8237-1600 ProTech-GII Overspeed Protection Device

The 8237-1600 is a high‑reliability overspeed protection device from Woodward’s ProTech‑GII series. It is designed for steam turbines, gas turbines, hydro turbines, and large reciprocating engines. This model features panel mount construction, mixed high‑voltage and low‑voltage (HV/LV) power inputs, 2oo3 (two‑out‑of‑three) voted relay outputs, and voted inputs. It is a safety device certified for SIL 3 (IEC 61508) and complies with API 670, API 612, and API 611 standards.

The 8237‑1600 uses three independent modules (A, B, C) in a triple modular redundant (TMR) architecture. Each module monitors rotor speed and acceleration via its own speed sensor. When an overspeed or over‑acceleration event is detected, the system issues a trip command to shut down the turbine or engine, protecting both personnel and equipment.

This device is ideal for critical applications in power generation, oil & gas, marine propulsion, and industrial drives where both safety and high availability are required.

2. Key Features

• Triple Modular Redundancy (TMR) – Three independent modules; any single failure does not affect the others. Hot‑swap (online replacement) is supported.

• 2oo3 Voted Trip Relay Outputs – Internal voting logic ensures that at least two modules must trip before the output relays change state, preventing spurious trips.

• Flexible Speed Inputs – Each module accepts one speed sensor, configurable as passive MPU or active proximity/eddy‑current probe.

• Overspeed & Over‑acceleration Protection – Overspeed trip range: 0‑32,000 rpm; over‑acceleration trip range: 0‑25,000 rpm/s.

• Speed & Acceleration Redundancy Managers – Allows median, high‑select, or low‑select voting among up to three signals; configurable fallback behavior.

• Comprehensive Self‑Tests – Temporary overspeed setpoint test, manual/auto simulated speed test, auto‑sequence test (tests all three modules automatically), lamp test.

• Event Logging – Non‑volatile logs for overspeed/over‑acceleration (20 events), trips (50 events), alarms (50 events), and peak speed/acceleration.

• User Interface – Front panel with multi‑language support (English/Chinese), real‑time monitoring, configuration, and test initiation.

• Modbus RTU Communication – RS‑232/RS‑485 port per module for remote monitoring and control.

• Programming & Configuration Tool (PCT) – PC software for offline/online configuration, file management, and log export.

• Safety Certifications – TUV SIL 3, CSA Class I Division 2, ATEX Zone 2, GOST, and meets API standards.

3. . Detailed Functional Description

3.1 Trip Logic and Output Configuration (Voted Relay Models)

In the 8237‑1600, each module independently evaluates its own speed and acceleration signals. When a trip condition (overspeed, over‑acceleration, speed loss, etc.) occurs, the module sets its internal trip latch. The three modules share their trip status via a certified CAN bus. An internal 2oo3 voter module monitors the three trip signals and de‑energizes or energizes the two redundant Form‑C trip relays accordingly. The voter action can be configured as:

• De‑energize to trip (fail‑safe): loss of power causes a trip.

• Energize to trip: power must be applied to trip.

3.2 Speed and Acceleration Redundancy Managers

When enabled, the redundancy manager allows each module to use not only its own speed signal but also the speed signals from the other two modules. This enables:

• Voting on the median, highest, or lowest speed value.

• Fallback logic when only two signals are healthy (HSS or LSS).

• Configurable action when two inputs fail (trip or no trip).

• Difference alarm with adjustable threshold and time delay.

This feature is especially useful when only two speed probes are installed, or when one probe fails online.

3.3 Start Logic and Speed Fail Detection

The ProTech‑GII includes two complementary start‑up aids to prevent spurious trips while the turbine is stationary or at low speed:

• Speed Fail Trip: If the speed is below the Speed Fail Setpoint and the Speed Fail Override input is not closed, a trip occurs.

• Speed Fail Timeout Trip: After a Start command, if the speed does not exceed the setpoint within the configured timeout, a trip occurs.

These functions ensure that the system does not trip during normal start‑up when MPU output may be zero.

3.4 Event Logging and First‑Out Indication

Each module stores the following logs in non‑volatile memory:

The first‑out indicator is crucial for troubleshooting the root cause of a trip event.

4. Installation and Wiring Highlights

4.1 Environmental Requirements

• Install in an IP56 (or higher) enclosure.

• Ambient temperature: -20°C to +60°C.

• Avoid direct sunlight, water, condensation, and strong electromagnetic interference.

• Provide adequate ventilation and space for front panel access.

• Mount vertically.

4.2 Power Wiring

• Each module requires two independent power sources (one HV, one LV).

• Each power source must have its own circuit breaker.

• HV inputs must be connected to protective earth (PE) with wire ≥1.5 mm².

4.3 Speed Sensor Wiring

• Use shielded twisted‑pair cable; connect shield at one end (module side).

• MPU mode: 1–35 Vrms, 1.5 kΩ impedance, open‑wire detection active.

• Active probe mode: module provides 24 Vdc power; input thresholds Vlow <2V, Vhigh >4V.

• Each probe must be connected to only one module (no parallel connections).

4.4 Relay Outputs

• Trip relays (Form‑C): 8 A @ 220 Vac / 8 A @ 24 Vdc – can directly drive trip solenoids.

• Alarm relay (solid‑state): 1 A @ 24 Vdc – for remote annunciation.

• Use external power supply if total current exceeds 500 mA.

4.5 Modbus and Service Port

• Modbus: RS‑485 max length 1500 ft, RS‑232 max 50 ft.

• Service port (RS‑232) is for temporary connection only (programming/log retrieval).

5. Configuration and Operation

5.1 Front Panel Configuration

• Language: English or Chinese.

• Password required for test level (e.g., start tests) and config level (change parameters).

• Module must be in the tripped state to enter configuration mode.

• Configurable parameters: probe type, gear teeth, gear ratio, overspeed/over‑acceleration setpoints, redundancy manager, Modbus, test modes, etc.

5.2 Programming and Configuration Tool (PCT)

• Connects via service port (RS‑232).

• Allows offline creation/edit of settings files (*.wset).

• Online upload/download of configurations.

• Export logs to HTML.

• Supports configuration comparison between files.

5.3 Copy Configuration Between Modules

• From the front panel, one module’s configuration can be copied to another module.

• Excluded items: passwords, Modbus slave addresses, home screen preferences.

• Configuration mismatch alarm can be enabled/disabled.

6. Safety Certifications and Compliance

Safe State: When configured as De‑energize to trip, the module trips upon total power loss – the fail‑safe condition.

7. Typical Applications

The 8237‑1600 is suitable for:

• Gas turbine generators – overspeed protection to prevent blade failure.

• Steam turbine driven compressors – in refineries and chemical plants.

• Hydro turbines – anti‑runaway protection.

• Reciprocating engines (gas/diesel) – for gas compression or emergency power.

• High‑speed motors and compressors – over‑acceleration detection.

Its ability to support online module replacement and 2oo3 voting makes it ideal for applications where downtime is extremely costly.

8. Troubleshooting and Maintenance

8.1 Front Panel LED Indications

8.2 Common Faults and Solutions

8.3 Recommended Maintenance

• Perform auto‑sequence test every 6–12 months to verify all modules.

• Every 5–10 years, return the unit to Woodward or an authorized service center for inspection and upgrades.

• If stored for more than 24 months, apply power for 5 minutes to reform electrolytic capacitors.

9. Ordering Information and Accessories