The Application of Furnace Safety Supervisory System (FSSS) in the Oil-fired Utility BoilerLI Qinghai1, ZHANG Yanguo1, REN Ganglian2, MENG Aihong1 & CHEN Changhe1 (1 Key laboratory for Thermal Science and Power Engineering of Ministry of Education, Tsinghua University, Beijing 100084, China; 2 Beijing Boiler Works, Beijing 100043, China) Abstract: The boiler furnace explosion is a serious accident that must be avoided. There are more concerns about the loss of life, property, and production caused by boiler furnace explosions. In order to prevent furnace from exploding the furnace safety supervisory system’s (FSSS) have been used in boiler safety control. This paper presents a FSSS’s reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which produces CTA and PTA, a raw textile material. The boiler is a dual-fuel typeboiler, to which biomass and heavy oil can be fed simultaneously for combustion. This reference is implemented by Beijing Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration, precommissioning. A series of problems are met during the test and modified by the vendors and contractors. It is a long distance to catch the level of the developed country’s FSSS hardware such as flame scanner, on/off valve, pressure switch and so on. This paper presents a reference for FSSS in engineering field. Keywords: FSSS; Explosion; Furnace; Flame Detection; Utility boiler 1 Introduction The boiler furnace explosion is a serious accident that must be avoided. The furnace explosion accident can be divided into two kinds, minus pressure explosion and plus pressure explosion. The boiler forced draft fan (FDF) and induced draft fan (IDF) failure usually leads to minus pressure explosion. Accumulation of unburnt combustible matter in furnace usually results in plus pressure explosion. There are more concerns about the loss of life, property, and production caused by boiler furnace explosions. In order to prevent furnace from exploding, the furnace safeguard supervisory system (FSSS) has been widely used in boiler safety control since 1950s in developed country[1,2,3]. With the large type of power generation unit imported from overseas, The FSSS is introduced to China in 1990s and early[4]. Successful use of FSSS in large boiler boosts its application in industrial boiler. At present the production process’s safety is paid more attention to than before. The newly erected boiler is usually equipped with FSSS, which is to provide a “back-up” protection system to take shutdown action immediately and automatically, if there is any equipment failure, operating error, or both. Otherwise large pockets of unburnt explosive fuel (such as pulverized coal, nature gas, biomass, heavy oil and so on) and air mixture in the furnace will lead to exploding. The FSSS on industrial boilers may contain so many components distributed over such a large physical area that local operation and monitoring of the firing system by the operator in timely manner is practically impossible. Thus, an important secondary function of a FSSS is to make it possible to operate and monitor all firing equipment from a single remote location. A successful FSSS will take shutdown action without failure when monitored conditions deviate from preestablished safe limits, but competitive utility boiler operation cannot tolerate frequent nuisance outage. This means that extreme care must be taken on equipment selection, application, and adjustment and operation to keep the condition being monitored with preestablished safe limits at all times. This is sometimes overlooked, and when frequent outages occur, FSSS may be unduly damned, or even bypassed, just because they are doing their job. Obviously, the FSSS and its control interlock system must be selected and applied for extreme reliability, for failure of any small part will shut down an industrial boiler. However, the extreme reliability also means high financial cost. In the past, the overall set of FSSS is imported and it is very expensive. This paper presents a FSSS’s reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which produces CTA and PTA, a raw textile material. The boiler is a dual-fuel type boiler, in which biomass and heavy oil can be fired simultaneously. The steam output from the oil-fired boiler meets the PTA production needs. This reference is implemented by Beijing Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration and precommissioning. The boilers are shown in Fig.1. The boilers have been operating from the Jan 2006 by now, for four months. The operation shows that this project is successful and the FSSS conducts its protective function slightly well. 2 FSSS’s Hardware 103 it can be easily divided into four basic sections. redundant interface on LCN to provide mass storage. Operator Consoles in Main Control Room are based on Global User Stations (GUS) ZConsole. redundant internal communication. GUS is equipped with Intel Pentium IV. All operator initiated