Barry Nurcombe, C.Eng.

Sr. Engineer, Bently Nevada® Applications Design

barry.nurcombe@ge.com

Introduction
Original Equipment Manufacturers (OEMs) are generally well-versed in the
ramifications of overspeed as well as the numerous considerations inherent in a
properly engineered overspeed protection system. This is with good reason: they
supply such systems with their new machines and can often assist in retrofitting
existing machines in the field. The same level of understanding, however, does
not always exist with end users. This article is written primarily for the benefit
of end users and acts as a tutorial on basic overspeed concepts, focusing on retrofit
considerations and recommendations. The article also summarizes the economic
implications, safety considerations, and industry trends that are leading many
end users to replace mechanical overspeed detection apparatus with electronic
systems. Finally, the article provides a number of practical observations made by
the author over the last 15 years during projects applying and installing such
systems that will assist users who are in the midst of – or considering – an
upgrade to their older overspeed systems.

[Vol.25 No.1 2005] ORBIT 17

A P P L I C A T I O N S
What is overspeed?
Some of the strongest forces acting on most turbo-
machinery are the centrifugal forces exerted when masses
are set into rotational motion. A simplified equation for
this force, assuming a constant speed of rotation, is
shown in Figure 1.
The centrifugal forces are the outward-directed forces
caused by spinning the rotating masses that comprise
the rotor, while the centripetal forces are the equal and
opposite restraining forces provided by the rotor that
keep blades, windings, and other components from
“breaking free” while they rotate. By spinning a rotor
faster, the centrifugal forces generated by these masses
will continue to increase, and the corresponding cen-
tripetal “restoring” forces increase in an equal and opposite
fashion. As can be seen from the equation in Figure 1,
these forces increase with the square of the rotative speed,
meaning changes in speed have a magnified effect in the
forces generated (e.g., a 50% increase in speed results
in a 225% increase in force). At some point, these forces
will exceed the limits of the rotor’s design. Yield points
of materials will be reached and the rotor will be damaged.
It may even fail entirely, potentially with catastrophic
results. In some circumstances, an overspeed event in a
machine will cause blades – and even the entire rotor –
to exit the machine casing, allowing the release of not
only high-velocity, high-energy projectiles, but also
steam and other process fluids. The severity of economic
and safety consequences arising from such failures are
obvious.
While machines are engineered with a safety margin
that allows them to tolerate brief excursions above the
Figure 1 – Centrifugal and centripetal forces on a rotating mass in equilibrium
m F
cf
ω
r
Fcp
18 ORBIT [Vol.25 No.1 2005]
rated maximum operating speed, they are not designed
for sustained operation at such speeds and overspeed
protection systems are supplied for this reason. It is
assumed by the manufacturer that the machine will
not operate above the rated maximum except under two
conditions:
1. Deliberate testing of the machine’s speed control
and overspeed protection systems;
2. A mechanical or control system failure resulting
in an overspeed condition.
Even during these conditions, the maximum speed
achieved by the machine must be constrained and the
duration of the elevated speed kept relatively short. The
manufacturer will generally have data for “yield speed”
and “burst speed.” Yield speed is the speed at which
rotor components will be deformed or compromised
through excessive stress induced by the overspeed con-
dition. Burst speed is the speed at which the machine
is expected to fail catastrophically. As a machine and
its components wear, these speeds may change.
Clearly, a machine should never be allowed to approach
its theoretical burst speed. Additionally, if a machine
ever exceeds the yield speed, an inspection is in order.
Consequently, overspeed protection systems should be
set to keep the machine from exceeding its yield speed,
allowing it to be safely restarted if overspeed does occur,
rather than necessitating an inspection. A “peak hold”
mechanism for capturing the maximum speed achieved
during an overspeed event is very helpful in this regard
and, for this reason, is a standard feature on Bently Nevada
overspeed detection tachometers.
Fcf = Fcp = mrω2
WHERE Fcf = centrifugal force
Fcp = centripetal force
m = mass of rotating object
r = radius of mass m from center (axis)
of rotation
ω = rotative speed

