1.

PURPOSE:
Purpose of this document is to chalk-out requirement of New PLC based
System for Boiler houses boiler no.1, 2, 3, Auxiliaries and Dearator.

2. SCOPE:
The document covers detailed specification of New PLC system including
ESD, Regulatory Control and HMI for Descon Boiler number 1, 2 and 3 of
Boiler House for Attock Refinery Limited Morgah Rawalpindi, Pakistan.
Each boiler shall have its individual PLC system. ESD, regulatory control
of each boiler, Auxiliaries and (Dearator) Control shall be on its individual
PLC system. Redundant Critical I/Os capability shall be provided.
An operator console with HMI shall be provided. Details of operator
console and HMI are
Existing Panels in Boiler house control room shall be utilized for PLC
system. Additional instruments shall be supplied as per Annex. . Existing
cables for instruments shall be utilized other than those mentioned as
Additional instruments.
Existing cable trenches shall be utilized for all cable interconnection
routing.

3. GENERAL
This will be a turnkey project including Engineering, supply, installation
and commissioning of PLC systems and field instruments.
Installation of PLC system at Boiler House will be done on-line. First the
system will be engineered (configured) and then, one by one, loops will be
transferred from Existing Controllers to PLC system.
Existing system is SAACKE boiler management system. Contractor will be
responsible for up gradation of the existing system with new system.
This document describes PLC system requirements for Boiler house up gradation Project,
which consists of three Boilers, Dearator and Auxiliaries located at
Attock Refinery Rawalpindi, Pakistan.

Burner Management Systems

Introduction
The following paragraphs outline a general method for implementing a typical boiler
Burner Management System (BMS). Several general guidelines to implement operation
strategies for such a system are also provided.
This document is intended for use by the control systems designer as a guide for basic
design. Final and detailed BMS design is required per the applicable design specifications. This
narrative contains provisions required for compliance with the NFPA 8501 Standard for Single
Burner Operation. The control systems designer is responsible for compliance with this
standard, and all other applicable federal, state and local standards and regulations.

General
The Burner Management System must be designed to ensure a safe, orderly operating
sequence in the start-up and shutdown of fuel firing equipment and to reduce possible errors by
following the operating procedure.
The system is intended to protect against malfunction of fuel firing equipment and
associated systems. The safety features of the system shall be designed to provide protection in
most common emergency situations, however, the system cannot replace an intelligent operators
reasonable judgment in all situations.
In some phases of operation, the BMS shall provide permissive interlocks only to insure safe
startup of equipment. Once the equipment is in service, the operator must follow acceptable safe
operating practices.
It is essential that all parts of the BMS are in good working order and in service whenever
the burner is in service if the system is to provide the protection for which it is designed. Regular
maintenance and inspection of the system and its associated hardware is essential for its
continued safe operation.
This narrative gives a description of a typical BMS as it relates to the various operating
phases and the operation of the fuel firing equipment and associated systems.

BMS Functions
The BMS shall be designed to perform the following functions:

Preventive firing unless a satisfactory furnace purge has first been completed.
Prohibit start-up of the equipment unless certain permissive interlocks have first
been completed.
Monitor and control the correct component sequencing during start-up and shut-down of
the equipment.
Conditionally allow the continued operation of the equipment only while certain safety
interlocks remaining satisfied.
Provide component condition feedback to the operator and, if so equipped, to the plant
control systems and/or data loggers

Provide automatic supervision when the equipment is in service and provide means to
make a Master Fuel Trip (MFT) should certain unacceptable firing conditions occur.

Proper attention to the design of the interlocks and trip system to provide a safe light up of the
boiler furnace is required.

