Steam Turbine Governors and Overspeed Protection: How Speed Control Works and How to Test It

A steam turbine has two systems that deal with speed, and they are easy to confuse. The governor controls speed and load in normal operation, adjusting steam flow continuously to hold the setpoint. The overspeed protection system does one thing only: if speed passes a set limit, it shuts off the steam, whatever the governor thinks. The first keeps the machine productive. The second keeps it in one piece.

Serious overspeed events usually need both to fail at once, and the most common reason is the least dramatic one: a valve that did not close because it was stuck.

What the Governor Does

The governor measures shaft speed, compares it with a setpoint, and moves the steam admission valves to correct the difference. On a generator set, speed is frequency, so the governor is also the frequency and load controller. On a mechanical drive turbine running a pump or compressor, it usually takes its setpoint from the process.

The important choice in governor behaviour is between droop and isochronous control.

Droop. The speed setpoint falls slightly as load rises. A set with 4 percent droop that runs at rated speed at full load would settle at 104 percent speed if all the load were removed, which on a 50 Hz system is a 2 Hz swing across the load range. Droop lets several sets share load stably, and it is the normal mode for a set connected to a grid. The grid fixes the frequency, so on a grid the governor setpoint effectively becomes a load setpoint.

Isochronous. Speed is held at the setpoint regardless of load. This is right for a single set supplying an isolated island, where that set alone decides the frequency. Two isochronous sets in parallel without a load sharing link will fight each other, and an isochronous set on a strong grid will try to correct the grid's frequency on its own, driving itself towards full or zero load. On an islanded plant with several sets, the usual arrangements are one set isochronous with the rest in droop, or all sets isochronous with electronic load sharing between them.

Plants that move between grid connected and island operation need a governor that changes mode cleanly when the tie breaker opens. Getting that transition wrong is a familiar way to lose the whole plant on a grid disturbance.

The two governor modes and where each belongs. On a grid the frequency is fixed, so the droop setpoint becomes a load setpoint. Source: MIMAH engineering practice.

Mechanical-Hydraulic and Electronic Governors

Older turbines, and many small ones still in service, use mechanical-hydraulic governors. Flyweights on a spindle driven from the turbine shaft swing outwards as speed rises and position a pilot valve, which directs oil to a power piston that moves the steam valve. Woodward is one widely fitted example of a governor maker, with both mechanical-hydraulic and electronic units found on many steam turbines.

Those governors work, and many have worked for decades. Their weaknesses appear with age. Wear in the flyweights, linkages and pilot valve adds deadband, so the governor responds late and speed hunts. Adjustments drift. Spare parts get harder to find. They record nothing, so there is no trace of what speed, valve position or load did in the seconds before a trip. And they struggle with what modern plants ask for: remote setpoints, extraction pressure control, and automatic changeover between grid and island.

Electronic governors measure speed with pickups reading a toothed wheel on the shaft, run the control logic in a digital controller, and drive the valve through an electro-hydraulic actuator or a converter feeding the existing hydraulic servo. The gains are steadier control, adjustable droop, start up sequencing that steps through critical speeds, and event records that turn a trip into evidence.

MIMAH has carried out power plant control system upgrades, and the lesson that repeats is that a governor upgrade is a system upgrade. A new controller driving a sticky valve through a worn linkage is still a sticky valve. Survey the valves, actuators, linkages and hydraulic oil before specifying the controller, and commission the whole loop afterwards rather than the cabinet alone.

Governor Valves and How They Fail

A governor is only as good as the valves it moves. Small turbines often have a single governor valve. Larger machines have several control valves that open in sequence, each feeding a group of nozzles, lifted by a bar, a cam or individual actuators. The failure modes are consistent.

Sticking from deposits. Silica and other solids carried over in the steam deposit on valve stems and in stem bushings, especially where a valve sits at one position for long periods. On the hydraulic side, varnish in servo and pilot valves does the same thing. From the control room both look alike: the valve does not move when asked, then moves suddenly. Our article on turbine lube oil analysis explains how varnish forms and how to see it in the oil before it reaches the servos.

Stem and bushing wear. Wear opens the clearance, lets the stem cock and bind, and increases leakage along the stem.

Linkage slack. Worn pins, clevises and bearings between actuator and valve add lost motion. The governor moves the actuator and nothing happens until the slack is taken up, which shows as hunting and poor load control.

Seat leakage. Eroded seats and plugs pass steam when closed. A turbine that will not hold speed at no load, or accelerates hard on a load rejection, may have leaking valves rather than a governor fault.