Maximum Temporary Overshoot Speed Nos
MACHINE SPEED
Overspeed Trip Speed Nost
Maximum Continuous Operating Speed Nmc
∆tod Overspeed Detection Response Time
∆toe Overspeed Execution Response Time
∆top Total Overspeed Protection System Response Time
As a rough rule-of-thumb, most overspeed protection
systems are set to keep the machine from ever exceeding
approximately 120% of the rated maximum operating
speed. The actual value may be higher or lower than
120% and must be established by consulting the man-
ufacturer along with pertinent industry machinery
standards (e.g., API 612) that the user may wish to apply.
Although overspeed can occur gradually (such as when
a speed control system fails and the speed slowly creeps
upward), it is more common for overspeed to occur very
quickly (just a few hundred milliseconds) because the
forces acting on a machine can change very quickly.
For example, consider a steam turbine driving a gen-
erator whose breakers suddenly open: the turbine will
see an instantaneous loss of load. As another example,
consider a gas turbine driving a pipeline compressor
whose coupling suddenly shears: this turbine will likewise
see an instantaneous loss of load, accelerating it within
a fraction of a second to 120% overspeed. Speed control
systems may not react to these kinds of sudden over-
speed conditions; the overspeed protection system must
instead be relied upon to trip the unit.
Terminology
The words “detection” and “protection” are not used
interchangeably in this article with respect to overspeed
systems. The distinction is important both in terms of
understanding the primary purpose and function of
A P P L I C A T I O N S
Figure 2 – Overspeed shutdown map
Not To Scale
OVERSPEED OVERSPEED
SHUTDOWN SHUTDOWN
DETECTION EXECUTION
TIME
∆tod ∆toe
∆top
each system, and in understanding the scope of
responsibility assumed by the suppliers of each system.
t An Overspeed Protection System (OPS) is the
complete electro-mechanical system (hydro-
mechanical or electro-pneumatic) that senses the
onset of an overspeed condition and automatically
shuts the unit down by closing (or opening) valves,
solenoids, and other devices necessary to bring the
unit to a safe halt.
t An Overspeed Detection System (ODS) is one part
of the larger OPS. It is responsible only for sensing
the onset of overspeed and providing a signal suitable
for triggering the rest of the OPS, which then
removes energy from the machine and brings it to
a safe halt. The ODS supplies this signal in the
form of activation of one or more electrical relays.
The Overspeed Map
The time required to detect an overspeed condition and
then shut the machine down must be factored into the
design of the OPS. As shown in Figure 2, the maximum
speed ever reached by the machine is Nos, the Maximum
Temporary Overshoot Speed. For reasons previously
discussed, this speed must be less than the yield speed
of the machine and should be determined through con-
sultation with the machine OEM and consideration of
relevant industry standards. To account for the time to
[Vol.25 No.1 2005] ORBIT 19
A P P L I C A T I O N S

detect an overspeed condition and then execute the The detection time is the latency for the overspeed
various steps necessary to trip the unit, the Overspeed detection system to detect the onset of overspeed and
Trip Speed (Nost) is set at a lower level than Nos. Nost generate a shutdown signal; the execution time is the
is generally set as low as possible to provide maximum latency for the remainder of the overspeed protection
time for the overspeed protection system to respond, system to act on this signal. Table 1 summarizes typical
but without being set so low that normal speed fluctu- values for ∆top, ∆tod, and ∆toe along with some of the
ations about the machine’s maximum continuous operating items that would normally contribute to these
speed N mc will trigger a false overspeed alarm and latencies in a typical system consisting of a fully elec-
shutdown. tronic overspeed detection system and an electro-hydraulic
As an example, American Petroleum Institute Standard shutdown system. As shown in the table, a typical appli-
612 (pertains to Special-Purpose Steam Turbines) uses cation will require a total OPS response time of between
the following values: 140 and 250 ms. ODS response time will generally be
50 ms or less (API 670 requires that ODS tachometers
t Nost is 10% above Nmc be capable of responding within 40 ms when an input
signal of 300 Hz or greater is present).
t Nos is 10% above Nost (i.e., 21% above Nmc).
Thus, an overspeed protection system designed to comply The Economics of Overspeed
with API 612 must begin to act when turbine speed Shutdown Events
reaches 110% of maximum continuous operating speed With many operators striving to achieve an absolute
and keep the machine from ever exceeding 121% of minimum of process interruptions, whether caused by
maximum continuous operating speed. machinery failures or any other factors, traditional
overhaul and maintenance intervals are being extended
Reaction Times whenever possible. While this is being achieved suc-
It is useful to think of the total time ∆top required for cessfully for many machines through appropriate condition
the overspeed protection system to act as being com- monitoring and asset management strategies, it is never
posed of two parts: The detection time ∆tod and the advisable to delay routine maintenance and inspections
execution time ∆toe where of safety-related systems, such as overspeed protection.
As will be discussed next, fewer process interruptions
∆top = ∆tod + ∆toe.
and enhanced safety are not mutually exclusive. Through

