32242044_Spec_2013-09_A00

DEP SPECIFICATION

INSTRUMENTATION CONTROL AND PROTECTION FOR FIRED EQUIPMENT

DEP 32.24.20.44-Gen.

September 2013

ECCN EAR99

DESIGN AND ENGINEERING PRACTICE

DEM1

© 2013 Shell Group of companiesAll rights reserved. No part of this document may be reproduced, stored in a retrieval system, published or transmitted, in any form or by any means, without the prior

written permission of the copyright owner or Shell Global Solutions International BV.

This document contains information that is classified as EAR99 and, as a consequence, can neither be exported nor re-exported to any country which is under an embargo of the U.S. government pursuant to Part 746 of the Export Administration Regulations (15 C.F.R. Part 746) nor can be made available to any national of such country. In addition, the information in this document cannot be exported nor re-exported to an end-user or for an end-use that is prohibited by Part 744 of the Export

Administration Regulations (15 C.F.R. Part 744).

ECCN EAR99 DEP 32.24.20.44-Gen.September 2013

Page 2

PREFACE

DEP (Design and Engineering Practice) publications reflect the views, at the time of publication, of Shell Global Solutions International B.V. (Shell GSI) and, in some cases, of other Shell Companies.

These views are based on the experience acquired during involvement with the design, construction, operation and maintenance of processing units and facilities. Where deemed appropriate DEPs are based on, or reference international, regional, national and industry standards.

The objective is to set the standard for good design and engineering practice to be applied by Shell companies in oil and gas production, oil refining, gas handling, gasification, chemical processing, or any other such facility, and thereby to help achieve maximum technical and economic benefit from standardization.

The information set forth in these publications is provided to Shell companies for their consideration and decision to implement. This is of particular importance where DEPs may not cover every requirement or diversity of condition at each locality. The system of DEPs is expected to be sufficiently flexible to allow individual Operating Units to adapt the information set forth in DEPs to their own environment and requirements.

When Contractors or Manufacturers/Suppliers use DEPs, they shall be solely responsible for such use, including the quality of their work and the attainment of the required design and engineering standards. In particular, for those requirements not specifically covered, the Principal will typically expect them to follow those design and engineering practices that will achieve at least the same level of integrity as reflected in the DEPs. If in doubt, the Contractor or Manufacturer/Supplier shall, without detracting from his own responsibility, consult the Principal.

The right to obtain and to use DEPs is restricted, and is typically granted by Shell GSI (and in some cases by other Shell Companies) under a Service Agreement or a License Agreement. This right is granted primarily to Shell companies and other companies receiving technical advice and services from Shell GSI or another Shell Company. Consequently, three categories of users of DEPs can be distinguished:

1) Operating Units having a Service Agreement with Shell GSI or another Shell Company. The use of DEPs by these Operating Units is subject in all respects to the terms and conditions of the relevant Service Agreement.

2) Other parties who are authorised to use DEPs subject to appropriate contractual arrangements (whether as part of a Service Agreement or otherwise).

3) Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred to under 1) or 2) which requires that tenders for projects, materials supplied or - generally - work performed on behalf of the said users comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with users, Shell GSI disclaims any liability of whatsoever nature for any damage (including injury or death) suffered by any company or person whomsoever as a result of or in connection with the use, application or implementation of any DEP, combination of DEPs or any part thereof, even if it is wholly or partly caused by negligence on the part of Shell GSI or other Shell Company. The benefit of this disclaimer shall inure in all respects to Shell GSI and/or any Shell Company, or companies affiliated to these companies, that may issue DEPs or advise or require the use of DEPs.

Without prejudice to any specific terms in respect of confidentiality under relevant contractual arrangements, DEPs shall not, without the prior written consent of Shell GSI, be disclosed by users to any company or person whomsoever and the DEPs shall be used exclusively for the purpose for which they have been provided to the user. They shall be returned after use, including any copies which shall only be made by users with the express prior written consent of Shell GSI. The copyright of DEPs vests in Shell Group of companies. Users shall arrange for DEPs to be held in safe custody and Shell GSI may at any time require information satisfactory to them in order to ascertain how users implement this requirement.

All administrative queries should be directed to the DEP Administrator in Shell GSI.


Page 3

TABLE OF CONTENTS

PART I INTRODUCTION AND GENERAL............................................................................5

1. INTRODUCTION.......................................................................................................51.1 SCOPE...................................................................................................................... 5

1.2 DISTRIBUTION, INTENDED USE AND REGULATORY CONSIDERATIONS..........5

1.3 DEFINITIONS............................................................................................................6

1.4 CROSS-REFERENCES............................................................................................7

1.5 SUMMARY OF MAIN CHANGES..............................................................................7

1.6 COMMENTS ON THIS DEP......................................................................................7

1.7 DUAL UNITS.............................................................................................................8

1.8 GUIDANCE FOR USE...............................................................................................8

2. SELECTION MATRIX...............................................................................................9

3. MINIMUM REQUIREMENTS...................................................................................113.1 GENERAL REQUIREMENTS..................................................................................11

3.2 FIRED EQUIPMENT CONTROL – BASIC PHILOSOPHY AND PRINCIPLES........11

3.3 FIRED EQUIPMENT SAFETY – BASIC PHILOSOPHY AND PRINCIPLES...........13

3.4 COMBUSTION SYSTEM HARDWARE REQUIREMENTS.....................................20

3.5 ADDITIONAL REQUIREMENTS.............................................................................24

PART II AMENDMENTS/SUPPLEMENTS TO API RP 556 SECOND EDITION (APRIL 2011)...........................................................................................................26

1 Scope...................................................................................................................... 26

2 References.............................................................................................................26

3 Fired Heaters..........................................................................................................26

PART III AMENDMENTS/SUPPLEMENTS TO NFPA 85 (2011 EDITION)...........................32

Chapter 5 Single Burner Boilers............................................................................................32

Chapter 6 Multiple Burner Boilers.........................................................................................36

Chapter 8 Heat Recovery Steam Generators and Other Combustion Turbine Exhaust Systems.................................................................................................................. 41

PART IV AMENDMENTS/SUPPLEMENTS TO EN 746-2 (MAY 2010 EDITION).................43

5 Safety requirements, measures and verification means....................................43

6 Verification of the safety requirements and/or measures..................................48

7 Information for Use................................................................................................49

PART V AMENDMENTS/SUPPLEMENTS TO EN 12952-8 (MAY 2002 EDITION).............50

4 Fuel supply.............................................................................................................50

5 Equipment for air supply and flue gas discharge...............................................51

6 Firing system.........................................................................................................51


Page 4

PART VI AMENDMENTS/SUPPLEMENTS TO API RP 14C APPENDIX A.6 (MARCH 2007 EDITION) and ISO 10418 APPENDIX B.8 (2003 EDITION)..........................53

A.6 Fired and Exhaust Heated Components..............................................................53

PART VII STANDARD CONTROL AND SAFEGUARDING NARRATIVES AND FUNCTIONAL LOGIC DIAGRAMS.........................................................................57

ANNEX A CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A DUAL FUEL FIRED, FORCED DRAFT, SINGLE BURNER FURNACE/BOILER....................................................58

ANNEX B CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR A AUTOMATICALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS.................................................................76

ANNEX C CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR AN AUTOMATICALLY-STARTED, DUAL-FUEL FIRED, FORCED DRAFT, MULTI-BURNER FURNACE...............................................................................................................92

ANNEX D CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A MANUALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS.................................................................................................123

PART VIII REFERENCES......................................................................................................130


Page 5

PART I INTRODUCTION AND GENERAL

1. INTRODUCTION

1.1 SCOPE

This DEP specifies requirements and gives recommendations for control systems and instrumented protective functions for fired equipment.

This DEP replaces DEP 32.24.20.30-Gen., DEP 32.24.20.33-Gen., DEP 32.24.20.38-Gen. and DEP 32.24.20.42-Gen. that were in use up to 2011.

This DEP outlines the minimum requirements in relation to controls and safeguarding which are applicable to all fired equipment with the exception of the sulphur recovery Claus reactors and SCOT furnaces. It also contains a flow chart which enables the user to select and adopt the appropriate international/national codes and standards on basis of the configuration of the fired equipment and its intended geographical location and application.

Process side control of fired equipment is not covered in this DEP.

Parts II - VI of this DEP are based on various national and international codes/standards and recommended practices which cover specifications on control, instrumentation and protective functions for fired equipment. These include API RP 556, NFPA 85, EN 746-2, EN 12952-8 and API RP 14C, Appendix A.6 and ISO 10418, Appendix B.8. These sections amend, supplement and delete various clauses of these international codes and standards.

All clauses of API RP 556, NFPA 85, EN 746-2, EN 12952-8 and API RP 14C, Appendix A.6, ISO 10418, Appendix B.8 not modified by this DEP remain valid as written.

This DEP is written for systems which use either Distributed Control Systems (DCS) or Programmable Logic Controller (PLC) for control and monitoring and a safety PLC or solid state/magnetic core type instrumented protective function.

This DEP Specification is mainly intended to be used for new equipments. When improvements of existing systems are required, local circumstances and economic factors may require different solutions.

This DEP contains mandatory requirements to mitigate process safety risks in accordance with Design Engineering Manual (DEM) 1 – Application of Technical Standards.

This is a revision of the DEP of the same number dated February 2013; see (Part I, 1.5) regarding the changes.

1.2 DISTRIBUTION, INTENDED USE AND REGULATORY CONSIDERATIONS

Unless otherwise authorised by Shell GSI, the distribution of this DEP is confined to Shell companies and, where necessary, to Contractors and Manufacturers/Suppliers nominated by them. Any authorised access to DEPs does not for that reason constitute an authorization to any documents, data or information to which the DEPs may refer.

This DEP is intended for use in facilities related to oil and gas production, gas handling, oil refining, chemical processing, gasification, distribution and supply/marketing. This DEP may also be applied in other similar facilities.

When DEPs are applied, a Management of Change (MOC) process shall be implemented; this is of particular importance when existing facilities are to be modified.

If national and/or local regulations exist in which some of the requirements could be more stringent than in this DEP, the Contractor shall determine by careful scrutiny which of the


Page 6

requirements are the more stringent and which combination of requirements will be acceptable with regards to the safety, environmental, economic and legal aspects. In all cases the Contractor shall inform the Principal of any deviation from the requirements of this DEP which is considered to be necessary in order to comply with national and/or local regulations. The Principal may then negotiate with the Authorities concerned, the objective being to obtain agreement to follow this DEP as closely as possible.

1.3 DEFINITIONS

1.3.1 General definitions

The Contractor is the party that carries out all or part of the design, engineering, procurement, construction, commissioning or management of a project or operation of a facility. The Principal may undertake all or part of the duties of the Contractor.