Furnace Purge
Before any fuel firing is permitted, either initially or after a boiler trip, a satisfactory
furnace purge cycle must be completed. Prior to starting a furnace purge cycle, the operator must
ensure that the following purge requirements are satisfied:

Drum level within operating range (not high, not low)

Instrument air header pressure within operating range
Fan is in service
Purge airflow capable of a minimum of 70% of the full load airflow
established through the unit.
All flame scanners reading "No Flame"
Natural gas block valves are proven closed
Fuel oil block valves are proven closed
Air dampers are in the fully open position
Natural gas, or fuel oil, header pressure upstream of block valve is
satisfactory
Pilot gas header pressure is satisfactory
Burner Control System is energized
A "No Master Fuel Trip condition" condition is established

As each of the above conditions is reached, their respective indicator lights shall
illuminate as "PURGE PERMISSIVES" on the operator control console.
Once all of the above conditions are satisfied, the "PURGE AVAILABLE" light shall
illuminate indicating that the START PURGE switch is enabled by the system logic. Activating
the START PURGE control, when the "PURGE AVAILABLE" light is illuminated, will begin a
timed furnace purge cycle as indicated by a "PURGE IN PROGRESS" light illuminating. As
indicated in NFPA 8501, section 6-2.4.1(i), the purge shall be ...sufficient for at least eight air
changes of the furnace.
If the operator is starting the boiler from the cold condition, or restarting after a Master
Fuel Trip event, the procedure outlined in the following paragraphs is required. If the boiler is
recycling or otherwise starting from a warm condition, the MFT circuit will reset automatically
and the procedure will skip directly to the main flame light off sequence.

At the end of the purge cycle, and providing that the purge requirements remained
satisfied, the damper control shall position the inlet damper for light-off, approximately 10% to
30% airflow, depending on burner design, required turn-down, etc. The "PURGE COMPLETE"
light will illuminate and the boiler trip circuit shall be ready for reset, and so indicated by a
"MFT RESET" light.
Provided the start-up permissive remain satisfied, the system shall initiate a burner
startup period timer set for no more than 10 minutes. If the operator does not initiate a start-up
within this time, the boiler control system will exit the PURGE COMPLETE condition and the
operator must begin again with the pre-purge cycle. If the MFT has been reset, the boiler control
system will trip the MFT when leaving the PURGE COMPLETE condition.
Upon completing a satisfactory purge, the operator must press the RESET MFT
pushbutton. The boiler control system will indicate that the MFT has been reset with a steady on
MFT RESET light. At this point, the boiler control system is ready to allow the main flame
start-up sequence.

Main Flame Start-Up Sequence

The main flame start-up sequence, from the lighting of the pilot flame through main
flame light-off, is an automated sequence. Once the start-up sequence has begun, only the
BOILER STOP switch and the EMERGENCY STOP will interrupt the start-up sequence.
Any interruption of the start-up sequence requires a post-fire purge prior to attempting to start the
boiler again. To initiate the start-up sequence, the operator activates the START BOILER
switch.

Pilot Flame Light-Off

Before the burner can be started, satisfactory light-off conditions for the pilot and main
burners must be met. This is accomplished when the following conditions are satisfied:
For the pilot igniter:
1. MFT relay reset
2. Pilot gas header pressure normal
For natural gas:
1. All of the above mentioned for the pilot igniter
2. Natural gas pressure normal
3. Natural gas control valve is in light-off position
For fuel oil:
1. All of the above mentioned for the pilot igniter
2. Oil gun is in place in the burner
3. Oil pressure is normal
4. Fuel oil atomizing interlocks are satisfied
5. Fuel oil atomizing medium is provided to the burner
6. Oil control valve is in light-off position
Other Conditions:
1. No MFT condition after purge

2. All flame scanners report no flame

3. All natural gas, or all fuel oil, block valves shown closed
4. All air dampers are in light-off position
Failure to meet any of these conditions shall prevent the burner light-off operation.
To light the pilot flame, the pilot header vent valve, and, for natural gas fuel, the natural
gas vent valve shall be closed by the boiler control system. Then, sequentially, the igniter
transformer is energized, the pilot gas block valves are open and a 10 second pilot ignition timer
starts counting down. When ignition timer cycle is completed, the igniter transformer is deenergized and the pilot flame scanner is checked by the control system. If the pilot flame is
present, the main flame light-off sequence continues.
If the pilot flame fails, the boiler control system initiates a pilot flame failure shutdown.
Additional attempts of pilot light-off are permissible provided a successful pilot light-off is made
within 10 minutes after the furnace purge.
Note that if the pilot flame continues to fail after several attempts, the boiler should be
inspected to determine the fault and the condition corrected.