Table 1 – Overspeed protection system response times and factors

TOTA L OV E R S P E E D P R OT E C T I O N R E S P O N S E T I M E ( ∆ t o p )

OV E R S P E E D D E T E C T I O N
RESPONSE TIME (∆tod)

( TY P I C A L LY 4 0 - 5 0 m s )

Time for multi-tooth speed wheel to generate sufficient pulses to measure speed change accurately
Time to compare speed inputs against alarm setpoints
Time to vote multiple channels against one another in 2-out-of-3 system
( TY P I C A L LY 1 4 0 – 2 5 0 m s )

Time for alarm signal to be transmitted to relay contact circuitry

“Bounce” time for relay contacts to settle fully opened or closed

Input scan times for logic solvers or other safety instrumented systems
OV E R S P E E D E X E C U T I O N

( TY P I C A L LY 10 0 – 2 0 0 m s )
RESPONSE TIME (∆toe)

Hydraulic system latencies

Solenoid actuation latencies
Valve latencies
Time for entrained energy downstream of trip valve to fully discharge through machine
Interposing relay latencies and “bounce” time for contacts to settle fully open or closed

20 ORBIT [Vol.25 No.1 2005]


the use of electronic overspeed detection systems, rather
than older mechanical “trip bolts,” reliability and safety
can be significantly enhanced while eliminating the need
for costly process interruptions required to test and verify
the overspeed detection circuity.
Mechanical Overspeed Devices
Mechanical overspeed devices, such as trip bolts or trip
rings (which contain internal trip bolts), utilize moving
parts. These bolts or rings are fixed to the rotor and
rotate with it. Under an overspeed condition, the cen-
trifugal force of the rotating bolt causes it to move radially
outward against preset spring forces. At a pre-designed
speed, the bolt is designed to overcome these spring
forces and pop outward, far enough to strike trip
levers. These levers are normally latched in place, but
are released by the impact of the trip bolt/ring striking
the trip lever surface. In turn, these levers are connected
to valves and linkages that commence the unit shutdown
process. Figure 3 shows a typical trip ring from a steam
turbine.
Unfortunately, these mechanical trip bolts can become
stuck by the ‘gelling’ or ‘lacquering’ of the sur-
rounding lubricating oil. At minimum, this gives rise
A P P L I C A T I O N S
Figure 3 - A typical trip ring relying on a spring-loaded bolt
to a delay in the instigation of the overspeed shutdown
process. In other cases, the shutdown system will com-
pletely fail to act.
To help ensure such systems continue to work properly,
it is necessary to carry out an overspeed test at regular
intervals. However, such testing can be potentially dan-
gerous and is frequently very expensive for the following
reasons:
1. To test the system, the machine must be phys-
ically oversped. If the bolt fails to operate during
the test, it may be difficult to manually react
in time to prevent unconstrained overspeed and
ensuing results.
2. Such testing generally requires an interruption
of the production process – exactly the opposite
of the aforementioned goals to extend intervals
between outages and production interruptions.
Often, these interruptions are measured in mil-
lions of dollars per day due to the expensive
processes of which the turbomachinery is a part.
Ironically, although industrial insurers generally require
operators to test their overspeed systems at regular
intervals, it is precisely during these tests that many
[Vol.25 No.1 2005] ORBIT 21
A P P L I C A T I O N S
To test or not to test…
This rotor is from a steam turbine
that was completely destroyed with
serious consequences due to an
overspeed situation when its mechanical
bolt did not function properly.The user
had stopped testing the system due to
significant problems with getting the
machine out of overspeed during
previous tests.
Electronic overspeed detection systems
avoid such scenarios by allowing func-
tional testing without the need to change
a machine’s speed.
22 ORBIT [Vol.25 No.1 2005]
machines suffer overspeed damage because the bolt fails
to act properly and the machine enters a runaway
overspeed condition.
Electronic Overspeed Detection
An electronic overspeed detection system does not rely
on mechanical parts or actuation. Instead, speed sensors
observe a rotating toothed wheel on the machine. When
the sensors detect excessive rotative speed, a relay is
actuated which causes the remainder of the overspeed
system to trip the unit.
A properly designed overspeed detection system must
minimize both false trips and missed trips. False trips
represent expensive process interruptions. Missed trips
