Boiler Protection System and Burner Management System

The Boiler Protection System in combination with the Burner Management System
protects the boiler (including furnace explosion and implosion) from an
unforeseen process fault or an incorrect action at the Distributed Control System.
The BPS / BMS in combination ensures all the necessary interlocks for a safe start
up and shut down of burner equipment. This narrative contains provisions
required for compliance with the NFPA 8501 Standard for Single Burner
Operation.

The Burner Management System is designed to ensure a safe, orderly operating

sequence in the start up and shut down of fuel firing equipment and to reduce
possible errors by following the operating procedure.

In some phases of operation, the BMS shall provide permissive interlocks only to
insure safe start-up of equipment. Once the equipment is in service, the operator
must follow acceptable safe operating practices.

It is essential that all parts of the BMS are in good working order and in service
whenever the burner is in service if the system is to provide the protection for
which it is designed. Regular maintenance and inspection of the system and its
associated hardware is essential for its continued safe operation.

Furnace purge : The purge system assures that the boiler furnace, the
associated air and flue gas paths, machineries like FD, ID and APH and
equipments containing sources of ignition energy like ESP are purged with air to
remove any explosive mixture before ignition. The BPS during the purge verifies
that the air and flue gas paths are open, fuel shut off valves are closed and no
flame is detected.

Master fuel trip : While monitoring the fuel system and the furnace operating
condition, a fault is detected, the BPS shall trip the MFT valve and individual
burners shut off valves, main and ignitor shut off valves, de energise sparks and
other ignition sources. When a MFT is caused by a loss of FD Fan and ID Fan trip
signal, all the air and flue gas passages of the boiler should be opened to fully
opened condition to provide as much Natural draft as possible. This condition
shall be maintained for a 15 minute period. At the end of this period, fans shall be
started to perform a post firing purge.

Flame sensors : Each ignitor and burner is provided with proper flame sensor
(fail safe trip) to continuously monitor the flame presence at any boiler condition.
Each ignitor is equipped with IFM flame proving system using flame ionisation
principle.
BMS Functions

The BMS shall be designed to perform the following functions

- Prevent firing unless a satisfactory furnace purge has first been completed
- Prohibit start up of the equipment unless certain permissive interlocks
have first been completed
- Monitor and Control the correct component sequence during start up and
shut down of the equipment
- Conditionally allow the continued operation of the equipment only while
certain safety interlocks remaining satisfied
- Provide component condition feed back to the operator and, if so
equipped, to the plant control system and or data loggers
- Provide automatic supervision when the equipment is in service and
provide means to make a Master Fuel trip (MFT) should certain
unacceptable firing conditions occur
- Execute a MFT up on certain adverse unit operating conditions

National Fire Protection Association

As per NFPA 8501, a common cause of furnace explosions is “Fuel leakage into
an idle furnace and the ignition of the accumulations by a spark or other
source of ignition.”

In order to initiate and complete a satisfactory furnace purge, the operator must
verify that all of the following conditions are satisfied.

- All system power supplies on

- A minimum of 30% of full load air flow is established
- All of the auxiliary air dampers modulating is established.
- Ignitor header fuel trip valve is proven closed
- No natural draft and waiting time for purge requirement are present
- Oil header (MFT) trip valves are proven closed
- All flame scanners “No flame”
- The drum level is adequate between minimum and maximum of the
dangerous condition.
- No Boiler trip command is present
- Instrument air header pressure within operating range
- A “No master Fuel trip condition” is established
- Flame scanners cooling air not very low
- Oil header pressure not very low
- Furnace pressure is between minimum and maximum
- Atomising steam/air pressure not very low
As each of the above conditions is reached, their respective indicator lights shall
illuminate as “PURGE PERMISSIVES” on the operator control console.

Once all of the above conditions are satisfied, the “PURGE AVAILABLE” light shall
illuminate indicating that the START PURGE switch is enabled by the system logic.
Activating the START PURGE control, when the “PURGE AVAILBLE” light is
illuminated, will begin a timed furnace purge cycle as indicated by a “PURGE IN
PROGRESS” light illuminating.

If the operator is starting the boiler from the cold condition or restarting after a
Master Fuel trip event, the procedure outlined in the following paragraphs is
required. If the boiler is recycling or other wise starting from a warm condition,
the MFT circuit will reset automatically and the procedure will skip directly to the
main flame light off sequence.

Provided that the start up permissive remain satisfied, the system shall initiate a
burner start up period timer set for no more than 10 minutes. If the operator
does not initiate a start up within this time, the boiler control system will exit the
“PURGE COMPLETE” condition and the operator must begin again with the pre
purge cycle. If the MFT has been reset, the boiler control system will trip the MFT
when leaving the “PURGE COMPLETE” condition.

Upon completing a satisfactory purge, the operator must press the “RESET MFT”
push button. The boiler control system will indicate that the MFT has been reset
with a steady on “MFT RESET” light. At this point, the boiler control system is
ready to allow the main flame start up sequence.

Main Flame Start-Up Sequence

The main flame start up sequence from the light- off the pilot flame through main
flame light – off is an automated sequence. Once the start up sequence has
begun, only the “BOILER STOP” switch and the “EMERGENCY STOP” will interrupt
the start up sequence. Any interruption of the start up sequence requires a post
fire purge prior to attempting to start the boiler again. To initiate the start up
sequence, the operator activates the “START BOILER” switch.

