Burner Management System Logic and Interlock

instrumentationtools.com/burner-management-system-logic-and-interlock/

July 29, 2019

Burner Management System or BMS (not to be confused with building management

system from another industry!) is a mechanism that monitors fuel burning equipment during
start-up, shutdown, operation and transient conditions.

It must be designed to present the status of all fuel burning equipment to the operator’s
interface in a concise format.

Burner Management System

The BMS primary tasks are to automatically initiate a safe operating or shutdown sequence
to prevent an explosion from occurring inside the furnace hence, protecting equipment from
damage and most significantly, personnel from injuries or death.

The Burner Management System is essentially an interlock switch which permits firing of a
boiler at any load and shuts down the fuel sources shall unsafe process conditions occur.

BMS also goes by different names. In my previous power plant, it is called as FSSS or
Furnace Supervisory Safeguard System which does the same duty.

A BMS is required in line with the inclusions of NFPA 85, Boiler and Combustion
Systems Hazards code.

The citations are as follows:

a) Single burner boilers, multiple burner boilers, stokers and atmospheric fluidized bed boiler with a fuel
rating of 3.7MWt (12.5 million Btu/hr) or greater.
b) Pulverized fuel systems at any heat input rate
c) Fired or unfired steam generators used to recover heat from combustion turbines [heat recovery steam
generators (HRSGs)] and other combustion turbine exhaust systems at any heat input rate.

The purpose of the Code stated is to ensure a safe process by establishing minimum
requirements for the design, installation, operation and maintenance of boilers, pulverized
fuel systems, HRSG as well as their associated systems for fuel burning, air supply and
combustion product removal.

The code requires the unison of operating procedures, control systems, interlocks and
structural design. The goal is to avert the most common contributor of explosions in the past,
human error it is.

Purge Control and Oil Leak test

1/9
Purging is obligatory before ignition of the first burner in order to clear any combustibles
which may have been accumulated in the boiler and its components.

The multiple-burner Purge Rate air flow as described on the NFPA code shall fall between
25%-40% range of designed full load mass airflow. This air flow has to be maintained from
purge completion through light-off and initial loading. If in the middle of purging, the air flow
has decreased below the nominal value, the purging time must be reset.

The process must be completed on the specified time under the definite air flow condition.
This time we are speaking of must not be any lesser than 5 minutes or the time it takes for
five volume changes of the boiler enclosure whichever is longer.

The total mass airflow is calculated with a weighted Primary Air and Secondary Air flow
ratios expressed under ideal gas conditions as Nm3/s. In the case of my current Plant, the
weighted ratio values for PA and SA flow are….

Operational leak test of the fuel header piping must also be performed while maintaining the
required purging air flow. Purging and Oil leak test must be successfully satisfied before the
fuel header will be placed in operation.

2/9
Figure 1: Sequential flowchart of Boiler Purge and Oil leak test. Ellipses indicate optimal
values to be figured out during design stage or commissioning proper.

Figure 1 summarizes the purge and oil leak test events on a somewhat flowchart format.
The goal is to pressurize oil group lines for leak testing and check if the holding pressures
are sustained. If the pressure on either group rises, the main shut-off valve must have
leakages on it as it allows passage of residual oil.

On the contrary that the pressure decreases, there must be some leakage in between the
piping of the main shut-off and return valves or in the return valves themselves. We can
better visualize the flow of oil using

Figure 2 below. The purge process can start after the HMI button is pressed for as long as it
maintains the nominal flow rate. It does not need to wait for the leak test to be finished simply
put, the two processes can be performed simultaneously.

3/9
If both processes are completed successfully, the Master Fuel Trip (MFT) reset button can
be already pressed and all the MFT relays will be energized. We can now proceed in lighting
off the first burner!

Figure 2: A tidbit of Start-Up burner P&ID.

Interlock System Diagram

I would really love to share our actual interlock diagram implemented at the Plant but let’s
just make use of the standard extracted from the NFPA 85 document.

Individual igniter shutdown sequences shall occur during the following situations:

a) Loss of igniter flame being constantly monitored by robust flame scanners.

b) Igniter oil (or gas) pressure low via pressure switches installed on the lines.

c) Igniter atomizing air pressure low via pressure switches on pneumatic lines.

Atomizing air is what transforms the fuel oil into very fine particles through the use of
engineered nozzles. Just like how you sprinkle water to the Bermuda grass on your lawn with
a specialized hose nozzle, the oil in this form will enable its full combustion potential.

Master fuel trip, MFT as we keep on mentioning is the term we use to kill all fuel sources
which cause combustion, not only limited to start-up oil igniters but also including the coal
conveying systems. All pneumatic shut-off valves shall close, if possible at lightning speed,
and all coal conveyor VFDs must stop.

4/9
It must be important to understand that an MFT does not necessarily mean that we are
shutting down the entire boiler. The boiler draft system can still function despite an MFT. This
is to maintain air circulation and provide ventilation. However if one of the draft sources has
ceased from operating, it is mandatory to execute an MFT.

I appreciate the design of my plant’s interlock set-up because all MFT sources are
instrumentation-based. This means that the system checks the individual draft fan’s pressure
outputs instead of looking at its individual running status from the switchgears, which totally
makes sense because running an equipment does not guarantee that it is producing the
required process values.

