Anda di halaman 1dari 58

e ida.

com
excellence in dependable automation

Introduction to Burner
Management Systems
On-line Lesson

Welcome to the exida.com on-line lesson, Introduction to Burner


Management Systems. In this lesson we will introduce burner safety and the
systems used to achieve that safety.

e ida.com
excellence in dependable-automation

Prerequisite and Companion Lessons


Introduction to Safety Instrumented
Systems
Burner Management System Safety
Functions

It is recommended that the exida on-line lesson, Introduction to Safety


Instrumented Systems, may be helpful as a prerequisiste lesson for those
not familiar with functional safety systems. As a companion lesson, Burner
Management System (BMS) Safety Functions, will show typical safety
functions for a BMS system.

e ida.com
excellence in dependable-automation

General Lesson Objectives


Review general operation of combustion equipment
Understand the hazards associated with combustion
equipment
Understand basic operation of Burner Management
System (BMS)
Develop an understanding of NFPA, ISA and IEC
standards and their requirements for BMS systems

Copyright 2002, exida.com

Over the duration of this course the participant will:


Review general operation of combustion equipment
Understand the associated hazards
Understand basic operation of a BMS
Develop an understanding of the major standards that apply to a BMS

e ida.com
excellence in dependable-automation

Boiler Components - FireBox


FIREBOX (WINDBOX)
9Ignition of fuel(s) takes place with proper air mixture
9Air and fuel Mixing takes place
9This air is referred to as the Primary Air

Stack

HRA

Fuel
Furnace

ID Fan
Windbox
FD Fan
4

Copyright 2002, exida.com

First, we will examine the basic components of combustion equipment. A


good place to start in the firebox. Fuel and air are mixed in the Firebox
(sometimes called Windbox). Ignition takes place in the Firebox.

e ida.com
excellence in dependable-automation

Boiler Components - Furnace


FURNACE
9Heat release takes place to heat boiler tubes
9Combustion of fuel(s) takes place with proper air mixture
9Heat from other source such as Gas turbine

Stack

HRA

Fuel
Furnace

ID Fan
WindBox
FD Fan

Copyright 2002, exida.com

Heat is released from combustion inside the Furnace. Much of that heat is
transferred into boiler tubes contained inside the furnace.

e ida.com
excellence in dependable-automation

Boiler Components - Fans


FD Fan (Forced Draft)
Provides the combustion air
into the boiler
Stack

ID Fan (Induced Draft)


Pulls flue gas from boiler.
Controls the furnace pressure

HRA

Fuel
Furnace

ID Fan
WindBox
FD Fan
6

Copyright 2002, exida.com

Fans are used to maintain proper draft. The FD fan provides combustion air
into the boiler. The ID fan pulls flue gas from the boiler. The pressure inside
the boiler is controlled with this fan.

e ida.com
excellence in dependable-automation

Boiler Components PreHeater/Economizer


Combustion air Preheater

Economizer

Cools flue gas


Minimize/reduce heat loss to the
stack
Heats combustion air entering
furnace

Cools flue gas


Minimize/reduce heat loss to the stack
Heats feedwater to boiler drum
Stack
HRA
Economizer

Fuel
Air Heater

Furnace

ID Fan
WindBox
FD Fan

Copyright 2002, exida.com

In some cases, a Combustion Air Preheater in combination with an


Economizer extracts energy from the flue gas and preheats the combustion
air.

e ida.com
excellence in dependable-automation

Boiler Components Superheater/Drums


Superheater
Reduce Moisture in Steam
Superheated steam required for turbines

Superheated
Steam

Steam Drum

Stack

Feedwater to boiler
Steam to headers

HRA
Drum

Economizer

Fuel
Air Heater

Furnace

ID Fan
WindBox
FD Fan

Copyright 2002, exida.com

A Steam Drum is used to provide feedwater to the boiler. In some cases a


superheater is used to provide superheated steam required for turbines.

e ida.com
excellence in dependable-automation

Boiler Components Control Systems


Firing Demand based on Steam Required
Combustion Control
Fuel flow control
Air flow control
Furnace Draft = Fan Control (ID Fan)
Drum Level = Feedwater Control

