Controlling fired heaters

[Esam]

CONTROLLING FIRED HEATERS © Walter ********, P. Eng., 2000 May 20. walter(at)********(dot)ca

First published in Hydrocarbon Processing , April 1997.

This

[link Point to another website Only the registered members can access]

[IMG]http://www.********.ca/ce5_fh/5-1.jpg[/IMG]INTRODUCTION. The purpose of a fired heater is very simple: To add heat to a process fluid. Its representation on a process flow diagram is also very simple. But, of course, fired heaters are among the most complex pieces of process control equipment. Each furnace is, after all, at least two pieces of equipment in one. Firstly, it is a special variant of the shell and tube heat exchanger since its purpose is to exchange heat. Secondly, it is a chemical reactor in which fuel and air undergo extremely exothermic reactions to produce the required heat.

In previous articles of this series^{1, 2, 3, 4}, the process aspects of controlling a piece of equipment were presented before dealing with protection and safety. This time the topics will be reversed: In the case of fired heaters, it must be safety first!
SAFETY. If fired heaters had not been invented and were being proposed for the first time, I would probably say, "You've got to be kidding. That thing will blow up in your face the first time you throw a match in it." However, at least a half a billion gas fired heaters are in service around the world (according to the American Gas Association). Most of them are operated by people with no technical experience whatsoever; few heaters blow up. Still, the average domestic water heater is not in the same league as a hydrogen reformer furnace. The fact that accidents and disasters are as few as they are, is due to the long experience the human race has in dealing with fire. A million years, I'm told. For the last century, this experience has been embodied in various codes and standards that have been written into law and are en-forced by inspectors around the world.
THE CODE. The most popular, or notorious, of these codes in North America is NFPA 85⁵ and 86⁶ issued by the National Fire Protection Association. These have been considerably updated in recent years, especially in terms of clarity. Nevertheless, there is still the problem of interpretation. The code is not at all easy to read as it combines many facets of construction, instrumentation and operation in a single document. Not only that, but the code⁵ contains the following disclaimers:
It is not possible for these standards to encompass specific hardware applications, nor should these be considered a "cookbook" for the design of safety systems.
and:
This standard applies to boilers with a fuel input of 12,500,000 Btu/hr (3663 kW) or greater. This standard applies only to boiler-furnaces using single burners firing:
a) Natural gas only as defined in Chapter 3.
b) Other gas with a BTU value and characteristics similar to natural gas.
c) Fuel oil of No. 2....
and:
Furnaces such as those of process heaters used in chemical and petroleum manufacture, wherein steam generation is incidental to the operation of a processing system, are not covered in this standard.
What is an engineer to use for a guide when the furnace is not a boiler, but a feed heater; does not exceed 12½ million Btu/hr, but is only four million; does not burn natural gas as defined in Chapter 3; but refinery off-gas with a high hydrogen content? Despite the disclaimers, the NFPA series is still an excellent guide to the instrumentation and control of any furnace.
FUEL GAS FIRED, SINGLE BURNER FURNACES. The NFPA standard deals with a variety of fuels, both oil and gas. The discussion that follows restricts itself to fuel gas fired, single burners. NFPA standards have been followed as much as possible and have sometimes been exceeded by adding components and control functions where the special requirements of process control make it advisable.
Figure 5-2, shows the in-line instruments typically installed on a burner fuel gas train. Diamond symbols with an "I" in them refer to I/O of the Burner Management System (BMS).

[IMG]http://www.********.ca/ce5_fh/5-2.jpg[/IMG]

FUEL GAS SUPPLY INSTRUMENTS
PCV-1 The fuel gas supply regulator is only required when the fuel gas pressure must be reduced in two stages. This is often the case in refinery service. See Figure 5-3 for typical regulator settings.
PI-1 Every regulator should have a gauge so that the operator
can set the regulator properly and so that he can know that it is doing its job.
PSV-1 Many standard fuel gas train components have an upper pressure limit of approximately 100 psig (700 kPag). Failure of both PCV-1 and PCV-21 would overpressure the fuel gas train if the supply pressure exceeds the rating of any downstream component. In such cases provision for pressure relief is required. Note that it is not unusual to consider double jeopardy in burner safety analysis.
FE-3 This is the place to put fuel gas metering, if required. NFPA puts the fuel gas meter on the main gas line down-stream of the main gas regulator. But when using accurate fuel/air ratio control it makes sense to include the pilot as part of the total fuel supply as it may supply as much as 10% of the total fuel.
PT-3 Large burners with a variable fuel gas supply pressure may require pressure, and possibly even temperature, compensation for the fuel gas measurement.

[IMG]http://www.********.ca/ce5_fh/5-3.jpg[/IMG]

PILOT GAS LINE INSTRUMENTS
PCV-11 The pilot gas regulator is set for the actual required pilot gas pressure.
PI-11 Of course the regulator has a gauge!
BV-14 On small burners, the first pilot shutoff valve may be a standard industrial, two port, solenoid valve. Limit switches can be considered optional on solenoid valves.
On large burners, a burner safety shutoff valve is generally the preferred choice. These valves have an internal spring to force the valve shut, a solenoid to hold them open, and a small motor to re-open the valve. Item BV-24, following, provides more detail concerning this type of valve.
Some installations use a standard, industrial, diaphragm operated control valve. In either case, the valve must be fail-closed.
ZSC/O-14 At least one limit switch is required on BV-14 if it is anything more than a simple solenoid valve. This is needed to prove that the valve is shut during the purge phase. For failsafe operation it is best to have a limit switch at each end of travel. The upper limit switch proves that the valve is fully open at all times when the pilot flame is supposed to be on. The article, "Limit Switches Key to Valve Reliability"⁸ , explains exactly how to connect double, failsafe, limit switches.
BV-15 The pilot vent valve makes certain that there is never any gas pressure on the second shutoff valve despite any leakage through the first one. Since its only purpose is to vent leakage, the vent line has a smaller bore than the supply line. It must be fail-open. The Canadian Gas Association code CAN/CGA-3.9-M87⁹ repeats the following table from NFPA 86A ⁷ for determining vent line sizes:

