The present invention relates to control systems of gas turbines and, particularly, refers to the apparatuses detecting the presence or the absence of the flame in turbine combustion chambers .

Gas turbines can be used in electrical power generation plants. The gas turbine is provided with a combustion chamber (or flame holder) wherein air is fed by a compression system. A flame obtained by a combustor heats this air at constant pressure and, after heating, air passes from the combustion chamber to the turbine.

In order to avoid dangerous situations, the presence of the flame in the combustion chamber is monitored by one or more flame sensors. The flame sensors are connected to control circuits which detect the flame status from electrical signals provided by the sensors and possibly trigger safety procedures. If the flame absence is ascertained, a block of the turbine operation is normally performed.

Particularly, in electrical power generation plants the so called common mode failure can occur: a single initial fault can cause failures in multiple parts of a system.

The Applicant has observed that the known control circuits associated with the flame sensors can show. malfunctions or anomaly behaviours that could cause dangerous situations or reduce the availability of the gas turbine.

The Applicant has noticed that improvements in the reliability of the control apparatuses associated with the flame sensors in gas turbine could reduce risk and disruptions, such as an example, the ones related to the common mode failure.

According to an embodiment of the invention, a gas turbine control apparatus is provided as depicted by the appended claim 1. Further embodiments of the apparatus are described by the dependent claims 2-11.

In accordance with another embodiment of the invention a gas turbine control system is defined by the independent claim 12;. a particular embodiment of the gas turbine control system is described by the dependent claim 13.

Further characteristics and advantages will be more apparent from the following description of preferred embodiment and of its alternatives given as a way of an example with reference to the enclosed drawings in which:

FIG. 1 schematically shows an electrical power generation plant comprising a gas turbine control and monitoring system, a gas turbine and an electrical generator;

FIG. 2 shows a gas turbine control system implementable in said electrical power generation plant, in a normal operation mode;

FIG. 3 shows the gas turbine control system, in a test operation mode.

FIG. 1 shows schematically an example of an electrical power generation plant 1000 comprising a gas turbine control and monitoring system 100, a gas turbine 200 (GT) and an electrical generator 300 (G) .

Particularly, the control and monitoring system 100 can be structured to perform automation, control and protection of the gas turbine 200. The control and monitoring system 100 shown in FIG. 1 comprises at least one control unit 400 including: a first power supply module 401A, a first processing and control apparatus 402A (CPU) , a first communication module 403A (COM) and one or more input/output electronic modules 404 (I/O) .

The first supply module 401A is, as an example, a

AC/DC converter connected to an input AC power supply line 405 (e.g. at 230 V) and to an output DC supply bus 406 (e.g. at 24 V) .

The first processing and control apparatus 402A includes, as an example, a control and processing unit, and is electrically fed by the output DC supply bus 406. Moreover, the first processing and control apparatus 402A is connected to the input/output electronic modules 404 for exchanging data or control signals via an input/output communication bus 407. The input/output electronic modules 404 can be electronic cards connected to sensor devices associated with the gas turbine 200 or to the electrical power generator 300.

The first communication module 403A (COM) is electrically fed by the output DC supply bus 406 and is configured to allow communications, via a communication bus 408, between the first processing and control apparatus 402A and other processing and control apparatuses (not shown) and/or at least one Human Machine interfaces 409, such as computer and display devices .

It is observed that the control and monitoring system 100 shown in FIG.l can be designed with redundancy so duplicating critical components to increase reliability. Accordingly, the control unit 400 can also include: a second power supply module 401B, a second processing and control apparatus 402B and a second communication module 403B. The gas turbine 200, which can be . a known apparatus, is provided with a combustion chamber or flame holder wherein air is fed by a compression system. A flame obtained by a combustor then heats this air at constant pressure. After heating, air passes from the combustion chamber to the turbine.

The control unit 400 is configured to implement a monitoring of the flame presence in the combustion chamber of the gas turbine 200 together with a safety policy in case that a flame absence is detected.

FIG. 2 schematically shows a gas turbine control system 500 implementable in the electrical power generation plant 1000 and configured to monitor and manage the conditions of presence and absence of the flame in the combustion chamber of the gas turbine 200.

The gas turbine control system 500 includes a flame sensor device 501 and a gas turbine control apparatus 502 comprising: a status decision module 503, a switch module 504 and an anomaly sensing module 505 ( TST-MOD) .

The flame sensor device 501 can be a device known to the skilled in the art and comprising, as an example, a sensing element (not shown) adapted to detect the frequencies of the radiation emitted by the flame and a corresponding processing module (not shown) configured to recognize the presence or the absence of the flame in the combustion chamber from signals provided by the sensing element. Particularly, the flame sensor device 501 is configured to selectively assume a flame configuration and a flame absence configuration.

In the flame configuration, the flame sensor device 501 is structured to generate a flame presence signal S _0N at a first terminal Tl. In the flame absence configuration, the flame sensor device 501 is structured to generate a flame absence signal S _0FF on a second terminal T2.

