An unplanned turbine trip ends a machine's operating period abruptly and opens a window of high-consequence decisions. What the response team does in the minutes and hours that follow — what data they capture, what assessments they make, and critically what they choose not to do — determines whether the machine restarts safely, whether the trip cause is understood, and whether secondary damage is avoided or quietly allowed to develop. The most common failure in trip response is not technical ignorance. It is commercial pressure to restore generation output overriding structured decision-making. This article covers the response sequence from the moment the trip occurs to the point where a restart or inspection decision is made.
What the Trip System Is Actually Telling You
A turbine protection system is a hierarchy of monitored parameters, each with alarm and trip setpoints. When a trip occurs, the most important initial question is not that the machine tripped — it is which parameter initiated the trip.
Modern installations record this as the first-out relay: the specific protection channel whose setpoint was exceeded first, triggering the protective shutdown. Most systems then cascade additional trips from the initial event. A low oil pressure trip may cause bearing temperature to rise and eventually trip on temperature as well. A vibration event may be accompanied by a bearing temperature alarm on the affected bearing. The relay indications that are showing after the event are not all initiating causes — most of them are consequences.
On many DCS and relay panel installations, what is displayed is first-up: the full list of protection channels that are in trip state at the moment the panel is read, with no automatic identification of which tripped first. The difference matters significantly. If a vibration trip reads as the initiating cause when it was actually triggered by high bearing temperature — itself caused by a reduction in oil flow — the investigation focuses on the rotor vibration source rather than the lubrication system. The diagnoses are different, and so are the corrective actions.
On systems where first-out is not automatically distinguished from first-up, the DCS event sequence log — showing timestamps at millisecond or second resolution for each protection channel — is the primary tool for establishing the actual trip sequence. This log must be captured before any reset action is performed.
The First Five Minutes
The five minutes immediately following the trip are the highest-priority window. The required actions are not complex, but they must happen in sequence.
Confirm the machine is decelerating normally
A turbine in coast-down from a normal trip should decelerate smoothly and become progressively quieter as speed drops. Metallic contact sounds, abnormal steam discharge, or vibration character that is different from a normal shutdown indicate potential damage and change the subsequent response. On large indoor installations with significant background noise, listening alone is insufficient — the coast-down vibration profile from the online monitoring system is a more reliable indicator of whether deceleration is normal.
Confirm turning gear engagement
On most modern large steam turbines, the turning gear engages automatically when shaft speed drops to the engagement threshold, or on receipt of the shutdown signal. Verify that engagement has occurred and that the rotor is being rotated. Do not assume it has engaged because the control system indicates it should. If turning gear has not engaged after a hot trip, this is a priority secondary problem that requires immediate attention: a stationary hot rotor will bow under differential thermal contraction within minutes, and correcting a thermal bow before restart can add hours to the outage.
Confirm the lube oil system is running
The lube oil system must continue operating through the full coast-down and for the entire turning gear period. If the machine tripped on low oil pressure, the cause of the pressure loss must be established without delay. If a primary pump has failed, the standby pump must be confirmed running and the oil system pressure must be verified before bearing condition can be assessed.
Confirm steam isolation
Verify that main stop valves and control valves have closed fully. On machines with separate trip mechanisms and emergency stop valves, confirm that the steam supply is isolated at all inlets. A partially seated valve allows steam to continue driving the machine at reduced speed, which may not be immediately apparent from the control room.
The strongest instinct after a trip is to reset the protection system so the machine can be restarted. Resetting the DCS before trip data is captured overwrites the first-out relay indication on many systems and may clear latched protection signals that carry diagnostic meaning. The instruction to the operating team must be explicit and unconditional: no system reset until the event log has been saved and the first-out identification has been recorded.
Capturing Trip Data Before Any Reset
Trip data is perishable. Some information is overwritten at the moment of DCS reset; some becomes harder to retrieve with time. The following must be captured before any reset is performed:
First-out relay identification
On systems that display first-out clearly, photograph or note the indication. On systems showing only first-up, go directly to the event sequence log and establish the trip order from timestamps. The person with engineering authority on site should take ownership of this step rather than delegating it to the operator who may be under pressure to reset.