commands are routed to the logic system and the status of all sensing elements is monitored continuously by the logic system. When 104 . The high performance manager (HPM) controller is the core of logic system. The logic system is designed to evaluate the operating status of the complete firing system and to pass the operat or commands to the driven devices only if the logic section is satisfied that the proper safety conditions are present.8 GB hard disk.2. The HPM is of redundant CPU. The logic system configuration is shown in Figs. The FSSS’ processor is made by Honewell. USA. for discussion and illustration. the logic section is designed to shut down any equipment whenever the boiler or the equipment itself would be damaged by its continued operation.2 Architecture of FSSS Fig.3 I/O marshalling and relay cabinet Fig. which are: (1) Logic system (2) Operator’s panel (3) Driven devices (4) Sensing elements The logic system is the brain of the FSSS. Additionally. The LCD displays operator’s actions. The network interface module (NIM) connects the two networks LCN and UCN.4 Global user station (GUS) The operator’s paned is furnished by LCD of DCS.Although the FSSS is very complex. redundant power supply. redundant key I/O. The history module (HM) is equipped with redundant 1. Fig.1 Side view of the oil-fired boilers Fig. sequences and system alarms. single 19 TFT-LCD monitor. the FSSS logic system is incorporated with DCS and the non-key part is procured onshore. 3 and 4. integrated keyboard with trackball. It connects operators directly to the process through preconfigured standard displays and through custom-built displays. In order to reduce the cost of FSSS. Global User Station (GUS) is the powerful and intuitive human interface to the Honeywell TotalPlant ® Solution (TPS) system. temperature detector. The driver devices control the admission of fuel and air to the boiler. The sensing elements include items such as position limit switches on various valves and dampers. pressure switches. are located throughout the fuel/air system with which we are concerned. For the detection of heavy oil flame. Valve operators for oil and gas firing. The branch fuel valves are designed to energize-to-trip. Driven and sensing elements. lights and so on are furnished by liquid crystal display (LCD).7.6 is a display to allow operate choose an item bypassing or not (detailed illustrated later). flame detectors. The sensing elements. which are commonly called field equipment. These elements are monitored and controlled by the operator through the logic system (DCS). and flame monitors for both the ignitor (LPG) and main fuel (oil) flames. Then a photodiode converts the light signal to an electronic signal which is analyzed for specific intensity and frequency as well as the absence of a fault signal. The visible light in furnace is transmitted by optic cable to an electronic preamplifier. All the switches. for manipulating the firing system equipment.LCD is coupled with a keyboard. such as status lights. the devices for picking up process and equipment information. In this case of branch fuel trip valve.6 MFT enable selection display 105 . the visible light scanner is applied. For example. Fig. Through the pushbuttons and lights operator can manipulate the burner. For the detection of LPG flame. The LCD allows the display of a great deal of information in a minimum of space. Fig. air and oil flow meters. the ultraviolet flame scanners are used.5 Operator’s panel for burner on LCD Fig.5 is the interface of operator with logic system.5 is completed by DCS vendor’s software. The operator’s panel contains the command devices. flow meters. Fig. The operator’s panel of LCD is shown in Figs. The display of Fig. which display the status of the equipment to be controlled. Fig. it presents valuable information on boiler operation. the opening coil would be momentarily energized to open the valve. such as switches and pushbutton. The ultraviolet light is useful for flame detection because substantial quantities of it are given off by burning fossil fuel while very little of it is emitted by other sources or radiation in the furnace. In Fig. feeder. pushbutton. The deenergize-to-trip design energizes the driven elements to operate them and deenergizes them to shut them down. include pressure switches. air damper drives and fan motor inverter are typical of driven devices that may be controlled by the FSSS.5 and 6. valve and watch its status feedback. pressure transmitters. the mail fuel trip valve would be energized to open and deenergize to trip. The on/off valve is driven by pneumatic actuator. The driven device is of the deenergize-to-trip type (‘fail-safe’). and the close coil would be momentarily energized to close the valve.8 shows the furnace pressure switch installation and the flame detector can be seen in Fig. and feedback indicators. air flow monitoring devices.7 we can see the on/off branch oil