Bentley 3500/53 RPM Limit Switch (Overspeed Switch) “Two-from-Three” (2003) Interlock Logic Configuration

This article provides a comprehensive overview of the Bentley 3500/53 (Over-Speed Card) “3-from-2" (2003) interlock logic configuration—covering everything from hardware architecture, software configuration, voting logic, and relay wiring to triggering and resetting.

• 3 independent speed sensors: 3 eddy current or magnetoelectric sensors mounted on the same gear disc, each physically, electrically, and power-supply independent.
• 3500 chassis (3500/05) + dual redundant power supplies (3500/15): Redundant power supplies are mandatory and must comply with API 670.
• Backplane TMR bus: The three cards implement a “two-out-of-three" hardware-level voting mechanism via backplane hardwiring, independent of software or the network.

The three cards are fully peer-to-peer with no master-slave relationship: Each card performs independent data acquisition, independent processing, and independent output to the trip relay. A failure in a single card or probe does not affect the system as a whole: The system automatically degrades to a “two-out-of-one" configuration without tripping the unit. If any two cards simultaneously detect an overspeed condition → hard trip: Response time ≤ 30 ms.

• 3500 Rack Configuration Software (v3.35+).
• Connection: Connect the computer’s serial port or a USB-to-serial adapter to the RIM module on the rack; set the key switch to Program mode.
• Principle: The configuration of all three card sets must be identical; configure the first card first, then synchronously copy the settings to the other two.

• Slot Selection: Select 3 adjacent slots; Module Type: Select 3500/53 Overspeed.
• Channel Activation: Channel → Active.
• Sensor Type: Eddy Current: Proximity (200 mV/mil); Magnetic: Magnetic.
• Range: 0–40,000 RPM (based on the unit’s rated speed, e.g., 3,000 RPM).
• Gear Parameters: Teeth per Revolution (e.g., 60), Polarity (sensor polarity).

Using a rated speed of 3,000 rpm as an example:

• Alert: 103% = 3,090 rpm; triggers an alarm only, does not trip the unit.
• Danger (Overspeed Trip): 110% = 3,300 rpm; triggers 2-out-of-3 voting, resulting in a forced trip.
• Trip (Ultimate Forced Trip): 114% = 3,420 rpm; the on-board hard relay trips immediately without voting.
• Delay: 0 ms for alert, 0 ms for trip (no delay for overspeed).

• Enter the Voting Logic interface and select 2 out of 3.
• Logic definition: ≥2 cards simultaneously reach the Danger setpoint → trigger a general trip.
• 1 card failure / alarm → automatically masked, does not participate in voting.
• Only 2 normal cards remain → automatically downgraded to 1 out of 2.
• Synchronization Settings: The voting mode for all 3 cards must be exactly the same; mixing 2-out-of-3 and 1-out-of-2 is prohibited.

• Each 3500/53 unit provides 4 relay channels. Key configurations:
• Alarm Relay: Activates during an Alert, sending an alarm to DEH/DCS.
• Danger Relay (Trip): Activates during a “Danger" event; dry contacts (NO/NC), hardwired to ETS / rapid-closing valve.
• Relay Status: Normally closed (NC), open during a trip (NO), safety-designed.

• Sensor Fault: Open circuit / short circuit / signal anomaly → The corresponding card automatically bypasses the sensor and is excluded from voting.
• Card Fault: CPU / power supply / communication anomaly → This card is bypassed, and the remaining two cards operate in 1oo2 mode.
• Fault Alarm: A bypass signal is sent to the DEH to alert maintenance personnel; the system does not trip.

• 3 sensors → Independent data acquisition by 3 cards → Normal RPM → All “Danger" relays energize (NC closed).
• Trip Circuit: NC contacts of the “Danger" relays on 3 cards connected in series → Circuit closed → Safety oil established → Unit operates normally.

• A single card detects overspeed → The Danger relay on that card opens.
• Only 1 card activates → Condition 2oo3 is not met → General trip is not triggered → The unit continues to operate.
• A single-card alarm is sent to the CCS as a reminder to prevent false trips.

• The second card also detects overspeed → Condition 2oo3 is met.
• The “Danger" relays on both cards open simultaneously → The series circuit is broken → Safety oil pressure is relieved → Speed-closing valves / main steam valves close.
• Full-chain response time ≤30 ms, far exceeding that of PLC/DCS (200–500 ms).

If any single card detects ≥3,420 rpm → the card’s internal hard relay actuates directly, bypassing the voting process to force a trip. This serves as the final line of defense against extreme overspeed (e.g., uncontrolled load shedding).

• Danger relay per card: NC (Normally Closed), NO (Normally Open), COM (Common).
• Two-out-of-three circuit: NC contacts from 3 cards connected in series → one end connected to 24 VDC, the other end connected to the ETS trip coil / speed-closing valve solenoid.
• Principle: Normally closed, opens upon trip, conforming to the fail-safe principle.

• Hardwired: Trip dry contacts, alarm dry contacts, card fault / bypass dry contacts.
• Communication: Real-time speed, peak speed, cause of first trip, card status.
• From DEH/DCS Hardwired: Reset signal, test enable signal.
• Communication: Unit operating status, speed setpoint.

1. Speed ≥ 3300 rpm → Detected by 2 or more cards → Passed by 2003 vote.
2. 2-card “Danger" relay opens → Hard-wired circuit opens → ETS solenoid valve actuates.
3. Safety oil pressure relief → Rapid closure of main steam valve / regulating valve / quick-closing valve → Unit shutdown.
4. 3500 System Log: First triggering card, peak speed, action time, fault cause.
5. DEH Interlock: Interlocks, pressure relief, anti-surge valve fully open, alarm pop-up.

1. Confirm unit shutdown, speed at 0, and fault cleared.
2. Local Hard Reset: Short-circuit terminals RST/COM on the 3500/53 (independent reset for each card).
3. After reset: “Danger" relay energizes → hard circuit is energized → safety oil is re-established → startup is permitted.
4. Remote software reset is prohibited: must be performed locally to prevent accidental resets.

• Single-sensor open circuit: Corresponding card bypasses → remaining two cards trigger 1oo2 → no trip.
• Single-card hardware failure: Same as above → No trip.
• Simultaneous failure of two probes: 2oo3 condition met → Trip.
• Electromagnetic interference: False alarm on a single card → Bypass → No trip.

The 3500/53 “Three-Input, Two-Output" interlock is a hardware-level, SIL 3, TMR-redundant overspeed protection solution. Through independent data acquisition from three cards, hardware 2003 voting, and hard-wired direct tripping, it ensures no tripping on a single fault, guaranteed tripping on a double fault, and millisecond-level response. It fully complies with API 670/612 standards and serves as the final, robust line of defense against runaway in large compressors / turbines.