1A strong wind, then the grid drops out
The turbine is making its full 3 MW in a gusty 13 m/s wind, with the blades pitched only about 2°. A fault on the grid trips the main circuit breaker, and the generator’s braking torque vanishes in an instant. Now only the blades’ pitch can hold the rotor back, and the rotor starts to speed up.
2The blades should feather, but don’t
The safety system orders an emergency stop: each blade’s drive should turn it to 90° on its own backup batteries. But all three battery banks have aged, and the warnings from their weekly tests were never acted on. The drives barely move, so the blades stay at about 3° and keep driving the rotor faster.
3The disc brake takes the full load
At 120 % of rated speed the overspeed guard applies the disc brake on the high-speed shaft. That brake is sized to park a rotor the blades have already slowed, not to fight one still catching a strong wind. It turns megawatts into heat: the disc passes 600 °C and glows, the pads fade (hot pads grip less) and the brake loses its hold. The sudden torque also hammers the gear teeth.
4Runaway: overspeed and bending blades
The rotor passes 25 rpm, over one and a half times its rated speed, and the tips approach 150 m/s. The forces on the blades grow with the square of speed, and the wind’s thrust on the fast-spinning rotor bends them back toward the tower. The gap between the passing tip and the tower closes metre by metre.
5A blade strikes the tower
A bent blade tip hits the tower as it passes. The blade shatters and the rotor is thrown badly out of balance; the impact can buckle the tower. Real runaways like this have ended with blades thrown off or the whole turbine collapsing, which is why the safety layers below exist.
6How a runaway is prevented
- Three independent pitch systems, each with its own backup batteries or ultracapacitors: a fault in one leaves the other two to slow the rotor.
- The backup power is tested automatically, often weekly, by feathering on batteries alone. A failed test should stop the turbine until it is fixed.
- An overspeed guard with its own speed sensors trips the safety chain independently of the main controller, as IEC 61400-1 requires.
- The disc brake finishes a stop after the blades have slowed the rotor; it is not meant to stop a rotor at working pitch in a strong wind.
- Condition monitoring and SCADA alarms (battery health, pitch speed, brake wear) give warning long before several failures line up.
- Designs keep a tower clearance margin under extreme loads, using the cone angle, the shaft tilt and blades built with a forward bend.