valve that is used to cut the branch oil passage to burner. and limit switches. Establishment of the appropriated permissive for firing the ignition fuel. including ignition permissive. Shut off fuels from an operating furnace when there is a fan or combustion-air failure.e. determined by the flame scanner. The degree of air swirl and the flow-shaping contour of the burner throat establish a recirculation pattern extending into the furnace.Fig.. will trip the fuel input to the burner. Once the fuel is ignited. After opening the angle fuel shutoff valve (shown in Fig. Shut off fuels. The only 3/4 flame failures as determined by a flame scanner will trip the main fuel input valve. The burners have internal baffles separating the primary and secondary air into two concentric air passages. A flame detector must be provided with each ignitor. to ensure that the purge will be adequate. Burners are started individually. Every branch trip valve is responsible for one burner. oil gun and gas gun. which is designed to avoid nuisance shutdowns and yet retain good protective capabilities. 106 . Each ignitor is equipped with its own flame detector (visible light scanner and ultraviolet scanner). continued operation of that individual burner depends totally on flame detection by its associated flame scanner. The oil gun is normal load gun. Emergently shut portion or all of the firing equipment down when required. to determine the presence or absence of stable flame. fuel pressure within limits. Every main fuel trip valve has four branch trip valves to connect with it. i. for gas gun and oil gun. Monitor of the firing conditions and other key boiler operating parameters continuously. at 30 percent above the design flow rate. Once a burner is started.7) that are located on front furnace wall and arranged to fire horizontally into the furnace cavity multiple. Every burner has two fuel guns. however. The fuel nozzle is interlocked with the ignitor so that the fuel shutoff valve cannot be opened until the ignitor is placed in operation. the system begins to trip the main oil valve. Flame failure. the hot products of combustion are directed back toward the fuel nozzle to provide the ignition energy necessary for stable combustion. purge complete. incorporate the following procedures: A pre-firing purge of the furnace: Enforce a 5 minute flow of air through the furnace. In the fired systems. if fuel pressures or oil temperatures and atomizing media pressures are not within proper limits. the ignition continues in operation for timed period (usually ten to fifteen seconds) to allow ignition of the branch fuel input. 3 Sofware Design and Configuration The FSSS’s interlocking depends on the physical characteristics of the firing system and type of fuel being fired. or prevent fuel valves from opening for light-off. All safety systems of this type. the fuel is mixed with combustion air in individual burners.7). etc. At the end of this timed period. The gas gun is start-up gun for burner. The (liquid petrol gas) LPG is fired firstly by the ignitor. the ignitor is removed from service and the optical flame scanner must detect flame to continue operation of the branch fuel nozzle. Establishment of the appropriate permissive for the primary (heavy oil) and secondary (biomass gas) fuel.8 Furnace pressure switch installation The oil-fired boiler is equipped with four burner (shown in Fig. and then the heated heavy oil is ignited by the LPG flame energy. A unique part of the FSSS is the flame failure protection system. Only when three of the four oil visible light scanners have no flame signal.7 Burner in front of furnace Fig. A single operator command to start an oil gun would initiate the following appropriately timed sequence of events: (1) Associated igniter placed in service and ignitor flame proven (2) Associated LPG valve opened (3) Associated atomizing steam or air valve open (4) Associated oil valve open In order to make intelligent decision in the operation of the boiler. The FSSS provides this information in the form of status indication on the operator’s panel (Figs. 9. The lowest degree of automatic of an FSSS safety system is a supervised manual system in which the operator initiates the startup and shutdown of each individual piece of equipment.3 MPa) (9) Flame failure (3/4 failure) (10) Low airflow (<30%) (11) Operator’s emergency trip pushbuttons depressed (manual MFT) The relevant logic diagram that includes above trip initiators is shown in Fig. the boiler is ready to be fired.5. A switch is used to decide the valve is controlled by logic system or local panel. These purge permissive requirements also provide a check on the proper operation of air damper. The operator’s panel is the means by which the boiler operator communicates with the logic system. and the flame monitoring devices indicate ‘non-flame’. This combination of conditions should ensure the removal of combustibles. For the oil-fired