The Manufacturer/Supplier is the party that manufactures or supplies equipment and services to perform the duties specified by the Contractor.

The Principal is the party that initiates the project and ultimately pays for it. The Principal may also include an agent or consultant authorised to act for, and on behalf of, the Principal.

The word shall indicates a requirement.

The capitalised term SHALL [PS] indicates a process safety requirement.

The word should indicates a recommendation.

Conflicts and deviations with respect to requirements and recommendations as mentioned in this DEP shall be tracked as a controlled record by the Contractor and shall be reported back to the Principal throughout the project and are subject to approval by the Principal.

1.3.2 Specific definitions

Term Definition

Automatic Burner Start

An automatic burner start involves start-up of the burner via push buttons (or an automatic sequence), automatically operating the burner TSO valves as well as flame detection.

Fired Equipment Covers a range of combustion equipment such as heaters, boilers and incinerators.

High Air-Side Pressure Drop Burner

Burner which has high air-side pressure drop (> 50 mm wc or (2 in. wc)) and not capable of natural draft operation.

Instrumented Protective Function (IPF)

A function comprising the Initiator function, Logic Solver function and Final Element function for the purpose of preventing or mitigating Hazardous Situations.

Low Air-Side Pressure Drop Burner

Burner which has low air-side pressure drop (< 50 mm wc or (2 in. wc)) and capable of natural draft operation.

Manual Burner Start

A manual burner start involves the operator manually igniting the ignition or pilot burner, opening the burner cock and observing flame ignition.

Safety PLC A PLC complying with the requirements of DEP 32.80.10.10-Gen. as logic solver for IPFs.


Page 7

Trial for Ignition Time

Maximum allowable time during which unburned fuel can be admitted into a heater/boiler without creating a risk of an explosion due to delayed ignition.

1.3.3 Abbreviations

Term Definition

CSC Car-Seal Closed

ESD Emergency Shut Down

HAZOP Hazards and Operability Study

HEMP Hazards and Effects Management Process

HRSG Heat Recovery Steam Generator

IPF Instrumented Protective Function

PLC Programmable Logic Controller

PTI Periodic Test Interval

RMS Root mean square, also known as the quadratic mean.

SIL Safety Integrity Level

TDL Tunable Diode Laser (instrument to measure average CO or O2 in a laser beam through the firebox)

TFIT Trial For Ignition Time

TSOV Tight Shut Off Valve

UPS Uninterruptible Power Supply

VPS Valve Proving System

1.4 CROSS-REFERENCES

Where cross-references to other parts of this DEP are made, the referenced section or clause number is shown in brackets ( ). Other documents referenced by this DEP are listed in (Part VIII).

1.5 SUMMARY OF MAIN CHANGES

This DEP is a minor revision of the DEP of the same number dated February 2013. The following are the main, non-editorial changes.

Section Change

Part II, 3.4.8 Replaced 1st sentence of clause to indicate the tabular alarms as being required. Added a sentence to the clause requiring that the alarm settings are to be approved by the Principal.


Page 8

1.6 COMMENTS ON THIS DEP

Comments on this DEP may be submitted to the Administrator using one of the following options:

Shell DEPs Online

(Users with access toShell DEPs Online)

Enter the Shell DEPs Online system at https://www.shelldeps.com

Select a DEP and then go to the details screen for that DEP.

Click on the “Give feedback” link, fill in the online form and submit.

DEP Feedback System

(Users with access to Shell Wide Web)

Enter comments directly in the DEP Feedback System which is accessible from the Technical Standards Portal http://sww.shell.com/standards.

Select “Submit DEP Feedback”, fill in the online form and submit.

DEP Standard Form

(Other users)Use DEP Standard Form 00.00.05.80-Gen. to record feedback and email the form to the Administrator at [email protected].

Feedback that has been registered in the DEP Feedback System by using one of the above options will be reviewed by the DEP Custodian for potential improvements to the DEP.

1.7 DUAL UNITS

This DEP contains both the International System (SI) units, as well as the corresponding US Customary (USC) units, which are given following the SI units in brackets. When agreed by the Principal, the indicated USC values/units may be used.

1.8 GUIDANCE FOR USE

A bullet () shown in the margin of various clauses in both this DEP and/or the external

standard indicates that further decisions or information are to be provided by the Contractor and/or the Principal. These decisions/information shall be indicated directly on the relevant data/requisition sheet where provisions are made for them. Otherwise, they shall be indicated on the data/requisition sheet(s) under the heading “Additional Requirements" or stated in the purchase order.

mailto:[email protected]

http://sww.shell.com/standards

https://www.shelldeps.com/


Page 9

2. SELECTION MATRIX

This DEP is intended to cover instrumentation control and protection requirements for a range of fired equipment purchased by the Principal. Depending upon the configuration of the equipment to be built (process heaters versus boilers, fuel gas versus fuel oil or combination firing, etc) and the intended geographical location of the equipment (USA versus other regions, offshore versus onshore facilities), Figure 1 below provides guidance to the appropriate industry codes/standards to be adopted in conjunction with the minimum requirements as outlined in (3).


Page 10

s tart

On/off shore

Process heater

API 14C

offshore

Gas fired?

USA

Oil / combination fired

EN 746 - 2

API RP 556

onshore

yes

no

yes

no

Boiler yes

no

yes

HRSG

yes no

Consult

t

Principal

l

no

USA yes

no

Incinerator

no

NFPA 85

EN 12952 - 8 yes

yes (see note 4)

USA

USA

Yes (see note 2)

ISO 10418 no (see note 2)

no

yes

USA

no

DEP 30.75.10.31

Note 3

Figure 1 Decision tree on use of applicable industry codes/standards

NOTE: 1. Some countries have nationally recognized codes that dictate the design, construction, installation, operation, and maintenance of fired equipment. The requirements of the DEP shall be followed within these “Codes in Effect”. Where differences exist between the DEP and the “Codes in Effect”, a discussion with the Authority Having Jurisdiction shall be held presenting Shell’s operational history and process safeguarding philosophy (IPS, bow-ties, HAZOP, etc.), with the intent of obtaining a variance to the “Codes in Effect”. For packaged equipment, the Contractor shall ensure that all local (the final installation of the equipment) “Codes in Effect” are met by the packaged equipment Manufacturer/Supplier.


Page 11

2. Although written for fired/exhaust heated equipment on offshore production platforms, API RP 14C/ISO 10418 may also be applied on similarly configured fired/exhaust heated components for specific onshore facilities (e.g., onshore tight gas sites).

3. DEP 30.75.10.31-Gen. should also be used in conjunction with NFPA 85, Section 8.

4. NFPA 85 or EN 746-2, together with (3) of this DEP, shall be applied selectively in the definition of the control and protection requirements for thermal incinerators.

The Principal shall be consulted on the approach to be adopted for thermal incinerators.

(Part VII) of this document provides control and safeguarding narratives and functional logic diagrams that satisfy the requirements as laid down in (3) of this document.

The Principal shall inform if the Control and IPF system must follow the narratives and

functional logic diagrams given in (Part VII) and shall indicate which of the Annexes shall be applied.


Page 12

3. MINIMUM REQUIREMENTS

3.1 GENERAL REQUIREMENTS

Clauses in API RP 556, NFPA 85, EN 746-2, EN 12952-8 and API RP 14C, Appendix A.6 and ISO 10418, Appendix B.8 which are not mentioned in this DEP, shall remain valid as written.

Where there are conflicts between the requirements outlined in this DEP and the international codes and standards, the requirements in this DEP take precedence.

In all designs for combustion control and protection of fired equipment the following basic requirements shall be met:

a. The design of the Safety Instrumented System shall consider the effect of single component failures and include provision for testing to identify dangerous faults, if test intervals are shorter than the planned turn-around (refer to DEP 32.80.10.10-Gen.).

b. All safeguarding systems (IPFs) shall be designed as per DEP 32.80.10.10-Gen.

The requirement for a local control panel shall be specified by the Principal.

If a local control panel is specified, it shall incorporate all devices required for local start-up.

3.2 FIRED EQUIPMENT CONTROL – BASIC PHILOSOPHY AND PRINCIPLES

3.2.1 General

The primary purpose of a combustion control system is to maintain a stable process output control (e.g. process outlet temperature, steam pressure) by regulating the fuel flow to the burners. Where a constant fuel gas quality is to be expected (e.g., only natural gas), the primary control may be on fuel pressure.

Secondary purposes include the control of air excess level (e.g., air/fuel ratio) and fire box pressure (application dependent).

3.2.2 Load control

The output of the process controller shall be cascaded to the main fuel flow controller. For systems that fire fuel gas of constant quality (e.g., natural gas) the output of the process controller may be cascaded to a fuel pressure controller.

Minimum burner load shall be ensured by either:

Maintaining a minimum opening on the fuel control valve (typically for systems with up to 2 burners), or

A dedicated active minimum pressure controller, which guarantees a minimum burner load, independent of the number of burners in operation (for systems having greater than 2 burners). If the master signal would drive the required fuel flow down to a level where the fuel pressure would come too close to the flame stability limit, the active minimum pressure controller shall take over.

Similarly, maximum burner load and over firing protection shall be ensured by a dedicated maximum pressure controller.

These minimum and maximum burner load controllers shall be configured in the control system. In case anticipated fuel gas quality variations may result in fluctuations to heater duty in excess of ± 15 %, the fuel gas flow measurement shall be corrected for changes in


Page 13

quality. Such corrections may be based on gas density measurement and/or heating value, depending on the anticipated fuel gas compositions.

Minimum burner load control shall be made active during the start-up sequence as defined in the installation-specific procedures and control narrative in consideration of the defined start-up fuel load for the burner(s) and start-up position of the main fuel control valve(s).

Load control for natural draft systems shall have active low oxygen/high CO and low draught constraints on fuel flow.

3.2.3 Combustion air control

Combustion air shall be uniformly distributed to all burners. With air manifold systems, facilities for monitoring and adjusting airflow shall be provided. For small packaged units, the combustion air may be controlled in parallel to the fuel through the use of a robust mechanical linkage (positioning control system), provided that these packaged units satisfy the following characteristics:

1. Firing capacity ≤ 6 MW (20 MMBtu/hr)

2. Firing of a single fuel with constant quality and constant supply pressure

3. Fuel and air is controlled individually per burner

For all other forced and balanced draft systems, air/fuel double ratio lead-lag (cross limiting) control shall be applied. This should either be manually set by the panel operator, or automatically set by a closed loop oxygen controller. Limits should be set to the range over which the air/fuel ratio may be adjusted, in order to prevent settings that correspond to substantial sub-stoichiometric combustion. To ensure that excess air is always maintained during load changes, the control signals should be interconnected through the control system selectors.

