Modern governors protect their machines well — until they don't. The overspeed function embedded in a governor shares power, sensors and electronics with the very control loop it supervises, and a control-side failure can silence the protection exactly when protection is needed. That dependency is why critical units keep an independent overspeed trip: a separate device, separate sensors, separate power — Woodward's DSS-2 (8800-1001 class), a dual-channel digital speed switch built to be the trip that outlives the control system's worst day.
What independence buys
Failure decoupling. The governor's power supply, its MPU wiring, its firmware — none of it is in the DSS-2's failure path. A control system that hangs, browns out or misbehaves cannot take the overspeed protection with it, because the protection never depended on it. Dual channels add the sensor-failure dimension: two independent speed inputs, wired per the safety study’s voting preference, mean one lying or dead sensor does not disable the trip — the TMR philosophy in miniature at the simpler tier.
How the DSS-2 works
Two speed inputs — typically from separate magnetic pickups on the shaft — feed a digital switch logic with independently settable trip points. On trip, relay outputs fire the shutdown path directly: fuel block, trip valve, breaker. The device's entire function is that decision, which is why it is fast, testable and auditable: proof-testing a speed switch takes minutes and a signal generator, not a shift.
The decision rule
Any machine whose overspeed consequence is serious enough to have its own paragraph in the safety study keeps an independent trip — the governor's built-in protection handles the daily duty, and the DSS-2 owns the catastrophic case. Small pumps and fans with benign failure modes can live on governor-integrated protection honestly; the escalation is consequence-driven. The DSS-2 lands beside the plant's other trip and protection hardware and stays out of the control loop by design.
Why two channels and not one?
A single-channel independent trip still dies silently with its sensor. Two channels give the safety study wiring options — either channel authoritative or both in agreement — and the hardware carries both arrangements.
Does the DSS-2 replace the governor's internal protection?
No — it supplements. The governor's internal overspeed remains the fast first line; the independent switch is the backstop that does not share the governor's fate. Layered protection is the point.
