#_HW_Trip) is triggered. This path is fast-response and highly robust, serving as the system's last line of defense.
Firmware overspeed detection is based on the speed value calculated by the processor, supporting dynamic setpoint adjustment and test modes. Users can modify the threshold in real-time via Signal Space parameters (e.g., OS#_Setpoint). The firmware also supports a "Trip Anticipate" function for steam turbine applications, dynamically adjusting the overspeed setpoint based on load.
3. Trip Signal Combining Logic
All trip signals generated by protective functions (e.g., overspeed, acceleration, E-Stop, watchdog timeout) are combined into a composite trip signal (ComposTrip1). This signal undergoes voting logic (2-out-of-3 in a TMR system) before driving the trip relays. The trip logic is divided into direct paths (e.g., hardware overspeed and direct contact inputs), which bypass the firmware to ensure operation even if the processor fails, and conditional paths, which depend on communication health assessments.
4. Synchronizing Check Algorithm
The synchronizing check function uses a Phase-Locked Loop (PLL) technique to track the voltage phase and frequency of the generator and the bus in real-time. The module calculates:
Voltage Difference (GenVoltsDiff)
Frequency Difference (GenFreqDiff)
Phase Angle Difference (GenPhaseDiff)
When all parameters are within their configured limits and the SyncCheck_Perm signal is true, the module outputs the L25A_Cmd signal to energize the K25A relay. If the bypass mode (SynCk_ByPass) is enabled, closing is permitted under dead bus conditions.
5. Communication and Monitoring Mechanism
The IS220PPROH1A maintains communication with the main controller via IONet, updating the heartbeat signal every frame. If communication is interrupted, the watchdog counter increments, eventually triggering a trip. The module also monitors the "dither" characteristic of the main control's speed signal: if the speed value remains unchanged for multiple consecutive frames, it is judged as a "Stale Speed," triggering a protection action. These mechanisms ensure the backup system can promptly detect main control anomalies and take over protection functions.
6. Relay Control and Feedback
The trip relay (ETR) drive command is determined by the composite trip signal and the enable signal. The module simultaneously monitors the relay feedback signals (K#_Fdbk) and the solenoid voltage (SOL#_Vfdbk) to ensure the commanded state matches the actual state. If a discrepancy is detected, a diagnostic alarm is generated (e.g., Alarms 69–71).
