Main, Auxiliary & Emergency Oil Pumps
Why One Pump Was Never Going to Be Enough
Module 6.1 introduced "the oil pump" as a single simplified concept. Real turbines use three distinct pumps, each covering conditions the others can't — directly applying Module 5.6's redundancy principles specifically to lube oil supply, arguably the single most safety-critical fluid system on the entire machine.
Three Pumps, Three Different Coverage Conditions
The main (shaft-driven) pump is often driven directly off the turbine shaft itself, automatically running whenever the shaft turns at speed with no separate motor or external power required. As long as the turbine is rotating normally, this pump is inherently running too — no dependency on plant electrical power for its basic operation.
But the main pump only works once the shaft is at or near normal speed. The auxiliary (AC motor) pump covers everything else: startup before the shaft reaches speed, shutdown as it coasts down, and — critically — the entire extended turning gear period (Module 2.6), where shaft speed is far too low for the main pump to generate adequate pressure. This pump directly enables Module 2.6's turning gear operation to actually happen.
The emergency (DC) pump runs off the plant's battery system, providing oil pressure even during a complete loss of AC electrical power — a scenario where both the main pump (shaft not turning) and the auxiliary pump (no AC power) would be unavailable simultaneously. This is Module 5.6's independence principle applied directly to lube oil: a genuinely independent power source (battery/DC) keeps bearing lubrication available even in the worst-case combined failure scenario.
It's a mistake to assume the main pump alone handles all operating conditions. It only functions once the shaft is at or near normal speed — the auxiliary pump is what actually covers startup, shutdown, and the entire turning gear period, when shaft speed is far too low for the main pump to work at all.
Automatic Changeover Logic
Each backup pump is configured with pressure-sensing startup — automatically starting when oil header pressure drops below its specific setpoint, rather than requiring manual operator intervention. This matters because a manual response process would introduce a dangerous delay during exactly the scenario where bearing protection is most critical.
Backup pumps use cascading setpoints: the auxiliary pump activates at a higher pressure threshold than the emergency pump's activation point, creating a sequential cascade that matches response to actual severity rather than every backup activating simultaneously regardless of how bad the pressure loss actually is.
Main pump (shaft-driven, normal running) → auxiliary pump (AC-powered, covers startup/shutdown/turning gear) → emergency pump (DC/battery-powered, covers total AC power loss). Each layer covers a condition the previous layer can't, following the same redundancy logic from Module 5.6.
Verifying the Changeover Actually Works
Just as Module 5.4 established for trip and overspeed protection, backup pump changeover requires periodic testing — simulating a pressure drop or briefly taking the running pump offline in a controlled way to confirm backup pumps actually start automatically as designed. A backup pump that's never been verified to actually start automatically is a backup pump whose real-world reliability is genuinely unknown, no matter how sound the design looks on paper.