The present invention relates to a gas turbine engine with active protection from flame extinction and to a method of operating a gas turbine engine.

As known, flame monitoring is a critical issue in gas turbine engines, because unexpected flame extinction at one or more burners may lead to loss in efficiency and, in the worst case, cause substantial fuel leak and possibly explosion. Given the actual risk of catastrophic events, redundant monitoring system must be provided and minimum safety requirements are set by standards such as IEC 61511. Redundant systems are designed to be able to continue reliable operation even in case of partial failure, at least to some extent in accordance with existing standards.

In annular combustors, flame monitoring is often accomplished by optical flame detectors, which include optical wave guides facing the flame region and image detectors coupled to the wave guides. A typical monitoring configuration includes three optical flame detectors that provide binary flame signals (flame ON/flame OFF) handled by a control system with a two-out-of-three, or 2oo3, redundancy logic. This means that the monitoring system can tolerate failure of one of the three available flame detectors and allow operation of the gas turbine engine while both the other two flame detectors correctly work. The mentioned monitoring systems fulfil the requirements set by the standards and are capable of effectively preventing dangerous conditions which may result in continued fuel supply in the absence of flame.

On the other side, however, and also in consideration of the severe operating conditions of parts exposed to hot combustion gas, relatively rapid ageing of hardware components may lead to false negative detections, meaning that the response of the flame detectors indicates flame extinction, while flame is actually present, instead. Even though such events do not normally result in imminent danger for structural integrity of the gas turbine engines, nevertheless unnecessary plant trips may be triggered, with sever increase of cost.

It is thus an object of the present invention to provide a control system of a gas turbine engine and a method of operating a gas turbine engine that allow to overcome or at least attenuate the above described limitations.

According to the present invention, there is provided a gas turbine engine comprising:

• an annular first combustor assembly;
• a second combustor assembly;
• at least three optical flame detectors, arranged to monitor flame presence in the first combustor assembly and configured to supply respective flame monitoring signals having a first state when a flame is detected in the first combustor assembly and a second state otherwise;
• a temperature monitoring assembly, configured to detect a control temperature of hot gas flowing from the first combustor assembly to the second combustor assembly at a location downstream of the first combustor assembly; and
• a processing unit, configured to determine dangerous flame failure based, at least in a control range of operating conditions, on the flame monitoring signals and a control function of the control temperature and based on M-out-of-N activation redundancy with Hardware Failure Tolerance of at least 1, wherein M is at least 3 and N is at least 4.

The above identified solution provides for maintaining Hardware Failure Tolerance of 1, while allowing two of the available flame monitors (i.e. the three optical flame detectors and the temperature monitoring assembly) to be marked as being of bad quality, which case would otherwise be counted as indication of absence of flame and would lead to safety shutdown. Thus, the possibility of safe operation is extended and availability of the gas turbine engine is increased. Availability of the gas turbine engine is improved also in case of failure of one of the optical flame detectors, which are frequently critical components.

According to an aspect of the invention, the gas turbine engine comprises a high-pressure turbine between the annular first combustor assembly and the second combustor assembly, wherein the control temperature is a temperature at an outlet of the high-pressure turbine.

Interaction with the HP turbine reduces gas temperature to an extent that reliable measures can be taken without exposing sensors to dangerous environment.

According to an aspect of the invention, the temperature monitoring assembly comprises a plurality of first temperature sensors arranged downstream of the first combustor assembly, e.g. downstream of the high-pressure turbine, and configured to provide respective temperature measurements, and wherein the control function of the control temperature includes an average of the temperature measurements provided by the first temperature sensors.

According to an aspect of the invention, the gas turbine engine comprises a compressor for supplying a flow of compressed air to the first combustor assembly and a second temperature sensor, configured to detect an air temperature of compressed air at an outlet of the compressor, wherein, when the second combustor assembly is not activated, the control function includes a combination of the average of the temperature measurements provided by the first temperature sensors and of the air temperature of compressed air provided by the second temperature sensor.

Advantageously, the control function is scarcely affected by variations of ambient temperature. In fact, the difference of the gas temperature at the outlet of the HP turbine and the air temperature at the outlet of the compressor does not remarkably vary with ambient temperature, especially at idle and during transients. Advantageously also, the working setpoint of gas temperature at the outlet of the HP turbine is weakly or not at all dependent on variations of ambient temperature when the second combustor is in operation.