Gas Supply Line Size		Gas Vent Line Size
NPS	mm	NPS	mm
1½	( 40 )	¾	( 20 )
2	( 50 )	1	( 25 )
2½	( 65 )	1¼	( 32 )
3	( 80 )	1¼	( 32 )
3½	( 90 )	1½	( 40 )
4	(100)	2	( 50 )
5	(120)	2	( 50 )
6	(150)	2½	( 40 )
8	(200)	3½	( 90 )
>8	(>200)	>15 % line cross-sectional area

For low molecular weight fuels such as hydrogen (Mol. Wt. = 2) or methane (Mol. Wt. = 16) it is sufficient to vent the valve to atmosphere outside the building. For fuels heavier than air, such as ethane, propane and butane (Mol. Wt. = 30, 44, 58 respectively), the vent should be piped to a flare header.
Using the table above, it may be determined that a ¾" or 1", simple solenoid valve is sufficient. If not, a fail-open burner safety valve should be used. It operates in a similar, but opposite, manner to BV-14.
ZSC/O-15 Limit switches should be included and incorporated in the BMS logic, if a full-sized vent valve is required.
BV-16 The second pilot shutoff valve is identical to the first, BV-14.
ZSC/O-16 Limit switches should be included and incorporated in the BMS logic, if a full-sized, second pilot valve is required.
PI-18 The final pressure gauge confirms that all valves are in their correct position and that the appropriate pressure is available for the pilot flame.
BY-18 The igniter itself is essentially a spark plug powered by a high voltage transformer. It is capable of sparking continuously as required by the BMS.
BSLL-19 The pilot flame detector is used to confirm that the pilot light has ignited and is burning in a stable manner. A variety of types exist depending on the size of the burner and the type of fuel.
A flame rod is a simple electrode that projects into the flame. An electric current passes through the flame to the pilot gas nozzle and energizes a sensitive relay or electronic circuit. Since it only senses flame at a point, it will not detect the main flame. A disadvantage is that the tips burn off after a period of time and a nuisance trip of the furnace will result.
An ultra-violet (UV) flame detector is probably the most popular on process heaters. It is, however, a rather complex device that requires certain precautions for reliable operation. UV detectors are optical devices. A lens in front must be aimed directly at the flame. Depending on the particular arrangement used, it may or may not be desirable for the detector to "see" only the pilot flame or the main flame as well. One or more viewing windows, BG-45A to X, must be provided by the furnace fabricator to assist in aligning the detector. UV detectors are mounted on ball swivels to permit accurate alignment. An instrument air purge complete with a rotameter and a needle valve should be connected to the tube between the lens and the flame in order to prevent dust from accumulating on the lens and to cool it. Some units also require a supply of cooling water.
FUEL GAS LINE INSTRUMENTS
PCV-21 The main gas regulator is set to the maximum allowable fuel gas pressure for the main burner.
PI-21 Every regulator requires a pressure gauge. This gauge is also used to adjust the setpoints of PSLL-22 and PSHH-27.
PSLL-22 The fuel gas low pressure switch prevents the operator from attempting ignition when there is insufficient pressure to complete it. The upstream location is so that it is not necessary to bypass its function during the ignition sequence.
BV-24 The first fuel gas safety shutoff valve is one of the "safety shutoff valves". It must be especially certified for fired heater use. The first of the three valves in the main gas train has a manual reset and a solenoid that function as follows:
- When the solenoid is de-energized the valve is shut and the manual reset has no function whatsoever.
- When the solenoid is energized, the valve remains shut until the manual reset is lifted.
- Lifting the manual reset opens the valve. The valve then remains open as long as the solenoid is energized.
A valve with this function is sometimes termed a "free handle" valve. Once a trip has occurred, the manual reset on the first safety shutoff valve will prevent the burner from reigniting. This is an extremely important safety feature. Even if there is insufficient pressure to maintain a flame, unburned gas may still collect in the firebox and ignite with explosive force once a large quantity has accumulated
ZSC/O-24 In addition, BV-24 requires a limit switch to prove that it is shut during the purge and ignition phases. Item ZSC/O-14, above, details the requirements of fail-safe limit switch arrangements.
BV-25 The fuel gas vent valve has similar criteria to those of BV-15. The same sizing table applies.
ZSC/O-25 These limit switches are optional, depending on the size of the vent valve.
BV-26 The second main gas safety shutoff valve is a little different from the first in that it does not require a manual reset. The automatic reset feature is accomplished by a small electric motor that opens the valve as soon as it is energized. The valve fails closed upon de-energization. Automatic reset valves are identified by the little "M" instead of the "S" in the symbols on Figure 5-2. The valve may incorporate a slow opening feature. Power to the reset motor should be disconnected as soon as the valve is open so that a momentary power loss to the solenoid does not cause the valve to cycle.
ZSC/O-26 BV-26 should also have limit switches whose status is incorporated into the BMS logic.
PSHH-27 The fuel gas high pressure switch shuts down the main furnace when the fuel gas pressure exceeds the maximum allowable for a stable flame. Excessively high pressure can blow the flame out only to have it reignite, perhaps explosively, higher up in the furnace.
There is a trend toward the use of analog transmitters instead of switches for sensing process values, even for shutdown purposes. The trip value is then programmed into the control system instead of being adjusted at the switch. Transmitters have become more reliable than switches and also provide much more information¹⁰ . If this is the policy at your installation, the functions of PSLL-22 and PSHH-27 can be combined in a single transmitter located at PSLL-22. A second transmitter can then be used to provide pre-alarms or an automatic redundancy scheme.
FV-3 Most large industrial furnaces have a gas flow control valve to modulate the heat input. Details of the control system are discussed in the sections on fuel control. The gas flow control valve must be fail-closed but must also have some means of ensuring that it does not shut too closely to the seat or an unstable flame will result. Approximately 35% of full flow is a typical minimum. Some engineers program a minimum output into the control system. Others weld a small stop onto the shaft. Software blocks can be easily altered and welded stops may not be re-installed when the valve is replaced. I use both. The software limit has the advantage that it can be raised if the original setting is too low. It should be set slightly higher than the welded stop in order to inhibit reset windup before the 0% controller output is reached.
Furnaces with cyclical service, such as those used in dryer regeneration service, may have the main flame turned on and off on a regular basis. In such cases, there cannot be a minimum stop on the control valve. Instead, logic should be provided that shuts the valve fully whenever the controller tries to position it below the minimum flame setting. The controller must also be switched to manual to prevent reset windup whenever this is done.
ZSC-3 The gas flow control valve requires a limit switch to confirm that it is at the minimum flow position before lightoff. The switch should be set slightly above the minimum stop.
PI-28 A pressure gauge should be placed last before the fuel nozzle itself to provide assistance in diagnosing mysterious problems. Dirt does collect in valves and other places!
BSLL-29 The main flame detector is generally of the combination ultra-violet and infra-red (UV/IR) type. The same requirements apply as to the UV detector for the pilot.
Burners in cyclical service do not require a main flame detector. They rely entirely on the pilot flame detector, which may be adjusted so that it can see both flames.
AIR SUPPLY INSTRUMENTS. There is considerable variation in the air supply system among furnaces of different sizes. Small heaters, and some not so small, may be entirely natural draft and are controlled only with a manually set air damper. For furnaces with forced draft (FD) fans some, or all, of the following instruments are required.

