The Application of Furnace Safety Supervisory System (FSSS) in the Oil-fired Utility Boiler

LI Qinghai1, ZHANG Yanguo1, REN Ganglian2, MENG Aihong1 & CHEN Changhe1

(1 Key laboratory for Thermal Science and Power Engineering of Ministry of Education, Tsinghua University, Beijing 100084,

China; 2 Beijing Boiler Works, Beijing 100043, China)

Abstract: The boiler furnace explosion is a serious accident that must be avoided. There are more concerns about the loss of life, property, and production

caused by boiler furnace explosions. In order to prevent furnace from exploding the furnace safety supervisory system’s (FSSS) have been used in boiler safety

control. This paper presents a FSSS’s reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which produces CTA and PTA, a

raw textile material. The boiler is a dual-fuel typeboiler, to which biomass and heavy oil can be fed simultaneously for combustion. This reference is

implemented by Beijing Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration,

precommissioning. A series of problems are met during the test and modified by the vendors and contractors. It is a long distance to catch the level of the

developed country’s FSSS hardware such as flame scanner, on/off valve, pressure switch and so on. This paper presents a reference for FSSS in engineering

field.

Keywords: FSSS; Explosion; Furnace; Flame Detection; Utility boiler

1 Introduction

The boiler furnace explosion is a serious accident that must be avoided. The furnace explosion accident can be divided into two

kinds, minus pressure explosion and plus pressure explosion. The boiler forced draft fan (FDF) and induced draft fan (IDF) failure

usually leads to minus pressure explosion. Accumulation of unburnt combustible matter in furnace usually results in plus pressure

explosion. There are more concerns about the loss of life, property, and production caused by boiler furnace explosions. In order to

prevent furnace from exploding, the furnace safeguard supervisory system (FSSS) has been widely used in boiler safety control since

1950s in developed country[1,2,3]. With the large type of power generation unit imported from overseas, The FSSS is introduced to

China in 1990s and early[4]. Successful use of FSSS in large boiler boosts its application in industrial boiler. At present the production

process’s safety is paid more attention to than before. The newly erected boiler is usually equipped with FSSS, which is to provide a

“back-up” protection system to take shutdown action immediately and automatically, if there is any equipment failure, operating

error, or both. Otherwise large pockets of unburnt explosive fuel (such as pulverized coal, nature gas, biomass, heavy oil and so on)

and air mixture in the furnace will lead to exploding. The FSSS on industrial boilers may contain so many components distributed

over such a large physical area that local operation and monitoring of the firing system by the operator in timely manner is practically

impossible. Thus, an important secondary function of a FSSS is to make it possible to operate and monitor all firing equipment from

a single remote location.

A successful FSSS will take shutdown action without failure when monitored conditions deviate from preestablished safe limits,

but competitive utility boiler operation cannot tolerate frequent nuisance outage. This means that extreme care must be taken on

equipment selection, application, and adjustment and operation to keep the condition being monitored with preestablished safe limits

at all times. This is sometimes overlooked, and when frequent outages occur, FSSS may be unduly damned, or even bypassed, just

because they are doing their job. Obviously, the FSSS and its control interlock system must be selected and applied for extreme

reliability, for failure of any small part will shut down an industrial boiler. However, the extreme reliability also means high financial

cost. In the past, the overall set of FSSS is imported and it is very expensive.

This paper presents a FSSS’s reference which is applied for two oil-fired boilers in Oriental (Shanghai) Petrochemical which

produces CTA and PTA, a raw textile material. The boiler is a dual-fuel type boiler, in which biomass and heavy oil can be fired

simultaneously. The steam output from the oil-fired boiler meets the PTA production needs. This reference is implemented by Beijing

Boiler Works. As the technical support, engineers from Tsinghua University are engaged in overall FSSS configuration and

precommissioning. The boilers are shown in Fig.1. The boilers have been operating from the Jan 2006 by now, for four months. The

operation shows that this project is successful and the FSSS conducts its protective function slightly well.

