Sie sind auf Seite 1von 13

Barry Nurcombe, C.Eng.

Sr. Engineer, Bently Nevada® Applications Design

Original Equipment Manufacturers (OEMs) are generally well-versed in the
ramifications of overspeed as well as the numerous considerations inherent in a
properly engineered overspeed protection system. This is with good reason: they
supply such systems with their new machines and can often assist in retrofitting
existing machines in the field. The same level of understanding, however, does
not always exist with end users. This article is written primarily for the benefit
of end users and acts as a tutorial on basic overspeed concepts, focusing on retrofit
considerations and recommendations. The article also summarizes the economic
implications, safety considerations, and industry trends that are leading many
end users to replace mechanical overspeed detection apparatus with electronic
systems. Finally, the article provides a number of practical observations made by
the author over the last 15 years during projects applying and installing such
systems that will assist users who are in the midst of – or considering – an
upgrade to their older overspeed systems.

[Vol.25 No.1 2005] ORBIT 17


What is overspeed?
Some of the strongest forces acting on most turbo- rated maximum operating speed, they are not designed
machinery are the centrifugal forces exerted when masses for sustained operation at such speeds and overspeed
are set into rotational motion. A simplified equation for protection systems are supplied for this reason. It is
this force, assuming a constant speed of rotation, is assumed by the manufacturer that the machine will
shown in Figure 1. not operate above the rated maximum except under two
The centrifugal forces are the outward-directed forces conditions:
caused by spinning the rotating masses that comprise 1. Deliberate testing of the machine’s speed control
the rotor, while the centripetal forces are the equal and and overspeed protection systems;
opposite restraining forces provided by the rotor that 2. A mechanical or control system failure resulting
keep blades, windings, and other components from in an overspeed condition.
“breaking free” while they rotate. By spinning a rotor Even during these conditions, the maximum speed
faster, the centrifugal forces generated by these masses achieved by the machine must be constrained and the
will continue to increase, and the corresponding cen- duration of the elevated speed kept relatively short. The
tripetal “restoring” forces increase in an equal and opposite manufacturer will generally have data for “yield speed”
fashion. As can be seen from the equation in Figure 1, and “burst speed.” Yield speed is the speed at which
these forces increase with the square of the rotative speed, rotor components will be deformed or compromised
meaning changes in speed have a magnified effect in the through excessive stress induced by the overspeed con-
forces generated (e.g., a 50% increase in speed results dition. Burst speed is the speed at which the machine
in a 225% increase in force). At some point, these forces is expected to fail catastrophically. As a machine and
will exceed the limits of the rotor’s design. Yield points its components wear, these speeds may change.
of materials will be reached and the rotor will be damaged. Clearly, a machine should never be allowed to approach
It may even fail entirely, potentially with catastrophic its theoretical burst speed. Additionally, if a machine
results. In some circumstances, an overspeed event in a ever exceeds the yield speed, an inspection is in order.
machine will cause blades – and even the entire rotor – Consequently, overspeed protection systems should be
to exit the machine casing, allowing the release of not set to keep the machine from exceeding its yield speed,
only high-velocity, high-energy projectiles, but also allowing it to be safely restarted if overspeed does occur,
steam and other process fluids. The severity of economic rather than necessitating an inspection. A “peak hold”
and safety consequences arising from such failures are mechanism for capturing the maximum speed achieved
obvious. during an overspeed event is very helpful in this regard
While machines are engineered with a safety margin and, for this reason, is a standard feature on Bently Nevada
that allows them to tolerate brief excursions above the overspeed detection tachometers.

