The panel shows a healthy machine. Speed steady, vibration under alarm, lube oil level normal, no first-out on the trip annunciator. Every protective device on that screen reports "OK" because nothing has asked it to act. That is the whole problem: a dormant protection loop reads identical to a working one until the day it is needed.
Skip These Four Fixes First
Every one of these gets proposed when someone asks how to test speed, vibration and lube oil level devices without taking the unit down. Every one of them leaves a gap.
- Pay the insurance penalty instead of testing. The arithmetic sometimes favors the penalty. The arithmetic does not close the trip valve. A penalty transfers money; it does not reduce the probability that a varnished trip bolt stays put at 110% speed. If a unit is genuinely believed to be untestable in service, that is a design or maintenance defect, not a scheduling problem.
- Wait for the major outage. A five- or six-year proof-test interval on a device whose dangerous failures are undetected drives average probability of failure on demand straight up — PFDavg scales roughly with λDU × TI / 2. Stretching TI by a factor of five multiplies your exposure by the same factor. Outage-only testing also finds the failure at the worst moment: after it has already been latent for years.
- Stroke the trip valve and call it a test. Stroking proves the actuator and the exhaust path. It proves nothing about the speed sensing element, the threshold, the voting logic, or the mechanical emergency governor. Partial-stroke exercising belongs in the program; it is not the proof test.
- Run only the electronic simulated overspeed test. Injecting a frequency into the electronic overspeed module and watching the relay drop out verifies the electronic channel and the trip solenoid. It does not verify the mechanical trip bolt or ring, and on machines that carry both, the mechanical device is the one that sits idle and gums up.
Start with the OEM manual, not with the schedule. Any steam turbine of modern design carries a testable emergency governor, and the test port for it is on the machine. If nobody on site knows where it is, that is the first finding.
Understand What Actually Degrades
Protective devices fail in a small, predictable set of ways. Match the test to the failure mode or you are burning a shutdown for nothing.
| Symptom on the panel | Underlying cause | Test that finds it |
|---|---|---|
| Nothing. Loop reads healthy. | Mechanical trip bolt/ring seized by oil varnish, deposits or corrosion | Oil-injection test of the emergency governor at running speed |
| Nothing. Setpoint reads correct. | Electronic overspeed threshold drifted, or speed pickup gap opened up | Frequency injection per channel with actual trip point recorded |
| Trip initiates, machine keeps rolling | Trip valve or trip-throttle valve sticking, dashpot fouled, steam leak-by | Timed closure with speed decay and chest pressure logged |
| Vibration flat-lines at a plausible value | Proximity probe gap out of linear range, driver mismatch, cable damage | Gap voltage check plus deliberate not-OK forcing |
| Lube oil level "normal" with reservoir dropping | Float or displacer stuck, sensing chamber plugged or gas-locked | Blowdown/drain of the chamber to walk the level through the switch |
| Trip never occurs on real demand | Bypass or maintenance override left engaged after the last test | Bypass register audit and hard-wired override lamp check |
Split the Loop Into Testable Segments
You almost never have to trip the machine to test the machine. Segment the loop, test each segment on the interval it needs, and reserve the full functional trip for the intervals the OEM and your insurer require.
- Sensor to logic solver, online. One channel at a time, with that channel voted out or in trip-inhibit. Requires 2oo3 or 1oo2D architecture. Record the as-found trip point before adjusting anything.
- Logic solver to final element, online. Energize the trip solenoid through the test header while the trip valve is held by the test lever, or partial-stroke the valve. Confirm solenoid current drops and the valve moves.
- Mechanical emergency governor, online. Oil injection behind the trip bolt at rated speed, with the trip lever held so the bolt latches the linkage without dumping the machine. Verify bolt travel and that it resets clean.
- Full functional overspeed, offline. Unloaded, breaker open, unit isolated from the header, actual speed raised to trip. This is the only test that proves the whole chain in series.
Write the segmentation into the procedure with the coverage of each segment stated. That document — not the penalty invoice — is what justifies the interval to an insurer or jurisdictional inspector.
Run the Speed Test
- Confirm the machine is at normal operating temperature and the lube oil system is in its normal alignment. A cold or turning-gear test tells you nothing about a hot rotor.