PDSH-31 If the air intake has a filter, it must be fitted with a differential pressure switch or transmitter connected to an alarm to warn of plugging.
FE-32 If the FD fan is large, a flow measurement device is needed at the intake to measure flow through the fan so that surge can be prevented. A simple averaging pitot tube (Annubar) or a thermal device provides sufficient accuracy without significant loss of head.
FV-32 Large fans require a minimum flow blow-off valve to prevent surge.
FE-33 The actual air flow to the burner must be measured if an accurate fuel/air ratio is to be maintained. This is generally done for large furnaces. Smaller packaged units have the fuel and the air linked with cams and no air measurement is done. A previous article¹, explains why it is not possible to use same flow element for both minimum flow and throughput flow control. It may be required to use a venturi to achieve both high accuracy and low head loss. On very large burners, arrays of pitot tubes or thermal flow meters distributed across the duct, are the preferred method. However, these can be somewhat time-consuming to install and maintain.
The associated transmitter is also used to provide the pre-alarm for FSLL-36.
FV-33 A fail-open combustion air control valve is placed at the inlet to the wind box for those burners requiring external air control. A butterfly valve is a popular choice. Very large fans may have provision for inlet guide vanes which provide a more efficient means of doing the same thing. The valve requires a minimum stop to prevent complete closure.
ZSO-33 FV-33 has a limit switch to confirm that it is fully open during purging.
VSHH-34 Large fans should be provided with a seismic type vibration switch. A previous article³ discusses these devices. The switch should be connected to shut down the entire system as the heater cannot be operated without the fan. Very large fans may even include an entire bearing vibration monitoring package.
YS-34 The FD fan motor status contact is used to provide information to the BMS.
FSH-35 The purge air switch is used to indicate adequate purge flow. It is usually a differential pressure switch across the wind box, if any, of the furnace or it may be a signal from the flow transmitter, FT-33. As can be seen in Table 5-1, there is a variety of opinions concerning minimum purge requirements.

Specification	Time	Volume	Flow
ASME Section VII11	> 5 minutes	> 5 volumes	> 25% full flow
API(RP 550 – Part 4)12	> 5 minutes	> 5 volumes	> 25% full flow
NFPA 85015	not specified	> 8 volumes	> 70% full flow
CGA B149.39	not specified	> 4 volumes	> 60% full flow

Table 5-1 Minimum Purge Requirements

FSLL-36 The combustion air low flow shutdown switch shuts down the burner if there is insufficient flow for safe combustion.
FURNACE INSTRUMENTS
TE-41 One or more skin thermocouples should be provided on the tubes of the furnace. The thermocouple element is welded directly to the tubes. Note that the device that receives the T/C signal must be capable of accepting grounded signals.
TSHH-42 High stack gas temperature is cause for shutdown. The furnace should also be isolated from the process feed if the feed is flammable. Tube rupture may be the cause for the high stack temperature.
AE-43 For a burner to operate at peak efficiency, stack oxygen and combustibles must be measured and controlled. However, the additional cost and maintenance of stack analyzers limit their use to large burners. High and low alarms should be programmed.
PI-44 A draft gauge must be provided to give a grade level indication of the pressure in the furnace. This is a special type of pressure gauge sensitive to inches of water pressure.
BG-45 A to X
FG-45 A to X Viewing windows were mentioned previously with respect to aligning the flame detectors. Other windows may be needed as well. These are usually made of glass and require a small air purge to keep them cool and clean. Regulators are often used control the air flow. This is rather pointless since it is flow control that is required. The presence of pressure may only mean that the line is plugged. The absence of pressure may mean that the purge is flowing freely at a rate beyond the capacity of the regulator. Pressure alone proves nothing. The appropriate instrument is a rotameter with a needle valve. 15 SCFH is a common flow setting. The rotameter provides proof that purge is actually occurring.
A number of purge rotameters can be mounted on a plate and pre-tubed to a small instrument air header. This greatly reduces field labour and provides a convenient way of checking all purge rates from a single location.