Figure 1 – Centrifugal and centripetal forces on a rotating mass in equilibrium

m F Fcf = Fcp = mrω2

WHERE Fcf = centrifugal force
Fcp = centripetal force
m = mass of rotating object
r = radius of mass m from center (axis)
of rotation
ω = rotative speed

18 ORBIT [Vol.25 No.1 2005]


Figure 2 – Overspeed shutdown map

Not To Scale

Maximum Temporary Overshoot Speed Nos

Overspeed Trip Speed Nost
Maximum Continuous Operating Speed Nmc

∆tod Overspeed Detection Response Time

∆toe Overspeed Execution Response Time TIME

∆tod ∆toe
∆top Total Overspeed Protection System Response Time

As a rough rule-of-thumb, most overspeed protection each system, and in understanding the scope of
systems are set to keep the machine from ever exceeding responsibility assumed by the suppliers of each system.
approximately 120% of the rated maximum operating
t An Overspeed Protection System (OPS) is the
speed. The actual value may be higher or lower than
complete electro-mechanical system (hydro-
120% and must be established by consulting the man-
mechanical or electro-pneumatic) that senses the
ufacturer along with pertinent industry machinery
standards (e.g., API 612) that the user may wish to apply. onset of an overspeed condition and automatically
shuts the unit down by closing (or opening) valves,
Although overspeed can occur gradually (such as when solenoids, and other devices necessary to bring the
a speed control system fails and the speed slowly creeps unit to a safe halt.
upward), it is more common for overspeed to occur very
quickly (just a few hundred milliseconds) because the t An Overspeed Detection System (ODS) is one part
forces acting on a machine can change very quickly. of the larger OPS. It is responsible only for sensing
For example, consider a steam turbine driving a gen- the onset of overspeed and providing a signal suitable
erator whose breakers suddenly open: the turbine will for triggering the rest of the OPS, which then
see an instantaneous loss of load. As another example, removes energy from the machine and brings it to
consider a gas turbine driving a pipeline compressor a safe halt. The ODS supplies this signal in the
whose coupling suddenly shears: this turbine will likewise form of activation of one or more electrical relays.
see an instantaneous loss of load, accelerating it within
a fraction of a second to 120% overspeed. Speed control The Overspeed Map
systems may not react to these kinds of sudden over- The time required to detect an overspeed condition and
speed conditions; the overspeed protection system must then shut the machine down must be factored into the
instead be relied upon to trip the unit. design of the OPS. As shown in Figure 2, the maximum
speed ever reached by the machine is Nos, the Maximum
Terminology Temporary Overshoot Speed. For reasons previously
The words “detection” and “protection” are not used discussed, this speed must be less than the yield speed
interchangeably in this article with respect to overspeed of the machine and should be determined through con-
systems. The distinction is important both in terms of sultation with the machine OEM and consideration of
understanding the primary purpose and function of relevant industry standards. To account for the time to

[Vol.25 No.1 2005] ORBIT 19


detect an overspeed condition and then execute the The detection time is the latency for the overspeed
various steps necessary to trip the unit, the Overspeed detection system to detect the onset of overspeed and
Trip Speed (Nost) is set at a lower level than Nos. Nost generate a shutdown signal; the execution time is the
is generally set as low as possible to provide maximum latency for the remainder of the overspeed protection
time for the overspeed protection system to respond, system to act on this signal. Table 1 summarizes typical
but without being set so low that normal speed fluctu- values for ∆top, ∆tod, and ∆toe along with some of the
ations about the machine’s maximum continuous operating items that would normally contribute to these
speed N mc will trigger a false overspeed alarm and latencies in a typical system consisting of a fully elec-
shutdown. tronic overspeed detection system and an electro-hydraulic
As an example, American Petroleum Institute Standard shutdown system. As shown in the table, a typical appli-
612 (pertains to Special-Purpose Steam Turbines) uses cation will require a total OPS response time of between
the following values: 140 and 250 ms. ODS response time will generally be
50 ms or less (API 670 requires that ODS tachometers
t Nost is 10% above Nmc be capable of responding within 40 ms when an input
signal of 300 Hz or greater is present).
t Nos is 10% above Nost (i.e., 21% above Nmc).
Thus, an overspeed protection system designed to comply The Economics of Overspeed
with API 612 must begin to act when turbine speed Shutdown Events
reaches 110% of maximum continuous operating speed With many operators striving to achieve an absolute
and keep the machine from ever exceeding 121% of minimum of process interruptions, whether caused by
maximum continuous operating speed. machinery failures or any other factors, traditional
overhaul and maintenance intervals are being extended
Reaction Times whenever possible. While this is being achieved suc-
It is useful to think of the total time ∆top required for cessfully for many machines through appropriate condition
the overspeed protection system to act as being com- monitoring and asset management strategies, it is never
posed of two parts: The detection time ∆tod and the advisable to delay routine maintenance and inspections
execution time ∆toe where of safety-related systems, such as overspeed protection.
As will be discussed next, fewer process interruptions
∆top = ∆tod + ∆toe.
and enhanced safety are not mutually exclusive. Through