DCS event sequence log
Export or photograph the event log covering 5–10 minutes before the trip and the sequence during the trip itself. This is the primary diagnostic record. It shows the order of alarms and trips, any process behaviour deviating in the lead-up, and whether other parameters had already been abnormal before the initiating trip occurred. In some facilities where there is no engineer on site at the time of the trip, establishing a standing procedure — no reset until the event log is saved — is the only reliable safeguard against this data being lost.
Vibration trend data
If the installation has continuous online vibration monitoring, export the trend for the 30–60 minutes before the trip. The pre-trip trend is often more diagnostically useful than the trip event itself: whether the vibration rose slowly and steadily or stepped up rapidly, whether it appeared first at one bearing or simultaneously at multiple bearings, and what the frequency content was before the amplitude reached the trip setpoint. If waveform or spectrum data is available, export it for the period of elevated vibration, not just the trip instant.
Bearing temperature trends
Export temperature trends for all bearings covering the period before the trip. A bearing temperature that had been rising steadily for several hours before the trip provides a fundamentally different diagnostic picture from a temperature that spiked in the final minutes. The trend shape and rate of rise are part of the diagnosis, not just the trip value.
Process conditions
Record steam pressure, temperature, and load at the time of the trip, and note any changes in the preceding operating period. Off-design steam conditions — reduced superheat, near-saturation steam, abnormal extraction pressures — are direct contributors to some trip scenarios and determine whether additional inspection scope is warranted.
Classifying the Trip
Not all trips carry the same implications for machine condition. The table below summarises the most common trip types, their immediate equipment risk, and the minimum required assessment before restart.
| Trip type | Immediate equipment risk | Minimum required assessment |
|---|---|---|
| Vibration — proximity probe or seismic | Active or residual mechanical fault; bearing damage if vibration was sustained at high amplitude | Review pre-trip vibration trend and frequency data; identify whether cause is transient or mechanical; restart with enhanced monitoring if cause identified |
| Overspeed | Blade and disc overstress; coupling overload; bearing overload from speed transient | Mandatory inspection per OEM procedure — no exceptions; inspection scope typically includes all accessible blade stages, discs, coupling and defined NDE areas |
| Low lube oil pressure | Bearing damage proportional to pressure drop and duration; oil film disruption | Identify and correct cause; oil sample for metallic wear particles; bearing inspection if pressure drop was significant or sustained; do not restart on unknown cause |
| High bearing temperature (journal or thrust) | Bearing wear or damage; oil degradation in bearing; potential journal surface damage | Review pre-trip temperature trend and rate of rise; bearing inspection at next available opportunity; oil analysis immediately after event |
| Axial displacement / thrust position | Rotor-to-stator contact; seal damage; diaphragm contact if displacement was large | Mandatory physical inspection of thrust bearing and adjacent seal clearances before restart; treat any unusual noise during coast-down as a contact event until inspection proves otherwise |
| Electrical protection (differential, LOE, overcurrent) | Generator winding or insulation fault; potential speed transient from sudden load rejection | Electrical investigation by protection engineering team; assess governor response and speed transient from the load rejection; confirm whether an overspeed event was associated with the electrical trip |
| Process / steam conditions | Wet steam ingestion; thermal shock from rapid temperature change; blade erosion if sustained | Review steam condition trend before trip; inspect inlet stages and first nozzle ring if significant wet steam ingestion is suspected |
| Manual trip / emergency stop | Usually known at initiation; secondary effects depend on operating conditions at time of trip | Confirm the reason for manual initiation; if initiated to respond to an abnormal condition, treat as the appropriate type above |
Vibration trips — a specific note on single-channel events
A common field interpretation after a vibration trip is that a single elevated channel indicates a sensor fault rather than a genuine mechanical event. This may be correct, but it requires evidence rather than assumption. A genuine mechanical excitation does not necessarily produce identical readings across all measurement channels — asymmetric rotor behaviour, directional stiffness differences, and the physical location of each transducer relative to the fault location all affect the response. Before concluding sensor fault, assess whether the elevated channel's reading is physically consistent: a proximity probe that reads high vibration should also show the corresponding shaft displacement relative to its housing; a seismic transducer that reads high should correlate with something physically palpable at the bearing housing. Inconsistency between the indication and the physical evidence strengthens the sensor fault hypothesis. Consistency weakens it. The pre-trip trend is also informative — a sensor developing a fault typically produces irregular, non-physical behaviour rather than a clean progressive increase.