For a multiple-burner system equipped with individual burner flame detection and fuel shut off capabilities, it will be necessary to isolate airflow to an individual burner which is tripped on loss of proof of flame. Alternatively, the air/fuel ratio control can be automatically adjusted such as to disregard air which is supplied to the tripped burner.

When 50 % or more burners of one controlled section are tripped, the burners are tripped to a minimum firing mode and air to all burners shall be restored.

When a burner is tripped, the oxygen trim controller, if used, shall be switched to a manual mode and held at its last output value. The oxygen controller mode change shall be alarmed to the operator.

For natural draft fired equipment, the presence of sufficient oxygen for combustion shall be assured by maintaining a negative pressure at the arch in combination with a percentage opening of the burner air registers at the chosen fuel load (performed manually by the operator), and shall be verified by an online oxygen analyzer at the arch. Oxygen measurement shall be indicated on a local panel and in control room.

Where common air plenums with air control dampers or common jackshaft arrangements are provided (individual air registers connected by common shaft and manipulated by single actuator), oxygen levels at the arch may be controlled automatically. This will require CO-TDL measurement as a constraint or the use of multiple O2 analysers (applying anacheck). Reference is made to following DEP Standard Drawings:

S 24.038

S 24.039


Page 14

S 24.040

The requirement for automatic O2 excess control shall be specified by the Principal.

As a minimum Oxygen constraint control shall be applied, whereby the control scheme automatically reduces fuel load in case O2 falls below a set minimum level. When the O2

constraint is hit an alarm shall be provided to the operator to make him aware of pending loss of temperature control. The O2 constraint shall not be able to reduce the firing below the minimum firing limit as set by the active minimum pressure controller (3.2.2).

3.2.4 Draft control

For natural draft and forced draft heaters, the draft generated by the stack and the firebox shall be sufficient to achieve a draft of at least 2.5 mm WC (0.1 inch WC) at the arch over the full load range of the heater. This draft shall be maintained by adjusting the stack damper. Draft indication shall be provided in the control room. Local draft gauges shall be provided to monitor draft at the floor and arch levels. Draft gauges upstream and downstream of the stack damper should also be provided.

Firebox pressure can be controlled by automating the stack damper. When the fired equipment has an induced draft fan, the firebox pressure shall be controlled by adjusting the induced draft damper or the ID fan speed.

Where an automatic damper actuator is used, it shall be equipped with a positioner bypass switch and manual means of setting the damper position. On instrument air supply failure, the actuator shall stay put in its last position, with a tendency to fail open. Except for the stack (bypass) damper on a balanced draft heater, there shall be a minimum stop which shall be set based on approximately 25 % design flue gas flow. This minimum stop shall be adjustable to allow optimizing of setting during initial operation. Once set in position, the minimum stop shall be locked to prevent any unauthorized adjustment.

For systems without ID fans, the requirement for automatic draft control shall be specified

by the Principal.

3.3 FIRED EQUIPMENT SAFETY – BASIC PHILOSOPHY AND PRINCIPLES

3.3.1 General

The selection and performance requirements of the safety systems shall be determined from a Hazards and Effects Management Process or HAZOP study.

Some packaged fired equipment such as boilers or auxiliary glycol heaters may be offered complete with combustion controls and protective instrument systems. In general, the manufacturers of such systems follow the applicable code in effect such as NFPA, CGA/CSA or API. It is not the intent to fully replace each of these systems with new components and systems as would be developed through direct use of this and other related Shell documents. Each application, however, shall be evaluated in terms of compliance with the basic philosophy and principles for fired equipment safety as herein described.

Unless otherwise governed by local authority requirements, the decision to start the fired equipment manually or automatically shall be based on whether the maximum allowable time (during which unburned fuel can be admitted without creating the risk of an explosion) may be too short to safely rely on human intervention. Heaters that are intermittently operated (e.g., regeneration gas heaters) shall also be automatically started.

The Principal shall approve the decision for manual or automatic ignition and start up.


Page 15

3.3.2 Fireside protection

The following outlines the basic philosophy and principles for fireside protection:

Burners shall be properly sized, adjusted, tested and maintained to ensure safe combustion over the full operating range of conditions expected for the fuel, combustion air and process conditions.

Overfire protection shall be provided through a combination of fuel control valve sizing and control limits, in addition a high pressure trip may be required.

Start-up of the first burners shall be achieved via the use of minimum fuel load control, which provides the primary measure for flameout protection and subsequent formation of an unsafe fuel mixture.

The minimum fuel load control shall be complemented by either proven continuous pilots or direct flame monitoring of the main burners. An exemption may be made for large heaters with multiple burners such as ethylene cracking heaters or hydrogen manufacturing heaters.

The main burner pressure downstream of the fuel control valve shall be indicated in the control system.

The heater SHALL [PS] be equipped with a safeguarding system that automatically trips the main fuel(s) of all, or of each individual burner in case of a flame failure. Identification of such flame failure may be direct (by means of flame detection) or indirect (by means of a combination of high and low fuel pressure trips, high firebox-floor pressure trips, etc.) depending on the type of application.

Minimum airflow protection shall be required for forced or balanced draft combustion systems with no provision for trip to natural draft. Upon loss of airflow, the firing shall automatically trip.

Fireside protective systems shall be active at the time of light off of the first burner as defined by the project's start-up sequence. For low air-side pressure drop burners with long Trial-for-Ignition-Time (TFIT), an exemption may be made to activate the main fuel pressure trips only after a time delay not exceeding 10 minutes in order to allow for light off of first few burners and stabilization of fuel header pressure.

Where pilots are used, these shall be armed prior to introducing fuel to the main burners. If pilots are tripped anytime during the timed override of the main fuel pressure trips, an automatic total fuel trip SHALL [PS] be required.

The instrument air supply to the instrumentation shall be monitored and alarmed upon detection of low pressure.

On forced draft installations, protection against substoichiometric combustion shall be

accomplished via an air/fuel ratio trip or equivalent as approved by the Principal.

The firebox SHALL [PS] be purged before ignition. Alternatively for natural draft heaters, a gas test can be carried out each time before lighting any ignition or pilot flame. Purging requirements may be exempted for ethylene cracking furnaces or steam methane reformer furnaces following any process related trips, provided the furnace is relighted while firebox temperature remains above 760 °C (1400 °F).

3.3.3 Process side protection

The following outlines the basic philosophy and principles for process side protection.


Page 16

All fired heaters SHALL [PS] be provided with tube-side overheating protection using dedicated IPFs. This shall be achieved for most heaters by ensuring adequate feed flow through the heater passes. For specialty heaters such as hydroprocessing heaters, ethylene cracker furnaces or the steam methane reformer furnaces, additional tube side overheating protection barriers such as high process outlet temperature, high steam temperature, high flue gas temperature or low steam-to-carbon ratio shall be required. Tube-side overheating protection shall be active for all operating conditions including start up. For specific operating modes that may occur on a regular basis, alternate IPFs shall be applied, for example the application of a low nitrogen flow trip (on steam methane reformer furnaces during start up).

The use of a time-delayed trip is an acceptable method to cover flow surges, particularly if the standby pump is equipped with an autostart. The duration of the time delay, however, shall be minimized to avoid damage/coking of the tubes.

A high process outlet temperature trip shall be applied to prevent serious overheating of process tubes or, in certain cases, to protect downstream equipment. Such trip may involve a trip to minimum firing, rather than a total fuel trip. However, as a trip to minimum firing typically makes use of DCS controls, a back-up IPF (initiating a total firing trip) shall be provided in case the trip to minimum firing does not have the desired result.

The primary means of providing tube side protection for boilers and immersed fire/exhaust gas tube heaters shall be to ensure an adequate liquid level in the steam drum or fired vessel together with a sufficient liquid hold-up below the low-level trip. When liquid levels in the steam drum or fired vessel are below the low-level, fuel SHALL [PS] be tripped automatically.

A high stack temperature alarm shall be provided on process heaters (as an indication of a possible tube failure).

3.3.4 Pre-ignition purging

For natural draft style heaters, steam purging shall be used. Steam purge shall be for a period not less than 15 minutes or three-firebox volume changes whichever is greater.

If steam is not available or equipment sensitive to moisture is in place, alternate methods of purging shall be agreed to by the Principal. In these cases, the atmosphere inside the enclosure must be checked for the presence of combustibles as per defined operating procedure and at an adequate number of locations. For forced or balanced draft heaters and boilers, purging with the combustion air fan shall be used. The purge air flow shall be equal to the minimum airflow during normal operation (air flow at minimum stop and no less than 25 % of design air flow).

A higher purge air flow rate may be allowed subject to approval by the Principal.

The purge time as part of a cold start-up or following a low-combustion airflow trip shall be for a period not less than five minutes or five-firebox volume changes,

The purge time as part of a hot start up (e.g., after a trip not related to low combustion air flow) shall be for a minimum duration of 5 minutes.

A heater trip shall not result in an automatic increase of the air flow to the heater or boiler.

3.3.5 Safety protection trips

3.3.5.1 General

The following summarizes the minimum requirements for safety trips in process heaters and boilers (where applicable).


Page 17

Fireside safety trips (Required time delays between detection and trip activation are indicated in [ ]. Such delay shall include any transmitter filter timer):

a) Loss of burner flame detection [max 2 s]

b) Low-low pilot gas pressure [1 s]

c) High-high pilot gas pressure [1-3 s]

d) Loss of pilot flame detection [1-3 s]

e) Low-low burner fuel pressure [1 s]

f) High-high burner fuel pressure [1-3 s]*

g) High-high fuel gas KO drum level [5 s]

h) Low-low atomizing steam/oil differential pressure [1-3 s]

i) High-high atomizing steam/oil differential pressure [1-3 s]

j) Low atomizing steam pressure [1-3 s]

k) Low-low combustion air flow [5 s]

l) Loss of ID or FD fans (FD/ID fans running trips) [5 s]

m) Low-low air/fuel ratio [10 s]*

n) High-high firebox arch pressure (low-low draft) trip as per (3.3.5.8) [10 s]

o) High-high firebox floor pressure (low-low draft) trip as per (3.3.5.9) [0 s]

p) Manual heater/boiler ESD trip (local panel and control room) [0 s]

Process-side safety trips:

General process heaters:

a) Low-low process flow (per pass) (applicable to all furnaces with individual pass control)

b) Low-low process flow (total) (applicable to all furnaces with no individual pass control)

c) Liquid feed low-low flow (applicable only to hydro processing heaters with no individual pass control)*

d) Recycle/Fresh gas low-low flow (applicable only to hydro processing heaters with no individual pass control)

e) High-high heater common outlet temperature*

Ethylene cracking furnaces:

f) Low-low feed header pressure downstream feed supply valves*

g) Low-low process flow (total) (alternative to (f))*

h) High-high superheater steam outlet temperature (applicable only for units where steam is not produced in the convection bank)

i) High-high dilution steam outlet temperature (alternative to (h))

j) High-high convection section flue gas temperature (alternative to (h))

k) High-high coil outlet temperature (alternative to (h))

Steam methane reformer furnaces:


Page 18

l) Low-low process flow (total)

m) Low-low nitrogen flow (applicable only during start up)

n) Liquid feed low-low flow

o) Low-low steam to carbon ratio

p) Low-low steam flow (alternative to (n))

q) High-high process header outlet temperature

Other process related trips:

r) Low-low steam drum level

s) High-high steam drum level**

t) Low-low bath level (for wellsite and line heaters)

* Denote a trip to minimum firing

** Not a fuel/firing trip

Process side trips are generally intended to prevent overheating of tubes, but are sometimes also installed to protect downstream equipment (e.g., high steam drum level).