represent potentially very serious safety and economic
consequences arising from catastrophic machinery failure.
Instrumentation with single-point failure modes cannot
achieve the reliability and availability required by such
applications. For this reason, a triple modular redundant
(TMR) approach is used, whereby three separate sensors
are used as inputs to three separate tachometers, and the
system energized by fully redundant power supplies.
These tachometers then use logic to provide 2-out-of-
3 voting (only when any two sensors/tachometers detect
an overspeed condition will the system initiate a shut-
down). This design ensures that a failure of a single
sensor or tachometer will not cause a shutdown to be
missed or initiated. It also allows users to isolate the
individual channels, simulate suitable speed inputs, and
test the system without physically placing the machine
into an overspeed condition.
A Migration
The above benefits have resulted in a strong migration
of users (and manufacturers), switching from mechan-
ically instigated overspeed shutdown to electronic systems
instead. In addition, a number of industry standards
(such as those from the American Petroleum Institute
and ISO) have undergone revision to reflect electronic
protection systems rather than mechanical bolts. It is
our recommendation that all customers relying on a
mechanical bolt or ring consider replacing these systems
with an electronic detection system. These systems
will generally pay for themselves immediately because
testing their proper operation does not require the
machine to be physically oversped or production to be
interrupted, as already mentioned.
Even when an OPS uses fully electronic ODS tech-
nology, there will generally be mechanical/hydraulic

Figure 4
i Control cabinet showing 2-out-of-3 hydraulic
solenoid valves and manifold used as part of
overspeed protection system
devices within the overall shutdown loop. The proper
operation of these non-electronic devices must also be
assessed at regular intervals. Just as the detection portion
of an overspeed system can employ triple modular redun-
dancy to allow isolation and testing of circuits without
the need for a process interruption, so can other parts
of the OPS benefit from redundancy. Figure 4 shows a
2-out-of-3 arrangement for hydraulic solenoid valves
and the corresponding manifold. Such a design enhances
safety and reliability while simultaneously allowing easier
testing of this critical component within the shutdown
system. Many users now consider such designs to be
“best practice.”
Scope
The scope assumed by the Bently Nevada team in any
overspeed-related project is confined to the Overspeed
Shutdown Detection region of Figure 2. When a project’s
scope includes retrofit of the entire OPS, the Bently Nevada
team works cooperatively with the customer’s choice
of provider which may be an OEM, the end user’s own
engineering personnel, or a third-party selected by the
customer. In other instances, customers may want full
scope to be assumed by GE Energy. In these instances,
the GE Energy Control Solutions team acts as lead con-
A P P L I C A T I O N S
Figure 5
i A turbine rotor undergoing retrofit for an electronic
overspeed protection system. Note mechanical bolt
on left, and existing castellated nut on right which
was chosen as the speed sensing surface.
tractor with overall OPS responsibility, and they sub-
contract the ODS portion to the Bently Nevada team.
Regardless of where responsibility for the overall OPS
lies, the Bently Nevada team must always conduct a
mandator y application review of the elements
affecting the response time and integrity of the ODS,
as discussed next.
ODS Application Audits
An ODS must properly initiate the auto-shutdown
sequence of a machine within the maximum allowable
time delay. If it does not, the result may be catastrophic,
unconstrained overspeed. The ODS solutions delivered
today are based on the Bently Nevada® 3500/53 over-
speed detection tachometer modules. The 3500
system employs a TMR configuration utilizing 2-out-
of-3 voting, and may be ordered with optional TÜV
certification, designating the system as suitable for Safety
Integrity Level (SIL) 3 applications. It has been specif-
ically designed to comply with the guidelines of relevant
functional safety standards such as IEC 61508, IEC
61511, and ANSI/ISA-84.01-1996.
There are many application variables that must be under-
stood and addressed for an ODS to perform properly
and with the necessary response time. It is only by
[Vol.25 No.1 2005] ORBIT 23
A P P L I C A T I O N S

