Hydro Turbine Control and Protection

Pelton — an impulse machine

Horizontal Pelton unit rated 1.5 MW at 500 rpm, two nozzles with needle control and a deflector ahead of them. The control problem is nozzle staging — the second nozzle brought in at a defined opening of the first — plus deflector timing, which is what actually protects the penstock, because the deflector can cut the jet in seconds while the needles take twenty.

Measured on the machine: deflector servomotor closing in 2 seconds over its full 190 mm travel; needle travel of 60 mm taking 36 seconds to close and 9 to open. The load characteristic is strongly non-linear — 86 % of cylinder travel gave 130 kW, 95 % gave 950 kW — which is the part a controller tuned on paper gets wrong.

We delivered this plant complete: specification, design documentation to the national standard for automated system documentation, cabinet build, field instrumentation, commissioning and witnessed testing, and it runs unattended.

Governing systems, from oil to all-electric

A hydro governor can be built several different ways, and the differences matter far more than the brand of controller sitting above them.

Oil-hydraulic on Pelton nozzles. An accumulator unit feeding the needle and deflector cylinders, with the deflector on its own much faster closing path. The accumulator is protected at both ends — a shutdown on low pressure and another on high — and the drain tank level is watched against limits above and below normal. We supervise spool position against the controller's demand and trip on a mismatch of more than 2 % held for 2 seconds, which catches a sticking spool before it becomes a runaway. In the rejection tests the accumulator never fell below 22.5 MPa against a 23–25 MPa standing pressure, which is the margin that says the system is sized correctly.

All-electric wicket gate drive. Gates driven by electric actuators through frequency converters, with no oil pressure system at all. The converters are supervised at both 380 V and 364 V, and a stored-energy cabinet holds enough charge to close the gates when the supply is gone — alarmed below 300 V, because a stored-energy cabinet that is quietly flat is the same thing as no gate closure at all. On a plant like this, proving the stored-energy capacity is a maintenance task of the same weight as proving a UPS battery.

Electric linear actuators for modulating duty. Self-locking linear actuators with stepper or brushless DC motors, up to 15 kN and 85 mm of stroke, EN ISO 5210 F05 and F07 valve attachment, electronic torque or travel seating, rated for continuous modulating duty at up to 1,200 starts per hour. These are what replaces a small hydraulic positioner when the machine is small enough and the oil system is not worth keeping. We installed one on the auxiliary gate at the Pelton plant.

Retrofits we have designed

Distributor block replaced by a proportional servo valve. A two-stage pilot-operated proportional directional valve with integrated electronics and electrical position feedback of the main spool, rated to 350 bar, mounted to ISO 4401, with a spring-centred main spool. The gain is not only resolution — it is that the spool position becomes a measurement the control system can supervise, instead of a mechanical state nobody can see.

Making loss of cabinet power a safe state. On the Pelton unit the start/stop mechanism used two solenoids, pulsed, with a mechanical latch holding the block in whichever state it had last been driven to. Losing the control cabinet's supply therefore left the machine exactly where it was. We specified the replacement: one spring-loaded solenoid, energised to arm and to admit oil to the main spool, so that removing power lets the spring drive the spool to its safe position and close the main cylinder and the nozzles. A protection function implemented in a spring is a protection function that does not need the controller to be alive.

Overspeed and vibration added to an existing scheme. On the vertical machine, shaft speed sensors wired to speed transducers with their relay setpoints at 160 % of rated speed, taken into the trip scheme and onto the shield release; an unused fourth speed sensor cabled in and brought into service; vibration transducers added and collected by a separate controller whose analogue outputs feed the unit control system. That work is described under Hydro Vibration and Shaft Monitoring.

Protection design and voting

Protection is a set of decisions about what a single failed sensor should be allowed to do. On the Pelton unit:

Plus generator electrical protection, outgoing line protection, generator breaker failure, excitation system failure, loss of the DC and AC incomers, and failure of two of the three power supply units.

One-out-of-two on overspeed is not arbitrary. It is a judgement about which way to fail: a spurious trip is cheap, a missed overspeed is not.

Governor structure

What a hydro unit should be controlling depends on what it is connected to and what the water is doing. The control system has to hold all of these and move between them cleanly:

• Speed control, no-load — from first movement to synchronising, holding rated speed with no electrical load to stabilise it. The least stable condition the governor ever sees.
• Frequency and active power control, synchronised — load setpoint with droop, so the machine shares load correctly with the rest of the system.
• Isolated operation — the machine sets the frequency rather than following it, which is the mode the penstock constrains hardest.
• Daily load schedule — a load curve loaded into the controller and followed without an operator, which is how an unattended plant participates in a dispatch programme at all.
• Headwater level control — the unit's load moved to hold the level in the settling basin, so the machine follows the inflow. Level is measured by radar in the basin, brought back to the unit cabinet over fibre, and the loop writes to the load setpoint rather than directly to the nozzles.
• Opening control, manual — nozzle or gate position held directly, with no outer loop, for testing and for conditions the outer loops cannot handle.

Moving between them without a bump

A plant spends its life changing which of these is in charge: synchronising, losing the grid, inflow rising, dispatch taking over, a test starting. Each transfer is a place where the machine can be kicked.

Transfer has to be bumpless in both directions and has to happen on two kinds of trigger — an operator command, and an automatic safety criterion when the plant's state no longer suits the active mode. The standing controllers track the active one, so that whichever takes over starts from the current output and not from its own stale integral. Done badly, this is the single most common source of load swings on a small plant, and it is invisible in a factory test because the condition that triggers it only happens on the river.

Why the characteristic has to be measured, not assumed

The relationship between opening and output is not linear, and it moves with head. On a run-of-river or derivation plant the head changes with the season and with what the intake is passing, so a controller tuned once is right on one day of the year and approximately right on the others.

That is why we take load characteristics and rejection records on the machine at commissioning: so that the gains, the limits and the nozzle staging point rest on a measurement rather than on a manufacturer's curve. Where the head range is wide enough to matter, the controller is parameterised by measured head rather than fixed.

Failure behaviour of the governing subsystem

Failure of the electronics has to stop the machine, not freeze its output. A short interruption of the supply must not produce a load step, which means the controller has to ride through it rather than restart and the actuator has to hold position without a command. And re-entry has to be bumpless in any operating state, after a loss of supply or a repaired fault, whatever the unit is doing at the time.

To that we add the requirement that survives all of the above: a manual path to the nozzles or gates from a local station, not passing through the controller at all. A governor that cannot be operated when its PLC is dead is a governor that defines its own worst case.