Superheated
Steam
Stack
HRA

Drum

Economizer

Fuel
Air Heater

Furnace

ID Fan
WindBox
FD Fan

Copyright 2002, exida.com

The control systems used include control of the firing demand based on the
need for steam. This is done by controlling fuel flow and air flow. The
firebox pressure is controlled with the ID fan speed. The water level in the
drum is also controlled.

e ida.com
excellence in dependable-automation

Consequences of Furnace Mis-Operation


Physical explosion of the steam drum and
piping
Vapor Cloud Explosion (VCE) of Fuel Gas
and/or Coal Dust in Furnace/Firebox
Pool Fire of Fuel Oil
Implosion of the Furnace (Typically not a
safety concern)

10

Copyright 2002, exida.com

There are a number of consequences when the combustion equipment is


not operated correctly. These include:
Physical explosion if the steam drum and piping
Possible vapor cloud explosion of fuel gas or coal dust
Possible pool fire of fuel oil
Possible implosion of the furnace itself.
Depending on circumstances, there are possible human injuries, human
death, environmental consequences and severe economic consequences.

10

e ida.com
excellence in dependable-automation

Causes of Furnace Explosions


Statistics indicate Human Error is a contributing factor in the
majority of explosions
Errors are the Result of:
Lack of understanding of, or failure to use proper
operating procedures, safeguards and equipment
Unfavorable operating characteristics of equipment or
control
Lack of functional coordination of the various
components of the steam generating system and its
components
These failures justify the use of automatic light-off
11

Copyright 2002, exida.com

Studies of furnace explosions often point to human error as a contributing


factor. While there were a number of reasons for this, most international and
national combustion safety standards now require automatic startup and
ignition of combustion equipment.

11

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9Leaks can create potential fire hazards
9Required atomizing steam system
9Water or sludge in fuel oil storage tanks
cause plugging
9Widely different characteristics from single
or multiple sources
12

Copyright 2002, exida.com

Common hazards are involved in the combustion of solid, liquid and gaseous
fuels. Each of these fuels have special hazards related to its physical
characteristics. The following items must be considered in the design of
the firing systems for oil fuels
(a) Fuel oils have high volumetric heats of combustion; therefore, even small
leaks can create potential fire hazards.

12

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9Leaks can create potential fire hazards
9Water or sludge in fuel oil storage tanks
cause plugging
9Widely different characteristics from single
or multiple sources

13

Copyright 2002, exida.com

Water or sludge in fuel oil storage tanks or improperly located suction


takeoffs from the storage tank could result in hazardous interruptions or
pulsations of the fuel supply to the burners. A flameout, either
immediately or later, could result due to plugged strainers in the burner
tips.

13

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9Leaks can create potential fire hazards
9Required atomizing steam system
9Water or sludge in fuel oil storage tanks
cause plugging
9Widely different fuel characteristics from
single or multiple sources
14

Copyright 2002, exida.com

Widely different characteristics of fuel oil from either a single source or


multiple sources could result in a significant change in Btu input rate to
the burner(s) without an equivalent change in airflow or without an
appropriate change in fuel oil temperature needed to restore the flowing
viscosity to the proper value. Different shipments of fuel oil with dissimilar
characteristics can cause a precipitation of sludge that can lead to
hazards

14

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9 Many boilers designed to fire both heated and unheated
fuels
9 Viscosity of fuel varies considerably and special viscosity
control equipment may be required
9 Fuel oils have low conductivities and may generate static
electricity
9 Incompressibility of fuel oil cause very rapid transients
9 Initial firing of a cold boiler may cause special soot
problems

15

Copyright 2002, exida.com

On installations designed to fire both heated and unheated fuel oils,


consideration shall be given to the design of the burner control system to
ensure proper interlocks are activated for the selected fuel oil. Similar
consideration shall be given to the fuel oil piping supply to the burner as
well as the oil recirculating piping to the fuel storage tanks, depending on
the arrangement of the equipment provided.

15

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9 Viscosity of fuel varies considerably and special viscosity
control equipment may be required
9 Fuel oils have low conductivities and may generate static
electricity
9 Incompressibility of fuel oil cause very rapid transients
9 Initial firing of a cold boiler may cause special soot
problems

16

Copyright 2002, exida.com

Proper pumping and atomization of fuel oils are dependent upon control of
viscosity. Changes in viscosity in relation to temperature vary for different
oils and blends of oils. Very close attention shall be given to the design
and operation of viscosity control systems for each fuel where the source
or properties are variable.