[Esam]

PROCESS RELATED SAFETY INSTRUMENTS. The details of process related safety instrumentation depend very much on the individual process. It is hard to generalize. The majority of furnace incidents occur during light-off. Therefore, it is not necessarily a good idea to add every automatic shutdown function that might suggest itself. The safety value of each interlock must be weighed against the risk of unnecessary shutdown and relight cycles. At least one nuisance trip is bound to occur during the life of the equipment for every shutdown device installed. Furnace isolation valves are especially problematical.

[IMG]http://www.********.ca/ce5_fh/5-4.jpg[/IMG]

XV-51 It may sound desirable to automatically shut isolation valves if it appears that a tube rupture has occurred. However, remember that any closure of an isolation valve during operation results in loss of flow. Further interlocks must be provided to shut down the burner if this occurs. Even after the shutdown, radiation from the refractory continues to heat the trapped fluid. Boiling may result in over-heated tubes. If the fluid is susceptible to coking, tubing damage may accumulate even after the immediate incident is past.
If careful analysis shows that an isolation valve would provide a net contribution to safety, the valve must be installed correctly. Details of XV-51 are shown in Figure 5-4. The valve must be a fire rated valve. That is, it must be capable of maintaining a seal in the presence of fire. API SPEC 6FA¹³ and 6FC¹⁴ outline the requirements. The wiring for both solenoids and for the associated limit switches should also be fireproof. Mineral insulated (MI) cable is an appropriate choice.
XV-51 should be located at least 50 feet (15 meters) from the furnace. Provision must be made to manually initiate valve closure from a location at least another 50 feet from the valve itself. The DCS console in the main control room is an ideal location.
XYO/C-51 If the process fluid is sufficiently hazardous that isolation valves are considered necessary, a difficult issue must be addressed: What should the failure mode of the valves be? If the valve fails to shut during an emergency, a hazardous situation exists. If the valve fails closed due to a power or instrument failure, other hazards occur. One solution to this problem is to use double-acting, fail-last (-locked) valve actuators. These should be installed with two separate solenoids: XYO to open the valve and XYC to shut it. If this is done, two failures are required to cause an undesired valve action. For example, if the valve is required to be in the open state, XYO will be energized. A signal failure results in both solenoids being de-energized. However, the valve will not move since air pressure on the piston is still balanced. It requires energization of XYC before anything happens. A valve that has been shut because of a fire will not re-open due to burned out wiring. Incidentally, double-acting actuators are considerably less expensive than spring-return actuators.
ZSC/O-51 Limit switches ⁸ are provided on the valve to ensure that it is fully open before furnace ignition is permitted, and fully shut when necessary.
XV-52 If the furnace contains a large inventory of flammable fluid, a depressurization valve may be required. It should be capable of dumping the entire contents of the furnace to the flare. A check valve should be added at the outlet of the furnace so that the blowdown valve does not attempt to depressure the entire downstream process.
XYO/C-52 The problems associated with a fail-open depressurization valve make it very unlikely that it would be acceptable to operations. Any power or air failure would result in massive flaring. Thus a fail-last valve actuator arranged in same way as XV-51 is the most reasonable choice.
ZSC/O-52 Limit switches on XV-52 should be interlocked to prevent opening XV-51 when the depressurization valve is open.
FSLL-53 Measuring the process outlet flow is an excellent safety feature. Remember that a process furnace is essentially a heat exchanger. If there is no process flow, the furnace tubes will overheat and may coke or even rupture. The flue gas will overheat upper section of the furnace and the stack. No furnace can be allowed to operate under these conditions.
If the inlet process flow, FE-33, is high and the outlet is low, it can only mean that a tube has ruptured. Immediate shutdown is imperative.
TSHH-53 High process outlet temperature means that the temperature controls are not functioning properly: The furnace must be shut down.
The note under PSHH-27 concerning the use of transmitters instead of switches also applies here. Modern programmable logic controllers (PLCs) and distributed control systems (DCSes) are quite capable of interpreting thermocouple and RTD signals directly. Consideration should be given to using them instead of the less reliable temperature switches or the combination of thermocouple and millivolt trip relay¹⁰ .
PSV-54 In all probability there will be block valves somewhere on either side of the heater so that it can be isolated manually. If these exist, a relief valve must be provided.
SUPERVISED MANUAL. The NFPA standards ^{5, 6} specify several types of burner management systems:

• • Automatic (Recycling)
  • Automatic (Nonrecycling)
  • Supervised Manual.

The type most commonly used in industrial process furnaces is supervised manual, often called semiautomatic. NFPA describes it best:
Supervised Manual. A system by which the furnace is purged and a burner started, ignited, and stopped manually, with interlocks to ensure that the operation follows proper procedures.
That this means is that the operator must be present at the burner to control the ignition procedure. At various key points he pushes a button or takes some other action to advance to the next step. The BMS supervises the operator and confirms that all conditions are appropriate for that step before allowing it to proceed. If conditions are wrong, the BMS shuts down the entire sequence and the operator must rectify the problem and start all over again. It's a little like playing Snakes and Ladders except that there is no quick way to the top. A detailed example of the ignition sequence for a furnace with an FD fan is given below. The indented paragraphs marked "· " indicate automatic action.
STEP 1: Close the gas flow control valve, FV-3, to its minimum stop.

