The Application of Furnace Safety Supervisory System (FSSS) in the Oil-fired Utility Boiler

LI Qinghai1, ZHANG Yanguo1, REN Ganglian2, MENG Aihong1 & CHEN Changhe1
(1 Key laboratory for Thermal Science and Power Engineering of Ministry of Education, Tsinghua University, Beijing 100084, China; 2 Beijing Boiler Works, Beijing 100043, China)
Abstract: The boiler furnace explosion is a serious accident that must be avoided. There are more concerns about the loss of life, property, and production caused by boiler furnace explosions. In order to prevent furnace from exploding the furnace safety supervisory systems (FSSS) have been used in boiler safety control. This paper presents a FSSSs reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which produces CTA and PTA, a raw textile material. The boiler is a dual-fuel typeboiler, to which biomass and heavy oil can be fed simultaneously for combustion. This reference is implemented by Beijing Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration, precommissioning. A series of problems are met during the test and modified by the vendors and contractors. It is a long distance to catch the level of the developed countrys FSSS hardware such as flame scanner, on/off valve, pressure switch and so on. This paper presents a reference for FSSS in engineering field. Keywords: FSSS; Explosion; Furnace; Flame Detection; Utility boiler

1 Introduction
The boiler furnace explosion is a serious accident that must be avoided. The furnace explosion accident can be divided into two kinds, minus pressure explosion and plus pressure explosion. The boiler forced draft fan (FDF) and induced draft fan (IDF) failure usually leads to minus pressure explosion. Accumulation of unburnt combustible matter in furnace usually results in plus pressure explosion. There are more concerns about the loss of life, property, and production caused by boiler furnace explosions. In order to prevent furnace from exploding, the furnace safeguard supervisory system (FSSS) has been widely used in boiler safety control since 1950s in developed country[1,2,3]. With the large type of power generation unit imported from overseas, The FSSS is introduced to China in 1990s and early[4]. Successful use of FSSS in large boiler boosts its application in industrial boiler. At present the production processs safety is paid more attention to than before. The newly erected boiler is usually equipped with FSSS, which is to provide a back-up protection system to take shutdown action immediately and automatically, if there is any equipment failure, operating error, or both. Otherwise large pockets of unburnt explosive fuel (such as pulverized coal, nature gas, biomass, heavy oil and so on) and air mixture in the furnace will lead to exploding. The FSSS on industrial boilers may contain so many components distributed over such a large physical area that local operation and monitoring of the firing system by the operator in timely manner is practically impossible. Thus, an important secondary function of a FSSS is to make it possible to operate and monitor all firing equipment from a single remote location. A successful FSSS will take shutdown action without failure when monitored conditions deviate from preestablished safe limits, but competitive utility boiler operation cannot tolerate frequent nuisance outage. This means that extreme care must be taken on equipment selection, application, and adjustment and operation to keep the condition being monitored with preestablished safe limits at all times. This is sometimes overlooked, and when frequent outages occur, FSSS may be unduly damned, or even bypassed, just because they are doing their job. Obviously, the FSSS and its control interlock system must be selected and applied for extreme reliability, for failure of any small part will shut down an industrial boiler. However, the extreme reliability also means high financial cost. In the past, the overall set of FSSS is imported and it is very expensive. This paper presents a FSSSs reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which produces CTA and PTA, a raw textile material. The boiler is a dual-fuel type boiler, in which biomass and heavy oil can be fired simultaneously. The steam output from the oil-fired boiler meets the PTA production needs. This reference is implemented by Beijing Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration and precommissioning. The boilers are shown in Fig.1. The boilers have been operating from the Jan 2006 by now, for four months. The operation shows that this project is successful and the FSSS conducts its protective function slightly well.

