An overspeed trip is the last-line protection that shuts a turbine or expander down the instant its speed climbs past a safe limit. On a bladed rotor, speed is not a nuisance parameter, it is a matter of survival: centrifugal stress rises with the square of speed, and a rotor that runs far enough over its rated speed can burst. To guard against that, machines carry a dedicated overspeed system that watches shaft speed through redundant sensors and, on a genuine overspeed, slams shut the valve feeding the driver so the machine coasts to a stop. It is deliberately simple, deliberately fast, and deliberately independent of the normal speed governor.
Overspeed Trip in one line: An overspeed trip is a protective function on turbine and expander drivers that detects when shaft speed exceeds a safe limit and immediately closes the trip-and-throttle valve to cut the driving energy, stopping the machine. Redundant magnetic speed pickups feed a voting electronic overspeed detector so a single sensor fault neither trips the machine spuriously nor blinds the protection. Because overspeed can burst a bladed rotor, the trip is treated as a catastrophic-consequence safety function, independent of the normal governor and integrated with the unit ESD.
The reason overspeed protection exists at all is the physics of a spinning bladed rotor. The centrifugal stress trying to tear the blades and disc apart grows with the square of rotational speed, so a modest percentage over rated speed produces a much larger jump in stress. Push a rotor far enough beyond its design speed and the material simply cannot hold, and the disc or blades let go. A burst turbine or expander wheel is one of the most destructive events in a plant: high-energy fragments can leave the casing, and the consequences to the surrounding equipment and to people can be severe.
Overspeed usually starts with a loss of load. A turbine or expander is a driver pushing against the resistance of the compressor it turns; that load is what holds the speed in check for a given energy input. If the load suddenly disappears, a coupling fails, the driven compressor is unloaded, a downstream trip removes the process resistance, the same energy input now has almost nothing to work against, and the rotor accelerates rapidly. Because the acceleration can be fast, the protection has to be fast too, which is why the overspeed trip is designed to detect and act in a very short time rather than to nudge a governor.
This is also why the overspeed trip is kept independent of the normal speed control. The governor regulates speed in normal operation and is a control function; the overspeed trip is a protection function whose only job is to prevent a burst. Mixing the two would mean a governor fault could disable the very protection meant to back it up. Keeping them separate ensures that even if the speed control system itself fails, the independent overspeed system is still watching and still able to trip.
Modern overspeed protection is electronic and built around redundant magnetic speed pickups. A magnetic pickup sits close to a toothed wheel on the shaft and produces a pulse each time a tooth passes, so the pulse frequency is a direct, robust measure of shaft speed. Several of these pickups are installed, and their signals are fed to an electronic overspeed detection module that continuously computes speed from each channel. Using more than one pickup means the protection does not depend on any single sensor, which is essential for a function this critical.
The channels are combined with voting logic, commonly a two-out-of-three arrangement. In two-out-of-three, the system trips when at least two of the three channels agree that the speed is over the limit. That logic threads the needle between two failure modes that both matter: a single failed or noisy pickup will not, on its own, trip the machine and cause a spurious shutdown, and at the same time a single failed pickup cannot blind the protection, because the other two channels still form a majority. This balance between avoiding nuisance trips and never missing a real overspeed is why voted redundancy is standard on this kind of protection, and it is reflected in the machinery-protection guidance of standards such as API 670.
The electronic module also brings testability, which matters because a protective function that is never exercised is a protective function you cannot trust. Overspeed detectors typically support online testing, where a channel's trip response can be checked, often against an injected or elevated test speed value, without shutting the machine down. Being able to prove the trip still works on a running unit is part of what makes electronic overspeed protection a step up from the older purely mechanical bolt-type trips it has largely replaced.
Detecting overspeed is only useful if there is a fast, reliable way to remove the driving energy, and that is the trip-and-throttle valve. On a steam turbine it is the valve admitting steam to the machine; on an expander or a gas turbine it is the equivalent element controlling the driving flow or fuel. In normal operation it can throttle to help control the machine, but its critical duty is to slam fully shut on a trip. When the overspeed system trips, it de-energizes or dumps the valve's holding pressure and the valve closes hard, cutting off the energy source so the rotor decelerates and coasts down.
The valve is engineered to fail safe, meaning it closes on loss of its actuating signal or pressure rather than needing a positive command to shut. That way a failure in the trip circuit, a lost signal, a dropped supply, tends to trip the machine to a safe state rather than leave it running unprotected. The valve and its actuator are sized to close quickly, because the whole detect-and-close chain has to complete before the rotor climbs from the trip setpoint to a genuinely dangerous speed. Speed of closure is a design parameter, not an afterthought.
Around the valve sits the rest of the trip path: solenoid trip valves, the trip header, and the logic that ties the overspeed signal to the valve's holding pressure. This chain is what the overspeed detector actually commands, and its integrity is tested along with the detector. The goal of the whole arrangement is unambiguous: when speed goes over the limit, the driving energy is cut off decisively and the machine is brought to a stop before the rotor can be endangered.
An overspeed trip rarely happens in isolation; it is woven into the unit's emergency shutdown scheme. When the overspeed system trips the driver, that same event typically initiates a broader ESD sequence, isolating the machine, actioning anti-surge and blowdown as required, and putting the whole train into a safe state. Conversely, other ESD causes will also close the trip valve. This integration ensures the overspeed trip is not a lonely function but part of a coordinated response, and it is a core reason overspeed protection is engineered to the same rigor as the rest of the safety system.
For after-the-fact understanding, the sequence of events matters enormously, and this is where the SCADA event log and historian come in. When a trip occurs, engineers need to reconstruct exactly what happened and in what order: did the load loss come first, how fast did the speed rise, at what value did the overspeed detector act, and did the valve close in time. A time-stamped event log that captures the speed trace, the trip initiation, and the valve response turns a violent, split-second event into an analyzable record. Without that record, diagnosing why a trip happened, or confirming the protection performed as intended, is guesswork.
A cloud SCADA platform contributes on the monitoring and record-keeping side rather than the fast trip logic, which properly lives in the dedicated hardwired protection system. By historizing shaft speed, valve position, and trip status from the machine, a platform such as Merobix gives a remote or unmanned station a durable, time-stamped account of every trip and near-trip, and lets engineers trend speed behavior and confirm periodic overspeed tests were carried out. The trip itself is safeguarded in hardware; the visibility, the alarming, and the event record that let a team learn from each event are what the monitoring layer adds.
The governor is a control function that regulates speed during normal operation, adjusting the driving energy to hold the machine at its setpoint. The overspeed trip is a separate protection function whose only job is to shut the machine down if speed exceeds a safe limit. They are kept deliberately independent so that a fault in the governor cannot disable the overspeed protection meant to back it up. The governor manages speed; the trip prevents a burst.
Two-out-of-three voting balances two competing needs. It requires at least two of three speed channels to agree before tripping, so a single failed or noisy pickup will not cause a spurious shutdown. At the same time, a single failed pickup cannot blind the protection, because the other two channels still form a majority and can still trip on a real overspeed. This makes the protection both dependable and resistant to nuisance trips, which is why voted redundancy is standard for critical machinery.
It cuts off the energy driving the machine. When the overspeed system detects excess speed, it de-energizes or dumps the valve's holding pressure and the valve slams fully shut, stopping steam, driving gas, or fuel from reaching the driver so the rotor decelerates. The valve is designed to fail closed on loss of signal and to close quickly, because the whole detection-and-closure chain must complete before the rotor reaches a dangerous speed.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.