Table 1 – Overspeed protection system response times and factors

TOTA L OV E R S P E E D P R OT E C T I O N R E S P O N S E T I M E ( ∆ t o p )


( TY P I C A L LY 4 0 - 5 0 m s )

Time for multi-tooth speed wheel to generate sufficient pulses to measure speed change accurately
Time to compare speed inputs against alarm setpoints
Time to vote multiple channels against one another in 2-out-of-3 system
( TY P I C A L LY 1 4 0 – 2 5 0 m s )

Time for alarm signal to be transmitted to relay contact circuitry

“Bounce” time for relay contacts to settle fully opened or closed

Input scan times for logic solvers or other safety instrumented systems

( TY P I C A L LY 10 0 – 2 0 0 m s )

Hydraulic system latencies

Solenoid actuation latencies
Valve latencies
Time for entrained energy downstream of trip valve to fully discharge through machine
Interposing relay latencies and “bounce” time for contacts to settle fully open or closed

20 ORBIT [Vol.25 No.1 2005]


Figure 3 - A typical trip ring relying on a spring-loaded bolt

the use of electronic overspeed detection systems, rather to a delay in the instigation of the overspeed shutdown
than older mechanical “trip bolts,” reliability and safety process. In other cases, the shutdown system will com-
can be significantly enhanced while eliminating the need pletely fail to act.
for costly process interruptions required to test and verify To help ensure such systems continue to work properly,
the overspeed detection circuity. it is necessary to carry out an overspeed test at regular
intervals. However, such testing can be potentially dan-
Mechanical Overspeed Devices gerous and is frequently very expensive for the following
Mechanical overspeed devices, such as trip bolts or trip reasons:
rings (which contain internal trip bolts), utilize moving
parts. These bolts or rings are fixed to the rotor and 1. To test the system, the machine must be phys-
rotate with it. Under an overspeed condition, the cen- ically oversped. If the bolt fails to operate during
trifugal force of the rotating bolt causes it to move radially the test, it may be difficult to manually react
outward against preset spring forces. At a pre-designed in time to prevent unconstrained overspeed and
speed, the bolt is designed to overcome these spring ensuing results.
forces and pop outward, far enough to strike trip 2. Such testing generally requires an interruption
levers. These levers are normally latched in place, but of the production process – exactly the opposite
are released by the impact of the trip bolt/ring striking of the aforementioned goals to extend intervals
the trip lever surface. In turn, these levers are connected between outages and production interruptions.
to valves and linkages that commence the unit shutdown Often, these interruptions are measured in mil-
process. Figure 3 shows a typical trip ring from a steam lions of dollars per day due to the expensive
turbine. processes of which the turbomachinery is a part.
Unfortunately, these mechanical trip bolts can become Ironically, although industrial insurers generally require
stuck by the ‘gelling’ or ‘lacquering’ of the sur- operators to test their overspeed systems at regular
rounding lubricating oil. At minimum, this gives rise intervals, it is precisely during these tests that many

[Vol.25 No.1 2005] ORBIT 21


machines suffer overspeed damage because the bolt fails

To test or not to test… to act properly and the machine enters a runaway
overspeed condition.

