Engine governors are the control systems that hold a diesel engine at its set speed by automatically adjusting fuel delivery as load changes. On every merchant vessel, governors sit on main propulsion engines, auxiliary generator sets, and emergency generator sets. They are not optional: SOLAS Chapter II-1 and IACS Unified Requirement M64 both require them. Getting the governor wrong, whether through incorrect tuning, mode mismatch, or a misunderstanding of droop, produces load instability, frequency excursions on the electrical bus, and, in the worst case, an uncontrolled runaway that ends at the overspeed trip.
This article covers the engineering of governor systems from first principles: what they do, the three hardware generations (mechanical, hydraulic, electronic), the two fundamental control modes (droop and isochronous), load sharing between parallel generator sets, PID control and droop expressed as inline equations, the actuator that connects the controller to the fuel system, and the separate overspeed protection device that remains when the governor cannot. It closes with the class society requirements, common faults, and maintenance practice.
What a governor controls
A diesel engine’s speed at any instant is the result of a torque balance: combustion torque minus load torque equals angular acceleration times rotational inertia. When load increases, the excess torque disappears, and the engine decelerates. Without correction, even a moderate load step on a 4-megawatt auxiliary diesel would drop frequency below the 47.5 Hz SOLAS disconnect threshold in under two seconds.
The governor’s job is to detect the deviation from the set speed and increase fuel delivery quickly enough to restore the torque balance before the speed error grows unacceptable. On the other side, when load drops, unburned fuel would accelerate the engine; the governor must cut fuel promptly. The controlled variable is almost always fuel quantity per cycle, delivered through a fuel rack on mechanically injected engines or through rail pressure and injection pulse width on common-rail engines.
Three quantities define how well a governor does its job:
- Steady-state speed deviation: the offset between set speed and actual speed when load is constant. A well-tuned governor holds this inside plus or minus 0.5 percent of rated speed in steady state.
- Transient speed deviation: the maximum excursion immediately after a sudden load step. IACS M64 permits up to plus or minus 10 percent of rated frequency on a 60 percent rated-power step load.
- Recovery time: the time from the load step until speed returns to within plus or minus 1 percent of rated. IACS M64 requires recovery within 5 seconds.
These three metrics directly constrain the governor’s gain settings and, for parallel machines, the droop characteristic.
Mechanical governors
The oldest governor type is purely mechanical, using centrifugal force to sense speed and move the fuel rack. James Watt’s flyball governor from 1788 is the ancestor, but marine diesel governors of the early-to-mid 20th century were more sophisticated two-speed or three-speed flyweight designs with hydraulic servo amplification.
The operating principle is the same across all mechanical types. Two or more flyweights rotate with the engine, driven off the camshaft or a dedicated gear. As engine speed rises, centrifugal force pushes the flyweights outward. This outward movement acts, through a system of levers and linkages, to pull the fuel rack toward the reduced-fuel position. As speed falls, spring force pushes the flyweights inward and the rack moves toward the increased-fuel position. Equilibrium is the rack position at which centrifugal force and spring force balance.
The Watt type uses two plain flyball weights on crossed arms. The Hartung type, common on medium-speed diesels through the 1970s, added a secondary spring and buffer to reduce hunting. Both are inherently proportional-only controllers: they produce a fuel-rack correction proportional to the speed error, and they are incapable of eliminating steady-state offset. A mechanical governor running in droop produces a permanent speed drop under load; a mechanical governor attempting to mimic isochronous operation requires a speed-setting spring that is adjusted by a separate servo as load changes, adding mechanical complexity that proves unreliable over time.
By the 1980s, mechanical-only governors had largely given way to hydraulic-mechanical hybrids on slow-speed two-stroke main engines, and the remaining legacy mechanical units were confined to emergency generators and older auxiliary diesels. Their main practical virtue is that they need no electrical power and carry no software: a mechanical governor cannot crash.
Hydraulic governors
The Woodward UG series, introduced in the 1950s and still in service on many vessels built before 1990, is the canonical hydraulic governor. The Woodward PGA (Proportional-Gain Actuator) and the Woodward EGB (Electronic-Hydraulic) extended the platform into the electronic era. Heinzmann and other makers produced comparable hydraulic units.
