It has now been over a year since the catastrophic accident at the huge Sayano Shushenskaya Dam and Hydroelectric Station in southern Siberia which cost the lives of 75 people and nearly destroyed the 6400MW powerhouse.
Initially, the accident was lightly reported in the west, both in the mainstream and the technical press. Over the ensuing months, the early internet postings of photographs, videos and narratives from witnesses and technical experts in Russia [references 1 through 8] were supplemented with studies, opinions and speculations about causes from writers both inside and outside of Russia.
So far, this writer has not seen a complete and credible explanation of how this accident, with its very violent sequence of events, could have been caused. Both the official reports issued after the incident, and several technical discussions that followed, have drawn very general conclusions that attributed the incident to heavy vibration and poor maintenance associated with failed studs in the turbine head cover of Unit 2 in the plant. This article has been prepared to offer a hypothesis as to the underlying direct cause of the accident. This is done in the interest of promoting safety awareness among owners, engineers, managers and operators of hydro plants everywhere.
This hypothesis is that the explosion was caused by water column separation in the draft tubes of the destroyed units. This condition can readily be caused by a too-rapid wicket gate closure during unit load rejection. Adjustment of governor times to unsafe values to achieve fast response to operating load changes may have occurred in recent times in response to a need to improve grid frequency control. This, combined with compromised stud connections due to poor maintenance, can explain the extreme violence of this accident.
Complete and detailed technical data, such as drawings and data sheets, have not been available to support a full-scale technical paper on this subject. Therefore, the conclusions presented in this article are speculative. The importance of the safety issue to the profession and the industry, however, is such as to dictate that this analysis be presented, however incomplete.
The accident
At 08:13 and 25 seconds local time on 17 August 2009, Unit 2 experienced a load rejection, which was followed immediately by a loud bang heard in the administration and control building adjacent to the powerhouse. The load rejection precipitated a massive failure involving the lifting of runner, shaft, head cover, turbine and generator bearings vertically upward into the umbrella generator rotor spider, destroying it. Full penstock head was then released into the turbine pit, resulting in an enormous geyser and massive destruction. [9, 10]
At least a half minute after the geyser blew the roof away, another very loud bang was recorded by a cell-phone video which showed events as seen from a substantial distance downstream from the powerhouse. [11]
Three units (2, 7 and 9) were totally destroyed. The rest of the units were severely damaged, with the exception of Unit 6, which was under refurbishment and not in operation. [10] Seventy-five people died in the flooded powerhouse. [9]
Background
Seventy percent of the load on the East Siberian grid consists of four very large aluminium smelters. [12] The Bratskaya hydro plant (4500MW) was normally the lead plant on the grid, with the responsibility of following load and contributing to grid frequency control. Sayano Shushenskaya was normally base loaded, and not following load swings.
Beginning in 2002, the owner of the grid and most of the generating plants, RusHydro, ordered an improvement in the quality of grid frequency control, which had been poor, due to the seriously fluctuating smelter loads, which are difficult to follow due to their lack of rotating inertia. The objective was to serve growing non-smelter loads, and to permit interconnection with other adjacent power grids, in particular the Russian Far East power interconnection, which is predominantly based on thermal generation. In support of improving frequency stability, RusHydro mandated that automated joint load control systems be installed in the Siberian plants under its control. Previously, the unit load control had been manual in all the plants. Automated joint load control was successfully placed into commercial operation at Sayano Shushenskaya during the first half of 2009. [12, 13]
Due to a fire at Bratskaya on the day before the accident, all that plant’s load, and its load following requirements were transferred to Sayano Shushenskaya by the grid load dispatcher. [9, 10]
During the night of 16-17 August 2009, Sayano Shushenskaya experienced large and rapid load swings, with the total varying from 2800 to 4400MW. Unit 2 at the plant, with both a new governor and a new automated joint load control system, had been set as the lead unit, and experienced the largest load swings. [10] The accident itself followed in the morning.