All IPFs that initiate a trip of fuel or waste gas to the heater SHALL [PS] use latching logic and initiate the signal to the relevant fuel control valve(s) to be forced to zero output (or to its minimum stop position). Latching means there shall be no automatic reset.

For manually started heaters, the trip reset facilities shall be located locally close to the heater (e.g., local panel).

For automated heaters with remote start-up facilities, the trip reset facilities shall be incorporated in the automatic start sequence.

Resetting /restarting of a heater shall only be possible if the fuel supply pressure, process flow and any other emergency or interlocking conditions are normal (permissives) as part of the logic solver.

The time between trip activation and closure of the TSOVs and main fuel valves shall be minimized.

For process side trips, time delays in seconds between detection and trip activation shall be

specified by the Principal.

Three different trip functions may apply:

a) Trip to minimum firing

High process outlet temperature, low air/fuel ratio and high fuel pressure may initiate trip to a minimum firing mode of operation.

For high temperature olefins cracking furnaces, this trip function is very much preferred over a total firing trip as the latter may impose huge thermal shock on the equipment and carry a risk of tube rupture due to contraction of hot radiant tubes over thick coke layers. Operationally, there is also risk of coke spalling that can plug equipment and necessitate physical/mechanical cleaning of the hardware. When a minimum firing trip is activated on an olefins cracking furnace, hydrocarbon


Page 19

feed to the furnace is automatically stopped, but steam continues to sweep the furnace and remove remaining hydrocarbon.

In case the minimum firing mode is accomplished via the control system, the firing shall be reduced to minimum via a ramp down timer not exceeding 30 s. The fuel pressure shall automatically be verified after this period to confirm if the pressure is close to the minimum firing pressure. If this is not the case then a total firing trip shall be initiated.

A minimum firing trip shall also include a trip of any waste gas that is routed to the heater/boiler, provided the heat release of the waste gas stream exceeds 15 % of the furnace design duty.

b) Total firing trip

In case of a total firing trip, all fuel supplies (excluding pilot fuel) shall be automatically closed, including waste gas supply valves. On trips initiated by ESD switches, also the pilot fuel shall be shut off.

c) Trip to natural draft operation

In forced or balanced draft heaters employing low air-side pressure drop burners, the system may be equipped with a trip to Natural Draft operation. In these cases the failure of the FD or ID fans (detected by a low air flow or a running contact or a low pressure differential over the fan) shall initiate an automatic opening of the bypass (stack) damper as well as the opening of the ‘plenum dampers’ or ‘natural draft air doors’. Failure of the ID fan may also be detected by a “high” fire box pressure trip, set sufficiently below the “high-high” fire box pressure trip.

The trip to Natural Draft shall be combined with a ‘trip to minimum firing’.

The requirement for configuring a forced draft or balanced draft system equipped with low

air-side pressure drop burners to operate in natural draft mode shall be specified by the Principal.

3.3.5.2 Loss of burner flame detection trip

High air-side pressure drop burners SHALL [PS] be equipped with flame detection trips that result in a trip of fuel(s) to the burner/heater in case of a loss of proof of flame on the burner/heater. An exception may be made for burners which are equipped with Class 1 igniters as designated by NFPA 85.

Flame detection may also be applied on low air-side pressure drop burners as an alternative to low fuel pressure trips and/or high firebox floor pressure trips.

Individual burner trip due to loss of flame detection shall include provisions to ensure that the remaining burners can continue to operate above stoichiometric air supply. This can be accomplished by automatically closing the individual airflow to the affected burner, or by applying a correction factor for the measured airflow so that air supplied to inactive burners is not included in the air/fuel ratio control calculations. When 50 % or more of the individual burners on heaters have tripped, a trip to minimum stop is required and air to all burners shall be restored.

The flame detectors SHALL [PS] not be equipped with maintenance override switches that can override the trip action. Maintenance override switches that switch the detector output to ‘flame-out’ status may be applied.


Page 20

3.3.5.3 Low burner fuel pressure trip

Low air-side pressure drop burners SHALL [PS] be equipped with a low burner fuel pressure trip. Alternatively a flame detection trip may be applied.

Where burners are equipped with flame detection trips, a low burner fuel pressure trip may not be required.

3.3.5.4 High burner fuel pressure trip

For heaters with more than 1 burner, a burner fuel pressure trip shall be initiated at 120 % to 125 % of burner normal heat release. For fuel gas firing, the setting shall be based on the lightest fuel available.

A trip to minimum firing is preferred but only acceptable with reliable burners that are stable over the entire range of conditions from low fuel pressure to high pressure and from no excess air to high excess air rates. For cases where the high fuel gas pressure could lead to flame blow-off, or unstable flames, a total fuel trip shall be initiated.

Refer to Table 6.2 of DEP 31.24.00.30-Gen. for further definition of burner heat release in reference to ISO 13705, API RP 535 and guidance for of fuel gas train design, alarm and trip settings.

3.3.5.5 Low combustion air flow trip

A loss of combustion air flow SHALL [PS] trip fuel supply to main burners in forced draft and balanced draft heaters that do not have a “trip to natural draft” option.

Minimum airflow protection shall be required in forced and balanced draft combustion systems. Minimum airflow protection shall be provided through the use of mechanical or soft stops on the fan louvers, by the low air flow trip, and a speed control soft stop where a variable speed drive is used.

For furnaces where the normal process duty turn down requirement is not more than 50 %, the minimum stop should be set at 50 %. If a larger process duty turn down is required, the minimum stop could be reduced accordingly but shall not be less the 25 % of the design airflow. The minimum stop shall be adjustable to allow optimizing of setting during initial operation.

Minimum airflow for forced and balanced draft systems shall be directly measured. The minimum airflow trip shall be set not less than 70 % of the stoichiometric air demand at minimum firing duty.

For combustion control schemes utilizing mechanical linkages, or in existing heaters, the low combustion air flow trip may be replaced by a low pressure switch in combination with reliable and robust mechanical minimum stops on the combustion air supply damper.

3.3.5.6 Low air/fuel ratio trip

Minimum air/ fuel ratio protection shall be installed in forced and balanced draft combustion systems. Minimum air/fuel ratio protection is provided through the measurement of air and fuel flows.

For combustion control schemes with mechanical linkages, a low air/fuel ratio trip will not be required.

In most cases, a trip to minimum firing is sufficient as the minimum stop on the combustion air damper ensures sufficient air for minimum fuel load.


Page 21

3.3.5.7 Low and high steam/oil differential pressure trips

Unless the burner is equipped with proof of flame detection, fuel oil fired installation SHALL [PS] be equipped with low and high steam/oil differential pressure trips.

In cases where flame detection is applied, the low steam/oil differential pressure trip shall be replaced by a low steam supply pressure trip. Both low and high steam/oil differential pressure alarms should however be maintained.

This section also applies when other atomizing media such as air or gas are adopted, in which case any reference to steam shall be replaced with the alternate atomizing media.

3.3.5.8 High firebox arch pressure (low draft) trip

A high firebox pressure trip based on low arch draft shall be installed for induced or balanced draft heaters.

The high firebox arch pressure trip is required for following reasons:

1. To prevent burners of induced draft heaters from being operated with an air shortage, thereby resulting in formation of excessive amount of unburned hydrocarbons in the firebox.

2. In case the firebox is unable to withstand the maximum head of the forced draft fan.

3. In case of high air-side pressure drop burners where the heater is not equipped with glass covered observation windows, i.e. in such case the high-pressure trip is considered to be a form of personnel protection.

For heaters which are equipped with the high firebox floor pressure trip as described in (3.3.5.9), the high firebox arch pressure trip will not be required.

3.3.5.9 High firebox floor pressure trip

Heaters with low air-side pressure drop burners which employ fuel staging can suffer from flame outs at too low excess air operation. Such systems SHALL [PS] be safeguarded by means of a high firebox floor pressure trip using fast response pressure transmitters (with a minimum frequency of 6 Hz) located at an elevation .3 m - 6 m (1 ft - 2 ft) from the floor and with zero time delay or filter.

Minimum requirements for the floor pressure trip are given in (Part VII, Annex D, D.5).

For low air-side pressure drop burners equipped with flame detection trips, or which are applied on ethylene cracking furnaces or steam methane reformer furnaces, the high firebox floor pressure trip will not be required.

3.3.5.10 Manual heater/boiler ESD trip

A remote and local manual ESD trip switch SHALL [PS] be installed that close all main fuel and process waste gas TSOVs.

For most heaters/boilers (with the exception of ethylene cracking furnaces), a manual ESD trip should also include a trip of pilot fuel, stopping both FD and ID fans and fully closing natural draft air doors (where applicable).

The Principal shall be consulted for any of the above mentioned additional functionality

associated with this manual ESD trip switch. Such an ESD trip is normally required to handle an emergency situation not covered by the heater safeguarding system. All other heater/boiler burner stops shall be achieved via a controlled shut-down procedure.


Page 22

For certain heaters a manual ‘tube rupture’ trip switch is installed to mitigate the consequences of a tube failure. The ‘tube rupture’ trip switch shall be installed in the control room panel and shall initiate the following:

1. close all fuel and process waste gas TSOVs

2. stop FD and ID fans

3. fully close FD inlet damper common air plenum damper and/or natural draft air doors

4. initiate high rate depressuring

5. stop feed pumps

6. close process feed supply to heaters

7. maximize sweeping steam to coils

8. stop quench oil

9. close furnace effluent valve

The requirement for such manual ‘tube rupture’ trip switch and its functionality shall be


Manual ESD trips shall be hardwired into the burner management system.

