Woodward MicroNet TMR 5009FT User manual

Product Manual 26518V1
(Revision E, 4/2017)
Original Instructions
MicroNet TMR® 5009FT
Fault-Tolerant Steam Turbine Control
Operations Manual
Manual 26518 consists of 4 volumes (26518V1, 26518V2, 26518V3, 26518V4)
Volume 1

General
Precautions
Read this entire manual and all other publications pertaining to the work to be
performed before installing, operating, or servicing this equipment.
Practice all plant and safety instructions and precautions.
Failure to follow instructions can cause personal injury and/or property damage.
Revisions
This publication may have been revised or updated since this copy was produced.
To verify that you have the latest revision, check manual
26455 , Customer
Publication Cross Reference and Revision Status & Distribution Restrictions, on
the publications page of the Woodward website:
www.woodward.com/publications
The latest version of most publications is available on the publications page. If
your publication is not there, please contact your customer service representative
to get the latest copy.
Proper Use
Any unauthorized modifications to or use of this equipment outside its specified
mechanical, electrical, or other operating limits may cause personal injury and/or
property damage, including damage to the equipment. Any such unauthorized
modifications: (i) constitute "misuse" and/or "negligence" within the meaning of
the product warranty thereby excluding warranty coverage for any resulting
damage, and (ii) invalidate product certifications or listings.
Translated
Publications
If the cover of this publication states "Translation of the Original Instructions"
please note:
The original source of this publication may have been updated since this
translation was made. Be sure to check manual
26455 , Customer Publication
Cross Reference and Revision Status & Distribution Restrictions, to verify whether
this translation is up to date. Out-of-date translations are marked with . Always
compare with the original for technical specifications and for proper and safe
installation and operation procedures.
Revisions— A bold, black line alongside the text identifies changes in this publication since the
last revision.
Woodward reserves the right to update any portion of this publication at any time. Information provided by Woodward is
believed to be correct and reliable. However, no responsibility is assumed by Woodward unless otherwise expressly
undertaken.
Manual 26518V1
Copyright © Woodward, Inc. 2010-2017
All Rights Reserved

Manual 26518V1 MicroNet TMR 5009FT
Woodward 1
Contents
WARNINGS AND NOTICES ...............................................................................................................4
ELECTROSTATIC DISCHARGE AWARENESS......................................................................................5
CHAPTER 1. GENERAL INFORMATION..............................................................................................6
Introduction ...................................................................................................................................................6
Control System Installation Procedure..........................................................................................................6
CHAPTER 2. DESCRIPTION..............................................................................................................8
General..........................................................................................................................................................8
Control Fault Tolerance.................................................................................................................................8
5009 Control System Inputs and Outputs...................................................................................................20
Configuration & Commissioning Tools (CCT) Programs ............................................................................28
CHAPTER 3. CONTROL FUNCTIONALITY OVERVIEW........................................................................30
Control Overview.........................................................................................................................................30
Block Diagrams...........................................................................................................................................33
CHAPTER 4. APPLICATION NOTES.................................................................................................41
Overview .....................................................................................................................................................41
Example Applications..................................................................................................................................43
CHAPTER 5. CONTROL FUNCTIONALITY.........................................................................................71
Introduction .................................................................................................................................................71
Turbine Start Modes....................................................................................................................................71
Valve Limiters..............................................................................................................................................77
Turbine Start Routines (Idle to Rated)........................................................................................................78
Speed Control Overview.............................................................................................................................83
Speed PID Operational Modes...................................................................................................................84
Extraction, Admission, or Extr/Adm Turbine Control ..................................................................................95
Auxiliary Control........................................................................................................................................109
Cascade Control .......................................................................................................................................113
Cascade Droop.........................................................................................................................................115
Remote Cascade Setpoint........................................................................................................................115
Seal GAS PID Control...............................................................................................................................116
Emergency Shutdown...............................................................................................................................117
Controlled Shutdown.................................................................................................................................118
Relays .......................................................................................................................................................119
CHAPTER 6. 5009 CONTROL SYSTEM OPERATION.......................................................................121
Introduction ...............................................................................................................................................121
5009 System Power-up.............................................................................................................................121
Valve / Actuator Calibration & Test...........................................................................................................122
Turbine Start .............................................................................................................................................123