Very soon after the event, the Russian industrial safety agency, Rostekhnadzor, studied the accident and attempted to determine its causes. It issued an extensive report on 3 October 2009 in which it attributed the cause to heavy vibration of Unit 2 in the plant, which, combined with lax maintenance and inspection practices, resulted in fatigue failure of the studs securing the turbine head cover to the unit stay ring. Although two other units in the plant were similarly destroyed, the Rostekhnadzor report did not address these failures, nor did it identify any other issues that may have contributed significantly to the accident. [10] It is understood that Rostekhnadzor released its report only about six weeks after the accident took place. They noted that it was an interim report, and that additional work would follow. As of this writing, Rostekhnadzor has not modified its conclusions that the accident was caused by fatigue failure of the head cover studs.
The Sayano Shushenskaya project (1, 10, 14, except as noted)
The 6400MW Sayano Shushenskaya installation is one of four very large hydroelectric generating stations that, at a total of 20,700MW, comprise over two thirds of the generating capacity in the East Siberian electrical grid. The general arrangement and size of the facilities at Sayano Shushenskaya are displayed in the photographs in Figures 1 and 2. Figure 3 is a reproduction of a drawing showing a vertical cross section through dam, penstock and powerhouse. It shows the relative locations and sizes of intakes, penstocks, turbines, generators, transformers and power take-off facilities. Figure 4 is an interior view of the machine hall looking across Unit 2 towards Units 3 through 10. Figure 5 is a photograph of a cutaway model of one of the turbine generator units showing its main components. Figure 6 is a cross section drawing through a turbine. It contains some key dimensions, and it clarifies the arrangement of the head cover, its structural support for the thrust bearing, and the location of the studs connecting the head cover to the upper stay ring.
October report of Rostekhnadzor
The Rostekhnadzor report was an extensive evaluation of the event and the conditions which led up to it. Considering the short time available to prepare it, the report was thorough, although its scope was clearly limited, concentrating on Unit 2. It attributed the destruction of Unit 2 to fatigue failure of many of the 80 8cm diameter studs which held the head cover in place. The report did not identify the exact location of the studs, nor the manner in which they were loaded. [10]
Other information (see Figure 6) has indicated that these studs were located at the extreme outer edge of the head cover, where it rests on a narrow flange which is part of the upper turbine stay ring. Both mating flanges at the location of the studs are narrow and relatively thin, as evidenced in the photographs (Figures 8 and 9). At full strength, the studs could be expected to carry a substantial load. Assuming a mild steel material, each 8cm diameter stud may be expected to carry a design load of 60 tonnes or more. It is likely, however, that these studs were primarily for the purpose of obtaining a seal where the head cover flange met the stay ring flange. The joint probably contained a gasket, which was held by the studs. From the available graphics (Figures 5 and 6, and some in Reference 10), it appears that the main structural support of the head cover in resisting uplift came from the conical structure connecting the head cover to the generator bearing housing above it. This structure comprised the unit thrust bearing support, so the entire weight of rotating parts and the hydraulic thrust on the runner were supported by the turbine head cover, and would, therefore, resist most, if not all of the hydraulic uplift. This is confirmed by the photographs. [15, 5 through 8]
The stud fatigue failure was attributed to the large vibration which had plagued Unit 2 for a very long time, both before and after the refurbishment in the first quarter of 2009. It appears that the runner repairs that year were made in place, without removal of the head cover, so the studs would not have been replaced. [10, 14]
The Unit 2 operating zones were defined in the report as acceptable between 0 and 265MW (Zone 1), unacceptable between 265 and 570MW (Zone 2), acceptable between 570 and 640MW (Zone 3), and prohibited above 640MW (Zone 4). The loads carried during the nine hours leading up to the failure indicate that the rough zone (Zone 2) was transited by the machine several times, and it was in that zone at the time of the load rejection and failure. [10]
The report contains several interesting facts taken from logs and automatic recording equipment. It notes that the Unit 2 load changed 12 times between midnight and 0230 on 17 August, and the range of total plant load was 2800 to 4415 MW. Unit 2 was known to have passed through its rough operating zones some six times in the few hours preceding the failure. (10)
Some sample times and Unit 2 loads before and after midnight on 16-17 August (10) are shown in the table.