Electronic Overspeed Detection

An electronic overspeed detection system does not rely
on mechanical parts or actuation. Instead, speed sensors
observe a rotating toothed wheel on the machine. When
the sensors detect excessive rotative speed, a relay is
actuated which causes the remainder of the overspeed
system to trip the unit.
A properly designed overspeed detection system must
minimize both false trips and missed trips. False trips
represent expensive process interruptions. Missed trips
represent potentially very serious safety and economic
consequences arising from catastrophic machinery failure.
Instrumentation with single-point failure modes cannot
achieve the reliability and availability required by such
applications. For this reason, a triple modular redundant
(TMR) approach is used, whereby three separate sensors
are used as inputs to three separate tachometers, and the
system energized by fully redundant power supplies.
These tachometers then use logic to provide 2-out-of-
3 voting (only when any two sensors/tachometers detect
This rotor is from a steam turbine an overspeed condition will the system initiate a shut-
down). This design ensures that a failure of a single
that was completely destroyed with sensor or tachometer will not cause a shutdown to be
serious consequences due to an missed or initiated. It also allows users to isolate the
individual channels, simulate suitable speed inputs, and
overspeed situation when its mechanical test the system without physically placing the machine
into an overspeed condition.
bolt did not function properly.The user
A Migration
had stopped testing the system due to The above benefits have resulted in a strong migration
of users (and manufacturers), switching from mechan-
significant problems with getting the
ically instigated overspeed shutdown to electronic systems
machine out of overspeed during instead. In addition, a number of industry standards
(such as those from the American Petroleum Institute
previous tests. and ISO) have undergone revision to reflect electronic
protection systems rather than mechanical bolts. It is
Electronic overspeed detection systems our recommendation that all customers relying on a
mechanical bolt or ring consider replacing these systems
avoid such scenarios by allowing func- with an electronic detection system. These systems
will generally pay for themselves immediately because
tional testing without the need to change testing their proper operation does not require the
machine to be physically oversped or production to be
a machine’s speed.
interrupted, as already mentioned.
Even when an OPS uses fully electronic ODS tech-
nology, there will generally be mechanical/hydraulic

22 ORBIT [Vol.25 No.1 2005]


Figure 4 Figure 5

i Control cabinet showing 2-out-of-3 hydraulic i A turbine rotor undergoing retrofit for an electronic
overspeed protection system. Note mechanical bolt
solenoid valves and manifold used as part of
on left, and existing castellated nut on right which
overspeed protection system
was chosen as the speed sensing surface.

devices within the overall shutdown loop. The proper tractor with overall OPS responsibility, and they sub-
operation of these non-electronic devices must also be contract the ODS portion to the Bently Nevada team.
assessed at regular intervals. Just as the detection portion Regardless of where responsibility for the overall OPS
of an overspeed system can employ triple modular redun- lies, the Bently Nevada team must always conduct a
dancy to allow isolation and testing of circuits without mandator y application review of the elements
the need for a process interruption, so can other parts affecting the response time and integrity of the ODS,
of the OPS benefit from redundancy. Figure 4 shows a as discussed next.
2-out-of-3 arrangement for hydraulic solenoid valves
and the corresponding manifold. Such a design enhances ODS Application Audits
safety and reliability while simultaneously allowing easier An ODS must properly initiate the auto-shutdown
testing of this critical component within the shutdown sequence of a machine within the maximum allowable
system. Many users now consider such designs to be time delay. If it does not, the result may be catastrophic,
“best practice.” unconstrained overspeed. The ODS solutions delivered
today are based on the Bently Nevada® 3500/53 over-
Scope speed detection tachometer modules. The 3500
The scope assumed by the Bently Nevada team in any system employs a TMR configuration utilizing 2-out-
overspeed-related project is confined to the Overspeed of-3 voting, and may be ordered with optional TÜV
Shutdown Detection region of Figure 2. When a project’s certification, designating the system as suitable for Safety
scope includes retrofit of the entire OPS, the Bently Nevada Integrity Level (SIL) 3 applications. It has been specif-
team works cooperatively with the customer’s choice ically designed to comply with the guidelines of relevant
of provider which may be an OEM, the end user’s own functional safety standards such as IEC 61508, IEC
engineering personnel, or a third-party selected by the 61511, and ANSI/ISA-84.01-1996.
customer. In other instances, customers may want full There are many application variables that must be under-
scope to be assumed by GE Energy. In these instances, stood and addressed for an ODS to perform properly
the GE Energy Control Solutions team acts as lead con- and with the necessary response time. It is only by