General Field Tuning Guidelines ..............................................................................................................133
Speed, Casc, Aux, and Ext/Adm Dynamics Adjustments.........................................................................134
Overspeed Test Function..........................................................................................................................136
Operation Information ...............................................................................................................................137
CHAPTER 7. PRODUCT SUPPORT AND SERVICE OPTIONS ............................................................140
Product Support Options...........................................................................................................................140
Product Service Options ...........................................................................................................................140
Returning Equipment for Repair ...............................................................................................................141
Replacement Parts....................................................................................................................................142
Engineering Services................................................................................................................................142
Contacting Woodward’s Support Organization.........................................................................................142
Technical Assistance ................................................................................................................................143

Manual 26518V1 MicroNet TMR 5009FT
Woodward 2
APPENDIX A. RECOMMENDED SPARES........................................................................................144
REVISION HISTORY.....................................................................................................................145
Illustrations and Tables
Figure 2-1. Double Exchange and Vote Structure......................................................................................10
Figure 2-2. Fault Tolerant Analog Input......................................................................................................12
Figure 2-3. Fault Tolerant Discrete Input....................................................................................................13
Figure 2-4. Fault Tolerant Analog Output ...................................................................................................14
Figure 2-5. Fault Tolerant Single Coil Actuator Output...............................................................................16
Figure 2-6. Fault Tolerant Dual Coil Actuator Output .................................................................................17
Figure 2-7. Fault Tolerant Discrete Output .................................................................................................18
Figure 2-8. Fault Tolerant Modbus Communication Ports..........................................................................20
Figure 2-9. Proportional Controller Diagram...............................................................................................22
Figure 2-10. P Controller Diagram..............................................................................................................23
Figure 2-11. PI Controller Diagram.............................................................................................................23
Figure 2-12. PI Lag Controller Diagram......................................................................................................24
Figure 2-13. PI Lead Lag Controller Diagram.............................................................................................24
Figure 2-14. Three-Wire Transducer ..........................................................................................................25
Figure 2-15. Four-Wire Transducer ............................................................................................................25
Figure 2-16. Five-Wire Transducer.............................................................................................................26
Figure 2-17. Six-Wire Transducer...............................................................................................................26
Figure 2-18. Configuration ToolKit Main Screen.........................................................................................28
Figure 2-19. Run and Service ToolKit Main Screen ...................................................................................29
Figure 3-1. Typical Single Valve or Split Range Valve Steam Turbine ......................................................30
Figure 3-2. Split Range or Admission Type of Turbine Configuration ........................................................31
Figure 3-3. Extraction and/or Admission Steam Turbine............................................................................32
Figure 3-4. Overview of 5009 Control System Functionality Notes............................................................33
Figure 3-5. Single or Split-Range Turbine Configurations (Speed PID with Remote Setpoint)..................34
Figure 3-6. Single or Split-Range Turbine Configurations (Auxiliary PID Configured as a Limiter) ...........35
Figure 3-7. Single or Split-Range Turbine Configurations (Auxiliary PID Configured as a Controller).......36
Figure 3-8. Extraction and/or Admission Turbine Configurations (Auxiliary Configured as a Limiter)........37
Figure 3-9. Extraction and/or Admission Turbine Configurations (Auxiliary Configured as a Controller)...38
Figure 3-10. Extraction and/or Admission Turbine Configurations.............................................................39
Figure 3-11. Extraction and/or Admission Turbine Configurations.............................................................40
Figure 4-1. Pump or Compressor Discharge Pressure Control with Turbine Inlet Pressure Limiting ........45
Figure 4-2. Pump or Compressor Suction Pressure Control with Turbine Inlet Pressure Limiting and Dual
Coil Actuator...........................................................................................................................47
Figure 4-3. Exhaust Pressure Control with Generator Power Limiting and Plant Import/Export Limiting...49
Figure 4-4. Plant Import/Export Control with DRFD Servo Interface..........................................................52
Figure 4-5. Plant Import/Export Control with DRFD Servo Interface..........................................................54
Figure 4-6. Inlet Pressure Control with Isochronous Load Sharing Control in Island Mode.......................57
Figure 4-7. Import/Export Control or Exhaust Pressure Control with Isochronous Load Sharing in Island
Mode ......................................................................................................................................60
Figure 4-8. Inlet Pressure Control, Exhaust Pressure Control with Generator Power Limiting..................63
Figure 4-9. Admission Steam Turbine Control with Bootstrap Start-up......................................................66
Figure 4-10. Plant Load and Steam Pressure Control Application.............................................................69
Figure 5-1. Manual Start Mode Example....................................................................................................73
Figure 5-2. Semiautomatic Start Mode Example........................................................................................74
Figure 5-3. Automatic Start Mode Example................................................................................................75
Figure 5-4. Automatic Start Sequence........................................................................................................79
