Open Cycle Gas Turbines
Cyber security considerations for Open Cycle Gas Turbines
Turbines are used in jet engines, right? Like the one, Maverick used in Top Gun? The same engine that is used on pretty much all modern aircraft? Well, turns out you can use them for more than just propelling an aircraft forwards….
Security consideration: throughout this post you will find these security
considerations. These are used to highlight some of the important processes
that may be worth considering from a security perspective. This is not an
all-encompasing analysis, though, so try and keep the following questions
in mind when reading the post -
[1] Is this a critical process that may be worth protecting?
[2] What should we do to protect the system?
* Disclaimer: this information should not be used for nefarious or unauthorised
purposes but rather as an educational tool (see the Welcome post of this
blog).Introduction
Before we jump into the workings of an Open Cycle Gas Turbine (OCGT), let us begin with the concept of a turbine. The high-level principle of a turbine is as follows: (1) compress air, (2) mix it with fuel and (3) ignite it. This process is shown in Figure 1 below:
The front of an engine usually has a large fan in order to suck air in. The air is then forced through a compressor stage. With each stage of fan blades, the same amount of air is forced into a smaller chamber thereby compressing it. Once the air is sufficiently compressed, fuel is added to it and ignited. This combustion generates a large amount of force which is expelled out of the back of the engine. The keen observer would note the turbine blades at the end of the engine which are connected via a shaft to the front compressor blades. This is an important design feature that we will consider again when we get to the OCGT.
Gas turbine for electricity generation
Alright, so now that we have an overview of how a gas turbine works, let us see how we can use these to generate electricity. Any ideas? Perhaps strap a generator to the output of the engine? Yes, pretty much. But it is just a little more complex than that. Let us consider Figure 2, below:
It should be evident that we have a very similar structure to the turbine engine as seen in Figure 1. Air passes into the compressor stage and enters the combustion chamber where it gets mixed with fuel and ignited. This high-pressure hot air is used to drive the turbine which can, in turn, drive a generator. Note again the combined shaft which indicates that once generation mode is reached, the turbine can spin the compressor (a side-effect of this design is that the OCGT is most efficient at full load). A key thing to remember, though, is that these turbines used for electricity generation are larger than aircraft turbines. Much larger in fact. A Rolls-Royce Trent 7000 engine ways approximately 6.5 tons. A Siemens V94.2 in turn can weigh in excess of 200 tons.
Side note: turns out that at the time of writing, you can buy a second-hand turbine for $17,250,000.00 here if you want.
OCGT Operation
Disclaimer: the following section is primarily based on this factsheet which describes the operation of a Siemens V94.2 turbine. Other turbines might have slightly different specifications or modes of operation.
Plant Operation
OCGTs typically have four operation modes, namely, standby, generating, turning gear, and synchronous condenser operation (SCO). SCO mode is used to regulate the reactive power (power flowing back into the grid) that is present in the transmission system. It is important that the system goes through specific and regulated phase changes to ensure that the system is not damaged.
Side Note: a synchronous condenser refers to a motor that is not connected to any drive equipment (in this case the turbine). The motor is disconnected from the turbine by means of a clutch and can as such spin freely to absorb reactive power and increase the stability of the grid.
The operating modes are described in more detail below:
- Standstill / Turning Gear to Generating: the systems rarely find themselves in a completely stopped state. They are typically either in SCO or turning gear mode. When the system needs to be started, the generator is used as a motor that turns the combined shaft (turbine/compressor) by means of a static frequency converter (SFC) (these systems are used to generate AC power at a fixed frequency typically not the same as that provided by the grid). The SFC is powered by the plant's auxiliary power unit. As the system increases speed, the turbines generate a suction force which is used to drive the system. At about 5.5–6.5 Hz, the combustion chamber is ignited with petrol. At 36.5 Hz, the petrol is replaced with diesel and the system enters diffusion mode. In this mode, only a portion of the fuel enters the combustion chamber ensuring better control of the process. At 38.6 Hz the external isolator is opened and the SFC is shut down. The system is now operating under its own power. When the system is ready to synchronise, the generator breaker is closed so that the system can begin to generate power.
Security consideration: stopping the fuel mixture, for example, may cause
the turbine to stop operating. Changing the fuel mixture to make it very
rich may result in a change in efficiency. - Standstill / Turning Gear to SCO: as described above, when in SCO mode, the turbine is used as a motor that can either speed up or slow down to either send out or absorb reactive power respectively.
- Generating to Standstill / Turning Gear: before the system can be shut down, it first needs to be deloaded (this occurs at a rate of 11 MW/min until it reaches 8 MW output power). The purpose of a deloading stage is to allow the rest of the equipment to shut down. Once it reaches 8 MW the turbine can be shut down, the system is disconnected from the grid, and the combined shaft is allowed to slow down naturally until it reaches turning gear speed. At this point, the shaft continues to spin for 24 hours to ensure that all of the components cool down naturally and that no warping occurs (if the shaft is stationary at a high temperature it may warp downwards). When the system is not in operation, dehumidified air is circulated through it to ensure that components are not damaged.