[Vol.25 No.1 2005] ORBIT 23


Figure 6 - Partial list of ODS audit points

Audit point Remarks / Options

Machine type Steam turbine Gas turbine Turbo expander

Manufacturer Name __________________ Model # _____________ Power _____________
Driven machine Compressor Generator Other ______________
Stored energy 1 Steam liquid gas Pressure ____________ Volume ____________
S/D System Electronic/electric Control oil Mechanical
S/D Valve Instantaneous Fast Slow
Bypass valve 2
Instantaneous Fast Slow
Speeds Operational _____________ Max continuous _____ Overspeed trip______
Sensor location 3 On driver shaft On driven shaft Other shaft _________
Sensor type Proximity probe Magnetic pick-up
Governor sensor Shared with ODS Separate from ODS
Speed wheel 4
True Gear type Pole wheel Profile/Dimensions
Events/Rev # of Teeth _______________ # of Holes ___________ a___ b___ c___ d___
1. Differing media have different stored energy release capability.
2. If fitted (e.g., expanders).
3. ODS Sensor MUST be on the driver unit to properly protect against overspeed in the event of a coupling failure.
A sensor observing a gear immediately driven from the main shaft may be acceptable.
4. Provide wheel dimensions using figures below.

Case One: the observed wheel is a true gear (i.e., it is designed to turn another gear)…

O/Dia. = _______
A = ___________
B = ___________
C = ___________
D = ___________

Case Two: the observed wheel is not a true gear (i.e., it is a toothed wheel designed for a
magnetic pickup or proximity probe)…

