t10 - standards review - burner management and combustion

Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.Rev 5058-CO900E

T10 - Standards Review - Burner Management and Combustion Control

Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.PUBLIC INFORMATION

Industrial Combustion Team Overview

Background and Industry Experience


RA’s IC&PG Team History

The Story of Rockwell Automation’s

Industrial Combustion and Steam Generation Team

Rockwell Automation acquired Electronic Corporation of America (ECA) in the mid ‘80’s, who owned FIREYE

The FIREYE ‘Systems’ Team merged into Rockwell Automation’s solutions business

Have many years experience working with agencies like FM, NFPA, IEC, etc.

Since this initial merger Rockwell Automation has complimented this team with highly skilled individuals who have brought many years experience working for companies like ABB Bailey, Foxboro, Babcock & Wilcox, Combustion Engineering, Riley Stoker, Modicon, Cleveland Electric Illuminating, North American Manufacturing, Forney and others.

Over 900 systems provided worldwide in a wide variety of combustion applications.


4

RA’s IC&PG Team Expertise

Extensive experience working with Factory Mutual

Extensive Knowledge of Safety Standards and Guidelines

NFPA 85 Boiler & Combustion Code

NFPA 86 Furnace & Ovens

NFPA 87 Fluid Heaters (Chem. Plant Oil Heaters, vessels, etc.)

FM (7605) Approval Standard for PLC based BMS

CSA B149.3 (Canada)

BLRAC Recommended Good Practices

ANSI/ISA S84.00.011/IEC 61511 SIL Ratings for Systems

IEC 61508 SIL Ratings for Hardware


Industrial Combustion and Power Generation

Burner Management (BMS):

- Combustion “SAFETY” and operator assistance in safely starting, monitoring and stopping the fuel fired burners

- Used in conjunction with a combustion control system in any fossil fuel fired “industrial” combustion application.

Combustion Control (CCS):

- Regulates air/fuel ratio for stable flame and energy optimization

- Used in conjunction with a burner management system in any fossil fuel fired “industrial” combustion application.

Balance of Plant (BOP):

- A “catch-all” for common activities in a powerhouse that excludes, burner management and combustion control

- ESP, Plant Master, demineralizer control, feedwater control, coal/ash

handling, scrubber control, soot blower control, etc.

Combustion Control & Burner Management


Definitions

6

NFPA – National Fire Protection Association

FM Factory Mutual – Insurance Underwriter

SIL – Safety Integrity Level

Critical Input – Any Input that if lost will cause a trip

Critical Output – Any Outputs that drive fuel delivery devices

Fail Safe System – Inputs & Outputs - High is Normal / Low is Trip


Rockwell Automation IC&PG SIL Certification


Industrial Steam Generation

Large Central Power House (i.e. –

Paper Mill or Large Industrial Complex)

Boiler Steam Generation

Burner Management Systems

Combustion Control Systems

Balance of Plant Systems

Multiple Burners / Fuels including:

Natural Gas

Oil

Black Liquor

Bark/Wood Chips/Sawdust

Coal

Others

8


Any Industrial facility where steam or heat

is used in the manufacturing process

Burner Management & Combustion

(Temperature) Control Systems

Industrial Boilers

Non-Boiler Applications including:

- Furnaces - Ovens

- Dryers - Kilns

- Heaters - Oxidizers

9

Industrial & Process Heating


Safety Codes and Application Highlights

Survey of Applicable Codes for Fired Equipment

Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.PUBLIC INFORMATION Copyri

ght ©

NFPA Standards

NFPA 85 – Boiler and Combustion Systems Hazards Code

(2011 Edition) (2015 due out in Jan)

NFPA 86 – Standards for Ovens and Furnaces (2015 Edition)

NFPA 87 – Recommended Practice for Fluid Heaters

(2015 Edition)


ght ©

NFPA 85 Key Highlights

“The burner management system (BMS) shall be provided with independent logic, independent logic solving hardware, independent input/output systems, and independent power supplies and shall be functionally and physically separate device from other logic systems.”

“The BMS safety functions shall include, but shall not be limited to, purge interlocks and timing, mandatory safety shutdowns, trial timing for ignition, and flame monitoring.”

“Diagnostics shall be included in the BMS design to monitor processor logic function.”

“Logic shall be protected from unauthorized changes.”

“Logic shall not be changed while the associated equipment is in operation.”