A hydraulic governor separates the sensing and power functions. The flyweight head senses speed and produces a small displacement proportional to the speed error. This displacement opens or closes a pilot valve that controls high-pressure hydraulic oil, typically at 400 to 700 kPa from the governor’s own internal gear pump. The hydraulic oil acts on a power piston that moves the fuel rack with much greater force than the flyweights alone could produce. This amplification lets the governor control large fuel racks on slow-speed two-stroke engines without the flyweights being impractically massive.
The Woodward UG governor includes an oil-filled dashpot (the buffer) that introduces a derivative action, damping oscillation without requiring electronic components. It’s a purely mechanical approximation of a PD controller. Steady-state droop comes from a needle valve setting that bleeds some oil from the power piston when the pilot valve opens, creating a deliberate feedback that prevents the governor from hunting toward zero steady-state error. Adjusting this needle valve sets the droop percentage.
Key service issues with hydraulic governors are oil viscosity sensitivity and sludge. The governor pump produces a fixed differential pressure; if the oil is cold and thick, response is sluggish. If the oil is contaminated with water or metal particles, the pilot valve sticks and the governor may oscillate or, in extreme cases, drive the engine to maximum fuel. Woodward recommends annual oil changes and specifies light turbine oil (ISO VG 32 or 46) rather than the main lubricating oil in the sump. Mixing the two is a documented failure mode.
The hydraulic governor was the workhorse of marine diesel speed control for roughly four decades. Woodward shipped more than a million UG units across marine, industrial, and power-generation applications. Vessels built in the 1970s and 1980s often still run the original UG governor with nothing more than periodic overhaul.
Electronic governors
Modern marine diesels, including all MAN B&W ME-series two-strokes and WinGD X-series engines, use fully electronic governor algorithms running on the engine control unit (ECU). The hardware chain consists of three elements: a speed pickup, a controller, and an actuator.
Speed pickups
Most engines fit two or three independent speed pickups on the flywheel or ring gear, typically magnetic inductive sensors or Hall-effect sensors. A 120-tooth ring gear and a 1 ms sampling interval gives a speed resolution of about 0.5 rpm at 500 rpm, adequate for tight control. The ECU cross-checks all sensors; disagreement beyond 2 to 3 rpm triggers an alarm. If one sensor fails, the ECU switches to the remaining sensors without interruption.
MAN Energy Solutions’ ME-C series uses a dual redundant tacho system: two independent sensor channels feeding two parallel ECUs, with automatic switchover. This design means a single ECU failure does not disable the governor.
The electronic controller
The ECU runs the governor algorithm in software, typically on a scan rate of 10 to 50 milliseconds. The algorithm computes the speed error between the setpoint (from the bridge telegraph or engine control room) and the measured speed, then produces a fuel command output.
The standard algorithm is the PID controller, described below in the control-modes section. The software implementation gives the operator (and the manufacturer’s service engineer) access to adjust all three gains, the droop setting, the rate limits, and the load-sharing interface, without physically changing hardware.
Actuators
The fuel command from the ECU must physically move the fuel rack or adjust the injection system. On engines with a conventional fuel pump and rack, a proportional electric actuator (Heinzmann STE, Woodward ProAct, or similar) converts the 4-to-20 mA or CAN-bus fuel command from the ECU into a mechanical displacement of the fuel rack, typically over a 30 to 60 mm stroke with a response time under 200 ms.
On common-rail engines such as the MAN ME-GI and WinGD X-DF, there is no mechanical rack. The ECU commands injection pulse width and timing directly to the fuel injection control units (FICUs), which drive the electronically controlled injector valves. The actuator is, in effect, the injector valve driver stage inside the FICU.
Some engines fit a hydraulic servo actuator between the ECU and the fuel rack, combining the fast electrical response of the controller with the high force output of hydraulics. This arrangement is common on larger medium-speed engines and on slow-speed engines with mechanically complex fuel pumps.
Control modes: droop and isochronous
All governor systems, whether mechanical, hydraulic, or electronic, operate in one of two fundamental modes. The difference is in the integral control term and in the steady-state relationship between speed and load.
Droop mode
In droop mode, the governor is a proportional controller. Speed at full load is lower than speed at no load, and the relationship is linear. The speed-droop percentage is defined as:
where is no-load speed, is full-load speed, and is the rated speed. A 4 percent droop on a 1500 rpm generator means the governor is set so that no-load speed is 1500 rpm and full-load speed (rated) is 1440 rpm, a drop of 60 rpm.