Security consideration: deloading the turbine too quickly may result in
damage due to an overspeed condition. Grid synchronisation
An important aspect of any power generation unit is the ability to synchronise with the electricity grid. Dependent on the region in which the unit operates, it may either have to operate at 60 Hz (USA) or 50 Hz (Europe). Ensuring that the generation unit is producing electricity at this frequency is important as variations could make the grid unstable.
The advantage of an OCGT is its ability to start generating electricity relatively quickly from the point at which it is started ( in comparison to a coal power plant for example). In fact, OCGTs can take between 5–7 minutes to synchronise whilst taking about 12–20 minutes to reach full load (at this point a Siemens V94.2 is spinning at 3000 rpm). This impressive ramp-up speed makes OCGT ideal for use as peaking stations i.e. generation plants that can be used during peak load when additional generation capacity is required quickly (such as in the evenings).
Important components of a plant
It should be evident that an OCGT plant is comprised of more components than just the turbine and compressor. The following section provides insight into some of these components:
- Lubrication: lubricating oil is constantly circulated through the bearings on the shaft to ensure that friction is kept to a minimum and that any debris is flushed out. The lubrication system is also used to power the hydraulic turbine which spins the shaft at 2 Hz (turning gear speed) for 24 hours. When the system has been standing for a while and needs to be started, the lubrication system provides a jacking function that slightly raises the shaft in order to reduce friction further. Finally, the lubrication system is used for the clutch attached to the SC.
Security consideration: disabling the lubrication system or limiting the
oil flow, may cause damage to the turbine and its supporting components.- Fuel System: the fuel system provides fuel to the burners within the combustion chamber. The fuel enters the system at ~6 bar, after which it passes through a 10-micron filter to remove any particles. It subsequently enters an 11-stage centrifugal pump to increase the pressure to 80 bar which is what is needed for the atomization of the fuel. The lines to and from the combustion chamber have control valves so that the system can be adjusted if need be.
Security consideration: shutting the valves for an extended period of time
may disrupt the process and cause a shutdown. Opening the valves completely
may cause the temperature to exceed the recommended operating limits
potentially damaging equipment (system dependent).- Purge Water: demineralised water is used to flush the injectors when the system changes between premix and diffusion mode. The injectors are flushed before and after premix mode to ensure that they are clean.
Security consideration: contaminating the water may cause damage to the
injectors affecting the availability of the process and the plant.- Filter housing: air enters the system through filters which include weather housings, bird screens, pre- and fine filters (measuring 25 and 4 microns respectively). The air enters the housing from three sides, is fed through silencers, and into the compression chamber.
- Turbine: the turbine can be used as an overarching term for all of the components highlighted in Figure 2. The Siemens V94.2 is 9.45m long and measures 4.1m in diameter. The compressor is comprised of section stages. The combustion chambers are of the silo type (often placed vertically) weighing ~6 tons each. Each chamber contains 6 individual burners.
- Generator: the generator in use at this plant weighs 223 tons with a rated output power of 15.75 kV, 6 818 A at 3000rpm with a power factor of 0.8. Due to the generator not being 100% efficient, it can generate in excess of 2 kW of heat, resulting in the need for a cooling system. The generator is air-cooled via lateral openings in the stator housing.
Security consideration: a sudden underload condition (such as the opening
of a circuit breaker) would result in an overspeed condition for the
generator which may damage it.- Electrical features: in order to export electricity, the generator voltage is stepped up from 15.75 kV to 400 kV by a transformer (rated at 186 MVA, weighing 135 tons of which 55 tons is oil). Furthermore, the voltage is also stepped down to 6.6 kV to supply various other plant systems. This 6.6 kV supply can be replaced by diesel generators if need be.
- Exhaust: the exhaust stack transfers the hot output air into the air. When it leaves the turbine it is at a maximum temperature of 560 °C and is transferred into the stack which is 30 m high and 10 m in diameter. The exhaust gases have a max flow rate of ~520 kg/s at a velocity of ~40 m/s.
Variations of the OCGT
- Closed Cycle GT: If you consider Figure 2, you will remember that the output of our OCGT was torque and exhaust gas. In an OCGT the gas is simply released into the environment through an exhaust stack. In a CCGT the gas is returned to the beginning of the system and reused.
- Combined Cycle GT: a Combined Cycle GT also works by reusing the hot exhaust gas except that instead of circulating through the turbine system, it is used to generate steam (by heating water) which in turn powers a steam turbine to once again generate electricity (we will cover this principle in another post). Figure 4, below, highlights this principle graphically:
Conclusion
So this was quite a bit of information to take in. Hopefully, though, we have gained a better understanding of the operating principles of an OCGT: air is compressed, mixed with fuel, and ignited in order to power a generator. Based on the information we have learned today, which systems do you think an attacker may target and how? Can we use this information to better protect our OCGTs?
Security consideration: we managed to identify several security
considerations throughout this post. Nevertheless, we may have missed
something. Feel free to leave a comment with additional considerations!