With reference to the example of FIG. 2, the flame sensor device 501 includes a sensor switch SW provided with a supply node Nl, a first movable contact Cl and a second movable contact C2.

The supply node Nl is connected by a first conductive line Ll to a first detection terminal Dl of the status decision module 503, which provides an electrical voltage (e.g. an electrical voltage at 24 V) . Moreover, the first movable contact Cl allows connecting/disconnecting the supply node Nl to/from the first terminal Tl . The second movable contact C2 allows connecting/disconnecting the supply node Nl to/from the second terminal T2. Particularly, the sensor switch SW can be a relay with two movable contacts in which one contact is normally closed and the other contact is normally open.

The first terminal Tl of the flame sensor device 501 is connectable by a second conductive line L2 to a second detection terminal D2 of the status decision module 503. The second terminal T2 of the flame sensor device 501 is connectable by a third conductive line L3 to a third detection terminal -D3 of the status decision module 503.

The status decision module 503 is configured to detect, by selectively receiving the flame presence signal S _0N and the flame absence signal S ₀ FF, a switching of the flame sensor device 501 from the flame configuration to the flame absence configuration and produce an extinguished flame signal S _D ET on a first output terminal OUl .

Moreover, the status decision module 503 is provided with a fourth detection terminal D4 connectable to the third line L3, at which an electrical supply voltage is applied (e.g. 24 V) by the status decision module 503. According to the described example, the status decision module 503 is configured to recognize the flame configuration wheh the flame presence signal SON (i.e. an electrical current) is flowing into a first electrical circuit comprising the first line Ll (the first movable contact Cl is closed) , the first detection terminal Dl, the second detection terminal D2 and the second line L2.

In that situation, there is no electrical current circulation into a second electrical circuit comprising the third conductive line L3 (the second movable contact C2 is open) and the third and fourth detection terminals D3 and D4.

The status decision module 503 can be an electronic card including hardware and/or software modules, such as a printed circuit board carrying an integrated circuit. Particularly, the status decision module 503 can be one of the input/output electronic modules 404 shown in FIG. 1.

The switch module 504 is connected between the flame sensor device 501 and the status decision module 503 and is operable by a test signal S _TS to simulate a switching of the flame sensor device 501 from the flame configuration to the flame absence configuration.

Particularly, the switch module 504 shows input terminals connected to the first terminal Tl, the supply node Nl and the second terminal T2 and output terminals connected to the first Dl, the second D2, the third D3 and the fourth D4 detection terminals. According to a particular example, the switch module 502 includes a first switch device SWl and a second switch device SW2 which share a drive module 506. Particularly, the first switch device SWl can be an electromagnetic relay having a first electromagnet including a first yoke Yl, around which a first coil l is wound, and at least one respective movable contact Kl.

The first coil Wl shows two respective terminals each connected to a first drive terminal PI and a second drive terminal P2 of the drive module 506. The movable contact Kl of the first switch device SWl is connected along the second conductive line L2 and is configured to connect/disconnect the first terminal Tl of the flame sensor device 501 to/from the second detection terminal D2 of the status decision module 503.

In accordance with the specific example shown in FIG. 2, the first switch device SWl is an electromagnetic relay with two movable contacts for which only the movable contact Kl is employed.

Moreover, in accordance with the example described, the second switch device SW2 can be an electromagnetic relay having a second electromagnet provided with a second yoke Y2, around which a second coil W2 is wound, a respective first movable contact CT1 and a respective second movable contact CT2.

The second coil 2 shows two respective terminals each connected to a third drive terminal P3 and a fourth drive terminal P4 of the drive module 506.

The first movable contact CT1 of the second switch SW2 is connected between the fourth detection terminal D4 of the status decision module 503 and a switching node N2 connected to the second movable contact CT2 of the second switch SW2 and the third detection terminal D3. The second movable contact CT2 of the second switch S 2 is connected along the third conductive line L3 and is configured to connect/disconnect the second terminal T2 to the third detection terminal D3 of the status decision module 503.

It is observed that the first switch SWl and second switch SW2 can be electromagnetic relays having one of the movable contact normally closed and the other movable contact normally open.

The anomaly sensing module 505 is configured to generate the test signal STS, to be provided to the switch module 504. Particularly, the anomaly sensing module 505 is configured to manage test operations in order to evaluate the correct or anomalous behaviour of the status decision module 503. As will be discussed later, the anomaly sensing module 505 periodically activates, by means of the test signal S _T s the switch module 504 to simulate a switching of . the flame sensor 501 from the flame configuration to the flame absence configuration and senses the extinguished flame signal S _D ET to verify if the configuration switching has been actually detected by the status decision module 503. The anomaly sensing module 505 is structured to generate an anomaly signal S _A indicated the correct or anomalous behaviour of the status decision module 503.