16

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9 Fuel oils have low conductivities and may
generate static electricity
9 Incompressibility of fuel oil cause very rapid
transients
9 Initial firing of a cold boiler may cause special soot
problems

17

Copyright 2002, exida.com

Clear distillate fuels have low conductivities and generate static electrical
charges in the fuel stream that can be dangerous unless flowing
velocities are limited.
NOTE: See NFPA 77, Recommended Practice on Static Electricity, and API
RP 2003, Recommended Practice for Protection Against Ignition arising
out of static, lightning, stray currents.

17

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9 Incompressibility of fuel oil cause very rapid
transients
9 Initial firing of a cold boiler may cause special
soot problems

18

Copyright 2002, exida.com

The incompressibility of fuel oil can create very rapid transients in oil flow
through operating burners under the following conditions:
1. The rapid operation of an oil supply valve;
2. The rapid operation of individual burner shutoff valves;
3. The rapid operation of a regulating valve in the return oil line from the
burner header (on systems using this type of control).
The equipment must be designed to withstand this transient pressure without
creating leaks or other equipment failures.

18

e ida.com
excellence in dependable-automation

Oil Firing Special Problems


9 Incompressibility of fuel oil cause very rapid
transients
9 Initial firing of a cold boiler may cause special
soot problems

19

Copyright 2002, exida.com

Automatic soot blowing equipment must be operated in accordance with


manufacturers instructions. Special instructions often refer to situations
where the initial firing of a cold boiler may create excess soot and an
associated fire hazard.

19

e ida.com
excellence in dependable-automation

Gas Firing Special Problems


9
9
9
9
9
9
9

Gas is colorless and odorless


Hazard is increased within buildings
Hard to detect improper air/fuel ratio
Gas impurities can cause plugging or fouling
Widely different characteristics from multiple sources
Discharges from relief valves or vents
Maintenance and repair of piping

20

Copyright 2002, exida.com

The following items must be considered in the design of the firing systems
for gas fuels
Gas is colorless; therefore, a leak usually cannot be detected visually. In
addition, detection of a gas leak by means of odor is unreliable.
Potentially hazardous conditions are most likely to occur within buildings,
particularly where the gas piping is routed through confined areas. In the
latter situation, adequate ventilation shall be provided.

20

e ida.com
excellence in dependable-automation

Gas Firing Special Problems


9
9
9
9
9
9
9

Gas is colorless and odorless


Hazard is increased within buildings
Hard to detect improper air/fuel ratio
Gas impurities can cause plugging or fouling
Widely different characteristics from multiple sources
Discharges from relief valves or vents
Maintenance and repair of piping

21

Copyright 2002, exida.com

The nature of fuel gas makes it possible to experience severe departures


from proper air/fuel ratios without any visible evidence at the burners,
furnace, or stack that could escalate into a progressively worsening
condition. Therefore, combustion control systems that respond to reduced
boiler steam pressure or steam flow with an impulse for more fuel shall be
considered potentially hazardous.
This also shall apply to manual firing.
NOTE: A safety instrumented function designed to prevent a fuel-rich
mixture is needed to protect against this hazard.

21

e ida.com
excellence in dependable-automation

Gas Firing Special Problems


9
9
9
9
9
9
9

Gas is colorless and odorless


Hazard is increased within buildings
Hard to detect improper air/fuel ratio
Gas impurities can cause plugging or fouling
Widely different characteristics from multiple sources
Discharges from relief valves or vents
Maintenance and repair of piping

22

Copyright 2002, exida.com

Natural gas can have many impurities. These cause plugging or fouling of
smaller lines. Natural gas can be either "wet" or "dry." A wet gas usually
implies the presence of distillate, which can be characteristic of a particular
source. In the case of such a wet gas, the carryover of distillate into the
burners could result in a momentary flameout and possible re-ignition. Reignition could result in a furnace explosion. Therefore, special precautions
shall be taken with wet gas supply systems.

