Orbit 60 vs 3500: What Changes for Machinery Protection Engineers

The Bently Nevada 3500 has been the reference machinery protection system for decades, and it remains fully supported by the manufacturer. Orbit 60 is the next-generation platform. It does the same core job — protecting critical rotating machinery — but changes how the system is built, configured and diagnosed.

This article is not a call to replace every 3500 rack. It looks at what actually changes for the engineer who designs, configures and maintains the system, and at which situations favour each platform.

Architecture and scale

The 3500 is built around a rack: monitors and their I/O modules sit in a fixed chassis, and the system grows by adding racks. Orbit 60 is a modular system with a noticeably smaller footprint — Baker Hughes states it is about half the size of the previous industry standard for the same function.

A single Orbit 60 system can handle up to 80 dynamic inputs (vibration, position, speed) and 100 static inputs such as temperatures. Several chassis can be linked with Bridge modules, either side by side in one cabinet or distributed closer to the machines, and they still behave as one system.

All Orbit 60 modules can be replaced with the system powered. For maintenance this means fewer outages planned around the protection system itself.

Configuration

In the 3500, channels are configured in pairs, and each monitor is configured as a separate unit in Rack Configuration Software. Orbit 60 changes both habits.

• Individual channels. Every channel is configured on its own. Two inputs that belong together, for example an X/Y probe pair, can be combined for a measurement even if they sit in different modules or chassis.
• System-level configuration. Orbit Studio configures the whole system as one entity, so cross-module checks happen at configuration time rather than on site.
• Graphical relay logic. Relay voting is drawn as a logic diagram instead of written as an equation. It is easier to review with the customer, and easier for the next engineer to understand years later.

For engineers used to 3500 the learning curve is real but short. The biggest change is thinking in terms of the whole system rather than individual monitors.

Alarming and protection logic

The 3500 gives each measurement two alarm levels: Alert and Danger. Orbit 60 provides four. In practice this allows an early warning, an operator alarm, a pre-trip and a trip on the same measurement, without building workarounds in the DCS.

The bigger conceptual change is protection states. Machines do not behave the same way during start-up, slow roll, normal running or shutdown, and setpoints that are right for one mode cause nuisance alarms in another. In the 3500 this was handled with dedicated contacts and functions such as Trip Multiply. In Orbit 60 the engineer defines states — for example "start-up" and "running" — and assigns setpoints to each. The DCS or a discrete input tells the system which state the machine is in.

The result is protection logic that matches how the machine is actually operated, and that is documented in one place.

Speed and Keyphasor inputs

In the 3500, phase reference and speed come from dedicated Keyphasor and tachometer modules, and the number of Keyphasor signals in a rack is limited. Orbit 60 accepts any number of speed and Keyphasor signals in one system.

This matters on machine trains with several shafts at different speeds — gearboxes, multi-casing compressors, turbine-generator sets — where each shaft needs its own phase reference for 1X and 2X vectors.

System self-diagnostics

The 3500 reports its own health essentially as OK or Not OK. Any abnormal condition in the rack drives the same status, whether or not it affects protection.

Orbit 60 separates two questions:

• Protection Fault — the system can no longer protect the machine on at least one protection path. This is the signal that should reach the control room immediately.
• Protection Compromised — the system still protects the machine, but with reduced reliability. A typical example is the loss of one of two redundant power supplies: protection works, redundancy is gone, and maintenance should act before a second failure.

For operators this means fewer alarms that turn out to be irrelevant, and a clear distinction between "act now" and "plan a repair".

Cybersecurity and condition monitoring

Cybersecurity requirements for plant control systems have tightened considerably since the 3500 was designed. Orbit 60 was built with them in mind: it includes a hardware data diode that separates the protection network from the condition monitoring network, and it is designed to the IEC 62443 series. The protection function is certified to SIL 2.

On the condition monitoring side, an optional Condition Monitoring Module samples and stores high-resolution data inside the system and feeds it to System 1. Data recorded during an event is kept even if the network link to the monitoring server is lost.

Which one to choose

Both systems protect machinery to the same standard. The choice depends on the project, not on which platform is newer.

Orbit 60 is usually the better fit when:

• it is a new plant or a new critical machine train with no installed base to match;
• the customer has strict cybersecurity requirements and wants protection and monitoring networks physically separated;
• the machine runs in several operating modes and needs different setpoints for each;
• a machine train has several shafts that each need their own Keyphasor;
• condition monitoring data must be stored locally and survive network outages.

3500 is usually the better fit when:

• the project extends an existing 3500 installation and the site wants one spare parts pool;
• the customer's engineering standard is written around the 3500;
• operations and maintenance staff are trained on the 3500 and retraining is not planned.

On many sites both systems will work side by side for years: existing machines stay on 3500, new trains get Orbit 60, and System 1 brings the data from both into one place.

Summary

Orbit 60 does not change what machinery protection is for. It changes how the system is configured, how it reports its own health and how it fits into a modern, cybersecure plant network. For new projects it is worth considering from the start; for existing 3500 sites there is no urgency, and a mixed estate is a normal situation.

Advance Technology supplies, installs and commissions Bently Nevada vibration monitoring and protection systems, including both 3500 and Orbit 60, for industrial plants across Central and Eastern Europe. Our engineers hold Bently Nevada training certifications. If you are planning a new protection system or an extension of an existing one, contact us.