Generator Start Permissives, Sync Handover and Load Shed

Lockout_86 is examined on rung 12 as a normally closed contact off the physical relay, never as a bit in a communications word, so a tripped 86 still blocks a start with the network down. That one choice in the generator start permissive marks where the PLC stops and the rest of the switchgear begins, on a plant with three 2.5 MW gas engines on an 11 kV bus. The protective relay trips, the governor holds speed and load, the AVR holds voltage, and the PLC sequences all of them and answers to the SCADA. Put a protection function in the controller because the logic looks easy and you have put it in the wrong box.

Decide what belongs in the PLC and what does not

The dividing line is simple. Anything that has to work with the PLC powered down belongs in a relay or in hardwiring. Anything that needs plant knowledge belongs in the PLC. Synchronism check in ladder is the classic mistake: it looks correct on the bench and closes a breaker across 40 degrees when the scan stretches under load.

Build the start permissive rung

Rung 12 (Gen2_Sequence, 50 ms periodic task):

  ---] [-----------] [-----------] [-----------]/[--------( )---
   Start_PB      LubeOil_OK     52G_Open     Lockout_86    Start_Seq
   |
   ---] [---
   Start_Seq

Rung 13:  crank only after prelube has run
  ---] [--------] [--------[TON Prelube_T Preset=30000]--------
   Start_Seq   Prelube_Run

Rung 14:
  ---] [---------] [---------] [----------( )---
  Prelube_T.DN   JW_Temp_OK   DC_Volt_OK   Crank_Cmd

Worth arguing about in design review:

1. Lockout_86 is examined as a normally closed contact from the physical lockout relay, not from a relay communications word. A tripped 86 must block a start even with the network down.
2. 52G_Open comes from the 52b auxiliary contact, wired to a digital input. Never take breaker position from a single 52a. A discrepancy between 52a and 52b for longer than 500 ms is itself an alarm and blocks any close attempt.
3. JW_Temp_OK is jacket water above 40 C, not below a maximum. A cold engine loaded quickly cracks liners, so the permissive is the heater doing its job.
4. The 30 second prelube runs before cranking and has to prove 0.8 bar of oil pressure, or you crank a dry engine after a long shutdown.
5. Every false permissive latches into a first-out word with a timestamp. Operators ask why it will not start; a blank HMI is not an answer.

Keeping the permissive list out of the main sequence is covered in implementing PLC safety interlock systems.

Hand the synchronising over to the relay

The PLC drives the engine towards the bus; the relay decides when the breaker may close. Never the other way round.

Run the generator slightly fast, about 0.1 Hz above the bus, so it picks up a little load at closing instead of motoring. Then put the breaker close time into the relay’s angle advance. An 11 kV vacuum breaker closes in 60 to 80 ms, and at 0.1 Hz slip the angle moves about 2.9 degrees in that time. Leave the close time at its default and the breaker closes late, which shows up as a shock on the first cycles of current.

IEC 61850 GOOSE is the layer 2 publish and subscribe message for trips and blocks, specified at 3 ms for the fastest performance class in IEC 61850-5 and a few milliseconds on a real switch. MMS is the client server path for measurements and controls, not for tripping. A ControlLogix without a native 61850 stack usually sits behind an SEL RTAC or a similar gateway, which converts GOOSE to CIP or Modbus TCP and adds 10 to 30 ms. Fine for a close permissive, not for a fast load shed. Time sync everything from one source, IRIG-B or PTP, so the sequence of events records line up to 1 ms.

Shed load before the frequency collapses

Load shedding comes in two forms. A plant needs both.

• Underfrequency shedding, the slow safety net. Stage 1 at 49.2 Hz with 200 ms delay drops non-essential loads. Stage 2 at 48.8 Hz with 150 ms takes the workshop and HVAC. Stage 3 at 48.4 Hz with 100 ms takes everything but the control room and the lube pumps. The real settings come from the network operator’s stability study, not from this list. A plant that exports instead of importing gets the same instruction from the other direction, as a curtailment setpoint, and that side is in SunSpec inverter curtailment and wind pitch rate limits.
• Fast shedding on a generator trip, triggered by the event and not by the frequency. The PLC keeps a live table of measured feeder kW and a priority per feeder. When a 2.5 MW machine trips while the plant draws 6 MW from three machines, the logic sums down the priority list until the shed total exceeds the lost generation plus a 15 percent margin, then trips those feeders in one scan.