At the time of the load rejection and failure, the load on Unit 2 was apparently being reduced. At 0800, Unit 2 was reported to be carrying a 605 MW load, with a turbine flowrate of 312m3/sec and a gate setting of 72.5%. At 0813, Unit 2 was carrying 475MW, with a flow of 256m3/sec at an opening of 69%. Twenty-five seconds later, the load was recorded as zero, indicating a sudden load rejection from 475MW. It should be noted that the load at 0813 was in the middle of Zone 2, and considerable vibration should have been occurring, based on previous experience with the machine. [10]
What could have caused this accident?
Early hypotheses
An early analysis [1] that was distributed via the internet only a week after the accident postulated causes for the Unit 2 failure including ingestion of debris and a broken governor oil pipe. The failures of Units 7 and 9 were attributed to runaway of the units under flooded conditions. As photographic evidence subsequently showed (Figures 10, 11, and 12), these explanations are not consistent with the events that have been shown to have occurred.
Another early hypothesis was that one of the draft tube piers collapsed causing a blockage of the draft tube. This seemed not to be credible at the outset, and the Rostekhnadzor report makes no mention of such a scenario, which would have left a clear set of evidence, had it occurred.
An early hypothesis by a Russian engineer and hydraulic turbine specialist, B. Kolesnikov [21], was that the accident was caused by the seizure of either the turbine bearing or the upper runner seals causing a very large twisting force to be transmitted to the head cover. The fact that the studs were not sheared off eliminates this possibility, as was pointed out by B. Kolesnikov in a later note written after additional photographs became available.
Hypotheses by Rostekhnadzor and a later writer
Rostekhnadzor attributed the accident to fatigue failure of the head cover studs caused by the heavy vibrations that had plagued Unit 2 over considerable time.
An October 2009 presentation by E. Kolesnikov [19] expanded on the Rostekhnadzor conclusions somewhat. He similarly attributed the failure of Unit 2 to the fatigue failure of the head cover studs due to the severe vibration the machine was experiencing, and he pointed out that the vibration monitoring equipment on the unit was out of service at the time of the failure. Neither he nor Rosteknadzor alluded to a source of the large upward force necessary to lift the machine, however. He did not attribute the failure to a load rejection situation, implying that the failure occurred during an operating load change. This does not seem likely, since, during even part load operation, there is a very significant hydraulic down thrust exerted on the runner (estimated to be of the order of 7500 tonnes) that is resisted by the thrust bearing, which, in turn, is supported on the head cover. This, combined with the weight of the parts supported by the thrust bearing, would have left no load to be carried by the studs.
B. Kolesnikov (21) hypothesized early that the event may have been caused due to a seizure of the turbine bearing or the upper runner seals causing a large torsional load on the head cover, but he later rejected these ideas since, as shown in the photographs in Figure 13, the studs failed in tension; not in shear.
Discussion and a new hypothesis
Unit 2 essentially exploded. The fatigue failure of the head cover studs during operation of the machine, as suggested by Rostekhnadzor and E. Kolesnikov, does not lead to a source for the enormous and sudden upward force necessary to achieve this violent explosion. That upward force caused runner, shaft, head cover, wicket gate upper trunnions and operating arms, both bearings, the generator rotor, and all associated structure of Unit 2 to be forced upward with enough violence to crush the rotor spider and destroy the stator. It had to be triggered by something that occurred suddenly and violently (Figures 7, 8, and 9).
Although the compromised condition of the head cover studs certainly contributed to the failure of Unit 2, stud fatigue failure alone seems very unlikely to have occurred in all three failed units (Units 2, 7 and 9) at the same time. In the absence of any stud failure at Units 7 and 9, it is very difficult to envision what could have caused the damage that is clearly visible in the photographs (Figures 10, 11, and 12). Thus, it is likely that the studs of Units 7 and 9 did fail, but their failure was caused by an upward force on the head cover of each unit.