According to an aspect of the invention, the processing unit is configured to determine partial flame failure in the control range of operating conditions based on the temperature measurements provided by the first temperature sensors and based on P-out-of-Q activation redundancy, wherein P is at least 3 and Q is a number of the first temperature sensors in the first combustor assembly.

According to an aspect of the invention, the processing unit is configured to determine dangerous flame failure when the control function is outside an admissible range.

According to an aspect of the invention, the processing unit is configured to determine dangerous flame failure based on comparison of the control function with a first temperature threshold when the second combustor assembly is not activated and with a second temperature threshold when the second combustor assembly is activated.

Accordingly, appropriate form of the control function can be selected and correctly used depending on whether the second combustor assembly is working.

According to an aspect of the invention, the flame detectors are configured to mark any of the flame monitoring signals as bad data quality if programmed plausibility criteria are not met and the processing unit is configured to mark the control temperature as bad data quality if the control temperature or one or more of the temperature measurements temporarily fall outside of plausibility ranges and to determine dangerous flame failure when at least one of the following conditions is met:

• all the flame monitoring signals have the second state;
• two out of three flame monitoring signals have the second state and the control function is outside the admissible range;
• one of the flame monitoring signals is identified as bad data quality and two out of three flame monitoring signals have the second state;
• the control function is identified as bad data quality and two out of three flame monitoring signals have the second state;
• two of the flame monitoring signals SFM1, SFM2, SFM3 are identified as bad data quality and one out of three flame monitoring signals SFM1, SFM2, SFM3 has the second state FOFF;
• two of the flame monitoring signals SFM1, SFM2, SFM3 are identified as bad data quality and the control function is outside the admissible range AR.

Identification and handling of signals affected by bad data quality allows to improve availability of the gas turbine engine without affecting safe operation. Conditions of suspect hardware failure can in fact be duly taken into account and criteria for emergency shutdown of the gas turbine engine may be completely safely relaxed.

According to an aspect of the invention, the processing unit is configured to determine dangerous flame failure based, outside the control range of operating conditions, on the flame monitoring signals and based on 2-out-of-3 activation redundancy.

The control range may be advantageously selected to cover most operating conditions of the gas turbine engine. During transient conditions, which amount to a relatively small part of the lifetime of the gas turbine engine, flame failure may be monitored through reliable, albeit less performant systems. Neither safe operation nor engine reliability and availability are significantly affected.

According to an aspect of the invention, M is 3 and N is 4.

According to an aspect of the invention, the gas turbine engine has a rated speed, wherein the control range of operating conditions includes speeds above a speed threshold, the speed threshold being a fraction of the rated speed.

According to an aspect of the invention, the processing unit is configured to trigger emergency shutdown in response to dangerous flame failure.

According to an aspect of the invention, there is provided a method of operating a gas turbine engine comprising an annular first combustor assembly and a second combustor assembly;
the method comprising:

• monitoring flame presence in the first combustor assembly by at least three flame detectors supplying respective flame monitoring signals with a first state when a flame is detected in the first combustor assembly and a second state otherwise;
• detecting a control temperature of hot gas flowing from the first combustor assembly to the second combustor assembly at a location downstream of the first combustor assembly; and
• determining dangerous flame failure based, at least in a control range of operating conditions, on the flame monitoring signals and a control function of the control temperature and based on M-out-of-N activation redundancy with Hardware Failure Tolerance of at least 1, wherein M is at least 3 and N is at least 4.

According to an aspect of the invention, detecting the control temperature comprises taking a plurality of simultaneous temperature measurements, and wherein the control function of the control temperature includes an average of the temperature measurements.

According to an aspect of the invention, the method comprises
supplying a flow of compressed air to the first combustor assembly by a compressor and detecting a temperature of compressed air at an outlet of the compressor, wherein, when the second combustor assembly is not activated, the control function includes a combination of the average of the temperature measurements and of the temperature of compressed air provided by the second temperature sensor.

The present invention will now be described with reference to the accompanying drawings, which illustrate some non-limitative embodiments thereof, in which:

• figure 1 is a simplified block diagram of a gas turbine engine in accordance with and embodiment of the present invention;
• figure 2 is a simplified cross-sectional front view of the gas turbine engine of figure 1; and
• figure 3 is a graph showing quantities related to operation of the gas turbine engine of figure 1.