Figure 6 - Partial list of ODS audit points

Audit point Remarks / Options

Machine type Steam turbine Gas turbine Turbo expander

Manufacturer Name __________________ Model # _____________ Power _____________
Driven machine Compressor Generator Other ______________
Stored energy 1 Steam liquid gas Pressure ____________ Volume ____________
S/D System Electronic/electric Control oil Mechanical
S/D Valve Instantaneous Fast Slow
Bypass valve 2
Instantaneous Fast Slow
Speeds Operational _____________ Max continuous _____ Overspeed trip______
Sensor location 3 On driver shaft On driven shaft Other shaft _________
Sensor type Proximity probe Magnetic pick-up
Governor sensor Shared with ODS Separate from ODS
Speed wheel 4
True Gear type Pole wheel Profile/Dimensions
Events/Rev # of Teeth _______________ # of Holes ___________ a___ b___ c___ d___
Notes:
1. Differing media have different stored energy release capability.
2. If fitted (e.g., expanders).
3. ODS Sensor MUST be on the driver unit to properly protect against overspeed in the event of a coupling failure.
A sensor observing a gear immediately driven from the main shaft may be acceptable.
4. Provide wheel dimensions using figures below.

Case One: the observed wheel is a true gear (i.e., it is designed to turn another gear)…

O/Dia. = _______
A = ___________
B = ___________
C = ___________
D = ___________

Case Two: the observed wheel is not a true gear (i.e., it is a toothed wheel designed for a
magnetic pickup or proximity probe)…