Each rotor weighed 920 tonnes. Each runner weighed 156 tonnes. The entire assembly as supported by the thrust bearing weighed about 1500 tonnes, not including the downward hydraulic thrust on the runner or the resistance of the various mechanical connections associated with the gate trunnions and any generator guide bearing lateral supports. [1, 9, 10] Each head cover was exposed to draft tube head, plus a contribution from penstock head, which was exerted on the head cover annulus outside of the upper runner seal, and particularly that part outside the wicket gate trunnion circle (Figure 6). [15] This could have provided enough upward force to lift the cover during a full shut down if the studs were truly so weak as to contribute little or nothing to the resistance to upward load, the down thrust on the runner had become negligible at full flow stoppage, and no significant resistance was exerted by trunnion connections or any connections of the generator guide bearing to its lateral bracing. The tables and diagrams in the Rostekhnadzor report suggest that the static tailwater load on the head cover at the time would have been about 10m. [10] This is equivalent to about 350 tonnes of upward force on the gross area of the head cover inside the runner seal ring under static conditions; however, during operation, and particularly during a load reduction, this upward load would have been reduced substantially due to the effects of the velocity head at the draft tube throat. Since the unit had experienced considerable cavitation during operation, it is possible that the upward load on the head cover from the draft tube was actually negative at large turbine loads. [10] It is estimated that the static penstock pressure load (neglecting penstock head losses) on the outer annulus of the head cover amounted to something on the order of 2000 tonnes upward. This compares with the machine weight of 1500 tonnes exerted downward. During operation, there would also be the significant hydraulic thrust downward on the runner (7500 tonnes), which would have been supported by the head cover. It is likely, therefore, that the head cover would not have lifted during operation even if the studs carried no load at all. Instead, the hydraulic thrust would have to have been reduced or eliminated prior to the failure, implying a shutdown. A full shutdown would generate a waterhammer pressure rise in the penstock associated with the reduction of velocity. Assuming a rapid governor time of five seconds for full stroke, and a round trip pressure wave travel time in the penstock of about 0.4 seconds (based on the penstock length of about 200m), it is expected that the waterhammer pressure rise in the penstock would amount to about 70m, equivalent to 33% of static head – a relatively high, but not unreasonable waterhammer ratio for a hydro plant. This would result in a peak pressure of about 290m on the outer annulus of the head cover, which is equivalent to an upward force of some 2550 tonnes on the 8.9m2 annular area, or about 550 tonnes above static conditions.
The pictures show that the Unit 2 turbine lifted as a unit, and the failed stud connection at the edge of the head cover is not marked by any visible clues (Figure 9). The head cover flange through which the studs passed appears to be completely undamaged by the failure of the studs, suggesting that all studs failed simultaneously allowing the head cover to rise vertically without distorting the flange. The conical steel thrust bearing support connected the head cover structurally to the generator bearing housing. This conical structure must have transmitted an enormous upward force to the bearing housing, which then lifted from its position, along with everything it supported, during the failure. Had all this occurred due to stud failure, with only some 500 tonnes of unbalanced upward force (or less, if there was negative pressure under the center of the head cover), it seems likely that the studs would have failed sequentially, and, when the flanges at the failed studs parted, the resulting flow into the turbine pit would have substantially relieved any upward load associated with waterhammer effects in the penstock. Moreover, lifting of the head cover on one side would have caused the shaft, both bearings, and all parts connected to them to tilt to the other side, causing the generator rotor to collide with the stator windings before all of the head cover studs had failed. Judging from the photographs of the damaged machine after the pit was dewatered (Figure 9), the head cover flange was undistorted. This suggests that some additional transient loading occurred at the time of the stud failures, since the photographic evidence suggests a very sudden event and a very massive and completely vertical upward acceleration, at least initially. [5 through 8]
Rostekhnadzor did not speculate as to the causes of the failures of Units 7 and 9. They may take this up in their further analyses of the accident. It is highly unlikely that they would have suffered simple stud failures due to fatigue during the same incident that destroyed Unit 2. The character of the damage as shown in the photographs (Figures 10, 11, and 12) is not consistent with simple overspeed due to governor failure. Both units appear to have moved vertically. Both also appear to have tilted so that the generator rotors collided with the stators, as shown by the stator damage clearly visible in Figure 13. Since the shaft alignment of each of these machines was governed by the turbine bearing and the generator guide bearing, both of which were quite rigidly supported by the turbine head cover, the only mechanism that could result in a tilt of that axis is the lifting of the head cover itself. It is unlikely that the governors would have failed soon enough to prevent wicket gate closure and allow a runaway, since some time would have passed between the electrical load drop and the flooding of the powerhouse spaces near Units 7 and 9. Moreover, wicket gates are usually designed to drift closed (but not to slam) upon complete loss of oil pressure. The damage could not have been caused by a short circuit, as E. Kolesnikov hypothesized, since a short circuit would not have caused a movement of the rotor axis.