Open the combustion air valve, FV-33, full.
Push the Start Fan button, HS-34. (The fan may be started from the main control panel or by some other means.)
· The green Fan Running light, YL-34, comes on.
PAUSE The sequence may wait indefinitely at this point.

STEP 2: Switch the Enable switch, HS-2, to ON. (This can also be done before the fan is started.) Any other shutdowns, such as from the Main Control Panel or a plant emergency shutdown (ESD) must be cleared before this has any effect.
· The green Ready light, XL-2, comes on if there are no active shutdowns.
· Automatic functions are enabled once the switch is ON. Until that point, no lights are on except the Fan Running light, and no push buttons function except the Lamp Test. All block and vent valves are de-energized.

[IMG]http://www.********.ca/ce5_fh/5-5.jpg[/IMG]

PAUSE The sequence may wait indefinitely at this point.

STEP 3: Push the Lamp Test button, HS-9.
· All lights should come on.
STEP 4: Push the Start Purge, HS-35, button.
· The following conditions must be met before the purge sequence can begin:
- Both safety shutoff valves are confirmed shut.
- The gas flow control valve is confirmed on minimum stop.
- The combustion air control valve is confirmed wide open.
- The fan is confirmed running (YS-34).
- The purge flow signal, FSH-35, is on.
· Once these conditions are met, a timer, KC-35, is started. The timer is set so that a minimum of eight air changes of the furnace is assured. (See Table 5-1, Minimum Purge Requirements.) The green Purge Complete light, FLH-35, flashes while the timer is running. Any time any of the conditions are not met, the timer is reset and the light goes off.
· Once the timer has completed the purge interval, the green Purge Complete light is on steady.
PAUSE The sequence may wait indefinitely at this point as long as the fan is running.

STEP 5: Push the Start Ignition button, HS-14.
· A twelve second timer, KC-14, is started.
· The ignition transformer, BY-18, is turned on.
· The green Pilot Flame On light, BLH-19, is flashing.
· The pilot vent valve, BV-25 is shut.
· The first pilot shutoff valve, BV-24, is opened.
· The second pilot shutoff valve, BV-26, is opened.
· Pilot flame, BSLL-19, must be confirmed for two seconds during the twelve second interval or the BMS reverts to Step 4.
Once the pilot flame, BSLL-19, is confirmed.
· The ignition transformer, BY-18, is turned off.
· The green Pilot Flame On light, BLH-19, is on steady.
PAUSE The sequence may wait indefinitely at this point as long as pilot flame is detected.

STEP 6: Push the Open Main Fuel button, HS-24.
· A second twelve second timer, KC-24, is started and the green Main Flame On light, BLH-29, is flashing.
· The fuel gas vent valve, BV-25, is shut.
· The first fuel gas safety shutoff valve, BV-24, is energized.
STEP 7: Lift the lever on the first fuel gas safety shutoff valve, BV-24, within ten seconds. The valve will then stay latched in the open position. It will not open at all if conditions are not safe.
· If this is not confirmed by ZSO-24 within the allowed ten seconds, the sequence reverts to Step 4. If it is, the open limit switch will trigger the BMS to open the second fuel gas safety shutoff valve, BV-26.
· Main flame must be confirmed by BSLL-29 for two seconds during the twelve second interval or the BMS reverts to Step 4.
· Once the Main flame is confirmed, the green Main Flame On light, BLH-29, is on steady.
PAUSE The furnace is now running on minimum flame (also known as "low fire"). The sequence may wait indefinitely at this point.

STEP 8: The operator may open the gas flow control valve at any time.
EMERGENCY SHUTDOWN. Various trouble indications will trigger a partial or total furnace shutdown. They are tabulated in Table 5-2. These shutdowns, except the two flame failures, are active at all times, including during the ignition sequence. The flame detectors are bypassed during the trial for ignition period.

Burner E S D cause	Main Gas BV-24/25/26	Pilot Gas BV-14/15/16	FD Fan	Manual restart at
VSHH-34 fan	De-energize	De-energize	Stop	Step 1
HS-2 manual	De-energize	De-energize
FSLL-36 air	De-energize	De-energize		Step 4
BSLL-19 pilot	De-energize	De-energize
BSLL-29 main	De-energize
PSLL-22 fuel	De-energize
PSHH-27 fuel	De-energize
TSHH-41 tube	De-energize			Step 6
TSHH-43 stack	De-energize
FSLL-53 process	De-energize
TSHH-53 process	De-energize