O/Dia. = _______
A = ___________
B = ___________
C = ___________
D = ___________

24 ORBIT [Vol.25 No.1 2005]


reviewing each application carefully and collecting
necessary details such as geometries and location of the
speed sensing surface (see Figure 5) that the proper oper-
ation of the ODS can be determined. For example, a
speed sensing surface must provide an adequate number
of pulses per shaft revolution to allow the ODS tachometers
to detect speed changes rapidly enough. Consider a 1500
rpm machine with a single Keyphasor® mark. It takes
40 ms for the machine to complete one revolution,
and multiple revolutions would be required to sense a
change in speed. Clearly, if this machine required the
ODS to respond within 50 ms, the speed sensing surface
would be totally insufficient. As another example, the
speed sensing surface should never be located on an aux-
iliary shaft where there is an intervening gearbox or
coupling that could potentially fail, isolating the speed
sensing surface from the actual machine speed.
Figure 6 shows a portion of the checklist used when con-
ducting a Bently Nevada ODS application audit. Below
are examples of typical actions required as a result of
ODS audit findings.
t A process train in a chemical plant had existing
speed control system sensors observing a portion
of the turbine governor shaft which was coupled
to the main turbine shaft by means of an inter-
vening gearbox. If the gearbox or its couplings
broke, the governor shaft (but not the actual turbine)
would begin to decelerate. The governor would
respond by speeding up the turbine to compensate
for the falling speed observed by the transducers.
To guard against such a failure mode, a different
location was chosen for the ODS sensors, allowing
them to observe the turbine shaft directly rather
than the governor shaft.
t The existing speed sensing surface (i.e., “speed
wheel”) for an ODS on one machine had been
designed for use with a magnetic pick-up. The
customer wanted to retrofit proximity probes in
place of the magnetic pickups. The application audit
revealed that a modified speed wheel would be
required because use of the existing wheel would
have caused the probes to detect three teeth at a time
instead of each individual tooth, resulting in incorrect
and/or intermittent speed measurements.
On rare occasions, a customer will not permit an
application audit to be performed, or will refuse to
implement aspects of the audit that ensure the ODS will
A P P L I C A T I O N S
respond properly. In these cases, a Bently Nevada® ODS
cannot be supplied since the ability to confirm the
suitability of input signals is no longer within our control.
Supplemental Findings
In addition to the mandatory ODS audit conducted,
customers sometimes request that the Bently Nevada
team review the broader OPS rather than confining
the audit to only the ODS. This scope falls outside the
Overspeed Shutdown Detection region in Figure 2.
While it can be provided upon request, and has been
performed in numerous instances, the additional
scope covered by this review is intended merely to sup-
plement – not replace – the review conducted by those
responsible for OPS supply and installation. In no cir-
cumstances does Bently Nevada assume responsibility
for the Overspeed Shutdown Execution portion of the
system. The examples below illustrate typical supple-
mental findings.
t A new high-speed, high-efficiency turbine at a
European facility incorporated several meters of
steam piping between the emergency stop valve
and the turbine. However, this length of piping was
found to contain sufficient volume of pressurized
steam to accelerate the turbine beyond Nos (refer
to Figure 2) even after the emergency stop valve
was closed. A modification to install a rapid-opening
vent valve and duct was recommended, ensuring
that this energy could be quickly released during
a trip rather than expanding through the turbine.
This allowed a sufficient reduction in the overall
response time ∆top to meet the application’s require-
ments.
t One facility had not tested the existing OPS on
their steam turbine for five years. While the plant
was taking measures to install a better OPS solution,
this interval between tests is considered totally unac-
ceptable regardless of what type of system is installed
– electronic or mechanical. Testing and mainte-
nance of the new system was recommended at much
more frequent intervals.
t A review of an OPS project at a large North American
petrochemical facility revealed that while the
proposed ODS solution had been engineered to
respond within 50 ms, the remainder of the system
contained latencies of up to one second (the logic
solver into which the ODS would be fed was not
[Vol.25 No.1 2005] ORBIT 25
A P P L I C A T I O N S
programmed to scan its inputs more than once per
second). This was far in excess of the application’s
requirement for ∆t op ≤ 250 ms and would
require extensive changes to the instrumentation
downstream of the ODS.
A Word About Tachometers
Standard tachometer modules (intended for indi-
cation only, not as part of an ODS) and high-speed
tachometer modules (intended for use as part of an
ODS) are both available as part of the Bently Nevada
product line. The high-speed 3500/53 overspeed
tachometer modules are specifically designed for ODS
applications and can respond to an overspeed event with-
in 40-50 milliseconds when properly applied and
configured. They are designed for use only as part of a
redundant voting configuration.
Customers with limited knowledge of overspeed and its
consequences will sometimes propose as a cost-saving
measure the use of standard indicator tachometer modules.
There are several reasons why we cannot supply our
products for such applications. First, standard indicator
tachometers do not provide the response times necessary
for use in an ODS. Indeed, to help prevent misappli-
cation by customers, these modules have been designed
so that their alarm time delays can be set no faster than
one second – far slower than required by overspeed appli-
cations. Second, these modules are “simplex” and are
not designed to be configured for the modular redundant
voting warranted by the critical nature of overspeed
applications.
Another cost-saving measure that is sometimes proposed
is to use the process control system as part of the over-
speed protection loop. However, numerous pertinent
industry standards, such as American Petroleum Institute
RP 554 (section 3.5) and ANSI/ISA SP84.01, specifically
advise against such practices by calling for a segregation
of basic process control systems from safety-related
shutdown systems, such as overspeed protection. These
standards, and generally accepted engineering practice,
recognize that the very conditions for which safety-
related shutdown systems are installed can be caused
by a failure of the basic process control system. As
such, independent protection systems that are not affected
by process control failures are essential. This is the same
rationale employed in standards such as API 612 that
call for segregating the overspeed protection system from
the machine control system.
26 ORBIT [Vol.25 No.1 2005]
Special Concerns for
Turbo Expanders
Turbo expanders represent special consideration when
reviewing and specifying an OPS. These machines are
used when the process stream pressure must be
reduced prior to its introduction to another process
stage. Expanders can also be employed to re-use the
energy contained in the process to drive compressors,
pumps, or other machines.
On smaller turbo expander/compressor units, the pro-
cess pressures can be significant, and this, coupled
with a low rotor inertia, leads to rapid acceleration in
the case of an inlet duct failure. Protection systems for
these units are required to operate with extremely fast
reaction times to prevent serious mechanical damage.
While API 617 (a widely used industry standard per-
taining to these machines) permits a single-channel
overspeed detection system, it also provides an option
for a 2-out-of-3 system. We strongly recommend that
customers choose the 2-out-of-3 option due to the critical
nature of the measurement and the consequences of
failure. For the reasons discussed above, Bently
Nevada tachometers may not be used in a simplex con-
figuration for any ODS applications.
Large expander units likewise represent special concerns.
On these machines, the pressure inlet duct can be on
the order of one meter in diameter (or greater), and
the associated control valves will be slow to operate.
When designing an OPS for this type of unit, there is
a strong case for installing a small diameter bypass
duct with rapid-action valves. This reduces the inlet
pressure, allowing more rapid shutdown in the event
of overspeed.
Relays
The relays provided from Bently Nevada overspeed
detection systems are generally limited to 5A of current.
When replacing an older overspeed detection system,
it is typical to find that the ODS drives a shutdown relay
with significant current draw. Leaving the old shutdown
relay in place requires the use of interposing relays
with higher current-carrying capacity than the 5A limit
of the Bently Nevada ODS. Rather than using inter-
posing relays, a better approach is generally to replace
the shutdown relay altogether, substituting a newer unit
that has less current draw. These newer relays generally
have much faster switching times. In addition, they can
 A P P L I C A T I O N S