2 FSSSs Hardware
103

Although the FSSS is very complex, it can be easily divided into four basic sections, for discussion and illustration, which are: (1) Logic system (2) Operators panel (3) Driven devices (4) Sensing elements The logic system is the brain of the FSSS. All operator initiated commands are routed to the logic system and the status of all sensing elements is monitored continuously by the logic system. The logic system is designed to evaluate the operating status of the complete firing system and to pass the operat or commands to the driven devices only if the logic section is satisfied that the proper safety conditions are present. Additionally, the logic section is designed to shut down any equipment whenever the boiler or the equipment itself would be damaged by its continued operation. The logic system configuration is shown in Figs.2, 3 and 4. In order to reduce the cost of FSSS, the FSSS logic system is incorporated with DCS and the non-key part is procured onshore. The FSSS processor is made by Honewell, USA. Operator Consoles in Main Control Room are based on Global User Stations (GUS) ZConsole. Global User Station (GUS) is the powerful and intuitive human interface to the Honeywell TotalPlant Solution (TPS) system. It connects operators directly to the process through preconfigured standard displays and through custom-built displays. GUS is equipped with Intel Pentium IV, single 19 TFT-LCD monitor, integrated keyboard with trackball. The history module (HM) is equipped with redundant 1.8 GB hard disk, redundant interface on LCN to provide mass storage. The network interface module (NIM) connects the two networks LCN and UCN. The high performance manager (HPM) controller is the core of logic system. The HPM is of redundant CPU, redundant power supply, redundant internal communication, redundant key I/O.

Fig.1 Side view of the oil-fired boilers

Fig.2 Architecture of FSSS

Fig.3 I/O marshalling and relay cabinet

Fig.4 Global user station (GUS)

The operators paned is furnished by LCD of DCS. The LCD displays operators actions, sequences and system alarms. When 104

LCD is coupled with a keyboard, it presents valuable information on boiler operation. The LCD allows the display of a great deal of information in a minimum of space. The operators panel contains the command devices, such as switches and pushbutton, for manipulating the firing system equipment, and feedback indicators, such as status lights, which display the status of the equipment to be controlled. All the switches, pushbutton, lights and so on are furnished by liquid crystal display (LCD). The operators panel of LCD is shown in Figs.5 and 6. Fig.5 is the interface of operator with logic system. Through the pushbuttons and lights operator can manipulate the burner, valve and watch its status feedback. The display of Fig.5 is completed by DCS vendors software. Fig.6 is a display to allow operate choose an item bypassing or not (detailed illustrated later). The driver devices control the admission of fuel and air to the boiler. Valve operators for oil and gas firing, feeder, air damper drives and fan motor inverter are typical of driven devices that may be controlled by the FSSS. In Fig.7 we can see the on/off branch oil valve that is used to cut the branch oil passage to burner. The on/off valve is driven by pneumatic actuator. The sensing elements, the devices for picking up process and equipment information, include pressure switches, temperature detector, flow meters, air flow monitoring devices, flame detectors, and limit switches. Fig.8 shows the furnace pressure switch installation and the flame detector can be seen in Fig.7. Driven and sensing elements, which are commonly called field equipment, are located throughout the fuel/air system with which we are concerned. These elements are monitored and controlled by the operator through the logic system (DCS). The driven device is of the deenergize-to-trip type (fail-safe). The deenergize-to-trip design energizes the driven elements to operate them and deenergizes them to shut them down. For example, the mail fuel trip valve would be energized to open and deenergize to trip. The branch fuel valves are designed to energize-to-trip. In this case of branch fuel trip valve, the opening coil would be momentarily energized to open the valve, and the close coil would be momentarily energized to close the valve. The sensing elements include items such as position limit switches on various valves and dampers, air and oil flow meters, pressure switches, pressure transmitters, and flame monitors for both the ignitor (LPG) and main fuel (oil) flames. For the detection of LPG flame, the ultraviolet flame scanners are used. The ultraviolet light is useful for flame detection because substantial quantities of it are given off by burning fossil fuel while very little of it is emitted by other sources or radiation in the furnace. For the detection of heavy oil flame, the visible light scanner is applied. The visible light in furnace is transmitted by optic cable to an electronic preamplifier. Then a photodiode converts the light signal to an electronic signal which is analyzed for specific intensity and frequency as well as the absence of a fault signal.