Table 5-2 Furnace ESD Key

Other, process related ESD functions such as isolation and depressurization of the furnace, may also be implemented. A thorough analysis of the entire process is required to determine what else, if anything, may be required.
LOCAL CONTROL PANELS. Figure 5-5, The Basic Local Control Panel, shows the minimum status lights, push buttons and switches required at the burner. This minimum assumes that all alarms and shutdowns are displayed on a main control console, perhaps a DCS, somewhere else in the plant. The local operator and the console operator must be in close communication during the light-off sequence. At other times the burner is unattended.
Many burners are supplied as self-contained packages. For such installations, a more complete local panel is required. Every pre-alarm, shutdown alarm and valve status is displayed as a separate indicating light on the panel. In general, a good colour code is:
Pre-Alarm Orange
Shutdown Alarm Red
Ready Light Green
Valve Open Green
Valve Shut Red
Avoid the use of blue indicating lights as they are practically invisible in bright daylight. Alarm logic must be provided to drive the alarm indicators and a horn according to the standard ISA Automatic Reset sequence A. The First Out and Lamp Test features (ISA sequence¹⁵ F3A-14) are often requested These can be accomplished by dedicated alarm annunciator logic or by a PLC. Logic and control hardware may be housed within the local panel or elsewhere in the plant.
FEEDBACK FUEL CONTROL. The simplest combustion control arrangement is to have a temperature controller (TIC) on the process outlet controlling the fuel gas firing rate. This system is essentially like the medium side, inlet throttling, arrangement described "Controlling Shell and Tube Exchangers"³. The TIC may drive the fuel valve directly, in which case the valve is tagged "TV", or it may cascade to a flow controller (FIC) on the fuel gas.
FEEDFORWARD FUEL CONTROL. In theory, feedback fixes everything. In practice, there are problems. Fired heaters have a considerable response lag to changes in either the firing rate or process inlet conditions. There will be transient dips or bumps whenever a significant change occurs on any process, fuel, or air variable. If deviation from setpoint is the disease, then feed-back is the cure. But an ounce (28 grams) of prevention is worth a pound (454 grams) of cure. Feedforward is the technique of preventing the problem before it occurs.
If there is significant variation in feed rate, feed forward can be applied as is described in "Controlling Shell and Tube Exchangers"³. Similar methods can be used to compensate for rapid variations in feed temperature.
[IMG]http://www.********.ca/ce5_fh/5-6.jpg[/IMG]Direct control of the fuel valve is not enough for any but the smallest burners. The fuel must be controlled to provide the exact amount of energy that the process requires. This implies that the heat content of the fuel as well as its flow rate must be known. If the fuel pressure, temperature and composition are constant, a simple flow meter is sufficient. If significant variations are expected, more complex feedforward techniques can be applied. Figure 5-6 shows the "full meal deal". It is seldom necessary to include all this instrumentation. A chromatograph measures the composition. From this the density, heating value, and oxygen demand can be calculated. Combining these calculations with the PT, TE and FT readings results in an exact figure for heat input per unit time. The result of this arrangement is that any changes in fuel gas condition will be corrected before any change in the process temperature occurs.
In the past, a calorimeter has been used instead of a chromatograph. It was specially designed to produce a single figure called the "Wobbe Index". (I don't know if this rhymes with "lobby" or "Toby".) This index is defined as Btu/scf/(specific gravity) ^1/2 . The square root in the denominator automatically accounts for the effects of molecular weight changes on an orifice plate. A calorimeter with such an output is frequently called a "Wobbe meter".
Wobbe meters function by actually burning a small amount of fuel that has been metered through a fixed restriction orifice. In this manner the effect of changing density on the flow meter and the control valve is mimicked. They serve very well with mixed hydrocarbon fuel gas. The assumption is that there is a proportional relationship between heat content and oxygen demand. This assumption is reasonably accurate for hydrocarbons but is not reliable if there are large, variable proportions of hydrogen in the fuel. In such cases, more complex analyzers are needed to provide an exact oxygen demand figure which can be used to adjust the ratio of the air controller, FFIC-33.
AIR CONTROL. Air must be supplied to the burner in proportion to the fuel. In small, simple units this is accomplished by having the two valves linked by a cam. The ratio between the two flow rates is set by mechanically adjusting the cam. Several significant assumptions are made when this arrangement is used:
· The pressure of both the fuel and the air is constant.
· The temperature of both the fuel and the air is constant. Note that a 90F° (50C° ) swing in temperature results in an 18% variation in density. Because of the square root relationship between density and the flow rate, this will result in an error of 9% in the measurement and hence a 1.8% change in excess oxygen.
· The composition of the fuel, and hence its air demand, is constant.
If these conditions are not met, the fuel/air ratio will vary. A fuel-rich mixture results in serious waste of fuel and possibly a hazardous condition. An air-rich mixture also results in inefficiency due the volume of air that must be heated and blown out the stack while reducing heat transfer.
Natural draft burners may have a set of actuator-driven louvres controlling combustion air. Accurate flow measurement may not be possible for such installations. The correct louvre position can be controlled by sending it a signal that is proportional to the signal sent to the fuel gas valve. Exact adjustment of the ratio can only be done on-line with the assistance of the stack O₂ analyzer.
LEAD/LAG COMBUSTION CONTROL. In order to control the fuel/air ratio on a continuous basis through all load changes, a flow ratio controller is used. This involves measuring both the fuel and the air. Figure 5-7 shows the complete arrangement; it has a number of specialized features. Firstly, the total heat demand is determined by the load controller, XIC-99, responding to the demands of the process. Most probably it is a temperature controller on the outlet. The XIC is cascaded to both the fuel and air controllers. Since these two controllers are measuring different flows, the signal from the XIC must be in units that both controllers can understand. The most convenient set of units is to have the 0 to 100% signal equal to the span of the fuel gas controller, either in SCFM, BTU/min or some other appropriate unit. Some DCSs have the features to do this automatically. Ignoring, for a moment, the two selectors FY-3B and FY-33B, the XIC-99 signal becomes the setpoint of both the fuel controller, FIC-3, and the air controller, FFIC-33. The latter is configured as a ratio controller which has the appropriate air/fuel ratio built in. Be careful here: Sometimes, for reasons of tradition, fuel is measured in SCFM and air is measured in lb/min. Ensure that the ratio programmed into the control system takes such peculiarities into account. Once the furnace is in operation, the ratio may be adjusted with the help of the flue gas analyzer.