eliminate the need for interposing relays, which intro-
duce their own latencies and add to the overall system
response time.
Speed Sensing Surfaces
An overspeed detection system relies on transducers that
observe a multi-toothed wheel (speed sensing surface).
This toothed wheel is one of the most important aspects
of the ODS and must be engineered properly for the
Figure 7
system to detect speed changes with adequate resolution
and response time. Customers sometimes propose to
use a Keyphasor® mark (one-event-per-revolution dis-
continuity on the shaft) for the ODS. Depending on
machine speed and ODS response times required, a
single event per revolution may or may not be adequate,
as previously discussed. Most commonly, multiple events
per revolution are required, necessitating the use of a
toothed wheel (Fig. 7). The required number of events
per revolution is carefully reviewed as part of the appli-
cation audit. Other important considerations include
the geometry and location of this speed sensing surface.
During one recent ODS project, our design require-
ments for the toothed wheel were – unbeknownst to
us – not implemented by the customer. This led to inter-
mittent false trips and costly loss of production, but
fortunately not a missed trip. The customer has since
replaced the wheel with one conforming to our
recommendations, and no further incidents have occurred.

i View of a new speed wheel installed on the end of
a steam turbine overspeed stub, after replacement
of the mechanical trip system of Figure 1.
Speed Sensors
Another important consideration is the type of speed
sensor. Magnetic pick-ups are often used for the basic
speed control system, and have historically also been
used for the electronic overspeed detection system as
well. A better alternative for most ODS applications is
to use proximity probes as they offer the advantages
summarized in Table 2.

Table 2 – Advantages of proximity probes over magnetic speed pick-ups*

Uniform, speed-independent response to zero speed.