22

e ida.com
excellence in dependable-automation

Gas Firing Special Problems


9
9
9
9
9
9
9

Gas is colorless and odorless


Hazard is increased within buildings
Hard to detect improper air/fuel ratio
Gas impurities can cause plugging or fouling
Widely different characteristics from multiple sources
Discharges from relief valves or vents
Maintenance and repair of piping

23

Copyright 2002, exida.com

Natural gas can discharge from relief valves or vents. If ignited, this can be
the cause of explosions.
The maintenance and repair of piping is more hazardous with natural gas as
gas must be purged from lines for safe maintenance.

23

e ida.com
excellence in dependable-automation

Coal Firing Special Problems


9
9
9
9
9
9
9
9
9
9

A Small amount of coal can form explosive mixture


Coal undergoes considerable processing
Methane can be released in storage
Raw coal contains considerable impurities
Pulverized coal is conveyed thru pipes
Pulverizer system explosions
Pulverizer system must be tightly integrated with burner(s)
Equalizing transport air velocities
Necessary to dry coal for pulverizer
Difficult to measure combustibles
24

Copyright 2002, exida.com

There are also a number of special issues to be considered when coal is the
fuel. The key point is that different hazards may be present depending on
fuel type. All such hazards must be identified and addressed with sufficient
protection. The safety lifecycle is becoming the most commonly used
method process to address the necessary protection.

24

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


What investigators
say they believe
happened during
the annual boiler
maintenance
shutdown to cause
the Feb. 1 blast at
the Ford Rouge
power plant.

25

Copyright 2002, exida.com

A study of one boiler explosion provides some insight.

25

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


1. Noon: A crew on
the east side of the
boiler works to
insert a blanking
piece into the
natural gas supply
line to seal off the
flow. A crew on the
west has inserted
theirs.

26

Copyright 2002, exida.com

At around noon a crew on the east side of the boiler inserted a blanking
piece into the natural gas supply line to seal off the flow. It is believed that
the blanking plate was not fully inserted.

26

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


2. The east side
main gas valve is
open.

27

Copyright 2002, exida.com

The east side main gas valve was open.

27

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


3. 12:45 p.m.: Pilot
burner valves are
opened from a
control room to
purge any
remaining gas from
supply lines
through the boiler.

28

Copyright 2002, exida.com

Pilot burner valves were opened to purge any remaining gas from supply
lines through the boiler.

28

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


4. Gas flows into
the furnace and
builds up.

29

Copyright 2002, exida.com

However, it is believed that gas flowed from the east side supply line into the
furnace and slowly built up.

29

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


5. About 1 p.m.:
Explosion.
Investigators
believe an electric
spark in an
electrostatic
precipitator, which
is a pollutioncontrol device, may
have ignited gas
flowing through the
furnace exhaust.

30

Copyright 2002, exida.com

About an hour after the maintenance action, an explosion occurred. The


ignition was believed to be an electrostatic precipitator, a pollution control
device.

30

e ida.com
excellence in dependable-automation

Case Study: Ford Rouge Power House


State inspectors
say a double block
and bleed venting
system probably
would have
prevented the gas
buildup that led to
the explosion.
Outside consultants
had recommended
installation of such
a system.
Sources: Department of Consumer and Industry Services, Bureau of Construction Codes Boiler Division; Free Press research by Mark
Thompson-Kolar
GENTRY J. SLEETS/ Detroit Free Press

31

Copyright 2002, exida.com

State inspectors state that a double block and bleed valve probably would
have prevented the gas buildup that led to the explosion.

31

e ida.com
excellence in dependable-automation

1997 - 1999 Power Boiler accidents


Injuries

73

12

Deaths

1058
Accidents

From The National Board of Boiler and Pressure Vessel Inspectors


32

Copyright 2002, exida.com

Combustion equipment presents many hazards. A compilation of the total


number of Power boiler incidents for 1997 thru 1999 in the United States
shows many accidents with some injuries and deaths.
It is easy to estimate that the economic consequences were quite high.
NOTE: The source is The National Board of Boiler and Pressure Vessel
Inspectors.

32

e ida.com
excellence in dependable-automation

Burner Management Systems (BMS)


Alternate Names

Burner Safety Systems


Burner Control Systems
Combustion Safeguards
Flame Safeguard System
Safety Shutdown Systems
Furnace Safeguard Systems
Boiler Safety Systems
Emergency Shutdown Procedures
33

Copyright 2002, exida.com

Burner Management Systems (BMS) are designed to protect against such


hazards. These systems have had many different names.