Overspeed trips — inspection is not optional
An overspeed event — where shaft speed exceeded the mechanical overspeed trip setpoint — is a mandatory inspection trigger on large steam turbines. Most major turbine OEM procedures specify the required inspection scope, which typically includes visual inspection of all accessible blade stages, rotor and disc examination, coupling inspection, and non-destructive examination of defined areas. These requirements are conditions of the OEM warranty, insurance coverage, and in some jurisdictions, operating permit compliance.
The mechanical basis for this requirement is direct: turbine blades and discs are designed to centrifugal load limits that include a defined safety margin above rated speed. When the mechanical overspeed trip is activated, that margin has been entered. Even if no visible damage is apparent, the OEM cannot certify continued safe operation without the specified inspection confirming that no damage was induced. The inspection requirement does not scale with the degree of overspeed — it applies whenever the mechanical trip setpoint is reached.
Thrust trips — assume contact until proven otherwise
A trip on thrust bearing position or temperature indicates that the rotor moved axially beyond its normal operating envelope, or that the thrust bearing was thermally overloaded. Either condition raises the possibility of contact between the rotor and stationary components — seals, diaphragm faces, or close-clearance elements at the stage inlet. The severity depends on how far the rotor moved and for how long. Any unusual noise during coast-down following a thrust trip — metallic scraping, intermittent contact, or abnormal vibration character — should be treated as a contact event until a physical inspection proves otherwise. Restarting without that inspection accepts an uncharacterised risk.
Risk Assessment Before Restart
Two questions structure the restart risk assessment regardless of trip type:
Question 1: Is the trip cause identified and resolved, or still present?
A trip caused by a process upset that has been corrected is a fundamentally different situation from a trip whose cause is unknown. Operating a machine without having identified why it tripped means accepting the risk that the same condition will reproduce — possibly at a different, less benign operating point, and with less opportunity to control the outcome.
Question 2: Did the trip event itself cause secondary damage?
This question is independent of cause identification. Some trip types — overspeed, thrust, sustained high vibration — can cause mechanical damage during the trip event even if the initiating cause is well understood and has been resolved. Secondary damage must be assessed on its own terms.
The answers to these two questions produce four response levels:
Trip cause identified and resolved. No indicators of secondary damage — normal coast-down behaviour, no unusual noise, vibration returning to baseline on turning gear, all bearing temperatures within normal range. Standard OEM startup sequence applies, with normal monitoring.
Trip cause identified with some residual uncertainty, or cause identified but not fully corrected. No clear secondary damage indicators. Startup proceeds with tighter vibration hold points at defined speed steps, additional bearing temperature monitoring at reduced intervals, and a defined review point before proceeding to full speed and load.
Mandatory inspection required by OEM procedure for the trip type (overspeed, thrust trip), or on-site assessment indicates potential secondary damage requiring physical verification. Restart must wait for the inspection to be completed and the findings evaluated. This level is not a recommendation — it is a requirement for the trip types listed in the table above.
Trip cause not identified after systematic review of available data. Multiple simultaneous initiating events. Evidence of significant damage. Or a developing pre-trip condition that has not been characterised. The machine should not restart until the investigation reaches a conclusion that defines specific restart conditions. If on-site expertise is insufficient to reach that conclusion, external technical support should be engaged rather than restarting speculatively.