Fig.5 Operators panel for burner on LCD

Fig.6 MFT enable selection display

105

Fig.7 Burner in front of furnace

Fig.8 Furnace pressure switch installation

The oil-fired boiler is equipped with four burner (shown in Fig.7) that are located on front furnace wall and arranged to fire horizontally into the furnace cavity multiple. In the fired systems, the fuel is mixed with combustion air in individual burners. The burners have internal baffles separating the primary and secondary air into two concentric air passages. The degree of air swirl and the flow-shaping contour of the burner throat establish a recirculation pattern extending into the furnace. Once the fuel is ignited, the hot products of combustion are directed back toward the fuel nozzle to provide the ignition energy necessary for stable combustion. Every burner has two fuel guns, oil gun and gas gun. The gas gun is start-up gun for burner. The oil gun is normal load gun. Burners are started individually. The fuel nozzle is interlocked with the ignitor so that the fuel shutoff valve cannot be opened until the ignitor is placed in operation. Each ignitor is equipped with its own flame detector (visible light scanner and ultraviolet scanner). After opening the angle fuel shutoff valve (shown in Fig.7), the ignition continues in operation for timed period (usually ten to fifteen seconds) to allow ignition of the branch fuel input. At the end of this timed period, the ignitor is removed from service and the optical flame scanner must detect flame to continue operation of the branch fuel nozzle. Flame failure, determined by the flame scanner, will trip the fuel input to the burner. Once a burner is started, continued operation of that individual burner depends totally on flame detection by its associated flame scanner. The only 3/4 flame failures as determined by a flame scanner will trip the main fuel input valve. Every main fuel trip valve has four branch trip valves to connect with it. Every branch trip valve is responsible for one burner. A unique part of the FSSS is the flame failure protection system, which is designed to avoid nuisance shutdowns and yet retain good protective capabilities. Only when three of the four oil visible light scanners have no flame signal, the system begins to trip the main oil valve. The (liquid petrol gas) LPG is fired firstly by the ignitor, and then the heated heavy oil is ignited by the LPG flame energy. A flame detector must be provided with each ignitor, for gas gun and oil gun, to determine the presence or absence of stable flame.

3 Sofware Design and Configuration

The FSSSs interlocking depends on the physical characteristics of the firing system and type of fuel being fired. All safety systems of this type, however, incorporate the following procedures: A pre-firing purge of the furnace: Enforce a 5 minute flow of air through the furnace, at 30 percent above the design flow rate, to ensure that the purge will be adequate. Establishment of the appropriated permissive for firing the ignition fuel, i.e., purge complete, fuel pressure within limits, etc. Establishment of the appropriate permissive for the primary (heavy oil) and secondary (biomass gas) fuel, including ignition permissive. Monitor of the firing conditions and other key boiler operating parameters continuously. Emergently shut portion or all of the firing equipment down when required. Shut off fuels from an operating furnace when there is a fan or combustion-air failure. Shut off fuels, or prevent fuel valves from opening for light-off, if fuel pressures or oil temperatures and atomizing media pressures are not within proper limits. 106