Figure 5-5. Idle / Rated Start.......................................................................................................................80
Figure 5-6. Automatic Start Sequence........................................................................................................81
Figure 5-7. Speed Control Functional Diagram ..........................................................................................83
Figure 5-8. Speed Relationships.................................................................................................................84

Manual 26518V1 MicroNet TMR 5009FT
Woodward 3
Figure 5-9. Speed PID Control Modes........................................................................................................88
Figure 5-10. Frequency and Unit Load Relationship ..................................................................................89
Figure 5-11. Load Sharing Logic.................................................................................................................94
Figure 5-12. Ext/Adm Control Diagram.......................................................................................................96
Figure 5-13. Coupled HP & LP Mode .......................................................................................................104
Figure 5-14. Decoupled Inlet (HP) Mode..................................................................................................105
Figure 5-15. Decoupled Exhaust (LP) Mode.............................................................................................106
Figure 5-16. Decoupled HP&LP Mode......................................................................................................107
Figure 5-17. Priority Flow Diagram...........................................................................................................108
Figure 5-18. Auxiliary Control Overview ...................................................................................................109
Figure 5-19. Cascade Functional Diagram...............................................................................................113
Figure 6-1. Proportional Gain Setting Effects ...........................................................................................126
Figure 6-2. Open Loop Proportional and Integral Response....................................................................127
Figure 6-3. Closed Loop Proportional and Integral Response..................................................................128
Figure 6-4. Integral Gain (Reset) Setting Responses...............................................................................129
Figure 6-5. Closed Loop Proportional and Derivative Action....................................................................130
Figure 6-6. Derivative Setting Effects .......................................................................................................131
Figure 6-7. Closed Loop Proportional, Integral and Derivative Action......................................................132
Figure 6-8. Typical Response to Load Change ........................................................................................133
Table 1-2. Control Component Hardware.....................................................................................................7
Table 2-1. System Module Layout................................................................................................................9
Table 2-2. Redundancy Manager Truth Table............................................................................................12
Table 2-3. Default M5200 CPUTCP/IP Addresses.....................................................................................27
Table 4-1. Example Extraction Summary ...................................................................................................44
Table 5-1. On-Line / Off-Line Dynamics Selection .....................................................................................91
Table 5-2. Load Sharing Logic....................................................................................................................94
Table 6-1. Actuator Driver Limits ..............................................................................................................122

Manual 26518V1 MicroNet TMR 5009FT
Woodward 4
Warnings and Notices
Important Definitions
This is the safety alert symbol used to alert you to potential personal injury hazards. Obey all
safety messages that follow this symbol to avoid possible injury or death.
DANGER - Indicates a hazardous situation, which if not avoided, will result in death or serious injury.
WARNING - Indicates a hazardous situation, which if not avoided, could result in death or serious
injury.
CAUTION - Indicates a hazardous situation, which if not avoided, could result in minor or moderate
injury.
NOTICE - Indicates a hazard that could result in property damage only (including damage to the
control).
IMPORTANT - Designates an operating tip or maintenance suggestion.
Overspeed /
Overtemperature /
Overpressure
The engine, turbine, or other type of prime mover should be
equipped with an overspeed shutdown device to protect against
runaway or damage to the prime mover with possible personal injury,
loss of life, or property damage.
The overspeed shutdown device must be totally independent of the
prime mover control system. An overtemperature or overpressure
shutdown device may also be needed for safety, as appropriate.
Personal Protective
Equipment
The products described in this publication may present risks that
could lead to personal injury, loss of life, or property damage.
Always wear the appropriate personal protective equipment (PPE) for
the job at hand. Equipment that should be considered includes but is
not limited to:
Eye Protection
Hearing Protection
Hard Hat
Gloves
Safety Boots
Respirator
Always read the proper Material Safety Data Sheet (MSDS) for any
working fluid(s) and comply with recommended safety equipment.
Start-up
Be prepared to make an emergency shutdown when starting the
engine, turbine, or other type of prime mover, to protect against
runaway or overspeed with possible personal injury, loss of life, or
property damage.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 5
Electrostatic Discharge Awareness
Electrostatic
Precautions
Electronic controls contain static-sensitive parts. Observe the
following precautions to prevent damage to these parts:
Discharge body static before handling the control (with power to
the control turned off, contact a grounded surface and maintain
contact while handling the control).
Avoid all plastic, vinyl, and Styrofoam (except antistatic
versions) around printed circuit boards.
Do not touch the components or conductors on a printed circuit
board with your hands or with conductive devices.
To prevent damage to electronic components caused by improper
handling, read and observe the precautions in Woodward manual
82715 , Guide for Handling and Protection of Electronic Controls,
Printed Circuit Boards, and Modules.
Follow these precautions when working with or near the control.
1. Avoid the build-up of static electricity on your body by not wearing clothing made of synthetic
materials. Wear cotton or cotton-blend materials as much as possible because these do not store
static electric charges as much as synthetics.
2. Do not remove the printed circuit board (PCB) from the control cabinet unless absolutely necessary.
If you must remove the PCB from the control cabinet, follow these precautions:
Do not touch any part of the PCB except the edges.
Do not touch the electrical conductors, the connectors, or the components with conductive
devices or with your hands.
When replacing a PCB, keep the new PCB in the plastic antistatic protective bag it comes in
until you are ready to install it. Immediately after removing the old PCB from the control cabinet,
place it in the antistatic protective bag.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 6
Chapter 1.
