GE IS220PPROS1B TMR Backup Protection I/O module

The IS220PPROS1B is a Triple Modular Redundant (TMR) Backup Protection I/O module within GE's Mark VIe control system, designed for gas turbines, steam turbines, and other rotating machinery. It serves as an independent backup protection layer separate from the primary control system, providing functions such as overspeed protection, synchronization check, main control monitoring, and emergency tripping. This ensures a safe shutdown in the event of a primary control system failure, preventing equipment damage and catastrophic incidents.

The IS220PPROS1B is a safety-certified version compliant with the IEC 61508 standard, suitable for industrial applications requiring certification under IEC 61511 for safety instrumented loops. Its design emphasizes hardware and software independence, guaranteeing that protection functions remain operational regardless of the primary control system's status.

System Architecture & Hardware Composition

1 Hardware Structure

• Processor Board: Utilizes a BPPC processor board, supported by ControlST software V04.07 and later.

• Application Board (BPRO): Contains application-specific hardware circuits for functions like overspeed detection, relay driving, and pulse signal processing.

• Terminal Boards: Can be mounted directly onto SPRO, TPROS#C, TPROH#C, or TREA terminal boards.

• Communication Interface: Connects to the IONet via Ethernet ports for data exchange with the main controller.

2 System Configuration Options

• TMR Configuration: Three PPRO modules are connected to the R, S, and T controller networks respectively, implementing a 2-out-of-3 voting logic.

• Simplex Configuration: Suitable for use with the TRES terminal board, where one PPRO module monitors two controllers (R and S).

• Standalone Configuration: The TREA terminal board allows three PPRO modules to be mounted directly, eliminating the need for external cabling between boards.

Core Functions & Operational Principles

1 Overspeed Protection
The IS220PPROS1B provides three levels of overspeed protection: control, primary, and emergency. The emergency level is executed independently by the PPRO and includes:

• Hardware Overspeed Protection:

• Uses hardware logic independent of software for overspeed detection.

• The trip setpoint (OSHW_Setpoint) is loaded only during module startup, ensuring it is unaffected by runtime software errors.

• Requires two consecutive shaft revolutions to exceed the setpoint to trigger a trip. Response time is typically less than 60ms at normal operating speeds.

• Firmware Overspeed Protection:

• Performs real-time calculations based on three speed signals (HP, IP, LP).

• Supports Rate-Based Overspeed Protection (RBOS), which dynamically adjusts the overspeed trip setpoint based on current shaft acceleration.

• RBOS Function (PPROS1B only):

• Allows users to define a response curve using five acceleration/RPM setpoint breakpoints.

• As shaft acceleration increases, the RBOS-driven overspeed setpoint decreases, allowing for earlier trip initiation under high acceleration conditions.

2 Synchronization Check Function

• Monitors generator and bus voltage, frequency, and phase angle via two Potential Transformer (PT) inputs.

• Energizes the K25A relay to permit breaker closing when conditions are within configurable limits for voltage difference, frequency difference (slip), and phase angle difference.

• Includes a bypass function for dead bus closure.

3 Main Control Watchdog

• Monitors the primary controller's health via a heartbeat signal (DEVICE_HB) received over the IONet.

• Triggers a trip if the heartbeat is missing for five consecutive data frames.

• Supports monitoring of two main controllers; one controller being healthy is sufficient to prevent a trip.

4 Other Protective Functions

• Speed Difference Detection: Trips if the difference between the primary control's speed signal and the PPRO's calculated speed exceeds a configured threshold for three consecutive samples.

• Stale Speed Detection: Trips if the speed signal from the main controller stops changing (dithering) for a prolonged period (100 frames), indicating potential signal integrity loss.

• LP Shaft Locked Detection: Triggers if the HP shaft has speed while the LP shaft remains at zero speed.

• Discrete Contact Input Trips: Seven isolated contact inputs support either direct (hardware-based) or conditional (firmware-logic-based) trip initiation.

• E-Stop (Emergency Stop): Monitors external E-Stop signals and initiates a cross-trip to the primary control.

5 Relay Outputs & Feedback

• Emergency Trip Relays (ETR1–ETR3): Control the trip solenoids.

• Economizing Relays (KE1–KE3): Insert series resistance into the solenoid circuit after pickup to reduce holding current.

• Servo Suicide Relay (K4CL): Forces fuel or steam valves closed (common in simplex systems).

• Synchronizing Check Relay (K25A): Controls the generator circuit breaker closing command.

Key Differences: IS220PPROS1B vs. IS220PPROH1A

Typical Applications

• Gas Turbines (Single Shaft / Two Shaft)

• Steam Turbines (Large, Medium, Small)

• Combined Cycle Plants (STAG configuration)

• Industrial applications requiring compliance with SIL 2 / SIL 3 safety integrity levels.