3.4 COMBUSTION SYSTEM HARDWARE REQUIREMENTS

3.4.1 Pilots and ignition systems

Burner main flames SHALL [PS] be lit by means of a proven ignition system. This may include continuous pilots, interrupted pilots or retractable high-energy igniters, all of which shall be appropriately sized and designed for the application.

A continuous pilot may be retained as supplemental protection against flameout/formation of an unsafe mixture of fuel and air as well as to expedite safe re-ignition following a fuel trip.

In order for a pilot to be considered a safety device:

a) It shall be proven (by means of burner testing or references) AND

b) it shall have sufficient capacity and reliability to re-ignite the main burner under conditions of highest air flow, worst draft and/or (internal/ external) environmental conditions, AND

c) it shall not damage the appliance if left lit for extended periods of time, AND

d) It shall be visually monitored each shift and equipped with low and high pilot gas pressure trips, OR

e) it shall be equipped with a flame detection system (e.g., flame ionization detectors).

Pilots not meeting the above criteria shall be extinguished once the main flame is ignited and stable. In those cases, main burner flame detection trips shall be applied.

Where continuous pilots are used, they shall remain in operation until tripped by low/high pilot gas pressure, manual trip or loss of pilot flame.

Fuel for continuous pilots shall be provided from a secure supply of clean fuel gas with pipeline natural gas preferred. The following requirements shall be met if refinery fuel gas is to be used:


Page 23

i. Its quality and heating value range shall be stable and consistent with the design of the device.

ii. A filter and filter coalescer shall be used in order to protect the pilot against fouling.

The use of bottled propane for interrupted pilot burners shall be subject to Principal’s

approval.

Continuous pilots, which could thermally endanger the heater, shall be tripped simultaneously with the main fuel trip. Normally, continuous pilots remain in operation unless stopped by means of the manual trip or pilot system low/high pressure trip.

When interrupted pilots are used to light-off a burner main flame, a low/high pressure trip and alarm such as those used with continuous pilot systems will not be required. However, a means shall be provided in the control system to confirm that fuel supply to the interrupted pilots has been isolated after use.

Continuous pilots shall not be used as supplemental protection for heaters equipped with forced draft high air-side pressure drop burners.

Igniters shall be used for the safe ignition of pilots and in selected applications, main burner flames. The ignition device being a permanently mounted electronic igniter, a portable high energy electric igniter or a portable gas igniter, shall be reliable, and appropriately designed and proven for the application.

High-energy igniters may be used in place of pilots to light main burner flames in selected burner applications.

The requirements for the use and selection of high energy igniters to light main burner

flames shall be specified by the Principal.

Refer to DEP 31.24.00.30-Gen. for more information on the selection of pilots and igniters.

3.4.2 Flame monitoring

A separate flame detector device to supervise the main flame SHALL [PS] be fitted for equipment with high air-side pressure drop burners. Flame monitoring may be retained for equipment with low air-side pressure drop burners as supplemental protection against flameout or formation of an unsafe mixture of fuel and air. Optical flame scanners are the preferred flame monitoring technologies. If an individual burner trip can cause a significant process disturbance, then two (2) flame detectors (2oo2) per burner shall be installed.

The requirement for flame detection in low air-side pressure drop burner set-up, as well as

selection and installation of flame detection devices, shall be specified by the Principal.

3.4.3 Fuel control valves

Fuel control valve(s) shall allow controlled burner start-up and meet all the operating scenarios while maintaining burner fuel pressure within the operating envelope for the given fuel composition range.

For multi-burner (> 8 burners) heater installations, a smaller control valve or self-controlled pressure regulator in parallel to the main control valve should be provided to assist with start up of the first burner(s).

The requirement for provision of isolation and bypass valves for maintenance shall be


If installed, bypass valves shall always be Car-Seal Closed (CSC) or locked closed except during maintenance.


Page 24

3.4.4 Tight shut-off valves (TSOVs)

3.4.4.1 General

TSOVs shall be installed for all installations as part of both the main burner fuel gas valve trains and the pilot burner fuel gas valve trains. The TSOVs shall meet EN-12266-1 (2003) maximum seat leakage rate C as a minimum. The use of similar standards to determine acceptable valve leakage rates shall be approved by the Principal.

The materials of construction for the TSOV’s shall be suitable for the application as determined by the exposure to fire. Soft seat materials shall not be used in TSOV construction where exposure to fire is possible unless the TSOV has a backup metal seat that maintains the required leakage rate.

TSOVs shall be equipped with a position switch that provides indication of the fully closed position. The position switch(es) shall be factory set and tamper resistant (e.g., cannot be field set). This position switch shall be connected to the BMS and used to provide valve closed position indication. Failure of valve close indication by this position switch shall result in the valve being assumed open and appropriate action taken as documented in the SIL for the burner behaviour.

NOTE: The TSOV may also be provided with auxiliary contacts field adjustable position indication. However, auxiliary contacts shall not be used as part of the BMS function to determine TSOV position.

The time between trip activation and fully closed position of the TSOVs shall be minimized, however, should be no greater than five seconds. This includes a one second margin to account for degradation of TSOVs over time.

TSOVs with a closing time greater than 5 seconds will require approval by the Principal.

TSOVs shall be installed with manual block valve upstream and pressure gauge between block valve and TSOVs (for in-situ leak testing). Where parallel TSOVs are applied, both parallel lines shall be equipped with block valves upstream and downstream of the TSOVs (to allow for on-line testing).

Overhauled or rebuilt valves shall be leak tested in the workshop to Manufacturer’s specification using the Manufacturer’s procedure.

Selected architectural arrangement shall be based on a detailed analysis of the hardware considered (valve type and make), fuel gas characteristics (fouling tendency) and acceptable functional/leak test frequency requirements, in accordance with DEP 32.80.10.10-Gen.

a) For systems firing clean fuel gases (e.g., natural gas, treated/filtered refinery fuel gas), two TSOVs shall be installed in series in the common fuel gas header, with no bypass across these valves.

b) For systems firing dirty fuel gases (e.g., untreated/unfiltered refinery fuel gas or other fuel gas of fouling nature), or if the test frequency does not fit with the run length of the equipment between two planned shutdowns, a third TSOV shall be provided in parallel to the two valves in series. This single valve in parallel shall be put in service for fuel shut off only while the functional/leak test on the shut off valves is in progress. During normal operation, the manual block valves upstream and downstream of this single TSOV shall be car-sealed closed.

c) For multi-burner systems comprising up to 4 burners with individual burner TSOVs and firing dirty fuel gases, two common TSOVs in parallel may be applied (rather than one in parallel to two in series). In such a system, the probability of failure on demand of one of the burner TSOVs is sufficiently low to treat them as one of the


Page 25

common TSOVs.

d) For dual fuel (oil and gas) heaters with individual burner TSOVs , one single common TSOV may be applied, whereby it is assumed that the required test frequency fits with run length of the equipment between two planned shutdowns or that the TSOVs can be tested on the run, having the furnace operated on the other fuel only.

The Principal shall be consulted for final approval of the TSOV valve arrangement.

3.4.4.2 Automatic vent valves

An automatic vent valve serving as a bleed in a double block and bleed set up (i.e., between two TSOVs in series) shall not be applied unless required by local regulations. When a vent valve is used, it shall be equipped with a closed position switch to indicate that the valve is fully closed when commanded. The position switch shall be factory set and tamper resistance (e.g., not field settable).

For automatically started multi-burner systems however, an automatic vent valve should be installed between the common TSOV and the burner TSOVs for the purpose of relieving excess fuel gas pressure to enable start up of first burner at low pressure.

If installed, the automatic vent valve shall Fail Closed to prevent hydrocarbon release to the atmosphere during normal operation. It shall be equipped with an upstream block valve and pressure gauge between the block valve and vent TSOV. The block valve shall be car-sealed open during normal operation.

Where a vent valve arrangement is to be used, the Principal shall be consulted for final

approval of the vent valve arrangement for all fuel gas arrangements including single and multi-burner configurations.

3.4.4.3 TSO Valve Testing

TSOVs shall be function-tested with a frequency in accordance with the PTI interval as determined from the IPF architecture (results of the SIL Analysis). This function test shall include an in-situ leak test. The function and leak test should be performed every turnaround as a minimum.

An automated Valve Proving System (VPS) is not required provided the TSOV test frequency is in line with SIL IPF testing requirements. Notwithstanding this, a VPS must be used if required by local regulations.

3.4.4.3.1 Manual TSO valve testing

For manual TSO valve testing a maximum allowable leak rate of 0.02 % of the capacity shall be used as the pass/fail criteria of the leak test to ensure safety of the system is not compromised. In this case, the capacity is defined as the total burner capacity of all burners that are connected to the TSO valve.

For manual TSO valve testing an in-situ test should be applied, whereby the pressure drop/rise between two valves (of which one is the TSO valve) is used as pass/fail criterion.

Where the piping between the valves is not greater than 1.2 m (4 ft) then a pressure drop/rise of 0.3 bar (4.35 psi) in one minute may be used as pass fail criterion. For longer lines between the valves, a calculation is required to determine the maximum allowable change in pressure associated with the allowable leakage rate.


Page 26

3.4.4.3.2 Automatic Valve Proving System

Where local regulations provide a choice between use of an Automatic Vent Valve or use of an automated Valve Proving System (VPS), the use of an automated VPS is preferred.

The Principal shall approve which system is to be used.

The VPS sequence shall be approved by the Principal.

NOTE: Depending on the use of the fired equipment, it may be desirable to have the VPS performed as part of the light-off sequence AND as part of the commanded shut-down sequence.

Where an automated VPS is applied, an allowable maximum leakage rate of no more than ten times the leak rate for the TSOV valve size (as provided in the standard applied) should be used by the VPS to determine if TSOVs have failed to meet their intended performance.

3.4.5 Fuel gas systems

Fuel gas header lines should be designed such that supply is uniformly distributed to all burners. Fuel maldistribution on the lightest fuel to the burners should not exceed 2.5 % RMS.

The designer of the fuel gas header shall submit calculations on fuel maldistribution to the

Principal for approval.

The combustion system (fuel gas train and controls) shall be sized to handle a maximum heat release of 115 % of normal burner heat release for the heater operating at the specified process design conditions, with design air excess levels as defined in DEP 31.24.00.30-Gen. Section 6.2.3. This margin is not intended to permit continuous operation of the heater at greater than the design process duty.