General Information
Introduction
The technical documentation for the 5009FT Control System consists of the following volumes:
Volume 1—provides information on system application, control functionality, fault tolerant logic, control
logic, PID setting instructions, and system operation procedures.
Volume 2—provides hardware descriptions, mechanical and electrical installation instructions, hardware
specifications, hardware troubleshooting help, and basic repair procedures.
Volume 3—provides installation procedures for the 5009FT control’s personal computer based interface
software program (CCT), information on all CCT features and modes (Configure, Service and Run).
Volume 4—provides details on installation and operation of the OpView™ operator control station, if
provided with your system. It contains a list of the control’s Modbus®* registers and tag names.
*—Modbus is a registered trademark of Schneider Automation Inc.
5009FT System part numbers covered in this manual are:
Control System Installation Procedure
1. Review all system manuals to gain an understanding of the control system.
2. Create a site-specific wiring diagram by referencing Volume 2’s wiring diagrams, and then perform
mechanical and electrical installation following Volume 2 instructions and the generated wiring
diagram.
3. Apply power to 5009FT Control and reset all three CPU’s by pressing the momentary reset button in
the top/front of the module.
4. Connect a keyboard and mouse to the front panel CCT Panel. Configure the system using the CCT
graphical interface screens (refer to Volume 3).
5. Perform a full system checkout; clear all system trips and alarms (refer to Volume 1, Chapter 6);
adjust linkages and stroke actuators (refer to Volume 1, Chapter 6).
When ready to start the turbine, follow the operation instructions of Volume 1, Chapter 6. During initial
start-up, the dynamics of each PID controller will need to be adjusted (refer to Volume 1, Chapter 6)
This volume provides control system description, and operation instructions for the Woodward MicroNet
TMR®5009FT Control System. It includes:
General description of the control system
Detailed functionality descriptions including I/O handling
Control system operation
Information on optional equipment
Detailed functionality description of start-up procedures
Detailed information on alarm and trip messages
Detailed information on Modbus parameters

Manual 26518V1 MicroNet TMR 5009FT
Woodward 7
This manual applies to all 5009FT Control Systems but does not include information that is unique to your
system. The 5009FT Control System can be provided in a number of hardware configurations and for
steam turbine applications driving either a Generator or a Compressor as shown in Table 1-1. Because
this manual addresses all configurations, many of the system software and hardware descriptions may
not apply to your particular 5009FT System.
This manual does not contain instructions for the operation of the complete turbine system. For turbine or
plant operating instructions, contact the plant- equipment manufacturer.
Table 1-2. Control Component Hardware
8262-1111 Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS
8262-1112 Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS + Integ Act Kit
8262-1113 Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS + Comp Cntrl Kit
8262-1114 Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS + Integ Act & Comp Cntrl Kit
8262-1115 Control-- 5009FT Cabinet w/2 220 Vac TMR PS
8262-1116 Control-- 5009FT Cabinet w/2 220 Vac TMR PS + Integ Act Kit
8262-1117 Control-- 5009FT Cabinet w/2 220 Vac TMR PS + Comp Cntrl Kit
8262-1118 Control-- 5009FT Cabinet w/2 220 Vac TMR PS + Integ Act & Comp Cntrl Kit
8262-1123 Control– 5009FT MicroNet w/2 24 Vdc TMR PS
8262-1124 Control– 5009FT MicroNet w/2 24 Vdc TMR PS+ Integ Act Kit
8262-1125 Control– 5009FT MicroNet w/2 24 Vdc TMR PS+ Comp Cntrl Kit
8262-1126 Control– 5009FT MicroNet w/2 24 Vdc TMR PS+ Integ Act & Comp Cntrl Kit
8262-1119* Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS w/o CCT
8262-1120* Control-- 5009FT Cabinet w/2 120 Vac/dc TMR PS + Integ Act Kit w/o CCT
8262-1121* Control-- 5009FT Cabinet w/2 220 Vac TMR PS w/o CCT
8262-1122* Control-- 5009FT Cabinet w/2 220 Vac TMR PS + Integ Act Kit w/o CCT
*CCT hardware not included as part of these P/Ns.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 8
Chapter 2.
Description
General
The 5009 Fault-Tolerant Control System is designed to control single valve, split- range valve, single
controlled-extraction, single controlled-admission, or single controlled-extraction/admission steam
turbines. The 5009 Control System is field programmable which allows a single design to be used in
many different control applications and reduces both cost and delivery time. It uses a Windows-based
computer program (CCT) to allow a user to configure the control, perform on-line program changes,
perform on-line hardware tests, and alternatively operate the turbine. This control can be used as a stand-
alone unit or in conjunction with a plant’s Distributed Control System (DCS).
Control Fault Tolerance
The basis of this control’s fault tolerance architecture is to detect control related faults, annunciate these
faults, and allow on-line service/replacement of modules and/or transducers to correct these faults.