Droop is essential for stable parallel operation. Consider two diesel generators, A and B, running in parallel on the same bus. If both run in isochronous mode, a small random difference in their effective speed setpoints causes one machine to take all the load while the other motors, because both are “fighting” to hold the same bus frequency. With droop, each machine’s load is self-limiting: machine A at 50 percent load runs at 1470 rpm (halfway between no-load and full-load speed); machine B at 50 percent load also runs at 1470 rpm. If load increases, both machines slow slightly, both governors add fuel, and both share the new load in proportion to their ratings. No external communication is needed; the physics of the droop slope enforce it.
Standard droop settings for shipboard auxiliary generators are 3 to 5 percent. The IMO Code on Intact Stability and IACS M64 do not mandate a specific droop value, but the requirement for stable parallel operation in practice means droop below 2 percent produces hunting and droop above 6 percent produces unacceptable frequency variation at partial load.
Isochronous mode
In isochronous mode, the governor includes an integral control term that accumulates the speed error over time and drives the steady-state error to zero. The engine holds rated speed regardless of load, as long as the load does not exceed the engine’s rated output.
Isochronous operation is correct for a single generator feeding an isolated bus, or for a single main engine driving a shaft with no other power source in the loop. It is also correct for shaft generators where the grid frequency must be exactly 60 Hz or 50 Hz regardless of load.
For parallel operation in isochronous mode, all machines need a load-sharing line: an analog or digital communication channel that tells each governor how much total load is on the bus and how much each machine carries, so the software can bias each machine’s effective setpoint to force an equal share. Modern electronic governors from Woodward (easYgen series), Heinzmann (DiGov series), and Kongsberg implement this as a serial bus with a shared load reference. Without the load-sharing line, two isochronous governors on parallel machines will fight.
PID control
The full electronic governor implements proportional, integral, and derivative action. The fuel command output is:
where is the speed error in rpm, is proportional gain, is integral gain, and is derivative gain.
The proportional term produces an immediate fuel correction proportional to the current error. The integral term accumulates error over time and eliminates the steady-state offset that a proportional-only controller (droop) leaves. The derivative term reacts to the rate at which the error is changing, providing anticipatory damping that reduces overshoot on a sudden load step.
In droop mode, is either set to zero or its output is intentionally limited so the steady-state error equals the droop specification. In isochronous mode, runs freely and integrates away the steady-state error.
Tuning all three gains is the central challenge of governor commissioning. Too high a produces oscillation. Too high a produces windup during saturation events (when the fuel rack is already at maximum, the integral term keeps climbing, and the first moment the rack can move, it overshoots). Too high a amplifies sensor noise into rapid fuel-rack dither, wearing out the actuator. MAN and WinGD provide engine-specific starting-point gain values in their commissioning manuals and expect sea-trial fine-tuning by a licensed service engineer with an oscilloscope on the speed signal.
Load sharing between parallel generators
A ship’s electrical plant in normal ocean service runs two or three auxiliary generators in parallel on the main switchboard. Stable, proportional load sharing among them is a safety and efficiency requirement. The governor is the primary mechanism.
Droop-based load sharing
With droop governors on all machines, load sharing is passive. Each machine has a speed-versus-load droop line. The common bus frequency locks all machines to the same actual speed. Where each machine’s droop line intersects that common speed determines that machine’s load.
For two identical machines (same rating, same droop) on the same bus, the load split is 50/50 regardless of frequency. If one machine has a steeper droop, it yields load more readily and carries less. Operators can shift load between machines by adjusting the governor speed setpoint on one machine while watching the kW meters: raising the setpoint on machine A shifts load to A, reducing it on B. The frequency stays constant because the bus frequency is the constraint, not the individual setpoints.
This passive sharing is the reason droop is the default mode for parallel marine generators. It needs no communication cable between governors, no synchronization protocol, and no supervisory controller. It’s also the failure mode that saves the plant when the power management system (PMS) loses communication: the governors continue sharing load by physics alone.
Isochronous load sharing via PMS
Modern vessels with a power management system (PMS) run generators in isochronous mode with a software-managed load reference line. The PMS measures total load on the bus and each machine’s load, computes a target load per running machine (usually equal sharing or following a priority order), and sends a small setpoint bias to each governor. Each governor integrates against its individually biased setpoint, producing isochronous speed control with actively managed load sharing.