33

e ida.com
excellence in dependable-automation

Burner Management Functions


The Old BMS DEFINTION
The Burner Management System (BMS) is a system to monitor/control
the FUEL BURNING EQUIPMENT during all start-up, shut-down,
operating and transient conditions.

PURPOSE
To protect against start-up when unsafe conditions exist.
To protect against the unsafe operating conditions and admission
of improper quantities of fuel to the furnace.
Provide the operator with status information
Initiate a safe operating condition or shut-down procedure if
unsafe condition exists.
34

Copyright 2002, exida.com

The scope of BMS attention has increased to a more comprehensive level.


Consider the the old BMS (circa 1988) definition taken from the NFPA 85C.
It focused on the FUEL BURNING EQUIPMENT.

34

e ida.com
excellence in dependable-automation

Burner Management Functions


Todays BMS DEFINTION
The control system dedicated to boiler furnace safety and operator
assistance
Key is to look outside the Firebox!

35

Copyright 2002, exida.com

This is an excerpt from the 1995 NFPA 8502 Standard for the prevention of
Furnace Explosions/Implosions in Multiple Burner Boilers. It explicitly covers
the entire safety of the boiler and does not just look at the burners.
This is consistent with newer standards that ask for a comprehensive review
of possible hazards and risk reduction methods.

35

e ida.com
excellence in dependable-automation

Standards Covering Burner Management


Systems (BMS)

NFPA
FM - Factory Mutual
UL Underwriters Lab
ISA 84.01
IEC 61508/61511
CGA Canadian Gas
Association
36

Copyright 2002, exida.com

There are a number of design documents that apply to burner management


systems. Some have a long history and are rather prescriptive (e.g., NFPA).
Some are more recent, and as is the trend, are generic and performance (or
goal) oriented (FM, IEC, & ISA).
NOTE:
NFPA has combined BMS standards into its 85 standard. This combined the older standards:
NFPA 8501-1992 Single Burner Boiler Operation. The standard, formerly known as NFPA 85A, applies only to
boilers with a single burner and a fuel input rating greater than 12,500,000 Btu/hr (3.6MW) or output of
approximately 10,000 lbs/hour.
NFPA 8502-1995 Prevention of Furnace Explosions/Implosions in Multiple Burner Boilers. This standard, formerly
known as NFPA 85C, applies to boilers with multiple burners and a fuel input rating greater than 12,500,000
Btu/hr (3.6MW) or output of approximately 10,000 lbs/hour. It is a compilation of four formerly individual NFPA
standards:
NFPA 85B (Natural Gas-Fired)
NFPA 85D (Fuel Oil-Fired)
NFPA 85E (Pulverized Coal-Fired)
NFPA 85G (Prevention of Furnace Implosions)
The purpose of the NFPA 85 series of standards is to prevent furnace explosions and implosions. They define the
Burner Management System as: The control system dedicated to boiler furnace safety and operator assistance in
the starting and stopping of fuel preparation and burning equipment and for preventing misoperation of and
damage to fuel preparation and burning equipment.
The NFPA is not involved in any way with the enforcement of these standards. However, insurance companies,
regulatory agencies, and company standards often require compliance with the NFPA standards.

36

e ida.com
excellence in dependable-automation

NFPA Standards
8501 - Single Burner
8502 - Multiple Burner
(Previously 85C)
8503 - Pulverized Fuel
8504 - Fluidized Bed
Boilers
8506 - Ovens & Furnaces

37

ANSI/NFPA 85C An American National Standard August 16, 1991


ANSI/NFPA 85C An American National Standard August 16, 1991

NFPA
NFPA85C
85C
Prevention
Preventionof
ofFurnace
Furnace
Explosions/Implosions
Explosions/Implosions
in
inMultiple
MultipleBurner
Burner
Boiler-Furnaces
Boiler-Furnaces
1991
Edition
1991Edition

National Fire Protection Association 1 Batterymarch Park, POBox 9101, Quincy, MA 02269-9101
National Fire Protection Association 1 Batterymarch Park, POBox 9101, Quincy, MA 02269-9101

Copyright 2002, exida.com

National Fire Protection Association (NFPA) standard 85 is probably the


most recognized standard worldwide for combustion systems safety. The
current standards are quite prescriptive with very specific design
requirements.

37

e ida.com
excellence in dependable-automation

NFPA Standard covers entire lifecycle.