DC gap voltage output, useful not only for establishing proper physical gap from the speed wheel, but also for enhanced transducer and
wiring fault diagnostics.

Much longer linear range. The 80 mil effective linear range of a standard eddy current transducer is far greater than the typical 30 mil non-
linear range of magnetic pickups. This increased range also offers a better physical “buffer” between the sensor tip and the rotating gear
teeth. For machines with over 5 mils of mechanical runout or vibration, maintaining proper clearance can be a problem if magnetic pickups
are used.

Greater bandwidth when using longer cable lengths.

Less susceptibility to EMI (electromagnetic interference).

Interchangeability with vibration, position, and Keyphasor® transducers used elsewhere on the machine, reducing spare part requirements.

* Where the existing magnetic pick-up must be replaced with a similar device due to mechanical or cabling constraints,
we can recommend suitable magnetic sensors to meet the requirements of our system as well as SIL requirements.

[Vol.25 No.1 2005] ORBIT 27

A P P L I C A T I O N S
Figure 8
i Output from proximity probe observing
a toothed wheel at slow-roll speed
(top) and running speed (bottom). In
this example, if slow-roll output is
used to set monitor triggering, running
speed waveform will result in
incorrect triggering.
When using proximity probes for speed measurement,
special attention must be paid to signal characteristics
at operating speeds, not slow-roll speed. While the
tachometers may trigger properly at slow-roll speeds,
it is essential that they also trigger properly at oper-
ating speeds, since these are the speeds at which protective
functions must actuate. As shown in Figure 8, the output
at slow-roll conditions may not always match the output
at operating speeds. The peak-to-peak value of the
waveform may decrease at operating speeds – a function
of transducer slew rate, frequency response, and other
characteristics. In extreme cases, the output amplitude
may drop enough to result in an incorrect number of
teeth being detected, unless the proper threshold/
hysteresis adjustments are made.
Summary
There are significant advantages to the use of elec-
tronic overspeed detection systems when compared to
mechanical systems relying on trip bolts. There are
also significant considerations that must always be
addressed to ensure that both the overspeed detection
system and the larger overspeed protection system will
work properly and within the maximum allowable
response time if an overspeed event occurs. This article
has summarized several of those considerations,
noting common pitfalls that can be encountered and
28 ORBIT [Vol.25 No.1 2005]
explaining the necessity of an application audit prior
to supplying an ODS. This audit addresses only the
ODS portion of the total overspeed protection system.
Users must also exercise good engineering judgement
and practices in the remainder of the OPS, which is
outside the scope addressed by a Bently Nevada over-
speed detection solution.
References
“Application of Safety Instrumented Systems for the Process Industries,”
ANSI/ISA-84.01-1996, First Edition, The Instrumentation, Systems, and
Automation Society, Research Triangle Park, NC (1996)
“Axial and Centrifugal Compressors and Expander-compressors for
Petroleum, Chemical and Gas Industry Services,” API Standard 617, Seventh
Edition, American Petroleum Institute, Washington, D.C. (2002)
“Electronic Overspeed Detection Systems,” ORBIT magazine, Vol. 20 No.
2, Second/Third Quarters 1999, pp. 44-45
“Functional Safety of Electrical/Electronic/Programmable Electronic
Safety-Related Systems,” IEC 61508, First Edition, International Electrotechnical
Commission (IEC), Geneva, Switzerland (1998).
“Functional Safety: Safety Instrumented Systems for the Process Sector,”
IEC 61511, First Edition, International Electrotechnical Commission (IEC),
Geneva, Switzerland (2003).
“Process Instrumentation and Control,” API Recommended Practice 554,
First Edition, American Petroleum Institute, Washington, D.C. (1995)
“Machinery Protection Systems,” API Standard 670, Fourth Edition, American
Petroleum Institute, Washington, D.C. (2000)
“Petroleum, Petrochemical, and Natural Gas Industries – Steam Turbines
– Special-purpose Applications,” API Standard 612, Fifth Edition, American
Petroleum Institute, Washington, D.C. (2003)