[IMG]http://www.********.ca/ce5_fh/5-7.jpg[/IMG]

So far, so good. But this arrangement does not allow for either rapid transients in the fuel demand nor the possibility that either the fuel or the air valves may not be responding correctly. This is where the two limiters come in. They are arranged in what is commonly called a "lead/lag" arrangement. (Note that the expression "lead/lag" has at least three totally unrelated meanings in process control: The first refers to a specific form of dynamic signal conditioner; the second to a two-stage pump or compressor control; the third applies to burners and is explained here.) Some call this arrangement a "cross limiter".
The purpose of the high selector on the setpoint of the air flow is to pass the greater of the process driven air demand and the actual fuel rate. On a rising demand signal, the air will lead the fuel since it responds immediately and does not wait for the fuel to rise. On a falling demand signal, the air setpoint will not fall until the fuel, as measured by FT-3, has fallen. Thus the air will lag the fuel on the way down.
Both the fuel and the air controllers have their setpoints based on the same fuel rate. In the event that the fuel valve opens without the setpoint to the air controller rising a corresponding amount, the increased fuel rate will pass through the high selector to increase the setpoint to the air controller to agree with the actual fuel injected into the burner.
The purpose of the low selector on the setpoint of the fuel controller is to prevent the fuel flow from rising before the air flow has risen. The fuel lags the air on the way up and leads on the way down. If the air supply should fail, the fuel setpoint will fall with the air, regardless of the demands of XIC-99.
One detail remains: FIC-3 is not a ratio controller. Its setpoint is defined in terms of the fuel flow rate. Both inputs to the
selector FY-3B must have identical units and range. FY-33C is a simple scaling function with the scale constant "K" exactly equal to the reciprocal of the air/fuel ratio of FFIC-33. In a DCS it is possible to configure this function block to automatically read the value of the ratio from FFIC-33 and apply it directly in the formula. This is important because the value of the ratio may be changed in response to changes in the fuel gas composition or the combustion efficiency. It is easy to overlook the K factor when making this adjustment.
FLUE GAS MEASUREMENT. Most modern process furnaces, even relatively small ones, have some form of continuous excess air measurement in the flue. This is important for both efficiency and safety. In the past, such instruments have had a well deserved reputation for high maintenance and low reliability. This is no longer the case. Today's instruments are based on the electrochemical response of zirconium oxide (ZrO ₂), also known as zirconia. A probe is inserted directly into the flue and does not require any sampling system.
An explanation of the meaning of excess air is in order. Excess air is combustion air in excess of the theoretical, or stoichiometric, air. This is approximately, but not exactly, the same as what is measured by the stack O₂ analyzer. The difference is that there will be at least some oxygen in the stack that could have burned but did not because of poor combustion conditions. This implies that it is possible to have some O₂ as well as unburned fuel going up the flue. This condition cannot be cured by instrumentation.
Air is about 21 volume percent oxygen. This means that a 10% excess O₂ reading implies that only half the oxygen is being consumed and that twice as much air is being blown into the furnace, heated up, and sent up the stack, as is necessary for combustion. That wastes a lot of energy and reduces the capacity of the furnace. Since the cost of unburned fuel is higher that than of excess air, a typical optimum is approximately 2% excess O₂ representing approximately 10% excess air. Natural draft furnaces without continuous air control should be operated at approximately 6% excess O₂. This ensures complete combustion under upset conditions.
Large furnaces such as power boilers, where the cost of inefficiency is high, often include a combustibles analyzer in the same unit as the excess O₂ analyzer. These devices can also make in-situ measurements without sampling. They use an infrared beam directed across the stack to measure the carbon monoxide (CO) content. Excess air levels below 1% give no useful indication of combustion efficiency as there is no longer any correlation between the amount of residual oxygen and the amount of unburned fuel going up the flue. A combustibles analyzer can provide that information. They are expensive, however, and must be justified on a cost/benefit basis.
Sometimes the flue gas analyzer is used to automatically adjust the air/fuel ratio of FFIC-33. Great care should be exercised in taking this obvious-looking step. Despite their considerable improvement in terms of accuracy and reliability, flue gas analyzers are still complex instruments and do not approach the reliability of flow transmitters. This step should only be taken if the benefit justifies the necessary commitment to maintenance. Even then, high and low limits must be placed on the signal going to the ratio controller so that failures or inaccuracies cannot drive the air/fuel ratio to dangerous extremes.
BURNER CONTROL and MANAGEMENT SYSTEMS. NFPA^{5, 6} defines three distinct control systems:
Boiler Control System. The group of control systems that regulates the boiler process including the combustion control system but not the burner management system.
Combustion Control System. The control system that regulates the furnace fuel and air inputs to maintain air/fuel ratio within the limits required for continuous combustion and stable flame throughout the operating range of the boiler in accordance with demand. This control system includes the furnace draft control where applicable.
Burner Management System. The control system dedicated to boiler-furnace safety, operator assistance in the starting and stopping of fuel preparation and burning equipment, and prevention of damage to fuel preparation and burning equipment.
For a process heater, the various process related controls would be equivalent to the boiler control system.
Contrary to common belief, neither PLCs nor DCSs are mentioned in any of the NFPA 8500 series. They are not mentioned in the CGA Code either. What NFPA says is
The logic system performing the safety functions for burner management and boiler control systems shall not be combined with any other logic or control system.
Unfortunately it is not at all clear what the word "combined" means, nor is there any explanation of the word "system". There seem to be many interpretations, some of them quite extreme. One I have heard is that "NFPA requires that the combustion controls shall be in the DCS, the sequenced start shall be in a dedicated PLC and there shall be hardwired shutdown relays." The problem with this approach is that there are too many links between these three systems. Each link adds complexity that reduces the reliability of the whole. For example, the sequenced start requires that the flame detectors must be bypassed during the trial for ignition period. Once the relays have bypasses from the PLC, they no longer have any independent reliability. And besides, who says that relays are safer than PLCs¹⁰?
There are also links between the PLC and the DCS. The start sequence turns the fuel gas control valve down to its minimum stop. It then manipulates the air flow for purging. Whether these links have the form of signals passing between the PLC and the DCS or they take the form of solenoid valves interrupting the air signals to the actuators, complexity is added that compromises the integrity of both the BMS and the combustion control system.
Firstly, the start sequence and the safety interlocks are one inseparable control system. Normal operation is simply the final stage of the start sequence. The main flame is now on, and all safety interlocks are fully operational.
Programmable control systems commonly used in today's process industries are built of large and powerful units that can handle logic and control functions far more complex than control of a single burner. A DCS, in particular, consists of many independent function blocks that are either linked together or kept separate according to the requirements of the control strategy. There is no reason why all aspects of a burner control cannot be carried out within a single physical controller. Certain precautions must be taken to ensure that the NFPA requirement for separation is met:
1. The BMS must reside in a clearly identified block of logic functions. This block must have all inputs and outputs clearly identified within the block. A DCS that requires this identification as part of its programming approach is acceptable. A DCS that requires "hardware" addressing is not.
For example: Assume that Logic Block 13 is the BMS. The statement "Set Register 21 in Logic Block 13 ON" appearing elsewhere in the DCS is an example of risky programming practice. An inspection of Block 13 would not reveal the connection. This type of statement is even more dangerous if it is made in error in a totally unrelated function. A safe method of accomplishing the desired function is to include the statement "If HS-12 is ON, then set BV-24 ON" within the body of Block 13. Anyone examining the BMS can readily see the statement and judge its validity. Such statements cannot accidentally be included in Block 13 by someone working on a different block.
2. Outgoing links between the BMS and other control functions must always be "pushed" by the BMS. For example: The BMS forces the fuel gas valve shut and then puts it back on automatic at the appropriate times. The fuel gas controller does not check the BMS to see what it should do.
3. Incoming links between the BMS and other control functions must always be "pulled" by the BMS. For example: The BMS checks the status of a bypass switch to see if it should ignore a high discharge temperature. The bypass switch does not force the BMS.
4. No unrelated logic function may reside in the same block as a BMS. It must always be extremely clear to anyone making modifications whether or not they are in a BMS block. Since there may be times when it is necessary to disable some unrelated function, it must always be possible to do this without disabling any part of the BMS.
5. Input and output modules for BMS related signals should not also handle other signals.
6. A hardwired "kill" switch should be included on the operator's console. This switch de-energizes all gas safety shutoff valves. This can easily be accomplished by cutting the power to the output modules. If rule 5 is followed this can easily be accomplished without disturbing unrelated functions of the DCS. The kill switch should also have a second contact wired to provide input to the BMS logic in the DCS. The BMS will then carry out an independent shutdown. In this way full redundancy is accomplished. In addition, the DCS logs the use of the kill switch.
7. A DCS control unit that carries out any functions beyond the control of a single furnace must be fully dual redundant with automatic transfer to an identical, on-line, backup unit. All communications between the control unit and the operator's console must be fully dual redundant with auto transfer. The consoles themselves must be at least dual redundant with no shared components.
It is my own opinion that a BMS can be integrated into DCS control unit safely, reliably, and legally if the above rules are followed. But... I realize that this a complex subject and that many users have had different experience. I would very much welcome feedback on this controversial subject.
Because of the wide range of interpretations of the functional separation rule, it is very wise to outline any proposed control system in detail and have it approved by the "authority having jurisdiction" before proceeding with implementation. I understand it is not very pleasant to have a design refused during commissioning.
COMMISSIONING. No Burner Management System can be certified safe until it has been field tested. NFPA is quite clear on this point:
The safety interlock system and protective devices shall be jointly tested by the organization with the system design responsibility and those who operate and maintain such systems during the normal operating life of the plant. These tests shall be accomplished before initial operation.
The proof of the pudding is in the eating. No safety system is safe until it is demonstrated to be safe.
REFERENCES
1. ********, W. C., "Controlling Centrifugal Pumps"; Hydrocarbon Processing, July 1995.