New hypothesis: water column separation and its effects
Each draft tube is long enough (about 35m) to suggest that a rapid load rejection from a heavily loaded condition (e.g. 475MW, or 74% of rated maximum) may have elicited water column separation in the draft tube, followed by an extremely violent pressure rise as the water column rejoined under the head cover. This could have caused the explosion that occurred. [2, 10] The Rostekhnadzor report, E. Kolesnikov’s presentation, and B. Kolesnikov’s commentaries do not discuss the possibility of column separation and rejoining as the mechanism responsible for the explosion. [10, 19, 22]
The Unit 2 turbine was known to have suffered from extensive cavitation damage to its runner. This suggests that the local pressure in the vicinity of the draft tube throat was fairly near vapor pressure during steady state operation. This is to be expected in a region where the velocity profile is extremely nonuniform, and there is a substantial whirl component of velocity. A sudden load rejection would have caused a drop in pressure at the draft tube throat as the draft tube water column was decelerated by the action of the closing wicket gates. If the gate closure were fast enough, the draft tube pressure would have been reduced to vapor pressure, leading to the formation of a vapor cavity in the draft tube throat. This is a credible sequence of events, as indicated by an approximate analysis of this condition for various assumed governor gate closure times. [20] This analysis indicates that column separation may be expected for governor times faster than full stroke in about six seconds. The analysis was based on mass surge assumptions and draft tube geometry reflecting uniform area increase from the throat to the exit. It does not account for the whirl component of velocity and related low pressure in the draft tube associated with operation well off the machine design point, and it is, therefore, probably not conservative in this instance.
As a result of the same gate closure, a simultaneous waterhammer pressure rise in the penstock and spiral case would have been produced. This pressure rise, however, would have been simultaneous with the pressure drop to vapor in the draft tube, and would have preceded the collapse of the vapor cavity by an interval.
During the time that the vapor cavity persisted in the draft tube, the transient flow condition between the throat and the draft tube exit would have approximated a slow mass surge under the influence of the unbalanced head between vapor cavity and tailwater. As a result, it is likely that several seconds passed between column separation and column rejoining at the collapse of the vapor cavity. The waterhammer pressure rise in the spiral case would have been relieved quite quickly due to the relatively short penstocks. The penstock round-trip pressure wave travel time of about 0.4 seconds was substantially shorter than the draft tube mass surge time. A simplified mass surge analysis of the draft tube flow during this postulated column separation indicates that the time between opening and reclosing of the vapor cavity would have been of the order of 2 ½ seconds. It further indicates that the upward water velocity at vapor cavity closure would have been approximately 2.4% greater than the initial downward velocity when the separation began. This simplified analysis assumed instantaneous draft tube inflow interruption at the time of column separation, so the results must be viewed as indicative only.
