Are AVRs Important?

Introduction: I’ve written some dynamic positioning (DP) articles that include power system voltage control and automatic voltage regulators (AVRs), but was holding off on full AVR articles, until I finished auxiliary systems and was working through power generation. Part of the problem is knowing lots of detail, but needing to express it simply. After receiving and answering this question, I thought an AVR preview was a good idea. I’ve added the first five paragraphs and some pictures to the original answer.

Question:

Thanks for the articles. Please provide some information on AVRs. People pretend they aren’t important and don’t have problems. This usually leads to trouble.

Answer:

See the picture above? That is the sinusoidal voltage waveform on one phase of the three phase system. That, and its offset brothers, is what transfers electrical energy from the generators to almost all the vital electrical equipment (batteries are DC). The engine speed (governor) controls the frequency of the voltage waveform, but the automatic voltage regulator (AVR) controls the voltage (hint in the name). AVR faults affect the size and shape of the waveform that connects all the generators and loads. No one can deny that AVRs are fundamental, as the whole system depends on the voltage waveform. A fault in one generator’s AVR can and often has caused loss of all generators on a common bus. Unlike the comparatively slow frequency faults, which are constrained by the inertia of large chunks of rotating iron (rotor and engine) and fluid dynamics (fuel oil), AVR faults are fast, as they only have to affect electro-magnetic fields.

Trouble? Everyone knows that engine faults cause blackouts, and everyone should know AVRs do the same. AVR faults are DP2 significant, and appear in the IMCA DP incident reports. They need taken seriously. Closed bus systems require fast protections against AVR, voltage, reactive load sharing, and waveform distortion (high THD) faults. Some of the important protections aren’t standard and some advanced generator protection/supervision systems lack effective protection (too slow, passive, or non-existent). Full AVR protections aren’t required for open bus (like all DP3 MSBs are), but some AVR protections are always installed, because the failure modes are so serious, and we like to avoid equipment damage.

Voltage Control Overview: The output voltage of each generator is controlled by the voltage and current in its field poles. This excitation power is controlled by an automatic voltage regulator (AVR) and supplied by a permanent magnet generator (PMG) that is part of the generator package, an external power supply, or both. Typically, most offshore AVRs use self-excited PMG power for the generator excitation, and external control power for the AVR control. Each generator has a dedicated AVR that controls its generator’s voltage by controlling the excitation voltage and current sent to the generator’s field windings. It measures the generator’s output voltage and current and adjusts the field excitation to maintain the correct voltage level over the normal operating load range and ensure that there is sufficient fault current to operate breaker trips. Preferably, the AVRs should operate in standalone droop, but some people can’t help but mess with things and introduce common weaknesses. You rarely see cross-current compensation now (like governor load sharing lines but current instead of voltage [bad news when it goes wrong]), but interference from synchronization control is more common (avoid in design), and worst of all are the increasingly common interfering power/energy management systems that control reactive load sharing and try to smooth the voltage waveform. This can interfere with robust AVR operation and fault response (Blackout City, Population: Your Ship), but is usually only caught with sufficient testing or in the field.

Voltage Control Faults Overview: Parallel DGs are connected together through the switchboard and a fault in one generator has an effect on the others by changing generator power factor/current and forcing them up or down the droop curve (don’t play with isochronous, and avoid compensated droop/pseudo isochronous). Balancing the excitation levels of online generators is important because it effects reactive load sharing. A high excitation hogs reactive load and may place other generators into capacitive operation, while a low excitation sheds reactive load and may produce positive VARs. These can lead to field collapse or sudden swings in load that can destabilize and blackout a bus. Similarly, a DG with an unstable voltage control or noisy output can destabilize a whole power plant. There are limits to how much noise power plants can still function with. Standard switchboard protections can work against redundancy by eliminating healthy DGs driven into an abnormal state by a faulty generator (e.g. over-voltage, under-voltage, hunting, etc.). The voltage distortion from spikes, field faults, or noise from AVR firing faults causes high switchboard THD, destabilizes voltage control, and causes blackouts. The most dangerous THD fault is exciter diode failure and all redundant closed bus AVRs must have protection against it. Only some AVRs do. AVRs for redundant closed bus operation need to be of high quality and capacity but still require external watchdog systems to eliminate faults they cannot detect. Hunting voltage and high THD may not be traceable to a source and needs to quickly trip the bus ties. Advanced generator protection/supervision systems are of variable quality, and some don’t cover the basics. They are useless without full conventional protections, and supplemental to it.