[link Point to another website Only the registered members can access]
2. ********, W. C., "Controlling Positive Displacement Pumps"; Hydrocarbon Processing, May 1996.

[link Point to another website Only the registered members can access]
3. ********, W. C., "Controlling Shell and Tube Exchangers"; Hydrocarbon Processing, March 1998.

[link Point to another website Only the registered members can access]
4. ********, W. C., "Controlling Steam Heaters"; Hydrocarbon Processing, November 1996.

[link Point to another website Only the registered members can access]
5. NFPA 85, Boiler and Combustion Systems Hazards Code (Formerly 8501, 8502, 85A, 85C).

[link Point to another website Only the registered members can access]


6. NFPA 86, Standard for Ovens and Furnaces.

[link Point to another website Only the registered members can access]
7. ********, W., Limit Switches Key to Valve Reliability; Intech, January 1993.

[link Point to another website Only the registered members can access]
8. CSA B149.3, Code for the Field Approval of Fuel-Related Components on Appliances and Equipment.

[link Point to another website Only the registered members can access]
9. Gruhn, P. and Cheddie, H.L., Safety Shutdown Systems: Design, Analysis and Justification, ISA.

[link Point to another website Only the registered members can access]
10. ASME Boiler and Pressure Vessel Code, Section VII, Care of Power Boilers.

[link Point to another website Only the registered members can access]
11. API RP 556, Fired Heaters and Steam Generators.

[link Point to another website Only the registered members can access]
12. API SPEC 6FA, Specification of Fire Test for Valves.

[link Point to another website Only the registered members can access]
13. API SPEC 6FC, Specification of Fire Test for Valves with Selective Backseats.

[link Point to another website Only the registered members can access]
14. ISA 18.1, Annunciator Sequences and Specifications.

[link Point to another website Only the registered members can access]
15. ISA 77.41, Fossil Fuel Power Plant Boiler Combustion Controls.

[link Point to another website Only the registered members can access]
16. CSA 3.9, Automatic Safety Shut-Off Gas Valves.

[link Point to another website Only the registered members can access]