Main Flame Light-Off

Once the pilot flame is made, the boiler control system opens the header block valves for
the selected fuel. A main flame light-off timer begins a 15 second countdown for natural gas, or
20 seconds for fuel oil, to establish and stabilize the main flame. At 5 seconds before time out,
the boiler control system closes the pilot block valves and opens the pilot vent valve. The
remaining 5 seconds are used to detect the main flame. For the typical dual flame scanner design,
a main flame failure shutdown is initiated if both flame scanners return a no flame signal to
the burner control system. This will generate a boiler trip, and another furnace purge will be
required. Once the burner is lit, the system is in the NORMAL RUN CONDITION and
combustion controls should be released to modulation control.

Burner Management System Sequence Of Operation

Burner Startup Check:
No trouble or shutdown condition
Safety Chain Check:

Burner Swing Out interlock ( limit switch )

Boiler Drum level Normal (Lo Level at 35%, Lo Lo Level at 26%)
Fuel oil temperature normal (Lo Level at 60 Degree Centigrade)
Drum pressure normal ( hi hi at 13.5 bars)
Fuel Gas Pressure ( Hi level at 250mbar)
Air damper closed (limit switch, Servo motor at zero level)

After the safety check the FD fan starts to move and the servo motor starts
to move towards high fire
Gas train Safeties:
Natural gas :
If the natural gas switch is selected the gas safety check starts

Natural gas emergency switch normal

Refinery gas emergency switch normal
Leak test
o Test 1 : Zero gauge test is checked between gas shut off valves
o Test 2 : Line Pressure is checked between the gas shut off valves.
(One valve opens for 5 sec)
If leakage test fails an alarm signal is generated
Refinery gas :
If the natural gas switch is selected the gas safety check starts

Natural gas emergency switch normal

Refinery gas emergency switch normal
Leak test
o Test 1 : Zero gauge test is checked between gas shut off valves
o Test 2 : Line Pressure is checked between the gas shut off valves
If leakage test fails an alarm signal is generated
During the gas safety checking the servo motor reaches high fire and
purging period (>45sec) starts.

After purging the servo motor starts moving towards low fire.
Ignition transformer opens for 3 sec and gas pilot valve open for 5 sec.
If flame is detected by the flame sensor the gas valve opens
Servo motor modulates according to the load changes.

Oil train Safeties:

After the startup safety check has been cleared the servo motor starts
moving towards high fire.
At the same time the oil train safety check starts
o Oil temperature normal (Lo level at 60 degree C)
o Burner motor contact closed
o Primary air pressure normal (pressure switch Lo level at 30 mbar)
o Operation indication ON
During the safety check the servo motor reaches the high fire
High fire limit switch closed and purging period starts (>45 sec).
After purging the servo motor starts moving towards low fire.
Pilot gas valve 1 and pilot gas valve 2 opens.
Ignition transformer opens for 3 sec and gas pilot valve open for 5 sec.
If flame is detected by the flame sensor the oil shut off valve 1 and oil
shut off valve 2 opens
Servo motor modulates according to the load changes.