Kongsberg’s K-Chief 600, Rolls-Royce’s IAS, and ABB’s EMMA systems all implement this pattern. The load reference is typically a 4-to-20 mA signal or a DeviceNet/Modbus message to each governor’s external reference input. If the PMS communication fails, governors revert to their local droop setting; the load share becomes passive droop-based, which is safe if all droop settings are consistent.
Load acceptance during start and connect
When a generator is started and synchronized to the bus, the governor receives a “connect” signal and begins to take load. The rate of load acceptance is a governor parameter: too fast and the engine overshoots full load before the fuel system can recover, too slow and the machine sits lightly loaded for minutes. Woodward’s easYgen series uses a configurable load ramp rate in percent of rated load per second, with a typical setting of 10 to 20 percent per second for marine generators.
Blackout recovery imposes the most severe test: all load appears simultaneously when the main generator reconnects. Generators intended for blackout recovery are tuned for fast transient response, accepting a larger transient frequency dip in exchange for faster recovery. IACS M64 permits a transient deviation of plus or minus 10 percent of rated frequency, recovering within 5 seconds.
See the article on marine electrical generation and distribution for the full context of generator paralleling, synchronization, and bus protection.
The actuator in the fuel path
The governor’s software output must reach the fuel system through a physical actuator. This component is often the weak link in governor reliability. On a 7-megawatt auxiliary diesel, the fuel rack moves perhaps 40 mm between no-load and full-load positions, with a required force of 200 to 500 N. The actuator must produce that force in under 150 to 200 milliseconds to meet IACS transient-recovery requirements.
Proportional electric actuators use a DC servomotor or a torque motor driving the fuel rack through a gearbox. Heinzmann’s STE series and Woodward’s ProAct series are the dominant types. Both use a position sensor (typically a LVDT or potentiometer) that feeds back to the actuator’s own internal servo loop, so the governor commands a position and the actuator holds it against fuel-system reaction forces. The ECU sees the actuator as a position-follower with a bandwidth of typically 5 to 20 Hz.
Hydraulic actuators (Woodward’s TG and EGB types) use engine oil or a separate hydraulic supply to power the fuel-rack movement. They produce more force than electric actuators and suit larger rack strokes, but they introduce oil temperature sensitivity and require hydraulic supply pressure to be maintained by an auxiliary pump. On slow-speed two-stroke main engines, fuel-rack forces can exceed 2,000 N, making hydraulic actuation necessary.
Actuator failures divide into mechanical and electrical modes. Jammed actuators hold the fuel rack at whatever position they fail in: full-fuel is an overspeed event; no-fuel is an unplanned stop. Actuator position sensor drift causes the governor to command a position the actuator misreports, producing a steady-state fuel error that shows up as a slight speed offset under constant load. Bearing wear in electric actuators introduces position hysteresis: the rack lags the command, degrading transient response. Annual calibration checks against the fuel-rack indicator and periodic actuator overhaul (every 4 years or at each major engine survey) are standard practice.
Overspeed protection as a separate system
The governor is not the overspeed protection system. This distinction is both a safety design principle and a regulatory requirement.
If the governor fails in the direction of excess fuel delivery (stuck actuator, failed ECU, software fault), the engine accelerates beyond its rated speed. The governor, being the failed component, cannot stop this. An independent overspeed trip is therefore required: a device that monitors engine speed through its own separate sensor chain and physically cuts fuel delivery by a path that is independent of the governor’s electronics.
SOLAS Chapter II-1, Regulation 46, requires that main engines and auxiliary engines on passenger ships be fitted with automatic means of stopping the engines in case of overspeed. IACS Unified Requirement M67 requires that every propulsion engine and every generator engine be fitted with an independent overspeed protection device. DNV Rules Part 4 Chapter 2 require the trip to activate at no more than 115 percent of maximum operating speed for main engines and no more than 115 percent of rated speed for auxiliary engines.
The trip mechanism is typically mechanical: a flyweight on the engine camshaft or crankshaft, separate from the governor flyweight, armed with a spring-loaded latch. When speed reaches the trip setting, the flyweight overcomes the spring and releases the latch, which trips a fuel shutoff valve or directly moves the fuel rack to zero through a separate mechanical linkage. The trip resets manually, requiring a deliberate operator action after the overspeed event, which prevents automatic restart into whatever condition caused the runaway.
