The IS220YTURS1A is a critical I/O pack within the Mark VleS Safety Control System, designed specifically for Primary Turbine Protection. It is an application-specific I/O module that works in conjunction with compatible terminal boards (such as TTUR, TRPA, TRPG) to monitor and safeguard turbines (gas or steam) against critical hazards like overspeed and flame failure. Its core function is to ensure a safe shutdown of the equipment upon detecting dangerous conditions.
The module is designed and certified in accordance with the IEC 61508 functional safety standard. It is capable of achieving:
SIL 2 in Hardware Fault Tolerance (HFT) = 0 architectures (e.g., 1oo1, 2oo2).
SIL 3 in HFT = 1 architectures (e.g., 1oo2, 2oo3).
It is suitable for use in both low-demand and high-demand/continuous modes of operation.
Key Functions
1. Speed Monitoring and Overspeed Protection
The IS220YTURS1A supports up to four passive, magnetic speed sensor inputs, with a frequency range of 2 Hz to 20,000 Hz.
Each input channel can be independently configured for different applications (e.g., Flow, Speed, Speed_High, Speed_Low).
It incorporates a fast overspeed detection algorithm with configurable trip logic, such as tripping on a single channel (PR_Single) or on the maximum value from multiple channels (PR_Max).
Configurable acceleration and deceleration trip functions are available to protect against sudden, dangerous changes in shaft speed.
2. Flame Detection
It accepts inputs from up to eight flame detectors (e.g., Geiger-Muller type).
The flame sensing circuitry interprets voltage pulses above 2.5 V as a logic high, indicating the presence of flame. The pulse rate is measured by a counter over a user-configurable time interval (multiples of 40 ms).
The safe state for the YTUR flame detection circuitry is defined as "Flame Present". A loss of flame signal constitutes the unsafe condition that will trigger a protective action. It is not intended for applications where detected flame is the unsafe state.
3. Electrical Trip Device (ETD) Control
The IS220YTURS1A drives monitored trip relay outputs to interface with Electrical Trip Devices (ETDs), which typically cut power to trip solenoids, initiating a mechanical shutdown.
In a Triple Modular Redundant (TMR) configuration, the outputs from three YTUR packs are connected to a terminal board (like TRPG or TRPA) that implements a hardware voting circuit (e.g., 2-out-of-3 voting) to ensure a single failure does not prevent a trip.
4. Emergency Stop (E-Stop) Input
A dedicated E-Stop input provides a hardware-based emergency shutdown path. When activated, it can directly de-energize the trip relays.
This E-Stop signal can also be configured to cross-trip other protection systems, such as the YPRO backup overspeed protection, ensuring system-wide protection.
5. Non-Safety Certified Functions (Non-Interfering)
Generator Synchronization and Breaker Control: Provides non-safety-rated functionality for synchronizing a generator to the utility grid and controlling the main circuit breaker.
Shaft Voltage and Current Monitoring: Monitors induced shaft voltage and current to help prevent damage from shaft currents, but this is not part of the safety function.
Potential Transformer (PT) Monitoring: Monitors generator and bus voltage signals from Potential Transformers for non-safety control and monitoring purposes.
System Architecture and Operating Principle
1. Hardware Architecture
The IS220YTURS1A operates as a key component within the larger Mark VleS architecture. Its signal path consists of three primary parts:
Terminal Board (TTUR/TRPA/TRPG): Provides the physical interface for field wiring, offering features like transient protection, signal fannin g (for TMR inputs), and output voting (for TMR outputs).
I/O Pack (YTURS1A): The module itself, which contains a common processor board and a unique data acquisition board. It digitizes signals, executes protection algorithms, and handles communication.
IONet: A proprietary, closed Ethernet network used for communication between the I/O packs and the Mark VleS Safety controllers. I/O packs multicast input data to the controllers every frame, and controllers broadcast output data back to the I/O packs.
In a TMR system, three IS220YTURS1A modules (R, S, T) are used. Each module processes the fanned-out inputs independently. The controllers then perform a median selection on the speed signals and a majority vote (2-out-of-3) on the health and trip decisions, ensuring continued operation even if one entire channel fails.
2. Signal Processing and Control Workflow
Input Acquisition: Field signals (speed, flame, E-Stop, etc.) are wired to the terminal board, which conditions and fans them to the YTURS1A module(s).
Signal Processing: The YTURS1A digitizes the analog signals and executes its embedded firmware algorithms. For speed inputs, it calculates RPM. For flame inputs, it determines the flame-on/flame-off status based on pulse counts.
Protection Logic: The module continuously compares the processed values (e.g., speed, acceleration) against the configured trip setpoints. It also monitors the health of its own hardware and input signals.
Output Action: If a trip condition is met (e.g., overspeed) or a critical fault is detected, the YTURS1A immediately de-energizes its safety-certified trip relay outputs. This action is performed locally within the I/O pack, without requiring a command from the main controller, ensuring a very fast response time.
System Communication: Simultaneously, the YTURS1A communicates the status of all inputs, outputs, and its internal diagnostics to the Mark VleS controllers via the IONet for system-level monitoring, alarming, and HMI display.
3. Health Monitoring and Diagnostic Coverage
The IS220YTURS1A features extensive onboard diagnostics to detect hardware failures, communication loss, and power supply issues.
In the Mark VleS system, every I/O-derived variable has an associated health status. This health is a combination of point health (from the I/O pack's self-diagnostics) and link health (from the controller's validation of IONet communication integrity).
Application code can monitor the health of critical variables using the VAR_HEALTH function block, allowing the safety logic to take appropriate action if an input is deemed unhealthy (e.g., selecting a redundant sensor, initiating an alarm).
The system's Branding feature ensures configuration integrity. Once the application is tested and branded, any unauthorized change to the code, constants, or hardware generates a diagnostic alarm.
4. Integration with YPRO and YSIL for Layered Protection
The IS220YTURS1A is often part of a multi-layered protection strategy:
IS220YTURS1A (Primary Protection): Serves as the main system for overspeed and flame protection.
YPRO (Backup Protection): Provides a completely independent, redundant overspeed protection layer, often with both firmware and hardware-based trip mechanisms.
YSIL (Core Safety Protection): Offers the highest level of safety integrity (SIL 3) for the most critical functions, such as gas compressor protection.
Configuration and Commissioning
Configuration of the IS220YTURS1A is performed using the ToolboxST application.
1. Basic Configuration
I/O Pack Redundancy (Simplex or TMR)
Terminal Board Type, Hardware Form, and Barcode identification
IONet port assignments
2. Protection Parameter Settings
Overspeed Trip Setpoints (e.g., PR1Setpoint to PR4Setpoint)
Acceleration/Deceleration Trip Enable and Setpoints
Flame Detection Time Interval and Threshold Limits (FlameLimitHigh, FlameLimitLow)
System Limit Checks and Diagnostic Difference Limits (TMR_DiffLimit)
3. Jumper Configuration (on TRPA board)
Safety Certification and Applications