O/Dia. = _______
A = ___________
B = ___________
C = ___________
D = ___________

24 ORBIT [Vol.25 No.1 2005]


reviewing each application carefully and collecting respond properly. In these cases, a Bently Nevada® ODS
necessary details such as geometries and location of the cannot be supplied since the ability to confirm the
speed sensing surface (see Figure 5) that the proper oper- suitability of input signals is no longer within our control.
ation of the ODS can be determined. For example, a
speed sensing surface must provide an adequate number Supplemental Findings
of pulses per shaft revolution to allow the ODS tachometers In addition to the mandatory ODS audit conducted,
to detect speed changes rapidly enough. Consider a 1500 customers sometimes request that the Bently Nevada
rpm machine with a single Keyphasor® mark. It takes team review the broader OPS rather than confining
40 ms for the machine to complete one revolution, the audit to only the ODS. This scope falls outside the
and multiple revolutions would be required to sense a Overspeed Shutdown Detection region in Figure 2.
change in speed. Clearly, if this machine required the While it can be provided upon request, and has been
ODS to respond within 50 ms, the speed sensing surface performed in numerous instances, the additional
would be totally insufficient. As another example, the scope covered by this review is intended merely to sup-
speed sensing surface should never be located on an aux- plement – not replace – the review conducted by those
iliary shaft where there is an intervening gearbox or responsible for OPS supply and installation. In no cir-
coupling that could potentially fail, isolating the speed cumstances does Bently Nevada assume responsibility
sensing surface from the actual machine speed. for the Overspeed Shutdown Execution portion of the
Figure 6 shows a portion of the checklist used when con- system. The examples below illustrate typical supple-
ducting a Bently Nevada ODS application audit. Below mental findings.
are examples of typical actions required as a result of t A new high-speed, high-efficiency turbine at a
ODS audit findings. European facility incorporated several meters of
t A process train in a chemical plant had existing steam piping between the emergency stop valve
speed control system sensors observing a portion and the turbine. However, this length of piping was
of the turbine governor shaft which was coupled found to contain sufficient volume of pressurized
to the main turbine shaft by means of an inter- steam to accelerate the turbine beyond Nos (refer
vening gearbox. If the gearbox or its couplings to Figure 2) even after the emergency stop valve
broke, the governor shaft (but not the actual turbine) was closed. A modification to install a rapid-opening
would begin to decelerate. The governor would vent valve and duct was recommended, ensuring
respond by speeding up the turbine to compensate that this energy could be quickly released during
for the falling speed observed by the transducers. a trip rather than expanding through the turbine.
To guard against such a failure mode, a different This allowed a sufficient reduction in the overall
location was chosen for the ODS sensors, allowing response time ∆top to meet the application’s require-
them to observe the turbine shaft directly rather ments.
than the governor shaft. t One facility had not tested the existing OPS on
t The existing speed sensing surface (i.e., “speed their steam turbine for five years. While the plant
wheel”) for an ODS on one machine had been was taking measures to install a better OPS solution,
designed for use with a magnetic pick-up. The this interval between tests is considered totally unac-
customer wanted to retrofit proximity probes in ceptable regardless of what type of system is installed
place of the magnetic pickups. The application audit – electronic or mechanical. Testing and mainte-
revealed that a modified speed wheel would be nance of the new system was recommended at much
required because use of the existing wheel would more frequent intervals.
have caused the probes to detect three teeth at a time t A review of an OPS project at a large North American
instead of each individual tooth, resulting in incorrect petrochemical facility revealed that while the
and/or intermittent speed measurements. proposed ODS solution had been engineered to
On rare occasions, a customer will not permit an respond within 50 ms, the remainder of the system
application audit to be performed, or will refuse to contained latencies of up to one second (the logic
implement aspects of the audit that ensure the ODS will solver into which the ODS would be fed was not