I would also like to talk about what I believe are the most overlooked causes of MFT:

1) 3-time unsuccessful Ignition attempts

During lighting off the first burner, BMS tracks the attempts taken before establishing the
flame. If after three consecutive attempts, the flame scanner is not registering any signs of
flame inside the furnace, then an MFT must act.

This can be ground for further investigation as to why the burner has failed to light during
normal operation but if we are experiencing this during commissioning stage, considerations
can be made given that it will be properly tuned both in the field and the DCS logic.

2) Loss of all fuels

If during the lighting off sequence of the second burner, the first burner has lost its flame, an
MFT shall again take place. This means that the furnace has an absence of ignition and
must be purged again to prevent combustible debris from exploding.

Of course this situation is also applicable when multiple fuel sources shutdown while in the
middle of a sequence of starting another fuel system, which can be a very rare case as the
blue moon.

5/9
Figure 3: Interlock system diagram for multiple burners. Excerpt from section 6.4.1.2.1 of
NFPA 85.

Control Systems Hardware / Software Requirements

6/9
The burner management system must be provided with independent logic, independent logic
solving hardware, independent input/output systems and independent power supplies. It
shall be an autonomous device in a way that it is functionally and physically separate from
other logic systems.

Signals and the manually operated devices such as push buttons on the operator’s console
which would initiate mandatory Master Fuel Trips must be hardwired. This requirement is
one of the reasons why modern coal fired power plants are still being built on the foundation
of conventional hardwired analog and discrete signals.

Provisions for digital I/O interfaces such as FieldBus and Profibus or even wireless are still
limited. We cannot see legacy wires retiring any time soon simply because of its proven fast
reaction and reliability.

System redundancy is already a norm in DCS or PLC these days but it is worth noting that in
a BMS, the whole system must be capable of hot-standby (seamless) switching shall a
failure occur on the power supply or the network communication switches.

The typical set-up of redundancy is through the levels of primary/secondary controller CPUs,
dual redundant ring network topology and dual UPS. During Site Acceptance Tests (SAT)
the functionality of hot-standby for these levels must be duly tested to be functioning.

“No single component failure within the logic system shall prevent a mandatory master
fuel trip.”

7/9
Figure 4: Streamlined Plant Data Highway. All components are powered by redundant UPS
and are not shown for simplicity. BPS is Boiler Protection System while BCS is Boiler Control
System.

Watchdog circuits, hard-wired on MFT relay panels and soft I/Os in the DCS is also a
requirement to prove the integrity that the entire BMS is healthy. Healthy means that there is
a continuous power supplied to the relays which are normally energized and the connection
among the controller CPUs is not ceased.

Normally a function block is used to generate random signals and be distributed on each
individual controller CPU. Take for example the algorithm called “heartbeat” in an Ovation™
DCS. This algorithm block’s task is to broadcast a randomly changing signal to all controller
CPUs.

Each controller CPU then detects that the signal it receives from the other CPUs in the
control network is continuously varying which indicates an “alive” state. The moment one
CPU has recognized any received signal broadcast halted from varying within a very short
amount of time, it will act on instinct to generate an MFT demand to occur.

“Failure of the logic system shall require a fuel trip for all equipment supervised by the
failed logic system.”

Field Instrumentation
In a Supreme Court where the DCS is the chief justice and three field instruments are
associate justices, a voting is required to convict a murder fuel trip, I mean Master Fuel Trip!
To achieve this, two instruments must be able to distinguish a process trip point before
initiating an MFT.

This is known as the 2 out of 3 or 2oo3 voting. The BMS supervising instruments also must
be checked for its signal propagation quality. If in any case that an instrument turns bad
quality, it will already be considered as one trip condition.

The burner management system interlock and alarm functions shall be initiated by one or
more of the following:

1) One switch or transmitter dedicated to the burner management system.

2) Voting logic derived from two or more switches or transmitters.

I remember a scenario when the commissioning operators of my plant are trying to shut
down the fuel igniters purposely by emptying the steam drum and cause a drum level low-
low condition. They did not know that by doing so will also empty the condensate pots as
well as the impulse filled lines of the 2oo3 level transmitters.

8/9
As a result, the analog current value fell below the sensor quality limit monitoring of the DCS,
say 3.6mA instead if the usual 4mA. This event triggered also the drum level high-high
condition and eventually shut down the draft system making the boiler trip unintentionally.

I can conclude this primer with the sequential flowchart of the actual operation of a
Start-up burner sequence but I decided to include them on a follow-up article which
will be published some other time.

Editor’s notes: This article was based on the 2015 edition of NFPA 85: Boiler and
Combustion Systems Hazard code. The editor also drew inspiration from Jerry Gilman’s
Boiler Control Systems Engineering ISA handbook. The written article is very limited and
covers only the editor’s personal understanding as well as experience of the subject. If the
reader wishes to have a copy of full NFPA 85 Code, the editor would be much obliged to
send it through an appreciation comment below.

Ovation™ is a registered trademark of Emerson Process Management.

P.S. Weighted Ratio of our Plant PA and SA flows are still to be determined. The editor keeps
on forgetting to check them on the DCS Signal Diagrams!

Author: Jeremiah Cayondong

Don't Miss Our Updates

Be the first to get exclusive content straight to your email.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

9/9