Thermal Bow and the Turning Gear Requirement
After any trip from elevated operating temperature, the rotor must spend a defined period on turning gear before a restart attempt. This requirement is not advisory and it does not shorten for schedule reasons.
The reason is heat distribution. A turbine rotor at operating temperature carries a substantial thermal load through its full cross-section. When the machine trips and decelerates, the outer surfaces cool faster than the core. If the rotor is left stationary, the upper surface cools faster than the lower surface — gravity and convection create a consistent temperature gradient across the rotor's cross-section. Under differential thermal contraction, the cooler upper surface contracts more than the hotter lower surface, bowing the shaft upward. A bowed rotor cannot be safely accelerated through the critical speed.
Slow rotation on the turning gear distributes the cooling evenly around the circumference, allowing the thermal gradient to equalise without producing a bow. The required turning gear period is specified in the OEM startup procedure for each machine. For large industrial steam turbines it is typically several hours — the specific requirement varies with machine size, thermal mass, and the steam conditions and load at the time of the trip. A trip from full load at rated steam conditions requires a longer turning gear period than a trip from reduced load or during a startup.
Before any acceleration attempt after a hot trip, measure the vibration at turning gear speed and compare it to the established slow roll baseline for this machine — the 1× vibration amplitude and phase recorded at turning gear speed during previous healthy shutdowns. If slow roll 1× vibration is elevated above the baseline, the rotor may still have a thermal bow. Continue on turning gear and re-measure before attempting acceleration. A bow that reduces progressively as the rotor turns is thermal in nature and will correct with time. A bow that does not reduce — or that is accompanied by a heavy, consistent phase angle — may indicate a permanent mechanical condition rather than a thermal one, and warrants specialist assessment before proceeding.
If turning gear failed to engage promptly after a hot trip, or if the turning gear period was interrupted, slow roll vibration measurement before any acceleration is not optional. It is the only reliable way to confirm that the rotor is straight before it is subjected to the forces of a run-up through the critical speed.
Common Mistakes Made After Turbine Trips
Assuming the trip was spurious without reviewing the data
"It was probably a sensor" is a reasonable starting hypothesis. It is not an investigation outcome. The hypothesis requires evidence: a sensor fault typically produces irregular, non-physical readings on the affected channel with no corresponding change in corroborating measurements. A genuine mechanical event typically produces some physical corroboration — a pre-trip trend, consistent response across multiple sensors monitoring the same component, or evidence palpable at the machine. Form the hypothesis, then check whether the data supports it. Do not form the conclusion first and then look only for confirming data.
Resetting the DCS before the event log is secured
This is the single most common information loss after a trip. An operator under pressure to show the machine as available resets the protection system before anyone has captured the first-out relay indication and the event sequence. Once reset, some of this information may be unrecoverable. The no-reset rule should be a standing written procedure at every facility, not an instruction given ad hoc after the trip has already occurred.
Restarting on an unidentified trip cause
The argument is always the same: "if it trips again, we'll investigate then." The problems with this argument are also consistent: a second trip may occur at a different operating point, with more damaging consequences than the first. The cause may not reproduce in a way that provides more information. A machine that has tripped twice in the same operating period attracts a more serious inspection requirement than one that tripped once and restarted correctly. The brief generation loss from a delayed restart is almost always smaller than the cost of the consequences this approach is intended to avoid.
Cutting the turning gear period for schedule reasons
There is no schedule argument that justifies accepting the risk of starting a bowed rotor. A rotor with a thermal bow that is accelerated before the bow corrects will produce elevated 1× vibration on the run-up, may trip on vibration at a lower speed than the original event, and may cause bearing or seal damage that forces the outage to be opened anyway. The turning gear time that was saved gets spent several times over.