9Design
9Installation
9Operation
9Maintenance

38

Copyright 2002, exida.com

The standard does provide requirements for the lifecycle of a BMS.

38

e ida.com
excellence in dependable-automation

NFPA 85
General Requirements
The logic system for burner management
shall be designed specifically so that a
single failure in that system does not
prevent an appropriate shutdown.

39

Copyright 2002, exida.com

The standard has a general requirement that the logic system be designed
specifically so that a single failure does not prevent an appropriate
shutdown. This is equivalent to the IEC61508 and IEC 61511 requirement
for a hardware fault tolerance of 1.

39

e ida.com
excellence in dependable-automation

NFPA 85
Failure Effects
The logic system designer shall evaluate the failure modes of
components where considering the design application of the system. As
a minimum, the following failures shall be evaluated and addressed:

Interruptions, excursions, dips, recoveries, transients, and


partial losses of power
Memory corruption and losses
Information transfer corruption and losses
Inputs and outputs (fail-on, fail-off)
40

Copyright 2002, exida.com

The standard requires that the designer evaluate the failure modes of
components used in the system to insure the general requirement that no
single failure will prevent a safety function.
A checklist of possible failure modes is given. The BMS system should
continue proper operation or fail-safe.

40

e ida.com
excellence in dependable-automation

NFPA 85
Failure Effects (cont.)
The logic system designer shall evaluate the failure modes of
components where considering the design application of the
system. As a minimum, the following failures shall be evaluated
and addressed:

Signals that are unreadable or not being read


Failure to address errors
Processor faults
Relay coil failure
Relay contact failure (fail-on, fail-off)
Timer failure
41

Copyright 2002, exida.com

Many different failure modes of the components must be considered


and analyzed as part of the design effort.
For each component failure mode, the system must either continue
successful operation or fail-safe.

41

e ida.com
excellence in dependable-automation

Typical PLC wiring for diagnostics


Output Module
H

Trip
WD WD Relay

H
L

TR
WD

Power Supply

Input Module

Output Module
H

TR
Fuse

Input Module
H

Trip
Alarm

Load

Typical for 1 of 8 channels

42

Copyright 2002, exida.com

Many BMS designers add redundant hardware and diagnostic


hardware to meet the requirements of the standard.
This drawing shows ONE functional output of a PLC logic system.
Extra inputs are added to check output operation. An extra output is
added with an external watchdog timer that will de-energize outputs
if the processor does not continue its periodic update.
The design can get quite complicated.

42

e ida.com
excellence in dependable-automation

Safety Certified PLC design


H
Power/Fuse
Monitor

Fuse

Output
Module

Watchdog
Circuit(s)
Diagnostic
Cut-Off
Relay

Relay
Control

Microprocessor

Relay
Monitor

Typical for 1 of
8 channels
Output
Readback
Output
Command

Output
Switch
Monitor

Output
Protection
Circuit

Solid-State
Switch

I/O

Fuse

Load

43

Copyright 2002, exida.com

Many BMS designers choose safety certified equipment that has been
designed to meet many functional safety standards including BMS
standards. This type of equipment meets failure effect requirements
without external components or special design effort.

43

e ida.com
excellence in dependable-automation

NFPA 85
Design
Logic shall not be changed while the associated
equipment is in operation.
Diagnostics shall be included in the design to monitor
processor logic function.
Logic system failure shall not preclude proper operator
intervention.
Logic shall be protected from unauthorized changes.

44

Copyright 2002, exida.com

In addition to failure effect requirements, NFPA has design requirements.


These include the need to prevent changes in the logic when the equipment
is operating.
There is a requirement that diagnostics be programmed into the logic to
insure proper processor operation. The logic must not preclude operator
intervention and the logic must be protected from unauthorized changes.

44

e ida.com
excellence in dependable-automation

NFPA 85
Design (cont.)
System response time (throughput) shall be sufficiently
short to prevent negative effects on the application.
Protection from the effects of noise shall be adequate to
prevent false operation.
The operator shall be provided with a dedicated manual
switch(es) that shall actuate the master fuel trip relay
independently and directly.

45

Copyright 2002, exida.com

The designer must be careful about equipment response time and electrical
noise. Systems must include a dedicated manual switch to directly stop the
fuel source.