Valve condition belongs in every overhaul scope, and our steam turbine overhaul guide covers where valve work sits in it.

Overspeed Protection Is a Separate System

The overspeed trip exists because governors and governor valves fail. It must therefore be independent of them, with its own speed sensing, its own logic, and a final element that shuts off steam whatever the governor is doing.

Why overspeed is so destructive. Centrifugal stress in a rotor rises with the square of speed. At 110 percent speed, stresses in discs and blades are 1.21 times their rated speed values; at 120 percent they are 1.44 times. A rotor pushed far enough can burst a disc or shed blades, and the fragments carry enormous energy. Of all steam turbine failures, overspeed is the one most likely to destroy the machine and injure people near it.

Mechanical trip. On many older and smaller machines, a spring loaded bolt or ring sits in the shaft. At trip speed, centrifugal force overcomes the spring, the bolt flies out, and it strikes a trip lever that dumps the trip oil pressure holding the steam valves open.

Electronic trip. Modern systems use three independent speed probes feeding a dedicated overspeed protection module that votes two out of three. A trip needs two channels to agree, so one failed probe neither trips the machine unnecessarily nor blinds the protection. API Standard 670 includes overspeed detection among its minimum requirements for machinery protection systems. Some machines keep a mechanical bolt as a backup to the electronic system.

The final element. The trip and throttle valve, or emergency stop valve, closes on loss of trip oil pressure and cuts steam at the turbine inlet, and the governor valves normally close with it. Extraction and admission lines need non-return valves that close too, because steam flowing back from a process header into a tripped turbine can drive it to overspeed after the inlet has shut.

For turbines in oil, gas and petrochemical service, API 612 for special purpose turbines and API 611 for general purpose ones set requirements for controls and auxiliary systems along with the machine itself. They are a sensible reference for any plant specifying a governor or trip upgrade.

The governor and the overspeed trip are separate systems. The trip exists because governors and governor valves fail, so it must not depend on them. Source: MIMAH engineering practice; overspeed detection within API 670 machinery protection systems.

Testing: What, When and How

An untested overspeed trip is an assumption. Four checks cover the system between them.

Trip valve exercising. Many trip and throttle valves can be partly stroked with the machine on line, proving that the stem is free. Done regularly to the manufacturer's procedure, it is the cheapest defence against the finding that recurs most, a valve held by deposits.

Overspeed trip test at the setting. The machine is brought up to trip speed, usually unloaded or uncoupled, and the trip must operate at its set value. The setpoint is fixed by the manufacturer in line with the applicable standard. It is commonly in the region of 110 percent of rated speed, but some machine classes are set differently and the manufacturer's setting governs. Record the speed at which the trip operated and how long the valves took to close. Some mechanical trips allow an oil injection test that fires the bolt at normal speed; it proves the bolt is free, not the speed it trips at, so it does not replace a real overspeed test. On electronic systems, a simulated speed signal can prove the logic and channels, which tests everything except the probes and the machine itself.

Valve closing time and tightness. Compare closing times with previous tests; a valve that has slowed is on its way to sticking. For tightness, close one set of valves with steam at the inlet and confirm that the rotor slows down rather than holding speed.

Governor response. Check that speed holds steady at no load and that the governor limits the speed rise on a load rejection, where the procedure allows it.

When to test: after every overhaul, after any work on the governor, trip system, valves or speed sensing, before returning a machine to service after a long outage, and periodically in between at intervals set by the manufacturer, the insurer and the plant's own risk assessment. The trip test belongs on the maintenance schedule with a date against it.

An overspeed test deliberately takes the machine towards its most dangerous condition. Run it to a written procedure, with the speed read on an independent instrument, a person stationed at the hand trip, and an agreed abort speed just above the setting at which the machine is tripped by hand if the protection has not acted.

The checks that prove a governor and trip system, and when to run them. The trip setpoint is the manufacturer's, commonly in the region of 110 percent of rated speed. Source: MIMAH engineering practice.

The Most Common Finding

When a trip test fails, it is rarely because the bolt or the electronics missed the overspeed. More often the trip signal worked and a valve did not respond: a trip and throttle valve stem seized in deposits, a governor valve held open by a varnished servo, an extraction non-return valve that had not moved in years. That is why valve exercising and oil condition matter as much as the trip device. These failures sit alongside the others in our guide to common steam turbine failures, and the valve checks belong on every turbine inspection checklist.

MIMAH's rotating equipment team surveys, overhauls and upgrades turbine governors, valves and trip systems, and commissions them afterwards. If you have a governor that hunts, a trip test that is overdue, or an old mechanical governor running out of spares, get in touch.