At a load of 475MW, the wicket gate setting was reported to be 69%, and the machine flow was 256m3/sec. [10] The average vertical velocity across the draft tube throat at that condition would have been 8.3m/sec. [15] If water column separation occurred at that point, and the vapor cavity persisted until the gates were completely closed, then the mass surge analysis indicates that the velocity attained after the flow in the draft tube reversed and just at the point of the vapor cavity volume reaching zero would have been 8.5m/sec upward. The instantaneous head rise resulting from the collision of the water column with the head cover, according to the fundamental waterhammer equation [21], will be:
∆H = – (a/g)(∆V),
where a is the celerity of an elastic pressure wave, g is the acceleration of gravity, and ∆V is instantaneous change of flow velocity, -8.5m/sec. This will amount to -(900/9.81)(-8.5), or about 780m. This head rise multiplied by the area of the head cover inside the wicket gates of 49m2 (see Figures 6 and 13), is equivalent to about 38,000 tonnes of upward force. This is based on a very simplified analysis, so the value must be taken as indicative of an upper limit, however, even a small part of this force would have been very destructive.
The time that this force would exist would, of course, be very brief. Based on a 35m draft tube length, it is estimated that the pressure spike would last about a tenth of a second. Assuming the parts of the machine that were lifted weighed 1500 tonnes, this pressure spike could have lifted the machine a meter and a quarter during the tenth of a second duration. This is about as close to a true explosion as it is possible to get with an incompressible fluid. It would explain the nature of the damage that is visible in the photographs of Unit 2 (Figures 7, 8, and 9).
If the 80 studs holding the head cover to the stay ring were all intact and in good condition, assuming that the stud material had an ultimate strength of 550 MPa, they would have all failed under an uplift force of about 23,000 tonnes. This implies that Unit 2 might have failed even if the studs were new.
Between late August and early December 2009, B. Kolesnikov posted several internet commentaries on the Rosteknadzor report and various publications in the mass media. [22] He accompanied his posts with three figures which included photographic evidence that strongly supports the column separation hypothesis presented here, although he did not mention column separation as a possible cause. His figures are reproduced in Figure 13. The photographs show that the wicket gate stems were all broken off at the tops of the gates, while the bottom trunnions were undamaged. This could have happened only if the gates had been lifted vertically until the trunnions were fully out of the lower bushings before the 300mm diameter stems were snapped off. Moreover, the pictures show that the gates were forced outward toward the spiral case; not inward toward the runner, because the runner blades show no evidence of the physical damage that would be expected from collisions with the broken gates. The pictures also show some of the studs remaining in the stay ring flange, which demonstrate that they were not sheared off, but failed in tension. This set of conditions can be explained only by a very large pressure exerted upward from the draft tube. B. Kolesnikov stated that there had to have been a large upward force on the head cover, but he did not speculate as to its cause. His information and observations have been very helpful.
In summary, the photographic evidence of the sequence of failure events seems to be very powerful. That the wicket gates were blown outward after their lower trunnions were pulled out of their bushings seems very clear from the pictures. Thus, it seems unavoidable to conclude that the very large pressure spike originated on the inside of the gate ring, which leads to the hypothesis that it started in the draft tube.
Units 7 and 9 apparently had sudden load rejection conditions imposed on them as a result of the Unit 2 failure. It appears that both Units 7 and 9 experienced draft tube water column separation followed by powerful uplift, causing severe damage to the generators and surrounding structure.
The evidence from the photographs and video recorded sounds suggests that Units 7 and 9 were similarly forced upwards, but with less violence than in the case of Unit 2. Since it is likely that the head cover studs on these two machines were in better condition than those of Unit 2, any upward force would have been resisted to a greater extent than in the Unit 2 case. It is possible, therefore, that the studs of Units 7 and 9 failed sequentially, causing the rotating parts to tilt as they were being thrust upwards. This would result in a collision between rotor and stator before the rotating parts had moved far enough upwards to release penstock pressure into the turbine pits.
