Hi,
I had a colleague who was at the Uskmouth Power Station in Wales in the 1960s, when the turbine stop valves failed to close on overspeed due to a disconnection from the National Grid. The cause was found to be sea water contamination in the valves hydraulic system.
He had been standing with a workmate by the turbine only 5 minutes before the turbine broke apart. He , luckily, had walked to another machine when all hell broke loose but his mate was killed.
He always carried a photo in his wallet of the H.P. turbine laying in the mud a mile away in the estuary!
With the large base-load turbo-generators, which run for years without stopping, provision is made for on-load valve testing, where typically there are four pairs of stop/governor valves. This enables the valve mechanisms to be tested one by one with only a partial load loss and gives confidence that they would close in an emergency.
I used to work on electronic turbine speed governors and, amazingly, the 7-tonne springs on each valve were compressed, via the hydraulics, with only a 26mA signal. Part of the requirement was for the valves to slam shut in 250ms, boy did that make us jump! Those 26mA signals controlled a million horse-power turbine.
Despite modern computer controls, which can be triplicated, the last bit of protection is the mechanical overspeed bolts on the main shaft; if they jam then you're in trouble.
Ian.