The purpose of the pre-firing purge is to remove any unburned fuel that may have accumulated in the furnace prior to introducing an ignition source. This is done by passing air through the boiler at a specified rate (usually 30 percent of that required for rated boiler capacity) for a timed period while the fuel admission devices are proven closed (or off), and the flame monitoring devices indicate non-flame. This combination of conditions should ensure the removal of combustibles. These purge permissive requirements also provide a check on the proper operation of air damper, fuel admission, and flame sensing devices just prior to the firing. On completion of the purge, the boiler is ready to be fired. For the oil-fired boiler the 30 percent minimum airflow requirement is maintained until the boiler reaches 30 percent load (the 33 percent load is the normal load in this boiler) in order to assure an air rich furnace mixture during the entire start-up phase. A typical list of the conditions that cause a Master Fuel Trip (MFT) of the oil-fired boiler is as follows: (1)Loss of forced draft fan (IDF) (2) Loss of two all induced draft fans( IDF, two IDF for every boiler) (3) High high furnace pressure (+1 300 Pa) (4) Low furnace pressure (-1 100 Pa) (5) Low drum water level (-200 mm) (6) High drum water level (+200 mm) (7) Low deaerator water level (+900 mm) (8) Low instrument air pressure (0.3 MPa) (9) Flame failure (3/4 failure) (10) Low airflow (<30%) (11) Operators emergency trip pushbuttons depressed (manual MFT) The relevant logic diagram that includes above trip initiators is shown in Fig. 9. IF the MFT takes place the display as fig.6 will record the first initiator to lead the MFT. The lowest degree of automatic of an FSSS safety system is a supervised manual system in which the operator initiates the startup and shutdown of each individual piece of equipment, and that operation can be conducted by display in Fig.5. A supervised manual system can be designed for local operation or for remote operation from a remote operating panel. In our project a local valve control panel is put in front of the furnace. By the valve control panel operator can open and close relevant valve. The local panel has priority over the logic system. A switch is used to decide the valve is controlled by logic system or local panel. The system logic monitors the operators actions to watch whether they are being performed in the correct sequence and the system intervenes only when required to prevent a hazardous condition. A higher level of automation commonly specified allows an operator to place in service or remove from service a related group of firing equipment in the proper sequence by initiating a single command. A single operator command to start an oil gun would initiate the following appropriately timed sequence of events: (1) Associated igniter placed in service and ignitor flame proven (2) Associated LPG valve opened (3) Associated atomizing steam or air valve open (4) Associated oil valve open In order to make intelligent decision in the operation of the boiler, the operator must be provided a great deal of information regarding the status of controlled equipment and the monitored process conditions. The FSSS provides this information in the form of status indication on the operators panel (Figs.4 and 5). The operators panel is the means by which the boiler operator communicates with the logic system, the sensing elements, and the driven devices of the fuel firing system. This operator panel contains switches or pushbuttons for initiating the desired sequences for the boiler firing system operation. That is, switches are provided for such functions as start purge, open oil trip valve, start ignitor, master fuel trip and so on. The panel also provides the operator with indications of the status of equipment in the fuel burning system: valve open-close, ignitor on-off, etc.

107

& & & & & & & & &

S R S R S R S R S R S R S R S R S R

& &

S R S R

1
1

S R
1

&

Fig.9 MFT first out logic diagram

4 Precommissioning and operation

During precommissioning a series problems are met: (1) The main fuel cutoff valve refuses to work when the open or close signal is transmitted to the valve; (2) The pressure switch is corroded by rain water and loses its normal function; (3) The flame detector peeps the near burner flame; (4) The relay cabinet power failure; (5) The software configuration logic confused. The onshore procurement sensor and actuator quality mainly leads to problems mentioned above. Through improvement of vendors and careful test of operators this system is getting more and more mature. The low cost must be at expense of reliability reduction. However, the reliability can be reconciled by careful maintenance. In order to advance the reliability it is suggested that the key component should be selected the best.

Conclusions
In order to protect boiler from explosion and reduce the FSSSs cost, a FSSS incorporated with DCS is accomplished. The

hardware and software architectures are described in detail. Some software and hardware fault are met and resolved. The sensor and actuator are purchased onshore in China. The onshore procurement lowers the projects cost. Although the reliability of actuator is slightly less than that of the offshore, the reliability can be compensated by careful route maintenance. The FSSS is operating successfully. This paper provides a reference for boiler safeguard system.
References [1] Lovejoy, Gary R, Clark, Ian M. Furnace safety systems: current practice for safe and reliable control of industrial boilers. American Institute of Chemical Engineers 1982 Spring National Meeting and Chemical Plant Equipment Exposition, Preprints, Anaheim, Calif, USA. AIChE, 1982. 1-39 [2] [3] Anderson G. E. Successful recovery boiler combustion safeguard systems. IEEE Transactions on Industry and General Applications, IEEE, 1969. 204-207 Anderson C. E. Successful recovery boiler combustion safeguard systems. 14th Annual Technical Conference on Pulp and Paper Industry, IEEE, Milwaukee, WI, United States, 1968. 1-7 [4] Zhang Xiguang. Hidden danger of boiler in safety and control system and their improvement. Petrochemical safety technology. 2004, 20(3):24-26(in Chinese)

108