“No single component failure within the logic system shall prevent a mandatory master fuel trip”


ght ©


Programmable logic controller-based systems listed for combustion

safety service shall be used…..”

“Safety devices shall not be bypassed electrically or mechanically.”

“Output checking shall be provided for PLC outputs controlling fuel

safety shutoff valves and oxygen safety shutoff valves.”

Only isolated PLC contacts shall be used in the required safety circuits.”

Flow and pressure “transmitters” can be used in place of pressure

switches if the transmitter is dedicated to safety service.

“Access to the PLC and it’s logic shall be restricted to authorized

personnel.”

“An excess temperature limit controller shall be provided and interlocked

into the combustion safety circuitry…..”


ght ©


“Does not apply to fired heaters in petroleum refineries and

petrochemical facilities that are designed and installed in accordance

with API560, Fired Heaters for General Refinery Service, API RP 556

Instrumentation and Controls for Fired heaters and Steam Generators,

and API RP2001 Fire Protection in Refineries.”


ght ©

NFPA Equivalency Clause

NFPA 85, 86 and 87 will allow variations to it’s published codes and

standards through it “Equivalency” paragraph which states:

“Nothing in this standard is intended to prevent the use of systems,

methods, or devices of equivalent or superior quality, strength, fire

resistance, effectiveness, durability, and safety over those prescribed by

this standard.”

Local authority having jurisdiction has final say over what is acceptable


ght ©

IEC Safety Standards

PROCESS SECTOR SAFETY INSTRUMENTED SYSTEM

STANDARDS

Safety Instrumented Systems Designers, Integrators & Users

IEC 61511

Manufacturers & Suppliers of Devices

IEC 61508


ght ©

17

IEC 61508

This is a Basic International Standard that defines the requirement

that Electric/Electronic/Programmable Electronic devices must meet

when used in Safety applications.

Performance based Standard

Includes all activities related to the Safety Life Cycle

Covers possible hazards caused by Failure of the Safety Functions

Does not cover SIS with SIL requirements less than 1


ght ©

IES 61511

A Process Sector Specific International Standard covering

Functional Safety for Safety Instrumented Systems

It defines the requirements that users must meet when designing,

implementing and maintaining a Safety Instrumented System in

Process Plants.

Performance based Standard

The document differentiates between Safety certified devices and

off the shelf general purpose devices.


ght ©

ISA/ANSI S84.01

The Americanized version of IEC 61511.


ght ©

IEC - Safety Integrity Levels (SIL) forSafety Instrumented Systems (SIS) Safety integrity is the probability that an SIS will perform its safety function(s) when the

process demands it.

Safety Integrity is specified as a discrete level, from 1 to 4 or Safety Integrity Level (SIL).

DEMAND MODE OF OPERATION

Safety IntegrityLevel (SIL)

Target AverageProbability of Failure on Demand

Target Risk Reduction

4 10-5

to <10-4

>10,000 to 100,000

3 10-4

to <10-3

>1000 to 10,000

2 10-3

to <10-2

>100 to 1000

1 10-2

to <10-1

>10 to 100

CONTINUOUS MODE OF OPERATION

Safety IntegrityLevel (SIL)

Target Frequency ofDangerous Failures to perform thesafety instrumented function (per

hour)

4 10-9

to <10-8

3 10-8

to <10-7

2 10-7

to <10-6

1 10-6

to <10-5


Copyright © 2008 Rockwell Automation, Inc. All rights 21

SIL Determination

.

D1

D2

D3

D4

A1

A2

A1

A2

E1

E2

E1

E2

P3 P2 P1

1 1

0

2 1

1

3 3

1

4 3

2

6

3

7

4

8

4

0

0

1

0

2

1

3

1

4 4

5

3

6

3

7

4

0 B

0

0 B

0

1 1

0

2 2

1

3

1

4

2

5

3

6

3

2

5 >4

3

DIN EN

IEC

Risk Parameters:

D - Extent of DamageD1: slight injuryD2: severe irreversible injury to one or more

persons or death of a personD3: death of several personsD4: catastrophic consequences, multiple

deaths

E - Exposure TimeE1: seldom to relatively frequentE2: frequent to continuous

A - Hazard Avoidance/MitigationA1: possible under certain conditionsA2: hardly possible

P - Occurrence ProbabilityP1: very low probabilityP2: low probabilityP3: relatively high probability

DIN VDE-19250 (AK) Fundamental safety aspects for measurement and control equipmentIEC 61508 (SIL) Functional safety of programmable electronic systems (PES)EN-954 (Category) Safety of machinery - Safety related parts of control systems


ght ©

Summary

At Rockwell Automation the IC&PG Team uses the NFPA standards as

our base system design.