[Vol.25 No.1 2005] ORBIT 25


programmed to scan its inputs more than once per Special Concerns for
second). This was far in excess of the application’s
Turbo Expanders
requirement for ∆t op ≤ 250 ms and would
require extensive changes to the instrumentation Turbo expanders represent special consideration when
downstream of the ODS. reviewing and specifying an OPS. These machines are
used when the process stream pressure must be
A Word About Tachometers reduced prior to its introduction to another process
Standard tachometer modules (intended for indi- stage. Expanders can also be employed to re-use the
cation only, not as part of an ODS) and high-speed energy contained in the process to drive compressors,
tachometer modules (intended for use as part of an pumps, or other machines.
ODS) are both available as part of the Bently Nevada On smaller turbo expander/compressor units, the pro-
product line. The high-speed 3500/53 overspeed cess pressures can be significant, and this, coupled
tachometer modules are specifically designed for ODS with a low rotor inertia, leads to rapid acceleration in
applications and can respond to an overspeed event with- the case of an inlet duct failure. Protection systems for
in 40-50 milliseconds when properly applied and these units are required to operate with extremely fast
configured. They are designed for use only as part of a reaction times to prevent serious mechanical damage.
redundant voting configuration. While API 617 (a widely used industry standard per-
Customers with limited knowledge of overspeed and its taining to these machines) permits a single-channel
consequences will sometimes propose as a cost-saving overspeed detection system, it also provides an option
measure the use of standard indicator tachometer modules. for a 2-out-of-3 system. We strongly recommend that
There are several reasons why we cannot supply our customers choose the 2-out-of-3 option due to the critical
products for such applications. First, standard indicator nature of the measurement and the consequences of
tachometers do not provide the response times necessary failure. For the reasons discussed above, Bently
for use in an ODS. Indeed, to help prevent misappli- Nevada tachometers may not be used in a simplex con-
cation by customers, these modules have been designed figuration for any ODS applications.
so that their alarm time delays can be set no faster than Large expander units likewise represent special concerns.
one second – far slower than required by overspeed appli- On these machines, the pressure inlet duct can be on
cations. Second, these modules are “simplex” and are the order of one meter in diameter (or greater), and
not designed to be configured for the modular redundant the associated control valves will be slow to operate.
voting warranted by the critical nature of overspeed When designing an OPS for this type of unit, there is
applications. a strong case for installing a small diameter bypass
Another cost-saving measure that is sometimes proposed duct with rapid-action valves. This reduces the inlet
is to use the process control system as part of the over- pressure, allowing more rapid shutdown in the event
speed protection loop. However, numerous pertinent of overspeed.
industry standards, such as American Petroleum Institute
RP 554 (section 3.5) and ANSI/ISA SP84.01, specifically
advise against such practices by calling for a segregation The relays provided from Bently Nevada overspeed
of basic process control systems from safety-related detection systems are generally limited to 5A of current.
shutdown systems, such as overspeed protection. These When replacing an older overspeed detection system,
standards, and generally accepted engineering practice, it is typical to find that the ODS drives a shutdown relay
recognize that the very conditions for which safety- with significant current draw. Leaving the old shutdown
related shutdown systems are installed can be caused relay in place requires the use of interposing relays
by a failure of the basic process control system. As with higher current-carrying capacity than the 5A limit
such, independent protection systems that are not affected of the Bently Nevada ODS. Rather than using inter-
by process control failures are essential. This is the same posing relays, a better approach is generally to replace
rationale employed in standards such as API 612 that the shutdown relay altogether, substituting a newer unit
call for segregating the overspeed protection system from that has less current draw. These newer relays generally
the machine control system. have much faster switching times. In addition, they can

26 ORBIT [Vol.25 No.1 2005]


eliminate the need for interposing relays, which intro- system to detect speed changes with adequate resolution
duce their own latencies and add to the overall system and response time. Customers sometimes propose to
response time. use a Keyphasor® mark (one-event-per-revolution dis-
continuity on the shaft) for the ODS. Depending on
Speed Sensing Surfaces machine speed and ODS response times required, a
An overspeed detection system relies on transducers that single event per revolution may or may not be adequate,
observe a multi-toothed wheel (speed sensing surface). as previously discussed. Most commonly, multiple events
This toothed wheel is one of the most important aspects per revolution are required, necessitating the use of a
of the ODS and must be engineered properly for the toothed wheel (Fig. 7). The required number of events
per revolution is carefully reviewed as part of the appli-
cation audit. Other important considerations include
the geometry and location of this speed sensing surface.
Figure 7
During one recent ODS project, our design require-
ments for the toothed wheel were – unbeknownst to
us – not implemented by the customer. This led to inter-
mittent false trips and costly loss of production, but
fortunately not a missed trip. The customer has since
replaced the wheel with one conforming to our
recommendations, and no further incidents have occurred.

Speed Sensors
Another important consideration is the type of speed
sensor. Magnetic pick-ups are often used for the basic
speed control system, and have historically also been
used for the electronic overspeed detection system as
i View of a new speed wheel installed on the end of well. A better alternative for most ODS applications is
a steam turbine overspeed stub, after replacement to use proximity probes as they offer the advantages
of the mechanical trip system of Figure 1.
summarized in Table 2.

Table 2 – Advantages of proximity probes over magnetic speed pick-ups*

Uniform, speed-independent response to zero speed.