This control’s architecture allows it to operate with any single point of failure, without shutting down the
turbine. A CPU fault tolerance logic of 3-2-0 allows the control to function normally with any CPU module
failed or removed. An analog I/O fault tolerance logic of 3-2-1-0 allows the control to function normally
with any one or two analog modules failed or removed. A discrete I/O fault tolerance logic of 3-2-0 allows
the control to function normally with any one discrete module failed or removed. A power supply fault
tolerance logic of 2-1-0 allows the control to function normally with any one power supply failed or
removed.
Three isolated kernel sections (A, B & C) each house a Kernel Power Supply module, CPU module,
Analog Combo I/O module, and a Discrete I/O module. Optionally an Analog I/O module can be added to
each kernel, and also an Actuator Controller module can be added to Kernels A and B. A single
motherboard supplies nine electrically isolated data paths. Each CPU has a data path to its VME modules
and two separate data paths, one to each of the other CPU modules. There is a total of six paths between
CPUs allowing for redundancy and error checking.
All control inputs and outputs are Triple Modular Redundant (TMR); meaning that each individual analog
and speed input is monitored by all three 5009 Control System kernels, then voted upon to ensure that
the correct input value is used for control. Each input is split at one of the control’s field termination
module, and routed to the three kernels (A, B, C) via separate I/O cables; this allows on-line module
replacement. Each control output signal is the sum of the three kernels outputs. Because the control
monitors the health of each kernel’s output signal, it can detect, alarm, and react to any system output
fault.
The 5009 Control System allows redundancy to be extended beyond the control, by allowing multiple
transducers to be used for any critical control parameter. Optionally the control can be configured to
accept up to four speed sensor inputs, and three analog input signals (from separate transducers) for any
single critical control parameter.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 9
Table 2-1. System Module Layout
Woodward 5009FT MicroNet+ TMR Control System
Main Chassis – MicroNet+ TMR P/N = 5453-279
Chass/
Kernel/
Slot
Module
P/N Module Description Cable / Length (Qty) FTM P/N (Qty)
1/A/1 5466-1049
MicroNet Kernel Power Supply – 24
Vdc Input — —
1/A/2 5466-1047 CPU - PowerCCT5200 400 MHz 5417-393 / 7’ —
1/A/3 5466-1115
TMR High Density Analog Combo
I/O 5417-026, -027 / 6-8’ 5501-502 (1)
5501-372 (1)
1/A/4 5466-1051 TMR HD Discrete I/O (24 in / 12 out) 5417-172 / 8’ (2) 5453-276 (4)
1/A/5 5466-257* TMR High Density Analog I/O (24/8) 5417-172,-173 / 8-10’* 5501-372
(2)*
1/A/6 5501-432* Actuator Controller Module (2 Chan) 5417-041 / 12’* 5437-672*
1/B/1 5466-1049
MicroNet Kernel Power Supply – 24
VDC Input — —
1/B/2 5466-1047 CPU - PowerCCT5200 400 MHz 5417-393 / 7’ —
1/B/3 5466-1115
TMR High Density Analog Combo
I/O 5417-026, -027 / 6-8’ 5501-502 (x) 5501-372 (x)
1/B/4 5466-1051 TMR HD Discrete I/O (24 in / 12 out) 5417-172 / 8’ (2) 5453-276 (x)
1/B/5 5466-257* TMR High Density Analog I/O (24/8) 5417-172,-173 / 8-10’* 5501-372
(2)*
1/B/6 5501-432* Actuator Controller Module (2 Chan) 5417-041 / 12’* 5437-672
1/C/1 5466-1049
MicroNet Kernel Power Supply – 24
VDC Input — —
1/C/2 5466-1047 CPU - PowerCCT5200 400 MHz 5417-393 / 7’ —
1/C/3 5466-1115
TMR High Density Analog Combo
I/O 5417-027 / 8 (2) 5501-502 (x) 5501-372 (x)
1/C/4 5466-1051 TMR HD Discrete I/O (24 in / 12 out) 5417-172 / 8’ (2) 5453-276 (x)
1/C/5 5466-257* TMR High Density Analog I/O (24/8) 5417-172,-173 / 8-10’* 5501-372
(2)*
1/C/6 3799-301 Blank — —
* Optional Item, See Volume 2, Appendix B
Each CPU module runs the identical software application as the other two. All inputs from each kernel are
distributed to the other two kernels. Each CPU then compares the value it read, with the value the other
two CPUs read, before outputting a signal to the application software. Depending on the configuration, a
total of nine values for the same input parameter could be used in the voting logic to provide the best
signal to the application software. Even if a data value has been corrupted along any one of the data
paths shown in Figure 2-1, all CPUs use the same correct data for their application calculations. All CPUs
use the same voted input signals in the same application calculations to generate the same outputs.