The second scheme has to act inside about 150 ms. A 50 ms PLC task plus a GOOSE trip to the feeder relays gets there. The same logic at 500 ms over polled Modbus does not; the frequency is through stage 2 before the command lands. Build the kW table from measurement, because nameplate is what the loads could draw and what matters is what they draw at 03:00 on a Sunday.

Interlock the switchgear so the wrong thing cannot happen

• Kirk key interlocks on the transformer and the earth switch. The key sequence is mechanical and the PLC only reads key position for indication. Software is not the last line.
• Bus tie logic never allows more than two of the three sources closed together unless a check sync element permits it. Hardwire the last stage through relay contacts.
• Breaker truck position, service or test, is a hard input. A close command to a racked-out breaker never leaves the PLC.
• Closed transition between sources is limited to 100 ms in logic and by a timer in the relay. Longer parallels two sources in a way the fault study never covered.

Black start, written as a sequence

1. Confirm DC control voltage healthy, station service breaker open, all feeders open.
2. Start the black start machine in isochronous governor mode, no sync.
3. Close 52G onto a dead bus. Dead bus close is a separate permissive with a dead bus voltage element under 20 percent, and only one machine may hold it at a time.
4. Energise station service and restart auxiliaries in a fixed order with a 5 second gap: lube pumps, cooling fans, air compressors.
5. Start the second machine, synchronise, then move the first from isochronous to droop or load sharing.
6. Bring feeders back by priority, waiting for frequency to recover within 0.2 Hz between each one.

Step 3 is the one that bites. Two machines holding a dead bus permissive can close a few hundred milliseconds apart and slam together out of phase. Give one machine ownership of the dead bus close, and clear it only when the bus is live.

Field notes

Breaker auxiliary contacts that both said open. A close attempt on a feeder failed twice. Both the 52a and the 52b read open, because the truck sat in test position and the auxiliary switch only makes in service. The discrepancy alarm added afterwards, a and b in the same state for more than 500 ms, catches racking problems and broken wires with one rung.

Blind close on a dead bus. During commissioning the synchroniser was left in auto with no live bus reference. The sync check relay refused, a temporary bypass in the PLC did not, and the machine closed onto a bus that was not dead because a small UPS was backfeeding through a transformer. The bypass came out that day, and the dead bus permissive now needs the voltage element rather than a maintenance switch.

GOOSE message that arrived late. A fast shed scheme worked on the bench and missed twice in service. The GOOSE frames had no VLAN priority tag, so they queued behind HMI traffic on a shared switch. Setting priority 4 and putting protection traffic on its own VLAN brought the message time back under 5 ms. Keep protection traffic on its own network.

Shed table built from nameplates. The first load shed table used nameplate kW. On a trip it shed three feeders totalling 1.9 MW of nameplate that were drawing 600 kW, and the plant went dark anyway. Measured kW per feeder, refreshed every minute and frozen at the moment of the trip, fixed it.

Frequently asked questions

Can the PLC do the synchronising itself?
It can drive raise and lower and monitor the match. The close permissive belongs to a sync check relay. Plenty of plants run PLC based synchronisers, and the good ones still have a hardwired 25 element in series with the close coil.

Modbus or IEC 61850 to the relays?
Modbus TCP is fine for metering and status on a small plant, and simple to commission. Use 61850 with GOOSE when you need fast interlocking or tripping between devices.

How do I test a load shed scheme without dropping the plant?
Run it in simulation with outputs inhibited and trip events injected, and record which feeders the logic selects. Then test for real during a planned shutdown with the feeders isolated.

Next step

A plant that loses its controller mid-start is worse off than one that never started, so look at availability next. Implementing redundant PLC systems for safety critical applications covers switchover and bumpless outputs, and introduction to SCADA systems and their integration with PLC sets out how the sequence of events and load data reach the control room.