Investigating only the initiating relay
The first-out relay identifies what tripped the machine. It does not necessarily identify the underlying cause. A vibration trip may have been preceded by hours of rising bearing temperature. A low oil pressure trip may have followed a period of abnormal oil temperature. The investigation must cover the full pre-trip data window — not just the final moments before the relay actuated — because that is where the developing condition is visible. Engineers who receive the trip relay information and immediately start investigating only that relay's direct cause are working with a fraction of the available information.
Not accounting for load rejection speed transients after electrical trips
When a generator disconnects from the grid under load — whether by electrical protection, circuit breaker operation, or other causes — the turbine instantly loses its load. The governor responds by closing the control valves, but the response is not instantaneous. Depending on the rate of load rejection, the turbine inertia, and the governor tuning, a significant speed transient may occur. On machines with a mechanical overspeed trip set close to the operational maximum governor response, an electrical trip under high load can result in a mechanical overspeed trip activating. After any high-load electrical trip, review the speed trace from the DCS historian to confirm whether an overspeed event occurred. If the mechanical trip setpoint was reached, the overspeed inspection requirement applies regardless of whether the overspeed was the initiating cause.
Bypassing the mandatory overspeed inspection
The OEM-specified inspection after an overspeed activation is a condition of warranty, insurance coverage, and — in some jurisdictions — regulatory operating permit. Engineers on site sometimes resist initiating it because it extends the outage significantly. The decision to skip a mandatory inspection is not an engineering decision that can be made in the field: it is a legal and commercial decision with consequences that extend beyond the current outage. If the inspection is going to be bypassed, that decision must be made explicitly by someone with commercial and legal authority, with full awareness of what they are accepting. It should never happen by default because no-one on site raised the requirement.
When to Call for External Technical Support
The call for external support is consistently made later than it should be. Bring in external technical support when:
- The trip cause has not been identified after a systematic review of all available data
- The trip type requires a mandatory inspection and on-site expertise for that inspection is not available
- There is unresolved disagreement within the technical team on whether restart is safe
- The machine has tripped more than once in the same operating period without a clearly identified and corrected cause
- The pre-trip data shows a developing pattern that is not explained by the available information
- The nature of the trip — thrust, high vibration sustained for more than a few minutes, unusual coast-down — raises the possibility of contact or secondary damage that on-site expertise cannot confidently rule out
Axerion provides unplanned stop technical support for situations where the trip cause is unclear and the restart decision carries significant technical or commercial risk — independent assessment and on-site field support structured specifically around this type of event. For planned outage decision support after a trip has resulted in opening the machine, see planned revision decision support.
Practical Summary
The structured response to an unplanned trip follows the same sequence regardless of trip type:
- Secure the machine. Confirm coast-down is normal. Confirm turning gear engagement. Confirm lube oil system is running. Confirm steam isolation.
- Capture the data — before any reset. First-out relay or event sequence timestamps. DCS event log for 5–10 minutes before and during the trip. Vibration trend and bearing temperature trends for 30–60 minutes before the trip. Process conditions at trip time.
- Classify the trip. Identify the trip type and apply the minimum required assessment from the table above. Check specifically whether the trip type triggers a mandatory inspection requirement.
- Assess secondary effects. Independent of cause identification: did the trip event itself create conditions — overspeed, axial movement, sustained high vibration — that require physical inspection before restart?
- Make the restart decision. Using the two-question framework, determine whether the machine can restart with normal monitoring, with enhanced monitoring, or only after inspection. Document the basis for whichever level is chosen.
- Execute the startup. With the monitoring intensity matched to the level of certainty about machine condition. Confirm slow roll baseline before acceleration. Apply defined hold points where uncertainty remains.
No DCS reset before the event log is saved. No restart before the trip cause is identified. No reduction in the turning gear period for schedule reasons. No bypass of mandatory inspection requirements without explicit sign-off from someone with the authority to accept that risk. These four rules, applied consistently, prevent the majority of the serious errors made after unplanned turbine trips.
Axerion provides on-site technical support for unplanned stops — structured diagnosis and independent technical assessment when the trip cause is not clear and the restart decision cannot safely be made with the resources on site.