All output values are exchanged between kernels, the results are voted and the appropriate value is
output from each kernel. Since the system can handle significant single errors, even multiple errors may
not shutdown a kernel section. In the event of consistent errors from one of the kernel section, an alarm
will be annunciated and that particular kernel will be shut down. Figure 2-1 shows the input to output
structure of the MicroNet TMR®.
The 5009 Control System’s redundancy architecture allows all control modules to be replaced one at a
time while the turbine is on-line and operating at full power (sometimes referred to a Hot Replacement).

Manual 26518V1 MicroNet TMR 5009FT
Woodward 10
Figure 2-1. Double Exchange and Vote Structure
Speed Inputs
The control can accept one, two, three, or four speed inputs. Each speed input is monitored by all three
kernels. With twelve possible speed signals from which to control with, the control can withstand multiple
speed input failures with no loss of control functionality. Only one of the possible twelve inputs is required
for speed control. The control can accept a ‘slow speed’ detect probe on channel 4 which can be unique
or different from the other speed signals.
All speed inputs are connected to the control, via field termination modules (FTMs). An input’s termination
module is used to terminate customer control wiring and distribute each input signal to all three kernels.
After the control’s kernels double exchange their input values, and vote out any erroneous values, the
Application Software Redundancy Manager then compares each kernel’s voted result to select a value to
be used within the application logic. Figure 2-2 is a graphical view of a control input’s architecture. Table
2-2 displays the redundancy manager’s input selection logic, for each possible input condition.
A speed input signal is determined to be faulty and is taken out of the input voting logic when it is below
its “Speed Failure Level” setting. This failure level setting is common to all inputs and can be adjusted via
the CCT program’s Service mode. Refer to Volume 3 for all CCT program procedures.
An input deviation alarm is also used to annunciate if any of the four possible speed input channels is
sensing a value that is different than the voted-good value used by the application. If an input channel’s
sensed value deviates from the voted-good signal value, by a greater margin than the speed control’s
“Max Deviation” setting, an input channel alarm will be issued. This type of annunciation can be used to
indicate when an input channel or magnetic pickup unit is intermittently failing high or low. Max Deviation
input settings are tunable via the CCT program’s Service mode, and are defaulted to 1% (deviation range
= .01 to 20%) of the “Overspeed Limit” setting. If a deviation alarm condition occurs, the alarmed input is
not removed from the control’s voting logic and still can be used to control with, in case all other channels
fail.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 11
The voting logic when more than one speed input (MPU or Prox. Probe) is used is as follows:
With 4 good sensors, use the median 2 sensors
With 3 good sensors, use the median value
With 2 good sensors, use the higher value
With 1 good sensor, use the good sensor’s value
Analog Inputs
The control can accept one, two, or three transducer inputs for all critical parameters (ext/adm, aux, casc
inputs). Only one input signal is accepted for non-critical functions (remote setpoint inputs). Each analog
input can withstand up to two failures with no loss of control functionality. If any two of an analog input’s
three “legs” are failed, the control uses the third healthy leg’s sensed input signal from which to control
with.
All analog inputs are connected to the control, via field termination modules (FTMs). An input’s
termination module is used to terminate customer control wiring and distribute each input signal to all
three kernels. After the control’s kernels double exchange their input values, and vote out any erroneous
values, the Application Software Redundancy Manager then compares each kernel’s voted result to
select a value to be used within the application logic. Figure 2-2 is a graphical view of a control’s input
architecture. Table 2-2 displays the redundancy manager’s input selection logic, for each possible input
condition.
Optionally, each leg of an input channel can be tested and its calibration verified through the CCT
program’s Service mode, by individually removing the other two input legs. Refer to Volume 3 for all CCT
program mode procedures.
An analog input signal is determined to be faulty when it is below its “Fail Low Value” setting, or above its
“Fail High Value” setting. These failure level settings can be adjusted via the CCT program’s Service
mode and are defaulted to values in engineering units which correspond to 2 mA and 22 mA respectively.
If an input is determined to be failed, that input is removed from the control’s voting logic.
Input deviation alarms are used to annunciate if any of the input channels or input legs are sensing a
value that is different than the voted-good value used by the application. If an input channel’s sensed
value deviates from the voted-good value, by a greater margin than its “Max Deviation” setting, an input
channel alarm will be issued. This type of annunciation can be used to indicate when an input channel or
system transducer is going out of calibration. Max Deviation settings are tunable via the CCT program’s
Service mode, and are defaulted to 1% (deviation range = .1 to 10%) of the configured input range. If a
deviation alarm condition occurs the alarmed input is not removed from the control’s voting logic, and still
can be used to control with, in case all other channels fail.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 12
TRANSDUCER #2 INPUT
VOTING
CONTROL
LOGIC
TRANSDUCER #1
MOD
MOD
C
B
ATM
MOD
A
INPUT 1
VOTING
ATM
VOTING
INPUT 2
ATM
INPUT 3
VOTING
TRANSDUCER #3
855−662
02−12−31
MOD
A
MOD
B
MOD
C
MOD
A
MOD
B
MOD
C
Figure 2-2. Fault Tolerant Analog Input
Table 2-2. Redundancy Manager Truth Table

Manual 26518V1 MicroNet TMR 5009FT
Woodward 13
Discrete Inputs
Each discrete input can withstand up to two failures with no loss of control functionality. If any two of a
discrete input’s three “legs” fail, the control uses the third healthy leg’s sensed input signal from which to
control with.