The photographs (Figures 10, 11, and 12) indicate that Unit 7 was somewhat more severely damaged than Unit 9. This is interesting, since the Rostekhnadzor report shows that at 0813, Unit 7 was carrying only 85MW, while Unit 9 was carrying 570MW. Although Unit 7 was carrying the lightest load in the plant at the time of the accident, the sudden load rejection by Unit 2 would have caused Unit 7, with its very light load, to start to accept the load dropped by Unit 2 when its breaker opened. Thus, during the period between the Unit 2 load rejection and the Unit 7 load rejection, Unit 7 would have experienced a significant load acceptance transient. When the massive electrical disturbances that followed the destruction of Unit 2 caused Unit 7 to shut down, it could have been from a heavily loaded condition, with substantial transients remaining in its hydraulic passages. [5 through 8, 10]
New hypothesis: potential causes of water column separation
Observations at hydroelectric installations over the past 40 years have indicated that plant operators sometimes try to improve the responsiveness of their generating units by various adjustments to the equipment. One such adjustment is to modify the orifice control of the wicket gate servomotor oil pressure system in order to speed up the wicket gate movement. Occasionally, this has resulted in cases where draft tube column separation has occurred causing loud banging sounds, pressure spikes, and sometimes damage to the machines. Normally, governors are designed with considerable margin allowance in the sizing of oil piping, leaving the speed control up to the orifice plates (or needle valves in some cases) that are installed to limit the velocity of oil flow. How much margin is allowed is determined by the governor designer, but oil piping is normally not a large portion of the cost of a governor, so designers can be conservative with piping sizes and remain competitive. Thus, it is often possible for governor speeds to be changed significantly by replacing orifice plates with larger ones.
The fact that Unit 2 at Sayano Shushenskaya had had a new governor installed in early 2009 is suggestive, as is the fact that this particular unit, in spite of its vibration problems, was chosen as the lead load-following unit and was under the control of the new joint load control system. It is possible that the governor had been adjusted to increase the speed of wicket gate movement, which would have been expected to improve the machine’s load-following capability. This would have been consistent with the very fast load changing capabilities of the joint load control system installed in June. It has been reported that the joint load control was set to change unit loads at the rate of 30MW/sec. [13] It is likely that the governors were set to an even faster rate. If the governor gate speed were too fast, the transient pressure drop in the draft tube accompanying a load rejection would have caused water column separation as described earlier.
Unfortunately, the lack of data on these machines and the nature of the complex pressure and velocity fields in the draft tubes make it technically infeasible to predict analytically the governor time that would cause column separation in the draft tubes. Normal waterhammer assumptions of uniform velocity distribution simply do not come close to actual draft tube conditions. Turbine designers require extensive physical model testing to determine draft tube behavior. Moreover, wicket gate position versus turbine flow behavior is quite non-linear. The last part of a closing stroke changes flow very dramatically compared with conditions near full load. Thus, it is possible to effect load changes in operation without producing the same transient conditions that would accompany a complete load rejection. Also, many operating load changes may be gradual enough that the governors are not saturated, or operating at maximum speed, while a load rejection will always saturate a governor to minimize overspeed of the generator.
The character of the damage to Units 7 and 9 suggests that they, too, may have had their governors speeded up, which could have caused column separation upon load rejection.
The reports of severe vibration in Unit 2 suggest possible causes for the initial load rejection that apparently precipitated this massive failure. There may have been a protective relay that responded to excessive vibration, as is often the case in large rotating electrical equipment. It has been reported, however, that the Unit 2 vibration monitoring equipment may have been disabled. [19] Excessive vibration could also have caused heavy loads on the guide bearings, which might have caused overheating and precipitated a trip. Also, if the powerhouse relay panels dated from the 1970’s, and the relays were not of the more modern solid-state types, vibrations carried through powerhouse structure to the relays in the panels could have caused the contacts mounted on the delicate carriages of an electro-mechanical relay to have closed inadvertently. There are, of course, many other possible causes for a load rejection to have occurred.
Conclusions
The conclusions of this article are based on an analysis that is speculative, since complete technical information on the machines and their governors and other ancillary and control equipment has not been available to the writer. Nevertheless, the importance of this incident to the safety of hydroelectric installations everywhere demands that this evaluation, however imperfect and incomplete, be made available to everyone in and around this industry.