2 FSSS’s Hardware

1383

Although the FSSS is very complex, it can be easily divided into four basic sections, for discussion and illustration, which are:

(1) Logic system

(2) Operator’s panel

(3) Driven devices

(4) Sensing elements

The logic system is the brain of the FSSS. All operator initiated commands are routed to the logic system and the status of all

sensing elements is monitored continuously by the logic system. The logic system is designed to evaluate the operating status of the

complete firing system and to pass the operat or commands to the driven devices only if the logic section is satisfied that the proper

safety conditions are present. Additionally, the logic section is designed to shut down any equipment whenever the boiler or the

equipment itself would be damaged by its continued operation. The logic system configuration is shown in Figs.2, 3 and 4. In order

to reduce the cost of FSSS, the FSSS logic system is incorporated with DCS and the non-key part is procured onshore. The FSSS’

processor is made by Honewell, USA. Operator Consoles in Main Control Room are based on Global User Stations (GUS) Z-

Console. Global User Station (GUS) is the powerful and intuitive human interface to the Honeywell TotalPlant Solution (TPS)

system. It connects operators directly to the process through preconfigured standard displays and through custom-built displays. GUS

is equipped with Intel Pentium IV, single 19 TFT-LCD monitor, integrated keyboard with trackball. The history module (HM) is

equipped with redundant 1.8 GB hard disk, redundant interface on LCN to provide mass storage. The network interface module

(NIM) connects the two networks LCN and UCN. The high performance manager (HPM) controller is the core of logic system. The

HPM is of redundant CPU, redundant power supply, redundant internal communication, redundant key I/O.

Fig.1 Side view of the oil-fired boilers Fig.2 Architecture of FSSS

Fig.3 I/O marshalling and relay cabinet Fig.4 Global user station (GUS)

The operator’s paned is furnished by LCD of DCS. The LCD displays operator’s actions, sequences and system alarms. When

1384

LCD is coupled with a keyboard, it presents valuable information on boiler operation. The LCD allows the display of a great deal of

information in a minimum of space. The operator’s panel contains the command devices, such as switches and pushbutton, for

manipulating the firing system equipment, and feedback indicators, such as status lights, which display the status of the equipment to

be controlled. All the switches, pushbutton, lights and so on are furnished by liquid crystal display (LCD). The operator’s panel of

LCD is shown in Figs.5 and 6. Fig.5 is the interface of operator with logic system. Through the pushbuttons and lights operator can

manipulate the burner, valve and watch its status feedback. The display of Fig.5 is completed by DCS vendor’s software. Fig.6 is a

display to allow operate choose an item bypassing or not (detailed illustrated later).

The driver devices control the admission of fuel and air to the boiler. Valve operators for oil and gas firing, feeder, air damper

drives and fan motor inverter are typical of driven devices that may be controlled by the FSSS. In Fig.7 we can see the on/off branch

oil valve that is used to cut the branch oil passage to burner. The on/off valve is driven by pneumatic actuator.

The sensing elements, the devices for picking up process and equipment information, include pressure switches, temperature

detector, flow meters, air flow monitoring devices, flame detectors, and limit switches. Fig.8 shows the furnace pressure switch

installation and the flame detector can be seen in Fig.7.

Driven and sensing elements, which are commonly called field equipment, are located throughout the fuel/air system with which

we are concerned. These elements are monitored and controlled by the operator through the logic system (DCS). The driven device is

of the deenergize-to-trip type (‘fail-safe’). The deenergize-to-trip design energizes the driven elements to operate them and

deenergizes them to shut them down. For example, the mail fuel trip valve would be energized to open and deenergize to trip. The

branch fuel valves are designed to energize-to-trip. In this case of branch fuel trip valve, the opening coil would be momentarily

energized to open the valve, and the close coil would be momentarily energized to close the valve. The sensing elements include

items such as position limit switches on various valves and dampers, air and oil flow meters, pressure switches, pressure transmitters,

and flame monitors for both the ignitor (LPG) and main fuel (oil) flames. For the detection of LPG flame, the ultraviolet flame

scanners are used. The ultraviolet light is useful for flame detection because substantial quantities of it are given off by burning fossil

fuel while very little of it is emitted by other sources or radiation in the furnace. For the detection of heavy oil flame, the visible light

scanner is applied. The visible light in furnace is transmitted by optic cable to an electronic preamplifier. Then a photodiode converts

the light signal to an electronic signal which is analyzed for specific intensity and frequency as well as the absence of a fault signal.