boiler the 30 percent minimum airflow requirement is maintained until the boiler reaches 30 percent load (the 33 percent load is the normal load in this boiler) in order to assure an air rich furnace mixture during the entire start-up phase.4 and 5). fuel admission. the operator must be provided a great deal of information regarding the status of controlled equipment and the monitored process conditions. The local panel has priority over the logic system. The system logic monitors the operator’s actions to watch whether they are being performed in the correct sequence and the system intervenes only when required to prevent a hazardous condition. This is done by passing air through the boiler at a specified rate (usually 30 percent of that required for rated boiler capacity) for a timed period while the fuel admission devices are proven closed (or off). This operator panel contains switches or pushbuttons for initiating the desired sequences for the boiler firing system operation. 107 . switches are provided for such functions as start purge. A typical list of the conditions that cause a Master Fuel Trip (MFT) of the oil-fired boiler is as follows: (1)Loss of forced draft fan (IDF) (2) Loss of two all induced draft fans( IDF. A supervised manual system can be designed for local operation or for remote operation from a remote operating panel. and flame sensing devices just prior to the firing. In our project a local valve control panel is put in front of the furnace. IF the MFT takes place the display as fig. two IDF for every boiler) (3) High high furnace pressure (+1 300 Pa) (4) Low furnace pressure (-1 100 Pa) (5) Low drum water level (-200 mm) (6) High drum water level (+200 mm) (7) Low deaerator water level (+900 mm) (8) Low instrument air pressure (0. the sensing elements. start ignitor. open oil trip valve. On completion of the purge. etc. A higher level of automation commonly specified allows an operator to place in service or remove from service a related group of firing equipment in the proper sequence by initiating a single command. The panel also provides the operator with indications of the status of equipment in the fuel burning system: valve open-close. and the driven devices of the fuel firing system. By the valve control panel operator can open and close relevant valve. ignitor on-off.The purpose of the pre-firing purge is to remove any unburned fuel that may have accumulated in the furnace prior to introducing an ignition source.6 will record the first initiator to lead the MFT. master fuel trip and so on. and that operation can be conducted by display in Fig. That is. Preprints. The onshore procurement sensor and actuator quality mainly leads to problems mentioned above. IEEE. However.1 & & & & & & & & & S R S R S R S R S R S R S R S R S R & & S R S R 1 1 S R 1 & Fig. the reliability can be reconciled by careful maintenance. 2004. The hardware and software architectures are described in detail. 5 Conclusions In order to protect boiler from explosion and reduce the FSSS’s cost. (2) The pressure switch is corroded by rain water and loses its normal function. Successful recovery boiler combustion safeguard systems. Successful recovery boiler combustion safeguard systems. E. The onshore procurement lowers the project’s cost. The low cost must be at expense of reliability reduction. Gary R. This paper provides a reference for boiler safeguard system. Anaheim. E. (3) The flame detector peeps the near burner flame. American Institute of Chemical Engineers 1982 Spring National Meeting and Chemical Plant Equipment Exposition. Furnace safety systems: current practice for safe and reliable control of industrial boilers. (5) The software configuration logic confused. USA. Ian M. AIChE. 1969. Milwaukee. References [1] Lovejoy. 1-7 [4] Zhang Xiguang. Petrochemical safety technology. United States.9 MFT first out logic diagram 4 Precommissioning and operation During precommissioning a series problems are met: (1) The main fuel cutoff valve refuses to work when the open or close signal is transmitted to the valve. Clark. IEEE. 1-39 [2] [3] Anderson G. The FSSS is operating successfully. Through improvement of vendors and careful test of operators this system is getting more and more mature. WI. the reliability can be compensated by careful route maintenance. In order to advance the reliability it is suggested that the key component should be selected the best. (4) The relay cabinet power failure. IEEE Transactions on Industry and General Applications. Although the reliability of actuator is slightly less than that of the offshore. 1982. 14th Annual Technical Conference on Pulp and Paper Industry. 204-207 Anderson C. a FSSS incorporated with DCS is accomplished. 1968. Hidden danger of boiler in safety and control system and their improvement. 20(3):24-26(in Chinese) 108 . The sensor and actuator are purchased onshore in China. Some software and hardware fault are met and resolved. Calif.