- Unload the generator or driven equipment, open the breaker, and isolate from the process header. Never raise a loaded machine toward trip speed.
- Station an operator at the manual trip handle with clear authority to trip, and a second at the local speed indicator. The control room speed display is not the reference.
- Suppress non-essential alarms, but leave the vibration and axial position channels live and displayed. Overspeed excursions are exactly when you want those readings.
- Raise speed in controlled increments. Log the as-found trip speed for each device before touching a setpoint.
- Record trip valve closure time and the speed decay slope immediately after trip. Slow closure with a correct trip point is still a failed test.
- If a device trips outside the OEM band, adjust, then retest to demonstrate repeatability. One good trip after an adjustment is not a result.
- Reset all latches, clear every bypass, and prove the trip circuit is armed before restart.
Test Vibration and Lube Oil Level the Same Way
These two get skipped because they seem lower risk than a speed test. They are the loops that fail quietly.
- Proximity probe channels: read gap voltage at the monitor and confirm each probe sits in the linear midrange of its curve. Verify probe, extension cable and driver are a matched set of the correct system length — a mismatched driver produces a stable, believable, wrong number.
- Alarm and danger relays: inject a signal or use the monitor's internal test function, and follow the action all the way to the DCS tag and the trip relay. Test the not-OK circuit deliberately by opening the probe input; confirm the machinery protection system inhibits the trip rather than tripping on an open circuit, and confirm operators know which behavior is configured.
- Voting: if trip is on 2oo2 vibration, test both channels separately. Half a voting pair proves half a trip.
- Lube oil level switches: exercise the actual float or displacer. Blow down or drain the sensing chamber and walk the level through both switch points, capturing as-found actuation levels. Filling a bypass leg does not move a stuck float.
- Cross-checks: compare the level transmitter against the sight glass or magnetic level indicator at the same instant. A steady disagreement means a plugged tap, not a calibration drift.
- Interlock proof: demonstrate that low level actually starts the auxiliary oil pump and that low pressure trips the machine. Test them separately so a good pump start does not mask a dead trip.
Verify, Then Know When to Escalate
Close out on evidence, not on a signed line. The as-found values are the deliverable — as-left values only prove that someone turned a screw.
- Every as-found trip point, closure time and switch actuation level recorded, with pass/fail against the OEM band.
- Bypass register reconciled to zero. Walk the field and look at the override lamps; do not trust the HMI list alone.
- Test jumpers, injection leads and mechanical test levers removed and accounted for by count.
- Alarm suppression lifted and verified by forcing one nuisance alarm through to the annunciator.
- Interval reviewed against the failure data you just generated. Two consecutive tests with a drifted setpoint means the interval is too long, whatever the calendar says.
Stop and escalate when the emergency governor will not latch or reset cleanly, when the trip valve closure time exceeds the OEM limit, or when as-found trip speed is outside the band by more than the OEM's adjustment range. Those are rotor-safety findings, not maintenance items — take the machine off line and open a case with the turbine OEM's service organization and your machinery protection system vendor before the next start. If the OEM manual for your unit contains no in-service test procedure for the emergency governor, get that answer in writing from the manufacturer rather than improvising one.
FAQ
What happens if we skip overspeed testing and just pay the insurance penalty?
You keep the money and keep the latent failure. The penalty covers the insurer's risk position, not the machine's; a trip bolt seized by varnish stays seized whether or not the premium is paid.
What happens if we only run the electronic simulated overspeed test?
You verify the speed pickup, the electronic threshold, the logic and the trip solenoid, and nothing else. The mechanical emergency governor and the trip valve remain unproven, and those are the components that stick after long service.
What happens if the machine trips during an online single-channel test?
That is the correct outcome for a machine without redundant, independently testable channels — which means online channel testing was never available on that architecture. Confirm the voting arrangement and the OEM's in-service test provision before you inject anything.
What happens if the as-found trip speed is above the setpoint?
Log it as a failed test, adjust, and retest for repeatability. A single high as-found reading is a drift indicator; two in a row means the proof-test interval is too long for that device.
What happens if a lube oil level switch is tested by filling a bypass leg instead of the chamber?
You prove the wiring and the DCS mapping and miss the actual failure. A stuck float or a plugged sensing tap only shows up when the real level moves through the switch point, so blow down or drain the chamber itself.