S.No
1
2
3
4

Safety Check
Boiler Drum
level
Fuel oil
temperature
Boiler Drum
pressure
Fuel Gas
Pressure

26%

Trend
Lo Lo
Level

60 C

Lo Level

13.5
bars
250mba
r

Hi Hi
Level

Value

Lo Level

Startup sequence of BMS Controller

Startup Check

Automatic Startup Sequence not locked out in troubled or shutdown

condition.
Control loop closed
Flame detector detects no flame
Timers at starting position
Safety interlock circuit closed
Power supply voltage not more 15% below nominal level (220V 6Amp)

Purge
Electric power is supplied to the automatic sequence control.
The air damper position is controlled.
A check is made if the flame detector detects no flame, the plug in
module for the trouble indicator memory is in place, there is no trouble
lock out and the timer are in starting position.
At the same time Control contactor is energized through time element
for pre ignition and safety time.
Flame detector is energized.
Check is made for the whether the timing element for the pre-ignition
and safety time is in place.
Purge process will start only if the flame detector detects extraneous
light.
Safety interlock circuit is supplied with power
When the acknowledge of the Air damper in purge position is given
the timing element for the purge period starts
A flame signal during the purge period will cause a trouble shut-off.
Ignition
At the end of the purge period the control contactor switches on. The
signal for the end of purge energize and the signal for the air damper
for purging de-energizes
A check is made whether the timing element for the purge period is in
place
As soon as the acknowledgment of the ignition rate position is received
terminal 17+19 (ignition transformer and ignition valve for fuel) as well
as 29 (trouble signal muting) and 33 (Extraneous light safety control) is
energized.
The ignition system is turned on and the timing element for the preignition and the safety period start
At the end of the pre-ignition time terminal 17(ignition transformer) is
de-energized.

The terminal 22 (flame detection system) and 30 (flame failure signal)

are energized.
If the flame detector proves flame the terminal 23(Flame detection
system) is energized through 20 (fuel valve for oil gas firing)- with gas
firing through21(fuel valve for oil gas firing).
Fuel valves open and safety period starts.
At the end of the safety period the control contactor is switched off and
the terminal 19 , 18, 29 and 30 de energize and the terminal 25
( release of combustion control de-energize.
If the flame detector does not proves any flame during the ignition
period the automatic sequence control will lockdown at the end of the
post ignition period and the fuel valve will not be allowed to open.
If at the end of the ignition period if the main flame hasnt formed the
fuel valve will be closed after the startup safety time.The automatic
sequence will lock up and must be reset for a new start

BMS Startup Instruments and I/Os

Level Transmitter ( Boiler Drum Level)

o 3 Level Probes
Lo Level Switch
NC
Lo Lo Level Switch
NC
Hi Level Switch
NO
o 1 Level Transmitter
Supply Voltage
220V

3 DI

1AI

Temperature Transmitter ( Fuel Oil Temp) 1 AI

(Local Gauge Installed)

Pressure Transmitter ( Drum Pressure )

o DP Type Transmitter
o Supply Voltage
18-45 VDC
o Loop Resistance 250-600 Ohm

1 AI

Pressure Transmitter ( Primary Air Pressure)

o DP Type Transmitter
o Supply Voltage
18-45 VDC
o Loop Resistance 250-600 Ohm

1 AI

Solenoid Valves
o 2 Shut off valves ( Natural Gas Line ) 2 DO
Supply Voltage
220VAC, 205VDC
o 2 valves at pilot gas lines
2 DO
Supply Voltage
220VAC, 220VDC
o 2 Shut off valves ( Refinery Gas Line ) - 2 DO
Supply voltage 220V

Limit Switches
Burner Swing Out Interlock
Siemens
Low Fire ( Servo Motor at Low)
High Fire ( Servo Motor at High)

1 DI
1 DI
1 DI

Pressure Switches
Pressure Switch Natural Gas Line 220V 3 DI ( NC)
Pressure Switch Refinery Gas Line 220V 3 DI ( NC)
FD Fan
1 DI

Fuel Gas Line Valve

Fuel Oil Main Line Valve

6 DO ( Solenoid Valve)
2 DO ( Solenoid Valve)

Servo Motor
Controller Type:
Supply Voltage:
DP Switch ( air )