The anomaly sensing module 505 includes hardware and/or software modules and can comprise a control and processing unit, such as a microprocessor, executing a specific software. The functionalities of the anomaly sensing module 505 can be also implemented by a finite- state machine. According to an example, the anomaly sensing module 505 is implemented into the first processing and control apparatus 402A of FIG. 1.

With reference to the operation, it has to be observed that the gas turbine control system 500 can operate in a normal mode and in a test mode.

In the normal operation mode, the switch module 504 is not activated and (as indicated in FIG. 2) the movable contact Kl of the first switch device SW1 is closed, the first movable contact CT1 of the second switch device SW2 is opened and the second movable contact CT2 of the second switch device SW2 is closed.

In the above situation and in the flame configuration of the flame sensor device 501 (as represented in FIG. 2), the first contact CI is closed and the second contact C2 is opened. The electrical current, corresponding to the flame presence signal S _0N , flows in the first conductive line Ll and in the second conductive line L2 and is sensed by the status decision module 503, at the first and second detection terminals Dl and D2.

In the third conductive line L3 there is no electrical current circulation since the the second contact C2 is opened. The extinguished flame signal S _DET produced by the status decision module 503 can carry a first digital value indicating flame presence.

With reference again to the normal mode, if the flame sensor device 501 performs a switching towards the flame absence configuration, the corresponding first movable contact CI is opened, while the second movable contact C2 is closed (contrary to the situation represent in FIG.l) . In this condition, the electrical current flowing into the first conductive line Ll and in the second conductive line L2 is interrupted and an electrical current (corresponding to the flame absence signal S ₀ FF) start circulate into the third conductive line L3. It is observed that the fourth detection terminal D4 is connected to the first detection terminal Dl by an electrical connection included into the status decision module 503.

This electrical current (flame absence signal S ₀ FF ) is sensed by the status decision module 503 at the third and fourth detection terminals D3 and D4 which generates, if it operates correctly, the extinguished flame signal S _D ET carrying a second digital value representing the detected flame absence condition.

It is observed that when the flame absence condition is detected safety procedures can be implemented to avoid risks in the gas turbine 200. Particularly, the gas turbine control and monitoring system 100 may include two or more gas turbine control system 500 analogous to the one above described with reference to FIG. 2. According to this example, if two extinguished flame signals S _D E _T indicating the flame absence condition are generated by the two gas turbine control system 500, a block of the gas turbine 200 can be carried out.

Reference is now made to the test operation mode. Initially, the gas turbine control system 500 is in the condition depicted in FIG. 2: the flame sensor device 501 is in the flame configuration (the first contact CI is closed and flame presence signal S _0N is generated) and the switch module 504 is deactivated.

To execute the periodic test, the anomaly sensing module 505 sends the test signal S _T s to the drive module 506 of switch module 504 which supplies electrical currents to the first coil Wl of the first switch device SWl and the second coil W2 of the second switch device SW2.

In this condition (depicted in FIG.3), the movable contact Kl of the first switch device SWl is opened, the first movable contact CTl of the second switch device SW2 is closed and the second movable contact CT2 of the second switch device SW2 is opened.

Particularly, the first electrical current flowing into the first and second conductive lines LI and L2 is interrupted and a simulation electrical current start flowing from the fourth detection terminal D4 (which provides a supply electrical voltage) , through the first movable contact CTl of the second switch device SW2 and the switching node N2, towards the third detection terminal D3 : in this particular manner, a simulation of the flame absence configuration' is performed . If the status decision module 503 detects the switching from the initial flame presence configuration to the simulated flame absence configuration and generates a corresponding extinguished flame signal S the anomaly sensing module 505 detects the correct behaviour of the status decision module 503 and provides a corresponding anomaly signal S¾N .

On the contrary, if the status decision module 503 does not detect the switching from the initial flame presence configuration to the simulated flame absence configuration, the same extinguished flame signal SDET , indicating flame presence as previously generated, is provided. In this case, the anomaly sensing module 505 senses the digital value carried by the extinguished flame signal S _D ET and detects an anomaly behaviour of the status decision module 503, so generating a corresponding anomaly signal SAN .

The anomaly signal S _m can trigger safety procedures including, as an example, the replacement of the defective status decision module 503. It is noticed that the anomalous behavior of the status decision module 503 can be due to a non-detectable failure in its input cards.

The gas turbine control system 500 shows the advantage of guarantee a high level of availability of the electrical power generation plant 1000, without any significant circuit complexity increasing.

The test on the status decision module 503 performed by the switch module 502 and by the anomaly sensing module 505 allows to fulfill the law requirements, such as the ones ruled by European Machinery Directive 2006/42/EC. It is observed that the European Machinery Directive 2006/42/EC refers to the standard ISO 13849-1: this standard deals with the design and integration of Safety-Related Parts of Control Systems (SRP/CS) independently from the technology used.

Moreover, the described control apparatus allows to increase the performance level (PL) defined by the standard ISO 13849-1. Particularly, it is noted that the implemented solution can minimize or cancel the common mode failure that could generate a dangerous failure in the electrical power generation plant 100.0.