Failsafe Operation for Paralleled Generator Sets

Ed Schroeder
Senior Engineering Specialist
Caterpillar Electric Power

Keith Folken
Senior Engineering Specialist
Caterpillar Innovation and Technology Development

October 2016

INTRODUCTION

In facilities with a high demand for power, such as a hospital or data center, communication among generator sets is crucial for maintaining power levels. In these types of applications, generator sets can be electrically connected to help manage the large power need. Called paralleling generator sets, this configuration helps ensure more efficient load sharing and load response within a network.

One way to operate power systems with paralleled generator sets is to use dedicated multi-function engine generator set controllers with integrated paralleling controls on board the generator set. With Cat® EMCP 4.4 control system, the individual controllers communicate with each other by way of an Ethernet backbone, synchronizing the generator sets through a connection to a single Ethernet switch.

This approach to paralleling is cost-effective, as it integrates the function of discrete paralleling control devices and programmable logic controllers with the generator set controls and reduces switchgear footprint, leading to lower project capital cost. However, the approach has raised questions among power system designers and users:

• What happens if the Ethernet switch fails and the generator sets no longer can communicate?
• What happens if the link from one or more generator sets is broken and those units are cut off from communication?
• Under such conditions, will the power system continue to operate, share load, and respond to load changes in a safe and stable manner?

For generator sets equipped with EMCP 4.4 control and Multiple-Generator Data Link (MGDL), the answer is an unequivocal yes. Caterpillar’s patented strategy called Failsafe Adaptive Load Sharing/Droop Operation is programmed into the EMCP 4.4 system to intelligently switch units to a control scheme that enables uninterrupted, stable operation for as long as it takes for full communication to be restored. The communication loss also triggers an alarm that alerts operating personnel to the condition so that repairs can be expedited.

Knowing The Risk

The traditional approach to communication failure in paralleled generators sets carries risks of system instability and unsafe engine operation. In the standard response to communication failure, units are divided into two modes: droop and isochronous. The droop units are automatically placed at a fixed, pre-determined target load level, such as 50 percent load at nominal frequency. The isochronous swing machines, also known as swing machines, take on the majority of load changes. The droop units begin to pick up load only after the isochronous units become overloaded to greater than 100 percent of their rating.

This control scheme has two main disadvantages. First, the droop generator sets may be operating at a different load percentage at the time communication is lost. They must then immediately adjust to the frequency and load on their droop curve. This may mean suddenly adding or lowering their fuel to match the frequency of the isochronous generator sets, which could cause instability in the system and loss of synchronization. The isochronous group can also become overloaded as load increases even after the system is stabilized. Although the droop generator sets could add more load, this design prohibits them from doing so.

Another deficiency of this approach is that it needlessly limits the system’s power capability. The output power of the swing machines changes to follow variations in load, while maintaining a constant speed and frequency on the system. The droop units, with the fixed setting at 50 percent load, will always produce the same power output at a particular speed or frequency. Therefore, the maximum available load for this type of system is limited to the combined output of the swing machines and the total fixed power output of the droop machines. Any load above that maximum will result in a decrease in speed and frequency. If load increases beyond this maximum available load, the swing machines can be overloaded even though the droop units are operating at well below their maximum capabilities.

Furthermore, the minimum system load cannot be allowed to fall below the combined fixed output for the droop units under this control approach. If it does, the system frequency will increase, and the swing machines can become motorized or reverse-powered.

Stabilizing System Performance

The Failsafe Adaptive Load Sharing/Droop Operation approach using EMCP 4.4 safely maintains stability through a loss of communication, seamlessly transitioning into failsafe mode with gradual, stable movement to a new equilibrium point.

Under this approach, the failsafe mode is triggered when communication messages from one or more EMCP 4.4 units are not received following a specified time interval. The communication loss can result from conditions such as broken wires, improper configuration, power loss to the Ethernet router or hub device, or power loss to an EMCP 4.4 unit.

When communication is lost, the failure mode intelligently switches some lost units to Failsafe Adaptive Droop and other units to Failsafe Isochronous Load Sharing. The operating modes of the units during a loss of communications are updated to best serve the generator system.