All discrete inputs are connected to the control via field termination modules (FTMs). A FTM is used to
terminate customer control wiring and distribute each input signal to all three kernels. After the control’s
kernels double exchange their input values and vote out any erroneous inputs, the Application Software
Redundancy Manager then compares each kernel’s voted result to select a value to be used within the
application logic. Figure 2-3 is a graphical view of the control’s discrete input architecture.
Figure 2-3. Fault Tolerant Discrete Input
A discrete input signal is determined to be faulty when it is determined to be different than the voted-good
value used by the application. If an input is determined to be faulty, the input is removed from the
control’s voting logic and an input channel alarm is issued. Once the input fault is corrected the alarm
condition can be reset by issuing a control “Reset” command.
Readouts (Analog Outputs)
Each control readout can withstand up to two failures with no loss of output functionality. Any leg of an
output channel can drive a readout’s full 4–20 mA current signal. After each CPU generates an analog
output signal, the signals are exchanged between CPUs, voted on, and sent to the Redundancy Manager
for output. The Redundancy Manager divides the output signal based on the number of known good
output channels and distributes each portion of the signal to the respective output channel.
Precision resistors are used in each channel’s readback circuitry to measure and verify the health of each
output “leg”. If a fault condition is detected, the faulty output leg is disabled, and the Redundancy
Manager redistributes the output signal to the remaining legs. In a case where two failures are
experienced at the same time within different legs, the single good channel (leg) will drive the entire
output. Figure 2-4 shows a Fault Tolerant Analog Output’s architecture. The Field Termination Module
(FTM) combines each analog output signal from all three kernels into one signal at the FTM’s terminal
blocks.
An output is considered failed, and an alarm issued, if a channel’s combined output or any leg of the
output measures a difference of more than 10% from the output demand. Optionally, each leg of a
readout channel can be tested and its calibration verified through the CCT program’s Service mode, by
individually removing the other two output legs. Refer to Volume 3 for all CCT program functionality.
With this output architecture, any single output driver failure results in the output signal only stepping to
66.66% of its original value. The time between when a failure is sensed and when the control corrects for
it by redistributing current through the other drivers can be as long as 50 milliseconds.
Upon the correction of an output failure, and a “Control Reset” command, each failed output performs a
continuity check though the its external load before current is again redistributed evenly between all
output drivers. This continuity check entails, the failed driver to output a small amount of current through
its output load, and compare that value with what is readback. The time between when a continuity check

Manual 26518V1 MicroNet TMR 5009FT
Woodward 14
is performed and when the control redistributes current through the all drivers can be as long as 50
milliseconds.
Figure 2-4. Fault Tolerant Analog Output
Actuator Outputs
Each actuator output can withstand up to two failures with no loss of output functionality. Any leg of an
output channel can drive an output’s full current signal (4–20 mA or 20-160 mA). After each CPU
generates an actuator output signal, the signals are exchanged between CPUs, voted on, and sent to the
Redundancy Manager for output. The Redundancy Manager divides the output signal based on the
number of known good output channels and distributes each portion of the signal to the respective output
channel.
Precision resistors are used in each channel’s readback circuitry to measure and verify the health of each
output “leg”. If a fault condition is detected, the faulty output leg is disabled, and the Redundancy
Manager redistributes the output signal to the remaining legs. In a case where two failures are
experienced at the same time within different legs, the lone good channel (leg) will drive the entire output.
Figures 2-5 and 2-6 show a Fault Tolerant Actuator Output’s architecture. The Field Termination Module
(FTM) combines each actuator output signal from all three kernels into one signal at the FTM’s terminal
blocks.
An output is considered failed, and an alarm issued, if a channel’s combined output or any leg of the
output measures a difference of more than 10% from the output demand. Optionally, each leg of a
readout channel can be tested and its calibration verified through the CCT program’s Service mode, by
individually removing the other two output legs. Refer to Volume 3 for all CCT program functionality.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 15
Before calibrating or testing, the unit must be tripped and the steam
supply removed. This is to ensure that opening the control valve(s)
will not allow steam into the turbine. Overspeeding the turbine may
cause damage to turbine and can cause severe injury or death to
personnel. STEAM TO THE TURBINE MUST BE SHUT OFF BY OTHER
MEANS DURING THIS PROCESS.