AVR Protection Overview: AVRs need chosen carefully for their capacity, noise resistance, and protections. Cheap is normally bad. The main switchboard protection modules monitor for AVR faults and produce fallback trips, but the fast trips should be in the AVR to avoid delay. This guide shows the standard and optional protections available in some different AVRs. Many of them aren’t suitable for redundant DP2 closed bus operation, but it’s an introduction. It’s a subject of a future article, but it’s informative how many closed bus systems don’t have the crucial protections needed to ensure closed bus redundancy, or AVRs capable of supporting them. Sometimes, the gaps can be closed with supplemental protections, like the old EDM-200 electric diode monitor modules. There is a danger to a control system policing itself, after all, if it knew it was messing up, it could stop. Fallback protections are needed in the MSB, for when the AVR can’t detect or solve a problem during redundant DP2 closed bus operation (or the main breaker can’t trip).

Right Here in River City: AVR faults are big trouble for parallel DGs and can easily cause a bus blackout. Open bus tie, that’s a partial blackout and lost redundancy, but closed bus, that’s a total blackout, and that’s as forbidden for DP2, as closed bus is for DP3. That should be understood by everyone. It’s there if you understand how things work and go wrong. It’s there in DP incident reports. And it’s there in the industry guidance. I’ve provided a bare introduction and touch on AVRs in a few articles, but it’s time to look at the problems documented in the DP guidelines.

MTS DP Design Philosophy:

• 14.13.4: To mitigate against partial and full blackouts, protective functions associated with governors and AVRs are recommended for open and closed bus power system configurations.

MTS TechOp D-01:

• A.4.1.17 Over voltage associated with voltage control systems failure or AVR overshoot following fault clearance: Severe AVR failure to full excitation can occur for a number of reasons including failure of the voltage sensing line from the generator VT. In addition to the reactive power export condition thus created, there is a possibility that the bus voltage may be driven to levels at which the overvoltage protection may operate tripping multiple generators. Generator overvoltage is not selective, but time grading can be used on the bustie circuit breaker protection to divide the plant and isolate the source of the overvoltage to one redundant group or the other. During the time when a short circuit fault exists, the AVRs will be providing maximum excitation to operate the overcurrent protection and isolate the fault. Once the fault has cleared, all connected service transformers will simultaneously re-energise and this may result in a voltage overshoot. The design of the power plant should be such that it can ride though such failure effects.
• A.4.1.18 Under voltage associated with severe overload condition: AVRs are only capable of regulating voltage independently of frequency over a limited range and are programmed to maintain a constant flux in the machine. Therefore, they will ramp down the voltage on falling frequency. Ultimately, the control range will be exceeded and the voltage drop over the generators internal impedance will dominate leading to brown out and blackout when the generators trip.

TechOp D-05:

IMCA: I’m not quoting the IMCA guidance, because they are sold rather than freely shared. They might have let me, if I asked permission, but I think the summary gives a clearer overview, and the references can be looked up. IMCA M206 3.13.1 discusses the need for enhanced generator protection systems to deal with AVR faults. IMCA M247, descendant of the noble but scorned M04-04, provides the best coverage of the subject. M247 4.2.3 is similar to the previous reference, 3.2.6 lists some of the faults to be considered, 4.2.6 discusses AVR analysis, and a few places mention other systems interfering with AVR control. M103 2.15.4 notes that AVR faults have caused a lot of failures, and that standalone droop operation is safest.

Conclusion: The guidelines were less descriptive and comprehensive than I had hoped. They do not mention or describe all the important AVR failure modes, why they are important, and how to protect against them. It's no wonder some of the vendors can't get it straight. I will definitely need to write about these, but I am currently working through the auxiliary systems on my way to power generation. This is only an introduction, but it does show that AVR operation and faults are important to safe DP2 (open or closed bus) and DP3 (open bus) operation. Yes, AVRs are important. Managers, designers, FMEA engineers, trials surveyors, reviewers, and crew can’t safely ignore them.

P.S. My following articles, give some additional hints:

https://www.dhirubhai.net/pulse/configuration-catastrophes-cbt-different-size-dgs-base-paul-kerr-rclec/

https://www.dhirubhai.net/pulse/signs-closed-bus-switchboard-isnt-redundant-paul-kerr/

https://www.dhirubhai.net/pulse/pmsing-testing-pt5-frequency-voltage-control-paul-kerr/

Share DP Incidents

This is the last article of the month, so next week will be the Sept/24 DP Incident article. Please privately message me with any incidents from the last month that you think are worth knowing and would like to see covered. Don’t use the article comments, as they aren’t private. This is unofficial to share lessons with each other. Public records are also welcome.

(Although I am looking to encourage informal dialog, official reporting to IMCA needs encouraged, when allowed by your employer. It is excellent practice to pass DP incident reports to them whenever you can.)