Electronic overspeed trips exist and are accepted by class societies for certain engine types, but they must use a separate sensor and separate processing chain from the governor ECU. Using the same ECU for both governor and overspeed protection is not permitted because a single ECU fault could defeat both functions simultaneously.
After every overspeed trip event, classification society rules require an engineer’s investigation and written report before restart. The engine cannot simply be restarted without determining the cause; doing so risks a repeat event, which the engine may not survive.
See engine emergency stop circuits for the full treatment of automatic shutdowns, safety sensor architecture, and SOLAS shutdown requirements.
Class society and SOLAS requirements
Governor performance requirements are set by two overlapping sources: IMO instruments (primarily SOLAS) and IACS unified requirements, which all major class societies adopt.
IACS Unified Requirement M64 is the definitive standard for generator engine governors. It requires:
- Steady-state speed regulation: the speed at any load between no-load and full-load must stay within plus or minus 1 percent of rated speed once the transient has settled.
- Transient speed deviation: must not exceed plus or minus 10 percent of rated speed following a sudden application of 60 percent of rated load (the standard load step used in type approval testing).
- Recovery time: speed must return to within plus or minus 1 percent of rated within 5 seconds of the step load.
- Frequency at no-load: must be stable (no hunting) without load connected.
These figures apply to the governor and engine as a system; they’re tested at sea trial and at the periodic load-step tests required by the class society’s survey program.
IACS Unified Requirement M67 covers overspeed protection independently, as noted in the section above.
SOLAS Chapter II-1 requires governors on main engines and auxiliary engines to hold speed within the limits needed to maintain safe electrical supply to safety systems (lifeboat winches, fire pumps, steering gear). For passenger ships, Regulation 46 specifies that main engines must have automatic shutdown protection against overspeed. For cargo ships, the main instruments are the class rules that SOLAS incorporates by reference.
DNV Rules, Part 4 Chapter 2 (and equivalent rules from Lloyd’s Register, Bureau Veritas, ClassNK, and ABS) require the governor to be type-approved. Type approval involves the governor maker running a defined test program at an accredited test house, demonstrating compliance with M64 across the full load and speed range, including at low temperatures and with degraded supply voltage. Woodward, Heinzmann, and Kongsberg hold type approvals from multiple class societies.
Periodic survey requirements typically include a governor function test (confirming setpoint response and stability) and an overspeed trip test (physically testing the mechanical trip at its set point) at each annual or class-renewal survey. The overspeed trip test is always done with the engine clutched out from the generator or propeller to avoid damage during the controlled runaway.
Faults and failure patterns
Governor faults on marine vessels follow a consistent pattern. Speed signal problems account for a large share: a loose wiring connection to the flywheel sensor, or a sensor air-gap out of specification, produces erratic speed readings that cause the governor to chase a ghost. Symptoms are unexplained frequency oscillations at constant load, sometimes only in a specific speed range where one tooth on the ring gear has a damaged profile.
Actuator stiction is the second most common fault on hydraulic governors. The pilot valve in a Woodward UG governor is lapped to a running clearance of a few micrometers; any particle in the oil that lodges in this clearance causes the valve to stick in one position. The engine runs at slightly off-speed (the stuck position fails to correct), and manual adjustment of the speed setpoint produces no change in fuel-rack position. The fix is governor disassembly and cleaning, which takes a licensed Woodward service agent and an oil analysis to identify the contamination source.
Electronic ECU faults may produce a loss of governor function with a failsafe fallback to a fixed fuel position. MAN’s ME-C engine control system fails to a “limp home” mode: the engine holds approximately 60 to 70 percent load at a fixed fuel command, enough to allow port entry under its own power. WinGD’s equivalent is a “manual override” mode where the engineer can control the fuel index directly from the engine control room.
Load sharing failures in parallel operation often trace back to a misconfigured droop percentage. If one machine’s droop is set at 2 percent and another’s at 5 percent, the 2 percent machine takes a disproportionate share of every load step and may trip its own overload protection. The fix is to verify and equalize droop settings during the annual governor survey, using the kW meters and the frequency meters simultaneously while adjusting no-load speed references.