Fig.5 Operator’s panel for burner on LCD Fig.6 MFT enable selection display

1385

Fig.7 Burner in front of furnace Fig.8 Furnace pressure switch installation

The oil-fired boiler is equipped with four burner (shown in Fig.7) that are located on front furnace wall and arranged to fire

horizontally into the furnace cavity multiple. In the fired systems, the fuel is mixed with combustion air in individual burners. The

burners have internal baffles separating the primary and secondary air into two concentric air passages. The degree of air swirl and

the flow-shaping contour of the burner throat establish a recirculation pattern extending into the furnace. Once the fuel is ignited, the

hot products of combustion are directed back toward the fuel nozzle to provide the ignition energy necessary for stable combustion.

Every burner has two fuel guns, oil gun and gas gun. The gas gun is start-up gun for burner. The oil gun is normal load gun.

Burners are started individually. The fuel nozzle is interlocked with the ignitor so that the fuel shutoff valve cannot be opened

until the ignitor is placed in operation. Each ignitor is equipped with its own flame detector (visible light scanner and ultraviolet

scanner). After opening the angle fuel shutoff valve (shown in Fig.7), the ignition continues in operation for timed period (usually ten

to fifteen seconds) to allow ignition of the branch fuel input. At the end of this timed period, the ignitor is removed from service and

the optical flame scanner must detect flame to continue operation of the branch fuel nozzle. Flame failure, determined by the flame

scanner, will trip the fuel input to the burner. Once a burner is started, continued operation of that individual burner depends totally

on flame detection by its associated flame scanner. The only 3/4 flame failures as determined by a flame scanner will trip the main

fuel input valve. Every main fuel trip valve has four branch trip valves to connect with it. Every branch trip valve is responsible for

one burner. A unique part of the FSSS is the flame failure protection system, which is designed to avoid nuisance shutdowns and yet

retain good protective capabilities. Only when three of the four oil visible light scanners have no flame signal, the system begins to

trip the main oil valve.

The (liquid petrol gas) LPG is fired firstly by the ignitor, and then the heated heavy oil is ignited by the LPG flame energy. A

flame detector must be provided with each ignitor, for gas gun and oil gun, to determine the presence or absence of stable flame.

3 Sofware Design and Configuration

The FSSS’s interlocking depends on the physical characteristics of the firing system and type of fuel being fired. All safety

systems of this type, however, incorporate the following procedures:

A pre-firing purge of the furnace: Enforce a 5 minute flow of air through the furnace, at 30 percent above the design flow rate, to

ensure that the purge will be adequate.

Establishment of the appropriated permissive for firing the ignition fuel, i.e., purge complete, fuel pressure within limits, etc.

Establishment of the appropriate permissive for the primary (heavy oil) and secondary (biomass gas) fuel, including ignition

permissive.

Monitor of the firing conditions and other key boiler operating parameters continuously.

Emergently shut portion or all of the firing equipment down when required. Shut off fuels from an operating furnace when there

is a fan or combustion-air failure. Shut off fuels, or prevent fuel valves from opening for light-off, if fuel pressures or oil

temperatures and atomizing media pressures are not within proper limits.

1386

The purpose of the pre-firing purge is to remove any unburned fuel that may have accumulated in the furnace prior to

introducing an ignition source. This is done by passing air through the boiler at a specified rate ( usually 30 percent of that required

for rated boiler capacity) for a timed period while the fuel admission devices are proven closed (or off), and the flame monitoring

devices indicate ‘non-flame’. This combination of conditions should ensure the removal of combustibles. These purge permissive

requirements also provide a check on the proper operation of air damper, fuel admission, and flame sensing devices just prior to the

firing.

On completion of the purge, the boiler is ready to be fired. For the oil-fired boiler the 30 percent minimum airflow requirement

is maintained until the boiler reaches 30 percent load (the 33 percent load is the normal load in this boiler) in order to assure an air

rich furnace mixture during the entire start-up phase.