Oversizing of fuel gas lines shall be avoided. Common TSOVs shall be located at minimum distance of the fuel control valves, with a holdup between the fuel control valve and TSOV of less than 0.1 times the volume of piping downstream the TSOV up to the burners. The volume between common TSOVs and the burners shall be less than 0.5 % of the radiant cell volume.

Fuel gas shall be treated upstream of the burners to eliminate any solids, and heavy liquids. All supplies to the fuel gas system shall be routed through a common fuel gas mixing/knock out drum. This drum shall be provided with a high liquid level trip that cuts off the fuel supply to the individual heaters.

Where staged fuel Low NOx burners are used, additional filter and/or filter coalescer shall be used in case refinery fuel gas is applied.

Fuel gas piping downstream of the filter shall be traced and insulated.

3.4.6 Dampers

Flue gas dampers that are or may be used to control fire box pressure (e.g., stack dampers on natural draft systems or ID fan inlet dampers) shall be equipped with a minimum stop. Typical setting for such minimum stop ranges between 10 % - 30 % opening. This minimum stop shall be adjustable to allow for optimizing of setting during initial operation. Once set in position, the minimum stop shall be locked to prevent any unauthorized adjustment.

Bypass dampers (e.g., air preheater bypass dampers or stack bypass damper on balanced draft systems) shall be able to be closed completely.

Refer to DEP 31.24.00.30-Gen. for further damper specifications.


Page 27

3.5 ADDITIONAL REQUIREMENTS

3.5.1 Waste gas firing

Process waste gases, if present, may be disposed in fired heaters/boilers when main burners are lit.

If the waste gas heat release exceeds 15 % of the furnace design duty, it SHALL [PS] be included in the load and air/fuel ratio control system. Changes in waste gas calorific value shall be corrected either by adjusting the constants in the summation block of the control system, or if this is frequently required, by installing a separate bias relay. A fixed heating value and stoichiometric air requirement shall be used for the waste gas heat input.

If the waste gas flow represents not more than 15 % of the design heat input, it may be fed uncontrolled to the furnace provided that the main burners are in operation.

Waste gas and low pressure gas firing shall always be supported by the main fuel oil or gas flame of the burner firing waste gas. A minimum fuel flow or fired duty of 25 % of design is required before introducing waste gas to the burners. Waste gas shall be tripped when the main fuel is tripped or when the fired duty is less than 25 % of design.

If more than one burner is required to fire the waste gases, these burners shall be symmetrically arranged in the furnace and the piping shall be designed to give equal distribution to the burners.

If the waste gas may contain oxygen to an amount that may cause the formation of a flammable mixture resulting in flashback, the waste gas supply line SHALL [PS] be equipped with a flame or detonation arrestor and a high temperature alarm immediately downstream of arrestor set at 400 °C (750 °F). The general requirements for the installation of a flame or detonation arrestor are as follows:

In cases where the waste gas is of a fouling nature, two flame (or detonation) arrestors shall be installed in parallel to facilitate online cleaning.

Flame (or detonation) arrestors shall be installed in the common supply line as close as possible to the burners.

If the flame arrestor cannot be located within 60 pipe diameters of the burner, detonation arrestors shall be applied.

The need for the use of flame or detonation arrestors and other pertinent design details shall be specified by the Principal.


Page 28

PART II AMENDMENTS/SUPPLEMENTS TO API RP 556 SECOND EDITION (APRIL 2011)

This Section of the DEP is based on API Recommended Practice 556 Second Edition (April 2011). It amends, supplements and deletes various clauses of API RP 556. Clauses of API RP 556 Second Edition that are not mentioned in this Section shall be applied as written. However, since API RP 556 contains mostly normative statements which are referred to as guidelines, care is to be exercised on the use of this document.

Where there are conflicts between the guidelines in API RP 556 and the requirements as specified in the minimum requirements Section of this DEP, the latter shall take precedence. For ease of reference, the clause numbering of API RP 556 has been used throughout Part II of this DEP.

1 Scope

1.2 General

Add new clause:

1.2.5 A bullet () is shown in the margin of this DEP where further decisions or information are to be provided by the Principal.

2 References

2.1 Normative References

Add to this clause:

Shell DEP 31.24.00.30-Gen., Fired heaters (amendments/supplements to ISO 13705)

Shell DEP 20.05.60.10-Gen., Fuel systems

2.2 Other References

Add to this clause:

ANSI Z21.21 / CSA 6.5, Automatic Valves for Gas Appliances

3 Fired Heaters

3.1 General

Add to this clause:

DEP 31.24.00.30-Gen. amends, supplements and deletes various clauses of API STD 560/ ISO 13705 including instrumentation requirements for fired heaters and their auxiliaries.

3.2 Process Measurement

3.2.1 Temperature

Add to this clause:

Flue gas thermowells shall protrude at least 60 cm (24 in) into the flue gas path or to the centre of the flue gas duct, whichever is the shorter.

3.2.1.1 Bridgewall Temperature

Replace the first paragraph with:


Page 29

The bridgewall temperature is the temperature of flue gas leaving the radiant section. Each flue gas radiant cell outlet and each common outlet duct, where applicable, shall have a bridgewall temperature thermowell. This temperature is used for trending the approximate flue gas temperature. Highly accurate temperature measurement here is not necessary for normal refinery service heaters. For more accurate bridgewall temperature measurement, shielded thermowells or velocity type thermocouples should be used.

Add to the first bullet:

One temperature measurement shall be provided for every 9 m (30 ft) of radiant cell length for horizontal heaters.

3.2.1.3 Convection Section Temperature

Replace this clause with:

Flue gas thermocouples shall be located between the different services to cross-check their heat absorbed duties.

In long convection boxes, several temperature measurement points along the length shall be used to identify flue gas channelling effects. One temperature measurement for every 9 m (30 ft) of convection box length is recommended.

3.2.1.4 Stack Temperature

Replace the 6th bullet with:

- Excessive length of thermowells should be avoided as stack gas induced frequency vibration of the thermowell is amplified by thermowell length.

3.2.1.5 Process Inlet and Outlet Temperatures

Replace first sentence with:

All heaters shall have temperature measurements on the outlet of each pass (with the exception of single phase heaters with a large multiplicity of passes) and their common inlet.

A separate check temperature element/indicator on the combined tube outlet line is required in addition to the heater temperature controller. This instrument may be combined with the trip transmitter – where applicable.

All heaters shall have a temperature measurement in each crossover between convection bank and radiant cell.

3.2.1.6 Tube-skin Thermocouples

Replace all 3.2.1.6 clauses with:

Tube skin thermocouples are used to monitor tube metal temperature. Tube skin thermocouples are required for services meeting any of the following conditions:

1. Heaters in which process side coke formation is expected or may occur (e.g., Crude heaters, High Vacuum heaters, Coker heaters, Visbreaker heaters).

2. Heaters in which process side fouling is expected or may occur. (e.g., in reboiler heaters in which the process-side "dry-point" may be reached inside the heater).

3. Heaters whose tube metal temperatures are operated within 40 °C (7 5°F) of the tube temperature limit recommended by ISO 13704 (API STD 530) or any other prescribed limit.


Page 30

Skin thermocouples are typically installed at locations with the highest heat flux, the poorest heat transfer coefficient and/or at locations where a high heat flux is combined with a high bulk temperature and/or low heat transfer coefficient. Two tube skin thermocouple locations per pass in each radiant cell is typically the minimum required.

The quantity, location, type, material selection, installation and testing requirements shall

be specified by the Principal. The preferred tube skin thermocouples are pad type, insulated shielded or bare, depending on the application.

3.2.2 Draft and Pressure

3.2.2.4 Fuel Gas Pressure


Fuel gas supply pressure should be measured upstream of the fuel gas control valves and downstream of the fuel gas preparation system. Burner pressure shall be measured downstream of the fuel gas control valve on the common fuel line as close as possible to the burners to minimize the effect of the line pressure drop.

The trip setpoint shall not be below the minimum span of the transmitter cell range. Thus, separate transmitters to measure the low and high alarm and trip points may be required depending upon the cell range selected and the turndown capability of the transmitter. The transmitter that is used for trip function shall be independent from that used for control and monitoring.

3.2.3 Flow

3.2.3.1 Fuel Flow

Replace the first paragraph with:

A flow meter shall be installed in the main fuel line located upstream of the fuel control valve where the pressure is relatively constant. To compensate for changes in fuel gas composition, the heat content may be measured by either analysis or inferred from fuel gas specific gravity. Refer to (3.2.2) of this DEP.

Add new sentence at the end of the last paragraph:

The use of mass flow meters is preferred.

3.2.3.2 Charge Flow

Replace the 1st bullet with:

If the charge is divided into two or more streams through the heater, the flow in each pass shall be measured in fouling, liquid and vaporizing/two-phase flow services. This measurement is used for pass balancing, which in turn helps prevent coking and plugging of each pass. For multi-pass heaters with pass flow control in vaporizing service, the combined flow upstream of the control valves shall also be measured.

3.2.3.3 Combustion Air Flow


Forced draft systems shall be equipped with combustion air flow measurement. Measurement principle shall be based on the venturi type pressure differential measurement. Reference is made to Standard Drawing S 24.002 and Standard Drawing S 24.005.

3.2.4 Flue Gas Analysis


Page 31

3.2.4.2 Oxygen

Replace this paragraph with:

An oxygen analyzer shall be provided for each independent heater combustion zone. For large combustion zones, due to non-uniformities in the firebox flue gas circulation and to facilitate balancing the burners, one oxygen analyzer for every 9 m (30 ft) of firebox length is required. Alternatively TDL analysers which span the entire length of the firebox may be applied.

Type and number of O2 analysers shall be specified by the Principal.

Oxygen measurements shall be taken as near as possible to the point where combustion is completed, normally at the exit of the radiant section and before the transition to the convection section to avoid tramp air. In multiple cell heaters, the best location for the sample points is below the level of the dividing walls.

Oxygen control shall follow (Part I, 3.2.3) of this DEP.

3.2.4.4 Carbon Monoxide (CO)

3.2.4.4.1 CO Control

Replace all 3.2.4.4.1 clauses with:

For heaters equipped with greater than 4 low air-side pressure drop burners, CO-TDL measurement shall be installed.

As the instrument is intended to provide information on incomplete combustion and to prevent afterburning, the CO-TDL analyser shall be installed either at the outlet of the radiant cell or at the inlet of the convection section.

If applied, CO control shall be implemented as indicated in (Part I, 3.2.3) of this DEP.

Type and number of CO TDL analysers shall be approved by the Principal.

3.2.5 Fuel Gas Heating Value

Replace clause with:

Where wide variations of fuel gas density and heating value is expected, or where inert gases or other types of gas such as carbon monoxide are added, a fuel gas analyzer (such as a Wobbe Index meter, gas chromatograph, or calorimeter) is required for proper of air/fuel ratio control.