RSE-P
220 V

Flame Detector
Model Number:
FLA (Signal Amplifier)
Supply Voltage:
Output

Leak Test Module

Ignition Transformer

FLUS 03
220 V
1 DI

2 DO ( Solenoid Valves)
1 DI (Pressure Switch)
Supply 220 Volts
1 DO

Boiler Panel IOs

Level Transmitter ( Boiler Drum Level)

o 3 Level Probes
Lo Level Switch
NC
Lo Lo Level Switch
NC
Hi Level Switch
NO
o 1 Level Transmitter
Supply Voltage
220V

3 DI

1AI

Temperature Elements (RTD)

Flow Transmitter ( Feed Water )

o P Type Transmitter
o Supply Voltage
24 VDC

Flow Transmitter ( steam Flow)

o DP Type Transmitter
o Supply Voltage
24 VDC

Flow Transmitter ( Natural Gas )

o DP Type Transmitter
o Supply Voltage
24 VDC

1 AI

Flow Transmitter ( Refinery Gas )

o Vortex flow meter
o Supply Voltage
24 VDC

1 AI

O2 Analyzer

1 AI

6 RTD inputs
1 AI

1 AI

Oil Temperature
Local Gauges installed
Indicators
Flame Failure
Flame Detector Fail Signal

1DI

Ignition Successful
Flame Detector Fail Signal

1DI

Hi Fire
Limit Switch

1DI

Lo Fire
Limit Switch
FD Fan on
(Pressure Switch Main Air Duct)
Panel Healthy
Supply On
Alarm
Reset
Lamp
Trouble
Air
Primary Air
Oil Valve Open
Gas Valve Open
Natural Gas
Refinery Gas

1DI
1DI
1DI
1DI
1DI
1DI
1DI
1DI
1DI
1DI
1DO
1DO
1DO
1DO

Auxiliary
Flow Transmitters
Type
Signal
Supply Voltage

Vortex Flow Meter

AI (4 20 mA)
24 V

Flow Transmitters
Type
Signal
Supply Voltage

Vortex Flow Meter

Pulse Type Input
24 V

Dearator
AB Plant Offsite
Lummus
HBUs Reformer
Steam to HCU
Steam to field offsite
Steam to AB Plant
Steam to offsite
S/Water to Dearator
Cond to Dearator
R/Water to DWTP
Steam to PMB
Instrument Air
HP Gas

Enunciators

Level
o
o
o

Probe
Dearator drum level Lo Lo
Dearator drum level Lo
Dearator drum level Hi

Pressure Switch
o Pressure Switch
o Pressure Switch
o Pressure Switch
o Pressure Switch
o Pressure Switch
o Pressure Switch

1 DI
1 DI
1 DI

(Instrument Air Lo)

(Main Gas Line Low)
(Feed Water Header Low)
(Fuel Oil Low)
(Raw Water Header Low)
(Steam)

1
1
1
1
1
1

DI
DI
DI
DI
DI
DI

Steam Temperature

1 DI

Indicator
Alarm
Reset
Accept
Lamp Test
Reservoir

1DO
1DO
1DI
1DI
Dearator Instruments

Level Probes

Level
o
o
o

Level Transmitter
o Supply Voltage
o Signal

Probe
Dearator drum level Lo Lo
Dearator drum level Lo
Dearator drum level Hi

1 DI
1 DI
1 DI

24 VDC
AI

Pressure Transmitter
o Supply Voltage
o Signal

24 VDC
AI

Control Valve (Feed Water Line)

Solenoid Valves ( To Be Installed)

o Raw Water and Feed Water
Three Element Loop
Ys100 Controller
Steam Flow
Type
Signal
Supply Voltage

Vortex Flow Meter

AI / Pulse Type Input
24 VDC

Feed Water Flow

Type
Signal
Supply Voltage
Level Transmitter

Vortex Flow Meter

AI / Pulse Type Input
24 VDC

Supply Voltage
Signal

24 VDC
AI