Hunting, the sustained oscillation of engine speed around the setpoint, is a tuning problem or a mechanical problem. PID gain too high is the software cause: proportional gain causes oscillation at high frequency; integral gain causes oscillation at lower frequency with load-dependent amplitude. A stiff or sticky governor linkage introduces mechanical hysteresis that can also produce hunting, because the controller overshoots trying to drive the rack through the stick point. Hunting in a single machine is a nuisance; hunting in one machine of a parallel pair feeds back through the bus frequency to destabilize the other machine.
Maintenance practice
Governor maintenance falls into three categories: routine monitoring, scheduled intervention, and overhaul.
Routine monitoring means checking speed stability under controlled conditions at each watch. The engine room log should record engine rpm against power (or fuel index) at least twice per watch. A machine that holds 1490 rpm at 70 percent load one week and 1485 rpm at the same load the next week has likely picked up a slight actuator drift. Catching this early avoids a more expensive fault later.
Scheduled intervention on hydraulic governors includes oil change at annual survey (Woodward specifies every 2,000 operating hours or annually, whichever is earlier), magnetic drain plug inspection for metallic particles, and filter replacement. On electronic governors, the scheduled work is software version verification against the manufacturer’s current release, sensor calibration check (comparing the ECU speed readout to a calibrated hand tachometer), and actuator position calibration (confirming the fuel rack indicator matches the ECU commanded position within 0.5 mm across the full stroke).
Overhaul of a hydraulic governor every 8,000 operating hours or at each Special Survey involves complete disassembly, dimensional inspection of the flyweight pins and pilot valve bore, replacement of all O-rings and seals, and bench test against a certified Woodward test rig before reinstallation. Electric actuator overhaul similarly involves bearing inspection, brush replacement on brushed DC units, LVDT calibration, and gearbox backlash check.
The marine engine room automation and monitoring system logs governor parameters continuously and should be configured to alarm on speed deviation exceeding 0.5 percent of rated in steady state. This alarm threshold, tighter than the IACS M64 steady-state limit, catches developing problems before they reach the class-mandated limit.
The engine telegraph and remote control system interacts with the governor on every bridge order: the telegraph converts the order (e.g., “Slow Ahead”) into a speed setpoint that the governor receives. Any mismatch between the intended setpoint and the actual setpoint delivered to the governor is a remote-control fault, not a governor fault, but the symptoms (engine running at wrong speed) look similar from the bridge.
Limitations
Speed droop calculations assume a linear speed-load relationship across the full load range. In practice, the droop slope is slightly nonlinear because fuel consumption per kWh is not constant, and the flyweight or actuator response is not perfectly linear at the limits of travel. Droop-based load sharing among machines of different ratings works proportionally only if the droop percentages are identical; mismatched droop produces unequal sharing that neither the governor nor the operator can easily see without a per-machine kW meter.
PID tuning done at rated load does not necessarily hold at partial load. A governor tuned for stable operation at 80 percent load may hunt at 20 percent load because the engine’s internal gain (the torque produced per unit of fuel-rack movement) changes with load, speed, and charge-air pressure. Engines that regularly operate across a wide load range benefit from gain-scheduled controllers that select different PID parameters in different operating zones.
Mechanical governors are sensitive to temperature. Woodward UG governors show measurably different response at oil temperatures below 30 degrees C (stiff pilot valve, sluggish response) compared to operating temperature of 50 to 60 degrees C. Cold-start governor instability is a documented issue on vessels operating in polar regions.
Electronic governors depend on electrical power. Loss of the governor’s 24V DC supply means loss of governor function; on engines with only an electronic governor and no mechanical backup, this produces an uncontrolled fuel-rack position. Best practice is to supply the governor ECU from an uninterruptible 24V DC bus backed by a battery, separate from the main UPS that supplies automation systems.
The droop model works reliably for two-machine and three-machine paralleling on a ship’s electrical bus. It becomes less predictable on larger ring-bus configurations with more than four machines, where bus sectioning and automatic bus management interact with individual governor characteristics. On large passenger vessels with six or more generator sets, active load management by the PMS is necessary, and the PMS tuning is as important as the individual governor tuning.
Finally, a governor failure is categorized as a loss of speed control, not as an overspeed event. The two failure modes, governor fails to zero fuel (engine stops) and governor fails to maximum fuel (engine accelerates), have opposite consequences. The first is an inconvenience; the second demands that the overspeed trip operates correctly. Governors and overspeed trips must be tested as separate systems under separate test procedures, not assumed to be interchangeable because they both monitor engine speed.