Refer to (3.2.2) of this DEP.

Fuel gas analyzers shall be provided downstream of the mixing/buffer vessel on all main gaseous fuel supply systems.

Variations in density and heating value shall be minimized by appropriate mixing and buffering of gaseous fuel streams. Also, the fuel gas shall be delivered to the consumer at a constant pressure, the header pressure being controlled by buffering and/or by make-up from a higher pressure supply.

Refer to DEP 20.05.60.10-Gen. for more information on fuel systems requirements.

3.2.6 Flame Monitoring

Replace all 3.2.6 clauses with:

Refer to (Part I, 3.4.2) of this DEP for flame monitoring requirements.


Page 32

3.3 Process Control Systems

Replace all 3.3 clauses with:

Refer to (Part I, 3.2) of this DEP for control system requirements.

3.4 Protective Systems

Replace all 3.4.1 – 3.4.7 clauses with:

Refer to (Part I, 3.3) of this DEP for the protective systems basic minimum requirements.

3.4.8 Alarm Summary Table

Replace first sentence with:

This table specifies the required alarms.

Add to this clause:

The alarm settings shall be approved by the Principal.


Page 33

3.4.10 Cause and Effects Table

Replace this section with:

Table II-1 is a typical cause and effect matrix summarizing the basic recommended safety trips or mandatory protection against accumulation of unsafe mixture and explosion potential for process heaters. Where trip initiators activate a full trip of the fuel supply to the burner(s), the fuel source is to be isolated with automatic fail-closed tight shutoff valves (TSOVs).

Table II-1 – Typical Cause and Effect Matrix

Typical Cause and Effect Matrix (Note 1) Safety Protective Functions

NATURAL DRAFT HEATERS

FORCED/BALANCED/INDUCED DRAFT HEATERS

Fuel Pilot Gas (Note 10)

Fuel Pilot Gas Stack Bypass Damper (Note 11)

Forced Draft Fan

Induced Draft Fan

Natural Draft

Doors

Low burner fuel pressure trip (Note 2)

Close Close

High burner fuel pressure trip (Note 3)

Close Close

Loss of main burner flame detection trip (Note 4)

Close Close

Low pilot burner gas pressure trip (Note 5)

Close

Close

Low and high atomizing steam/oil differential pressure trips (Note 6)

Close Close

Manual fuel trip (Note 7)

Close Close Close Close Dependent on hazard scenario

Low combustion air flow trip

Close (Note 8)

Open Off Off Open

Low air/fuel ratio trip

Trip to min fire

Loss of induced or forced draft fan trip

Close

(Note 8) Open Off Off Open

High firebox pressure (low draft) trip

Close

(Note 9)

Trip to min fire

Low heater process flow trip

Close Close


Page 34

NOTES: 1. This table provides general safety protective functions for fired process heaters. Each heater must be assessed on their own merit.

2. Considered a minimum requirement in the absence of direct flame detection, and individual burner safety shut-off valves and logic. Low pressure trip is not required in case flame detection trip is applied.

3. Measure for overfire protection. Alternative to total fuel trip, a trip to minimum firing may be applied to minimize process impact where national or local regulations allow it.

4. Where not safeguarded by pilot burner.

5. Where continuous reliable pilots are used (natural and induced draft heaters) as a primary safeguard. Use of continuous pilots is not recommended for high air-side pressure drop forced draft burners, as they do not guarantee main flame stability. For low air-side pressure drop burners which employ fuel staging, the system should at least be safeguarded with a high firebox pressure trip based on low draft detected at an elevation .3 m -.6 m (1 ft - 2 ft) from the floor or with flame detection on selected burners.

6. For oil fired heaters and boilers (only required if burners are not equipped with flame detection).

7. Operator initiated trip (local panel and control room). Total manual shutdown is used to take the heater to a known safe state.

8. Some heaters equipped with low air-side pressure drop burners have the ability to trip to natural draft. Therefore, the fuel valve(s) will close only if the natural draft doors fail to open.

The most common reason for tripping a balanced or forced draft heater to natural draft operation is on loss of combustion air, caused most often by power failure. In cases where (part of) the heat recovery system (e.g., air preheater) can be bypassed, the failure of the FD or ID fans initiates an automatic opening of the bypass (stack) damper, and the opening of the ‘plenum dampers’ or ‘natural draft doors’ to provide combustion air to the burners.

When a heater trips from FD/BD mode to natural draft, it is accompanied by a trip to minimum firing to allow the operator time to assess whether the stack and natural draft air dampers have opened properly and to check for proper oxygen levels in the flue gas. After verification that the dampers have opened, the fuel gas flow can be increased if desired. If either the stack damper or the natural draft door fails to open to at least 70 % within 15 seconds, then a fuel gas trip is initiated.

If the heater is not capable of automatically switching to natural draft mode, the main fuel gas is tripped on low combustion airflow or low draft.

9. For heaters equipped with low air-side pressure drop burners which employ fuel staging, high firebox pressure trip should be administered based on low draft at an elevation .3 m -.6 m (1 ft - 2 ft) from the floor. For induced or balanced draft heaters, high firebox pressure trip shall be administered based on low arch pressure.

10. Continuous pilots that could thermally endanger a heater shall lock up simultaneously with the main fuel trip. Normally, continuous pilots remain in operation unless stopped by means of the manual trip or low pilot fuel pressure.

11. In the event of a fuel gas trip, natural draft heaters should hold the stack damper in the last position.

3.4.11 Startup Sequence Table

Delete this section.


Page 35

PART III AMENDMENTS/SUPPLEMENTS TO NFPA 85 (2011 EDITION)

This part of the DEP is based on Chapters 5, 6 and 8 of NFPA 85 (2011 Edition). It amends, supplements and deletes various clauses of NFPA 85. Clauses in these sections of NFPA 85 2011 Edition, that are not mentioned in this part, shall apply as written.

Where there are conflicts between the guidelines in NFPA 85 and the requirements as

specified in the minimum requirements section of this DEP, such conflicts shall be conveyed to the Principal who shall then advise on the approach to take.

For ease of reference, the clause numbering of NFPA 85 has been used throughout PART III of this DEP.

Chapter 5 Single Burner Boilers

5.3 Equipment Requirements.

5.3.1 Fuel Supply — Oil.

5.3.1.9 Fuel Oil Safety Shut Off Valves.


Line up of TSOV shall be in line with (Part I, 3.4.4) of this DEP.

5.3.2 Fuel Supply — Gas.

5.3.2.3 Fuel Gas Safety Shut Off Valves.



5.3.2.3.1 Valve Proving.


Valve proving shall be performed on a frequency as determined by SIL analysis or maintenance turnaround frequency, whichever is more conservative. Automatic valve proving systems are not required unless specified by local regulations.

5.3.2.7 Valve Leakage Test.

Replace clause 5.3.2.7.2 with:

Valve leakage tests of the main safety shutoff valves shall be conducted based on a frequency as determined by SIL analysis or maintenance turnaround frequency, whichever is more conservative.

5.3.4 Fuel-Burning Equipment.

5.3.4.1 Ignition.


The main burner should preferentially be equipped with Class 3 Igniter.

The use of Class 1, Class 2 or Class 3 Special Igniters shall be subject to the Principal’s

approval.

5.3.4.1.3 Igniter Safety Shutoff Valves.



Page 36


5.3.4.1.3.1 Ignitor Valve Proving.


Valve proving shall be performed on a frequency as determined by SIL analysis or maintenance turnaround frequency, whichever is more conservative.

5.3.4.6 Combustion Products Removal.

5.3.4.6.2

5.3.4.6.2.3

Add to this clause:

The low combustion air flow trip shall be used as interlock to prevent firing against a closed damper. No proximity or limit switches shall be applied.

5.3.7 Flame Safety Shutdown System

5.3.7.1


The response time from flame failure to de-energization of the safety shutoff valves should not exceed 2 seconds.

A response time greater than 2 seconds will require approval by the Principal.

5.3.7.2


The response time from de-energization of the safety shutoff valves to full closure should not exceed 5 seconds.

A closing time greater than 5 seconds will require approval by the Principal.

5.5 Operating Systems.

5.5.2 Automatic (Recycling) Systems for Watertube Boilers.

Replace clause 5.5.2.1 with:

An automatic (i.e., recycling) unit shall not be used.

5.5.2.6

5.5.2.6.1 Prefiring Cycle.

Add to (4):

The low air flow trip may be used as fan interlock

Replace (8) with:

Purge airflow shall be satisfied solely by means of an air flow interlock.

Replace step (9) with:


Page 37

(9) Purge airflow must reach no less than 25 percent of the airflow required at maximum continuous capacity of the unit.

5.5.2.6.2 Light-Off Cycle.

5.5.2.6.2.1 Class 3 Igniters.


(3) After a maximum of 5 seconds for gas or a maximum of 10 seconds for oils, shut off igniter.

5.5.2.6.4 Shutdown

Delete clause in its entirety. Automatic (i.e., recycling) boilers shall not be used.

5.5.2.6.4.3 Safety Shutdown

5.5.2.6.4.3(A)

Delete items (1), (2), (9) and (10), as these abnormal conditions require alarms only.

Replace item (8) with:

Loss of atomizing medium, where used, as interlocked by atomizing medium supply pressure.

5.5.2.6.4.3(B)

Delete item (2) and (8), as this abnormal condition requires alarm only.

5.5.3 Automatic (Nonrecycling) Systems for Watertube Boilers.

Replace 5.5.3.3 with:

When low water level establishes a normal shutdown, the burner shall not be allowed to recycle.

5.5.4 Automatic (Recycling) Systems for Firetube Boilers.


An automatic (i.e., recycling) unit shall not be used.

5.5.4.2

5.5.4.2.1 Prefiring Cycle.

Add to (4): The low air flow trip may be used as fan interlock.

Replace (8) with: Purge airflow shall be satisfied solely by means of an air flow interlock.


(9) Purge airflow must reach no less than 25 percent of the airflow required at maximum continuous capacity of the unit.

5.5.4.2.2 Light-Off Cycle.


(3) After a maximum of 5 seconds for gas or a maximum of 10 seconds for oils, shut off igniter.

5.5.4.2.4 Normal Shutdown.

Delete clause in its entirety. Automatic (i.e., recycling) boilers shall not be used.


Page 38

5.5.4.2.4.4 Safety Shutdown.

5.5.4.2.4.4(A)

Delete items (1), (2), (8) & (10), as these abnormal conditions require alarms only.

5.5.4.2.4.4(B)

Delete item (2) & (7), as these abnormal conditions require alarms only.