45

e ida.com
excellence in dependable-automation

NFPA 8502
Requirements for Independence
Shall not be combined with any other logic system
The logic system shall be limited to one boiler
Independent logic, I/O systems, Power supplies,
functionally and physically separated from other
systems
The same Hardware type can be used for other logic
systems
Data Highway communications, but not for trip signals
A trip will require operator action prior to restarting
46

Copyright 2002, exida.com

There is a requirement that the logic be independent from other logic


systems and that it be limited to one boiler. Newer technology can be used
but must be independent.

46

e ida.com
excellence in dependable-automation

NFPA 8502
Maintenance and Inspection
An inspection and maintenance schedule shall be
established and followed
Operation, set points, and adjustments shall be verified
by periodic testing (and documented)
Defects shall be reported and corrected
System configuration (system, not just logic solver)
shall not be changed without evaluation and approval
Inspections, adjustments and repairs shall be
performed by trained personnel according to mfg.
recommendations and applicable standards
47

Copyright 2002, exida.com

Maintenance activities are also specified so that the entire lifecycle of the
equipment be considered.

47

e ida.com
excellence in dependable-automation

FM 7610
BMS Standard written for relay
based systems
Allen Bradley Burner Master (PLC5
based) FM approved per 7610 for
single burner applications.
Replaced by FM7605, December 1999
48

Copyright 2002, exida.com

Factory Mutual also writes standards for BMS equipment. The early
standard was created for relays based equipment but was used to approve a
programmable logic controller based on a microprocessor. This standard
was replaced in December 1999.

48

e ida.com
excellence in dependable-automation

FM 7605 Equipment Certification


BMS Standard written for compliance
with IEC61508.
WEquipment must be IEC61508 certified.
Hardware architecture for specified SIL
Software compliance for specified SIL

WManufacturing facilities examination.


WDemonstrated Quality and Reliability.
49

Copyright 2002, exida.com

FM standard 7605 builds upon an international functional safety standard


IEC61508. The FM standard requires that equipment for BMS applications
be functional safety certified per IEC61508. Other requirements in addition
to those of IEC61508 are listed as well.

49

e ida.com
excellence in dependable-automation

FM 7605 Equipment Certification


WRedundant components separated for common
cause strength
WNon-volatile memory for safety parameters
WControl system including flame scanner shall
respond within 4 seconds
WTrail-for ignition shall not exceed 10 seconds
WSingle automatic retrial for flame failure during
normal firing (under certain conditions)
50

Copyright 2002, exida.com

The FM standard has specific requirements for separation of redundant


components, non-volatile memory, response time and logic time limitations
and the requirement for a single retry on flame failure during normal firing.

50

e ida.com
excellence in dependable-automation

FM 7605 Equipment Certification


WEquipment must operate with power inputs
85-100 percent of normal
WEquipment shall be immediately operable
when the main power is turned on.
WEquipment Operating Temp. 0 60 C

51

Copyright 2002, exida.com

There are certain equipment strength requirements as well as operational


requirements.

51

e ida.com
excellence in dependable-automation

ANSI/ISA 84.01 Standard


Recognized by OSHA as industry accepted
good engineering practices.
Approved in 1994
Offers the Safety Lifecycle as a method for
SIS design
Risk reduction targets and compliance
measured by Safety Integrity Levels (SIL)

52

Copyright 2002, exida.com

The ISA 84.01 standard was not written specifically for BMS. It covers
functional safety of programmable equipment used in the process industries.
Since this standard was endorsed by OSHA in the United States it is
required on many BMS projects as well. This standard describes a lifecycle
approach to risk assessment and management using safety instrument
systems (SIS) as a risk reduction mechanism. A BMS is classified as a SIS.
The standard requires that risk reduction for specific hazards be classified
according to order of magnitude levels called safety integrity levels (SIL).
During risk analysis, a SIL target is assigned to each hazard and a safety
function is designed to prevent the hazard.

52

e ida.com
excellence in dependable-automation

Trips and Permissives


Trip Conditions and action taken to move
the heater to a safe state when a hazardous
condition is present (Master Fuel Trip)
Permissive Set of conditions that must be
met prior to an action being taken (Purge
Sequence)

53

Copyright 2002, exida.com

Safety functions are classified as either a trip (a shutdown) or a permissive.