Actuator outputs, or HP and LP valve outputs, are treated the same way as the other analog outputs, with
the exception of an added precision resistor in the actuator output’s return path. This resistor is used to
measure and detect ground loops and coil shortages that are possible when interfacing to an actuator. If
a single coil actuator is being driven, the dual coil terminal blocks are jumpered (wired) to the single coil
terminal blocks and the redundancy manager shares the current equally between all three kernels. In the
event of a fault, the Redundancy Manager will redistribute the load.
If the actuator connected to is a dual coil actuator, the Redundancy Manager shares half the current
evenly between Kernels A & B outputs, and the other half comes from the Kernel C output. In the event of
a fault, the Redundancy Manager redistributes load current.
With this output architecture, any single output driver failure results in the output signal only stepping to
66.66% of its original value (possibly 50% for dual coil applications). The time between when a failure is
sensed and when the control corrects for it by redistributing current through the other drivers can be as
long as 50 milliseconds.
Upon the correction of an output failure, and a “Control Reset” command, each failed output performs a
continuity check though the actuator before current is again redistributed evenly between all output
drivers. This continuity check entails, the failed driver to output a small amount of current through its
output load, and compare that value with what is readback. The time between when a continuity check is
performed and when the control redistributes current through the all drivers can be as long as 50
milliseconds.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 16
Figure 2-5. Fault Tolerant Single Coil Actuator Output

Manual 26518V1 MicroNet TMR 5009FT
Woodward 17
Figure 2-6. Fault Tolerant Dual Coil Actuator Output
Relay Outputs
Twelve fault tolerant relay outputs are provided with this control. With this control’s architecture, a six
relay configuration is used to form each fault tolerant relay output. When a relay output is closed, the
contacts of all six relays are closed. Because of the series-parallel configuration that the relays are in, the
failure of any individual relay will not cause the output to be open. This series- parallel configuration also
allows any single relay of the six relay configuration to be removed and replaced “on-line” with no affect
on the state of the fault tolerant relay output.
When a relay output is open, the contacts of all six relays are open. Because of the series-parallel
configuration that the relays are in, the failure or removal of any one relay will not cause the output to be
closed. The relay output would continue to be open.

Manual 26518V1 MicroNet TMR 5009FT
Woodward 18
Since this control’s fault tolerant architecture can tolerate a single fault, it is possible for this fault to go
undetected. This is called a latent fault. If a second fault occurs while a latent fault exists, the state of the
fault tolerant relay output may be affected, possibly resulting in a shutdown condition. This is why it is
important to detect and annunciate latent faults in a fault tolerant system.
Latent fault detection is provided with this control to detect any relay related failure without affecting the
state of the overall relay output. Each individual relay output can be configured to use or not use latent
fault detection. A latent fault detection test is performed periodically or on command through the CCT.
The period of time between tests can be set from 1 to 3000 hours.
A relay output is tested by cycling the output’s individual relays closed then open (or vice-versa
depending on the output state), to ensure that they are in the correct state, and that they can change
state. Position readback circuitry allows the state of each relay contact to be detected. Any failures are
annunciated, and further testing is disabled without affecting the state of the relay output contact or
control operation.
Each fault tolerant relay configuration consists of 6 relays, driven by two discrete outputs from each
kernel (as shown in Figure 2-7). The relays are configured in three legs of two relays each. Customer
circuit power is connected to one side of the resulting configuration, and customer load to the other side.
Field selectable jumpers, located on system FTMs, are provided to allow each output’s latent fault
detection logic to be compatible with the circuit being interfaced to. Latent fault detection is used to
monitor the actual contact positions of each of the six relays, and to momentarily change states of each
relay one at a time. This verifies each relay’s “normally open” or “normally closed” contacts.
LOAD
PW
NO
CM
C2
A2
B2
C1
B1
A1
CIRCUIT
POWER
A
A1
DISCRETE
MOD−B
DISCRETE
MOD−A
DISCRETE
MOD−C
855−663
DTM
A
A2
B
B1
B
B2 C1
C
C2
C
02−12−31
Figure 2-7. Fault Tolerant Discrete Output
Latent fault detection (LFD) is not usable with all applications or circuits. The control’s LFD logic can only
work with circuits using voltages between 18–32 Vdc, 100–150 Vdc, or 88–132 Vac. For latent fault
detection to work, a small leakage current is passed through the circuit’s load. Depending on the size of
the load, the leakage current may be enough to cause a load to be on or active, when a relay contact is
open. In this case, the individual relay’s latent fault detection logic may be disabled, eliminating the
leakage current, or a shunt resister can be used across the load to reduce the leakage current. Refer to
Volume 2 of this manual to determine if Latent Fault Detection can be used with a circuit.