Failure to meet any of these conditions shall prevent the burner light-off
operation.

To light the pilot flame, the pilot header vent valve shall be closed by the boiler
control system. Then, sequentially, the ignitor transformer is energised, the pilot
gas block valves are open and a 10 second pilot ignition timer starts counting
down. When ignition timer cycle is completed, the ignitor transformer is de-
energised and the pilot flame scanner is checked by the control system. If the
pilot flame is present, the main flame light-off sequence continues.
If the pilot flame fails, the boiler control system initiates a pilot flame failure
shutdown. Additional attempts of the pilot light-off are permissible provided a
successful pilot light-off are made with in 10 minutes after the furnace purge.

Note, if the pilot flame continues to fail after several attempts, the boiler should
be inspected to determine the fault and the condition corrected.

Main Flame Light-off

Once the pilot flame is made, the boiler control system opens the header block
valves for the selected fuel. A main flame light-off burner timer begins a 15
second countdown to establish and stabilise the main flame. At 5 seconds before
the time out, the boiler control system closes the pilot block valve and opens the
pilot vent valve. The remaining 5 seconds are used to detect the main flame. For
the typical dual flame scanner design, a main flame failure shutdown is initiated if
both flame scanners return a “no flame” signal to the burner control system. This
will generate a boiler trip, and another furnace purge will be required. Once the
burner is lit, the system is in the NORMAL RUN CONDITION and combustion
controls should be released to modulation control.

Shutdown

The normal shut down cycle for the boiler shall accomplish the following in the
order listed

- Shut off fuel supply to the main burner

- Interrupt spark and shut off fuel supply to ignitor, if in operation
- Where used, open the oil recirculation valve
- Shut off atomising medium

Boiler Master Fuel Trip

Any of the following conditions shall cause a boiler trip to occur. This results in
the shutdown of all fuel and requires another furnace purge cycle before any
attempt at re-lighting.

- Steam drum very low level

- Steam drum very high level
- Loss of Fans
- Total air flow less than 30%
- Furnace pressure very high
- Furnace pressure very low
- Oil header very low pressure
- Atomising steam very low pressure
- Flame scanner cooling air very low pressure
 - Loss of fuels
- Loss of flames
- DCS not available
- Loss of Instrument air

AFBC Boilers with Oil burners for initial heating of the fluid bed

Boiler General Protection

Master Fuel trip condition healthy

- Drum level is not very low

- Drum level is not very high
- ID Fan in service
- FD Fan in service
- Furnace pressure is not very low
- Furnace pressure is not very high
- Bed temperature is not below 650deg.C
- Bed temperature is not above 980deg.C
- Instrument air is within limits

Note: The individual coal feeder will trip, if the corresponding temperature falls
into the logic and start permissive is applicable once the bed temperature is
normalised. Other wise, the MFT will act based on the logic incorporated.

Boiler Purge permissive

- absence of boiler trip conditions

- Oil shut-off valve closed
- Drum at start up level
- Air flow > 30%
- At least one air gas circuit in service
- waiting time for purge requested
- Natural draught not required

Oil Shut-Off Valve condition healthy

- boiler purge completed

- oil header pressure is within limits
- atomising medium is not very low
CFBC Boilers with Oil burners for initial heating of the fluid bed

Boiler air protection

- Fluidised bed temperature <max.2

- Furnace draught >min.2
- Furnace draught <max.2
- Siphon I exit temperature <max.2
- Siphon II exit temperature <max.2
- Drum level >min.2
- Drum level <max.2
- Primary air flow >min.2

Note: Boiler must be tripped if only one bed temperature measurement is

available.

Boiler Oil protection / Preconditions to start hot gas generator

- Boiler air protection OK

- Fluidised bed temperature <min.1
- Primary air flow >min.2
- Fuel oil pressure >6kg/cm2
- Atomising air/steam pressure >7kg/cm2
- HGG out gas temperature <850deg.C
- No flame in HGG
- Differential pressure across HGG >25mmwg
- LPG press >0.4kg/cm2g

Preconditions to start Main Fuel

- Coal bunker level >min

- Boiler air protection OK
- Fluidised bed temperature 20deg.c above ignition temperature
- Fluidised bed temperature <920deg.C
- Coal feeder cut off gate Open
- Coal feeder down stream gate Open
- Drum level >min.2
- Drum level <max.2

Note: min & max depends on OEM recommendations

General Protections

01. Furnace draught <-150 or >100mmwc

02. Drum level (2 out of 3) <-320 or >150mm
03. Bed temperature>940deg.C
04. Drum pressure(4 seconds delay)
05. Siphon ash temperature >450deg.C
06. Root blowers trip
07. Start up time exceeded

When coal feeder are in ON

08. Bed height>1400mmwc or <600mmwc

09. PA pressure to APH(4 seconds delay)>1900mmwc
10. PA flow-total PA flow<14kg/s & both PA flow to HGG 1&2<7kg/s
11. Flue gas pressure before ID Fan <-500mmwc
12. SA pressure to APH > 720mmwc
13. Coal feeder trip on bed temperature>920deg.C or <450deg.C
14. Total air/fuel ratio less than minimum

End notes :

- Pre purge permissive condition checks and furnace purge are to be

initiated by the operator from the BMS
- The total furnace air flow shall not be reduced below the purge rate air
flow. Reducing air flow below the limits will lead to a MFT, and a new
furnace purge will be required

S.V.NAGESH