DC gap voltage output, useful not only for establishing proper physical gap from the speed wheel, but also for enhanced transducer and
wiring fault diagnostics.

Much longer linear range. The 80 mil effective linear range of a standard eddy current transducer is far greater than the typical 30 mil non-
linear range of magnetic pickups. This increased range also offers a better physical “buffer” between the sensor tip and the rotating gear
teeth. For machines with over 5 mils of mechanical runout or vibration, maintaining proper clearance can be a problem if magnetic pickups
are used.

Greater bandwidth when using longer cable lengths.

Less susceptibility to EMI (electromagnetic interference).

Interchangeability with vibration, position, and Keyphasor® transducers used elsewhere on the machine, reducing spare part requirements.

* Where the existing magnetic pick-up must be replaced with a similar device due to mechanical or cabling constraints,
we can recommend suitable magnetic sensors to meet the requirements of our system as well as SIL requirements.

[Vol.25 No.1 2005] ORBIT 27


Figure 8

i Output from proximity probe observing

a toothed wheel at slow-roll speed
(top) and running speed (bottom). In
this example, if slow-roll output is
used to set monitor triggering, running
speed waveform will result in
incorrect triggering.

When using proximity probes for speed measurement, explaining the necessity of an application audit prior
special attention must be paid to signal characteristics to supplying an ODS. This audit addresses only the
at operating speeds, not slow-roll speed. While the ODS portion of the total overspeed protection system.
tachometers may trigger properly at slow-roll speeds, Users must also exercise good engineering judgement
it is essential that they also trigger properly at oper- and practices in the remainder of the OPS, which is
ating speeds, since these are the speeds at which protective outside the scope addressed by a Bently Nevada over-
functions must actuate. As shown in Figure 8, the output speed detection solution.
at slow-roll conditions may not always match the output
at operating speeds. The peak-to-peak value of the References
waveform may decrease at operating speeds – a function “Application of Safety Instrumented Systems for the Process Industries,”
of transducer slew rate, frequency response, and other ANSI/ISA-84.01-1996, First Edition, The Instrumentation, Systems, and
Automation Society, Research Triangle Park, NC (1996)
characteristics. In extreme cases, the output amplitude
“Axial and Centrifugal Compressors and Expander-compressors for
may drop enough to result in an incorrect number of Petroleum, Chemical and Gas Industry Services,” API Standard 617, Seventh
teeth being detected, unless the proper threshold/ Edition, American Petroleum Institute, Washington, D.C. (2002)
hysteresis adjustments are made. “Electronic Overspeed Detection Systems,” ORBIT magazine, Vol. 20 No.
2, Second/Third Quarters 1999, pp. 44-45
Summary “Functional Safety of Electrical/Electronic/Programmable Electronic
There are significant advantages to the use of elec- Safety-Related Systems,” IEC 61508, First Edition, International Electrotechnical
Commission (IEC), Geneva, Switzerland (1998).
tronic overspeed detection systems when compared to
“Functional Safety: Safety Instrumented Systems for the Process Sector,”
mechanical systems relying on trip bolts. There are IEC 61511, First Edition, International Electrotechnical Commission (IEC),
also significant considerations that must always be Geneva, Switzerland (2003).
addressed to ensure that both the overspeed detection “Process Instrumentation and Control,” API Recommended Practice 554,
system and the larger overspeed protection system will First Edition, American Petroleum Institute, Washington, D.C. (1995)

work properly and within the maximum allowable “Machinery Protection Systems,” API Standard 670, Fourth Edition, American
Petroleum Institute, Washington, D.C. (2000)
response time if an overspeed event occurs. This article
“Petroleum, Petrochemical, and Natural Gas Industries – Steam Turbines
has summarized several of those considerations, – Special-purpose Applications,” API Standard 612, Fifth Edition, American
noting common pitfalls that can be encountered and Petroleum Institute, Washington, D.C. (2003)

28 ORBIT [Vol.25 No.1 2005]