The code issue can be very confusing and are open a lot of different

interpretations.

The customer needs to advise what specific codes/standard that they

require to be applied to their application.


Burner Management System (BMS)

Description: Burner Management System

A BMS is a SAFETY SYSTEM

A BMS is only for the safe start-up, monitoring and shutdown of a

combustion system.

Special Requirements:

Monitoring and testing of inputs and outputs

Boilers - NFPA 85 Standard

Ovens, Dryers, Furnaces, etc. - NFPA 86 Standard

Fluid Heaters – NFPA 87 Recommend Practices

Recovery Boilers - BLRBAC

Safety response – Fail-Safe Control of purge, ignition, shutdown

Factory Mutual Approval Standard (FM 7605) for PLC Based Burner Management Systems

ANSI/ISA S84.00.01/IEC 61511 - provides procedure for how to implement the SIL standards

Customer specific standards


24

Burner Management System Value

A new burner management system can

Improve availability by increasing the operator’s trouble-shooting

capability and accessibility of system information through enhance

diagnostics

Reduce normal startup time

Protects your combustion product equipment against damage

Uses standard Rockwell Automation hardware thus reducing or

eliminating the need for additional spare parts for existing RA

Clients.

Potential increase in overall safety


Design Documents (Non-SIL)

NFPA 85 for Boilers

NFPA 86 for Ovens and Furnaces

NFPA 87 for Fluid Heaters

Factory Mutual (FM)

IEC 7605 Approval Standard for Programmable Logic Control (PLC)

Based Burner Management Systems

BLRBAC (Recovery Boilers Only)

Customer Standards and Specifications


Design Documents for SIL

All of the applicable non SIL documents

IEC 615011 Functional Safety Instrument Systems

IEC 61508 Functional Safety of Electrical / Electronic / Programmable

Electronic Safety Related Systems

1756-RM001 Applying ControlLogix in SIL 2 Applications


What Makes a BMS Unique

Input Testing

Output Monitoring

External Watchdog

Hardwired Trip Circuit

No Online Edits system is operating

Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.PUBLIC INFORMATION 28

Burner Management Design Features

A system watchdog, completely independent of the programmable controller, continually

verifies the controller’s timing function, as well as its ability to execute logic and control outputs

Input channels on each l/O module are periodically tested to verify their ability to detect

field device state changes to the “fail-safe” position.

Critical outputs are monitored by feeding back the status of the output as a separate input

signal and comparing it to the state demanded by system logic.

The use of software interlocks help guard against unauthorized modification of the

controller’s program.

A hardware trip circuit which allows the operator or the system watchdog to initiate a main

fuel trip

Start-up, first out, and system alarm/diagnostic messages.

Communication with other Rockwell programmable automation controllers or operator

terminals

Adaptable to any fossil fuel combustion applications with single or multiple burners


BMS Functions

Input Testing

Output Monitoring

External Watchdog


Timer Preset Locking

No Online Edits


Input Testing

Detects Input Card Failure

Detects Input Circuit Shorted to Power

Detects Forced Inputs


Input Test Wiring


BMS Functions

Input Testing

Output Monitoring

External Watchdog



No Online Edits


Output Monitor

Critical Outputs are wired to Inputs

Typical Outputs are to Fuel Valves & Ignition Transformer

Alarms if monitoring input Disagrees With Command

May Initiate Trip


Output Monitor Wiring


BMS Functions

Input Testing

Output Monitoring

External Watchdog



No Online Edits


External Watchdog Trips

Processor Failure

MFT Relays Fail To De-energize

Processor Not In Run Mode (Controllogix)


External Watchdog Wiring


BMS Functions

Input Testing

Output Monitoring

External Watchdog



No Online Edits



Timer Presets can not be changed while the processor is running.

All Timer Preset Changes Must Be Made In Program Mode


BMS Functions

Input Testing

Output Monitoring

External Watchdog



No Online Edits


Online Programming

NFPA does not allow program changes to be made to the processor while

the equipment is operating

If the processor is switched out of RUN mode, the System will MFT.


Procedure to Make Program Changes

44

Switch Processor to Program Mode

Make all Changes

Store Program to Non-volatile Memory (If installed)

Switch Processor Back To Run Mode


Rockwell Automation

45

Questions?