A trip function looks for dangerous conditions and takes action to move the
process to a safe state. A permissive function looks for dangerous
conditions and prevents a process from moving to a dangerous state.

53

e ida.com
excellence in dependable-automation

Permissive - Furnace Purge System


(All Fuels)
All main, igniter, and individual
burner and igniter safety shutoff
valves are closed?

One set of ID and


FD fans running?

Are required burner


registers open?

Yes

Yes

Is air at purge rate?


Yes

Yes

Five-minute
time delay

Yes

Reset master
fuel trip relay(s)

54

Copyright 2002, exida.com

An important permissive safety function in a BMS is the furnace purge.


Ignition cannot be done unless the furnace has been purged of residual fuel.

54

e ida.com
excellence in dependable-automation

Fuel Gas Trip System


1.

Loss of igniter flame

2.

Igniter fuel pressure out of stable range

3.
See Note

Loss of ID fan

6.

Loss of ID fan

5. Cut back main fuel

8.

Combustion airflow low

9.

Excessive furnace pressure

10a.

Burner header fuel pressure high

10b.

Burner header fuel pressure low

11.

Loss of all flame

12.

Partial loss of flame introducing hazard

A
N
D

4. Loss of FD fan
7. Loss of FD fan

13.

All fuel inputs zero

14.

Manual trip switch

15.

Loss of individual burner flame with one or more additional


stable burner flames present

Master
Fuel Trip
Logic

Close igniter header and


individual igniter safety shutoff
valves and deenergize sparks

Master
Fuel Trip
Relay(s)
Close main safety shutoff
and individual burner safety
valves

Close individual burner safety shutoff valve(s) and


its individual igniter safety shutoff valve(s) and
deenergize the associated sparks

Note: Based upon two pairs of ID and IF fans; other


arrangements of fans affect actions in blocks 3, 4, 5, 6, and 7

Based on Figure 6-6.3.1.1 NFPA 8502

Typical Cause of
Trip Indication

Close individual igniter safety


shutoff valve(s) and
deenergize sparks

55

Copyright 2002, exida.com

Other trip safety functions in a BMS look for dangerous conditions and stop
the fuel flow, shutting down the combustion.

55

e ida.com
excellence in dependable-automation

Interlocks/Safety Functions
Light off Sequences
Trips vs. Permissives
Master Fuel Trip and Purge Sequence
Gas-Fired Systems
Oil-Fired Systems
Pulverized coal-fired systems

Safety Instrumented Functions

56

Copyright 2002, exida.com

A typical BMS includes safety functions for ignition (light off) sequences,
permissives and trips. The safety functions are different depending on fuel
type and BMS systems designed for multiple fuels and by necessity more
complicated.

56

e ida.com
excellence in dependable-automation

General Lesson Objectives


Review general operation of combustion equipment
Understand the hazards associated with combustion
equipment
Understand basic operation of Burner Management
System (BMS)
Develop an understanding of NFPA, ISA and IEC
standards and their requirements for BMS systems

57

Copyright 2002, exida.com

This lesson was intended to provide an introduction to BMS.


A description of combustion equipment was provided. A brief review of
some of the possible hazards was presented. Some of the standards
covering BMS were presented and a brief description of common safety
functions was presented. It should be understood that this lesson is not
comprehensive. Those designing and operating combustion equipment
have the responsibility to completely and thoroughly understand the hazards
and consequences of such equipment operation. Operation of such
equipment may require compliance with many local and regulatory
standards not covered in this lesson.

57

e ida.com
excellence in dependable-automation

Questions
Questions: please send any questions to
info@exida.com We will respond as soon as possible.
Additional Resources:
Free articles are available to download from the
exida.com website. These can be reached at
http://www.exida.com/articles.asp
Additional resources including books, tools, and reports
are available from the exida on-line store. A product
listing is available at http://www.exida.com/products2/
58

Copyright 2002, exida.com

If have any questions, they may sent via email to info@exida.com. Please
refer to this particular lessonIntroduction to Burner Management Systems.
exida.com is a knowledge company focused on system reliability and safety.
We provide training, tools, coaching, and consulting. For general information
about exida, please view our detailed website at www.exida.com.
Thank you for your interest. Please consider other lessons in the on-line
training series from exida.com.

58

Anda mungkin juga menyukai