With reference to Figure 1, number 1 defines a gas turbine plant as a whole comprising a gas turbine engine 2 and a control system 3. The gas turbine engine 2, in turn, comprises a compressor 4, a first combustor assembly 5, a high-pressure turbine or HP turbine 6, a second combustor assembly 8 and a low pressure turbine or LP turbine 10, all extending about an axis, which is indicated by A in figure 2.

The compressor 4 (figure 1) feeds the first combustor assembly 5 with a flow of compressed air drawn from outside. Air supply to the compressor 4 is controllable by the control system 3 by adjusting orientation of inlet guide vanes 11 of the compressor 4 through first actuation signals SA1.

As schematically illustrated in figure 2, the first combustor assembly 5 comprises an annular combustion chamber 12 and is provided with a plurality of combustor units 13, which are circumferentially distributed about the axis A, . The combustor units 13 admix air from the compressor 4 and fuel from a fuel feed system 15 to form a mixture for combustion. The fuel may be gaseous, for example natural gas or syngas, or liquid, for example gasoil. The gas turbine engine 2 can be structured to use different types of fuel, both gaseous and liquid. Fuel supply is controllable by the control system 3 through the fuel feed system 15 and second actuation signals SA2.

The HP turbine 6 receives and expands a flow of hot gas from the first combustor assembly 5 to extract mechanical work, which is transferred to an external user, typically an electric generator, here not shown.

The hot gas is then conveyed along a hot gas path to the second combustor assembly 8, which is annular as well and comprises a plurality of combustor units (not shown in the drawings). In the second combustor assembly 8, additional fuel and possibly fresh air are added to the hot gas flow to form a mixture for sequential combustion. The control system may activate the first combustor assembly 5 alone or both the first combustor assembly 5 and the second combustor assembly 8 together as required by the operating conditions.

The LP turbine 10 receives the hot gas flow from the second combustor assembly 8 for further extraction of mechanical work and discharges exhaust gas out of the gas turbine engine 2, for example to a heat recovery steam generator.

The control system 3 comprises a controller 16, a processing unit 17 and a plurality of sensors and/or detectors as explained hereinafter. The definition "control system" as used herein is to be broadly understood as meaning a system supervising all functions and operation of the gas turbine, including at least control or regulation functions, such as load control, determining set-points and driving actuators to reach the set-points, primary and secondary frequency control, and protection functions, such as protection against flame failure. In particular, a control system may comprise a first subsystem for control functions and a second subsystem for protection functions.

The controller 16 is configured to operate the gas turbine engine 2 in accordance with received load request. In particular, the controller 16 determines set-points for the gas turbine engine 2 so that the load request may be met and, based on determined set-points and feedback signals from selected sensors and/or detectors, it drives the inlet guide vanes 11 of the compressor 4 and the fuel feed system 15 through the actuation signals SA1, SA2.

The control system 3 comprises at least three flame detectors 18, arranged to monitor flame presence in the first combustor assembly 5 as indicated schematically in figure 2. The flame detectors 18 supply respective flame monitoring signals SFM1, SFM2, SFM3 having a first state FON when a flame is detected in the first combustor assembly 5 and a second state FOFF otherwise. In one embodiment, the flame detectors 18 are of an optical type and may comprise respective optical wave guides facing a flame region in the combustion chamber 12 of the first combustor assembly 5 and image detectors. Specifically, the optical flame detectors 18 may be responsive to radiation in wavelength bands in the visible and/or infrared range.

The control system 3 further comprises a temperature monitoring assembly 20, configured to detect a control temperature TC of hot gas flowing from the first combustor assembly 5 to the second combustor assembly 8. The monitoring assembly 20 is arranged at a location downstream of the first combustor assembly 5, in one embodiment at the outlet of the HP turbine 6. More precisely, the temperature monitoring assembly 20 comprises a plurality of first temperature sensors 21 circumferentially arranged around the axis A downstream of the HP turbine 6. The first temperature sensors 21 provide respective temperature measurements TM1, ... TMK, e.g. 12 or 24. The temperature monitoring assembly 20 may exploit an internal processing module 17a of the processing unit 17 to calculate the control temperature TC from the temperature measurements TM1, ... TMK.

The control system 3 further comprises a second temperature sensor 25 is configured to detect an air temperature TA of compressed air at an outlet of the compressor 4.