1. The fundamental conclusion from this examination is that the explosion of Unit 2 and the destruction of Units 7 and 9 were very probably caused by water column separation in the turbine draft tubes during unit load rejection. This hydraulic transient phenomenon was probably caused by turbine governors that had been speeded up (probably unknowingly) to an unsafe level in an attempt to improve frequency stability under changing electrical loads.
2. This project serves to re-emphasize the need to stress both model and field testing of hydraulic turbomachinery. Although the rough operating zones of the Sayano Shushenskaya turbines were able to be identified in the laboratory, the problem of resonance in the penstocks as excited by draft tube pulsations at overload conditions could only be identified in the field under full scale operating conditions. Such testing was done early on and established limits to safe operating zones which prevented resonance problems in operation. Had these limits not been established or been violated in practice, consequences as dire as those experienced on 17 August could have occurred. Fortunately, they did not, due to adequate field testing and implementation of results. Much progress has been made in recent times in the field of computational fluid dynamics (CFD), however, the fluid mechanics of turbomachinery, especially in unsteady flow regimes, still remains beyond the abilities of present day CFD modeling.
3. If the turbine governors in this plant were adjusted in recent times to increase wicket gate operating speed above safe levels, this may have been done in good faith by operations personnel who were not familiar with hydraulic transient phenomena, and the attendant limitations that the design of this installation imposed on operation.
4. This sort of adjustment has been observed on other plants, both in the USA and in other countries. Operators, left to their own devices, will attempt to maximize the output of their plant, while ensuring that it reacts to load changes in the fastest way possible. In this case, the plant operators were clearly under pressure from the owners and grid operators to improve system frequency stability, and, therefore, load following capability. Starting with the first implementation of automated and fast joint load control, the operators of this plant had a strong incentive to speed up the governors, which could have been accomplished easily by replacing orifice plates or adjusting needle valves. [13] Full load rejections in hydro plants are not very common. There may not have been any severe ones at Sayano Shushenskaya prior to August 2009.
5. Turbine mechanical designs should be carefully evaluated relative to the safety and redundancy of connections. This mechanical design, which exposed a significant head cover area to static penstock pressures at the outer periphery of each, placed a great burden on a set of relatively small and rather inaccessible studs. Inspection of the studs was not easy due to their location in recesses that were small and not particularly visible. This could be considered a deficiency on the part of the machine designers
6. Plant designers typically prepare Operating and Maintenance Manuals as part of the design documentation. These manuals are for the use of operations personnel, and they include both equipment manufacturer recommendations and limitations and those of the overall plant designers. A vital responsibility of the designers of these plants is to state clearly in the O&M manuals the design limitations inherent in the plant and its equipment. Clear warnings should be stated about such matters as speeding up governor times without allowing for the hydraulic transient effects thereof. Operators may not be trained in the mechanics of hydraulic transients, and their understanding of these phenomena must not be taken for granted. They must be warned what not to attempt and why, as well as what good practices to follow. It must be kept in mind that operators may be widely separated from designers by both distance and time, and additionally in technical knowledge. The O&M manual may be the only link between the two.
7. The importance of hydraulic transient phenomena cannot be overemphasized, as witnessed by the tragic outcome of this spectacular failure. Designers must be cautious, and must impart that caution to operations people. Hydro plants are inherently safe structures, and hydro machinery is robust, conservative, and safe. All that can be negated by misoperation and by lack of maintenance and inspection, so these must be avoided through every avenue available. The continued safety of our hydro resources depends on it.
F. A. Hamill, P. E., Life Member ASCE, Member USSD, Project Engineering Manager, Hydro and Water Resources, Bechtel Corporation, San Francisco, California, USA
The author would like to thank Dr. Alexander Gokhman and Dr. Fred Locher for their encouragement and technical assistance in the preparation of this article
Related ArticlesSayano-Shushenskaya probe complete, seven charged with safety breaches
| Sayano Shushenskaya – key facts |
|
Initial operation date: 1978 Particular turbine features: Special issues related to turbine unit 2: |
TablesSample times