A typical list of the conditions that cause a Master Fuel Trip (MFT) of the oil-fired boiler is as follows:

(1)Loss of forced draft fan (IDF)

(2) Loss of two all induced draft fans( IDF, two IDF for every boiler)

(3) High high furnace pressure (+1 300 Pa)

(4) Low furnace pressure (-1 100 Pa)

(5) Low drum water level (-200 mm)

(6) High drum water level (+200 mm)

(7) Low deaerator water level (+900 mm)

(8) Low instrument air pressure (0.3 MPa)

(9) Flame failure (3/4 failure)

(10) Low airflow (<30%)

(11) Operator’s emergency trip pushbuttons depressed (manual MFT)

The relevant logic diagram that includes above trip initiators is shown in Fig. 9. IF the MFT takes place the display as fig.6 will

record the first initiator to lead the MFT.

The lowest degree of automatic of an FSSS safety system is a supervised manual system in which the operator initiates the

startup and shutdown of each individual piece of equipment, and that operation can be conducted by display in Fig.5. A supervised

manual system can be designed for local operation or for remote operation from a remote operating panel. In our project a local valve

control panel is put in front of the furnace. By the valve control panel operator can open and close relevant valve. The local panel has

priority over the logic system. A switch is used to decide the valve is controlled by logic system or local panel. The system logic

monitors the operator’s actions to watch whether they are being performed in the correct sequence and the system intervenes only

when required to prevent a hazardous condition.

A higher level of automation commonly specified allows an operator to place in service or remove from service a related group

of firing equipment in the proper sequence by initiating a single command. A single operator command to start an oil gun would

initiate the following appropriately timed sequence of events:

(1) Associated igniter placed in service and ignitor flame proven

(2) Associated LPG valve opened

(3) Associated atomizing steam or air valve open

(4) Associated oil valve open

In order to make intelligent decision in the operation of the boiler, the operator must be provided a great deal of information

regarding the status of controlled equipment and the monitored process conditions. The FSSS provides this information in the form of

status indication on the operator’s panel (Figs.4 and 5). The operator’s panel is the means by which the boiler operator communicates

with the logic system, the sensing elements, and the driven devices of the fuel firing system. This operator panel contains switches or

pushbuttons for initiating the desired sequences for the boiler firing system operation. That is, switches are provided for such

functions as start purge, open oil trip valve, start ignitor, master fuel trip and so on. The panel also provides the operator with

indications of the status of equipment in the fuel burning system: valve open-close, ignitor on-off, etc.

1387

Fig.9 MFT first out logic diagram

4 Precommissioning and operation

During precommissioning a series problems are met:

(1) The main fuel cutoff valve refuses to work when the open or close signal is transmitted to the valve;

(2) The pressure switch is corroded by rain water and loses its normal function;

(3) The flame detector peeps the near burner flame;

(4) The relay cabinet power failure;

(5) The software configuration logic confused.

The onshore procurement sensor and actuator quality mainly leads to problems mentioned above. Through improvement of

vendors and careful test of operators this system is getting more and more mature. The low cost must be at expense of reliability

reduction. However, the reliability can be reconciled by careful maintenance. In order to advance the reliability it is suggested that

the key component should be selected the best.

5 Conclusions

In order to protect boiler from explosion and reduce the FSSS’s cost, a FSSS incorporated with DCS is accomplished. The

hardware and software architectures are described in detail. Some software and hardware fault are met and resolved. The sensor and

actuator are purchased onshore in China. The onshore procurement lowers the project’s cost. Although the reliability of actuator is

slightly less than that of the offshore, the reliability can be compensated by careful route maintenance. The FSSS is operating

successfully. This paper provides a reference for boiler safeguard system.

References

[1] Lovejoy, Gary R, Clark, Ian M. Furnace safety systems: current practice for safe and reliable control of industrial boilers. American Institute of Chemical

Engineers 1982 Spring National Meeting and Chemical Plant Equipment Exposition, Preprints, Anaheim, Calif, USA. AIChE, 1982. 1-39

[2] Anderson G. E. Successful recovery boiler combustion safeguard systems. IEEE Transactions on Industry and General Applications, IEEE, 1969. 204-207

[3] Anderson C. E. Successful recovery boiler combustion safeguard systems. 14th Annual Technical Conference on Pulp and Paper Industry, IEEE,

Milwaukee, WI, United States, 1968. 1-7

[4] Zhang Xiguang. Hidden danger of boiler in safety and control system and their improvement. Petrochemical safety technology. 2004, 20(3):24-26(in

Chinese)

1388