Overspeed Protection Fundamentals
Starting With the Most Critical Protection Function
Track 3 introduced the protection system as independent from the control system, and Track 4 covered vibration-based protection. This track goes deeper into protection specifically, starting with overspeed — arguably the single most critical protective function on any steam turbine, since uncontrolled overspeed can lead to catastrophic rotor failure within seconds.
Mechanical vs. Electronic Overspeed Detection
Older turbines used a purely mechanical overspeed bolt — a spring-loaded eccentric weight mounted in the rotor, sized so that at a specific overspeed condition, centrifugal force overcomes the retaining spring and the weight flies outward, mechanically triggering a mechanism that dumps trip system hydraulic pressure. This requires no electrical power or digital logic whatsoever — a purely mechanical response to centrifugal force, valued historically as a simple, self-contained protection layer independent of everything else on the turbine.
Modern turbines primarily use electronic overspeed protection: multiple independent speed pickups feeding dedicated overspeed trip logic, deliberately separate from the speed feedback the normal EHC control system uses for governing. This is a direct application of Module 3.4's system independence principle — using separate sensors specifically for overspeed protection means a fault in the control system's speed sensing can't simultaneously compromise the overspeed protection function.
It would be a serious misunderstanding to assume the same speed signal used for normal governing also provides overspeed protection. Modern designs deliberately use separate, independent speed pickups for protection specifically so a control-system sensor fault can't blind the overspeed protection at the same time.
The Three Speed Tiers
Rated speed — 3600 RPM on a 60 Hz two-pole generator, 3000 RPM on 50 Hz — is the normal full-speed operating point, the baseline every overspeed threshold is defined relative to. Test overspeed, typically around 103-105% of rated, is a deliberately elevated speed the turbine is intentionally run up to during periodic overspeed testing (Module 5.4) to verify trip devices actually function — testing at a controlled elevated speed rather than only trusting the mechanism will work when genuinely needed.
The emergency trip setpoint, typically around 110% of rated speed, is the threshold at which overspeed protection automatically and immediately trips the unit, closing stop valves via the same trip solenoid/dump valve mechanism introduced in Module 3.4. This setpoint is chosen with real margin below the speed at which genuine mechanical damage — blade failure from excessive centrifugal stress, connecting to Module 2.3's centrifugal load discussion — becomes likely.
Rated (100%) → test overspeed (~103-105%, verifies the system works) → emergency trip (~110%, stops the machine automatically) → mechanical damage threshold (well above trip, never reached if protection functions correctly). Each tier has margin built in relative to the next.
Why Overspeed Is Uniquely Time-Critical
Unlike many other protective functions that respond to slowly developing conditions, overspeed can develop extremely quickly — a sudden loss of electrical load (like a generator breaker opening unexpectedly while the turbine is producing significant power) removes the load that was previously absorbing the turbine's mechanical output, and speed can rise very rapidly with nothing left to hold it back except the governor's response and, if that's insufficient or too slow, the overspeed trip. This time-critical nature is exactly why overspeed protection is built with the fastest-acting, most independent protective logic on the entire machine.