The processing unit 17 is configured to determine dangerous flame failure based, at least in a control range of operating conditions, on the flame monitoring signals SFM1, SFM2, SFM3 and a control function of the control temperature TC. Moreover, determination of dangerous flame failure is based on M-out-of-N activation redundancy with Hardware Failure Tolerance of at least 1, wherein M is at least 3 and N is at least 4. In the embodiment described herein M is 3 and N is 4. In a range of operating conditions outside the control range, i.e. below the speed threshold ST, the processing unit 17 determines dangerous flame failure based on the flame monitoring signals SFM1, SFM2, SFM3 and 2-out-of-3 activation redundancy.

With reference to figure 3, the control range of operating conditions includes speeds above a speed threshold ST of the rated speed. In one embodiment, the speed threshold ST is 90% of the rated speed.

The control function is based on the control temperature TC, which in one embodiment may be an average of the temperature measurements TM1, ... TMK simultaneously provided by first temperature sensors 21, and depends on whether or not the second combustor assembly 8 has been activated.

More precisely, when the second combustor assembly 8 is not activated and while it remains in inactive condition, the control function includes a combination of the control temperature TC, which is the average of the temperature measurements TM1, ... TMK, and of the air temperature TA of compressed air provided by the second temperature sensor 25. In one embodiment, the control function is the difference TC-TA of the control temperature TC and of the air temperature TA of compressed air provided by the second temperature sensor 25. When the second combustor assembly 8 is active, instead, the control function is the control temperature TC (i.e. the average of the temperature measurements TM1, ... TMK) alone. In both cases, a correction, e.g. a proportionality factor, may be applied. The control function is considered as indicating normal operation within an admissible range AR of values and flame failure outside the admissible range AR of values. In one embodiment, the admissible range AR of values includes the range above a first temperature threshold TH1, when the second combustor assembly 8 has not been activated yet, and the range above a second temperature threshold TH2, when the second combustor assembly 8 is active. Thus, values of the control function outside the admissible range AR (i.e. below the first temperature threshold TH1 or the second temperature threshold TH2, depending on the state of the second combustor assembly 8) are used by the processing unit 17 to detect dangerous flame failure.

The processing unit 17 is configured to weigh also data quality of the flame monitoring signals SFM1, SFM2, SFM3 and of the control temperature TC to use data quality assessment in determining flame failure. In one embodiment, for example, the flame monitoring signals SFM1, SFM2, SFM3 come from the flame detectors 18 with additional information relating to data quality, i.e. flame detectors 18 are available that are configured to mark any of the flame monitoring signals SFM1, SFM2, SFM3 as bad data quality if, upon internal check, programmed plausibility criteria are not met. Likewise, the processing unit 17 is configured to mark the control temperature TC as bad data quality if the control temperature TC or one or more of the temperature measurements TM1, ... TMK temporarily fall outside of plausibility ranges. Bad data quality too is taken into account by the processing unit 17 in determination of dangerous flame failure.

In one embodiment, the processing unit 17 determines dangerous flame failure when at least one of the following conditions is met:

• all the flame monitoring signals SFM1, SFM2, SFM3 have the second state FOFF;
• two out of three flame monitoring signals SFM1, SFM2, SFM3 have the second state FOFF and the control function is outside the admissible range AR;
• one of the flame monitoring signals SFM1, SFM2, SFM3 is labeled as bad data quality and two out of three flame monitoring signals SFM1, SFM2, SFM3 have the second state FOFF;
• the control function is labeled as bad data quality and two out of three flame monitoring signals SFM1, SFM2, SFM3 have the second state FOFF;
• two of the flame monitoring signals SFM1, SFM2, SFM3 are identified as bad data quality and one out of three flame monitoring signals SFM1, SFM2, SFM3 has the second state FOFF;
• two of the flame monitoring signals SFM1, SFM2, SFM3 are identified as bad data quality and the control function is outside the admissible range AR.
• When dangerous flame failure is determined, based on any one of the above conditions, the processing unit triggers a safety shutdown or trip of the gas turbine engine trip 1, either directly or through the controller 16. Time response to trigger the engine trip is selected to meet process safety times, which may depend on the kind of fuel currently used at the time when dangerous flame failure is detected.

The processing unit 17 is also configured to determine partial flame failure in the control range of operating conditions based on the temperature measurements provided by the first temperature sensors 21 and based on P-out-of-Q activation redundancy, wherein P is at least 3 and Q is a number of the first temperature sensors in the first combustor assembly 5, e.g. 24.

It is finally apparent that changes and variations may be made to the gas turbine engine and method described and illustrated without departing from the scope of protection of the accompanying claims.