5.5.5 Automatic (Nonrecycling) Systems for Firetube Boilers.

Replace 5.5.5.2 with:

When low water level establishes a normal shutdown, the burner shall not be allowed to recycle.

5.5.6 Supervised Manual Systems for Oil-Fired Watertube Boilers.

5.5.6.4

Delete item (8), as this abnormal condition requires alarm only.

5.5.6.5

Delete item (2).

5.5.7 Supervised Manual Systems for Gas-Fired Watertube Boilers.

5.5.7.4


5.6 Simultaneous Firing of Oil and Gas Fuels.

5.6.1 General.

5.6.1.1

Delete clause.

5.6.5 Shutdown Cycle.

5.6.5.3 Oil Safety Shutdowns.

5.6.5.3.1

Delete items (1), (2) and (4), as these abnormal conditions require alarms only.

5.6.5.4 Gas Safety Shutdowns.

5.6.5.4.1


5.6.5.5 Boiler Safety Shutdown.


5.7 Simultaneous Firing of Oil and Gas for Fuel Transfer Only.

5.7.1 General.

5.7.1.2

Delete clause.


Page 39

5.8 Dual Oil Atomizers in a Single Burner.

5.8.1 General.

5.8.1.1

Delete clause.


Page 40

Chapter 6 Multiple Burner Boilers

6.1 Application.

6.1.6

Add to this clause:

The use of pulverized coal as fuel for the boiler shall be subject to the Principal’s approval.

Add new clause:

6.1.8

The employment of a reburn system in a multiple burner boiler shall be subject to

Principal’s approval.

6.3 Mechanical Equipment Requirements.

6.3.1

Replace clause 6.3.1 with:

General requirements for mechanical equipment shall be in accordance with DEP 30.75.10.30-Gen. and Sections 4.6 through 4.16.

6.3.3 Fuel Gas and Fuel Oil Safety Shutoff Valves.

Refer to (Part I, 3.4.4) of this DEP.

6.3.3.1

Add to clause 6.3.3.1:

An automatic header vent valve should be provided to relieve fuel gas pressure prior to start of the main burner. This automatic valve shall be Fail Closed to prevent hydrocarbon release to the atmosphere during normal operation. The vent valve shall be equipped with an upstream manual block valve and a restriction orifice.

The manual block valve shall be car-sealed open.

6.3.3.2


(Manual) proof of closure shall be provided for all header and burner safety shutoff valves as well as the header vent valve(s).

6.3.3.3


Multiple burners supplied from a common set of burner safety shutoff valves shall be treated as a single (individual) burner.

A schematic as such shall be subject to the Principal’s review and approval.

Refer to 6.6.7.1.3 and 6.7.7.1.3 for two burner units.

6.3.3.4



Page 41

Only fuel gas igniters shall be used. A common igniter fuel header safety shutoff valve and individual igniter safety shutoff valves shall be provided. The igniter header safety shutoff valve shall be dedicated to the igniter subsystem.

6.3.3.5


A schematic as such shall be subject to the Principal’s review and approval.

6.4 Burner Management and Combustion Control Requirements.

6.4.2 Interlock System.

6.4.2.3 Required Interlocks.

6.4.2.3.1


(Part I, 3.3.4) of this DEP outlines the minimum required system of interlocks that shall be provided for basic furnace protection for a multiple burner boiler.

6.4.2.3.4 Purge Requirements.

Add to this clause.

ii. For burners with manually operated air registers – which are normally always open, the check of the open position of the air register may be performed manually.

iii. The FD fan running interlock may be replaced by the low air flow trip.

6.6 Fuel Gas Systems.

6.6.3 System Requirements.

6.6.3.1 Fuel Supply Subsystem – Fuel Gas.

6.6.3.1.2 Fuel Gas Supply Overpressure Protection.

6.6.3.1.2.2

Replace clause 6.6.3.1.2.2 with:

The requirement in 6.6.3.1.2.1 shall be accomplished by providing a high fuel gas pressure trip.

6.6.3.1.3


A manual emergency fuel shutoff valve located at a safe and accessible location, 15.2 m (50 ft) as a minimum from the firebox shall be provided.

6.6.3.1.10


A double block valve arrangement may be adopted for each burner and igniter fuel line, however no vent valve shall be provided in between each set of double blocks.

6.6.4 Flame Monitoring and Tripping System.

6.6.4.1 Ignition.


Page 42


The main burners should preferentially be equipped with Class 3 Igniters.


approval.

6.6.4.1.3 Class 3 Igniters.

6.6.4.1.3.2

Add to clause 6.6.4.1.3.2:

The Class 3 igniters may be equipped with an ionisation detection system, in which case the main flame detector does not necessarily requires to be positioned to detect the ignition flame. Main flame detectors shall be installed such that the chance on detecting neighbouring flames is minimized.

6.6.5 Operations.

6.6.5.1 General Operating Requirements.

6.6.5.1.1 All Conditions.

6.6.5.1.1.3


Purge rate shall be equivalent to the airflow at the fan minimum stop.

6.6.5.1.5 Sequencing.

6.6.5.1.5.6 Burner Operation.

Replace 6.6.5.1.5.6(D) with:

A minimum of N/2 + 1 burners should be placed in service (N represents the total number of burners), with the load to each burner adjusted as necessary to accomplish the following:

- Raise the boiler pressure or temperature

- Carry the initial load on the unit



(D) The burners, registers and ignition system shall be designed such, that the same register position can be applied during purging, ignition of ignition burner, ignition of main burner and normal operation.

6.6.5.2 Functional Requirements.

6.6.5.2.1 Cold Start.

6.6.5.2.1.3 Starting Sequence.

Add to (B)11e:

A minimum wait time of 1 minute shall be imposed before any restart of the burner(s) is possible

Replace (B)12 with:

The burners, registers and ignition system shall be designed such, that the same register position can be applied during purging, ignition of ignition burner, ignition of main burner and normal operation.


Page 43

Add to (17): (e) A minimum of (N/2 + 1) burners are in service, where N represents the total number of burners.

6.6.5.2.2 Normal Operation.

6.6.5.2.2.6 Loss of Individual Burner Flame.

Replace 6.6.5.2.2.6 with:

Upon loss of individual burners, the air/fuel ratio control shall compensate for the air that flows through the burners lost. Upon loss of N/2 or more burners (N represents the total number of burners), the fuel supply shall automatically be reduced to a safe minimum setting (trip to minimum firing).

6.6.5.2.5 Emergency Shutdown — Master Fuel Trip.

6.6.5.2.5.2 Mandatory Automatic Master Fuel Trips.

Replace (B)(8) with:

Failure of fuel gas trip to minimum firing (initiated by low air/fuel ratio trip or high fuel gas pressure trip) and no other fuel proven in service.

6.6.5.2.6 Starting Sequence — Second Fuel.

6.6.5.2.6.2 Starting sequence second fuel.

Replace (3) with:

Ignition of second fuel does not require use of the ignition burner. Main burner shall be designed such that safe ignition of second fuel (by first fuel flame) is guaranteed.

6.7 Fuel Oil Systems.

6.7.4 Flame Monitoring and Tripping System.

6.7.4.1




approval.

6.7.4.1.3 Class 3 Igniter.

6.7.4.1.3.2


The Class 3 Igniter may be equipped with an ionisation detection system, in which case the main flame detector does not necessarily require to be positioned to detect the ignition flame. Main flame detectors shall be installed such that the chance of detecting neighbouring flames is minimized.

6.7.5 Operations.

6.7.5.1 General Operating Requirements.

6.7.5.1.1 All Conditions.

6.7.5.1.1.3


Page 44


Purge rate shall be equivalent to the airflow at the fan minimum stop.

6.7.5.1.5 Sequencing.



A minimum of N/2 + 1 burners should be placed in service (N represents the total number of burners), with the load to each burner adjusted as necessary to accomplish the following:

- Raise the boiler pressure or temperature

- Carry the initial load on the unit




6.7.5.2 Functional Requirements.

6.7.5.2.1 Cold Start.

6.7.5.2.1.3 Starting Sequence.

Add to (B) (12)e:

A minimum wait time of 1 minute shall be imposed before any restart of the burner(s) is possible.

Replace (B) (13) with:


Add to (18):

(e) A minimum of (N/2 + 1) burners are in service, where N represents the total number of burners.

6.7.5.2.2 Functional Requirements: Normal Operation.

6.7.5.2.2.6 Loss of Individual Burner Flame.


Upon loss of individual burners, the air/fuel ratio control shall compensate for the air that flows through the burners lost. Upon loss of N/2 or more burners (N represents the total number of burners), the fuel supply shall automatically be reduced to a safe minimum setting (trip to minimum firing).

6.7.5.2.5 Emergency Shutdown — Master Fuel Trip.

6.7.5.2.5.2 Mandatory Automatic Master Fuel Trips.

Add to (B) (1):

Failure of fuel oil trip to minimum firing (initiated by low air/fuel ratio trip or high fuel oil pressure trip) and no other fuel proven in service.


Page 45


Page 46

Chapter 8 Heat Recovery Steam Generators and Other Combustion Turbine Exhaust Systems

8.1 Application.

8.1.1

Add to clause 8.1.1:

Combustion Turbine Exhaust Systems shall be designed as per requirements laid down in DEP 30.75.10.31-Gen.

8.4 Equipment.

8.4.3 HRSG Fuel-Burning System.

8.4.3.2 Fuel Supply.

8.4.3.2.1 General.

8.4.3.2.1.9


A manual emergency shutoff valve that is accessible in the event of fire shall be provided at a safe location at least 15.2 m (50 ft) from the HRSG casing.

8.7 Controls, Monitoring, Alarms, and Interlocks.

8.7.4 Interlocks.

8.7.4.2 Flame Detection.




approval.

8.8 Purge, Start-up, Operation, and Shutdown of HRSG and Other Combustion Turbine Exhaust System.

8.8.4 Combustion Turbine Purge and Light-Off.

8.8.4.2 Initial Combustion Turbine Purge and Light-Off.

8.8.4.2.2 Purge Rate.

8.8.4.2.2.2


The adequacy of this purge rate shall be demonstrated by ensuring a flow rate of not less than 25 percent of full-load mass airflow is provided through the HRSG or other combustion turbine exhaust system.

8.8.5 Duct Burner Purge and Light-Off.

8.8.5.2



Page 47

The duct burner purge shall accomplish at least five volume changes of the HRSG enclosure, after combustion turbine exhaust flow rate has been achieved in accordance with 8.8.5.1.

8.8.5.3


Purge prior to light-off of the combustion turbine shall not be considered a duct burner purge.

8.8.5.8 Starting Sequence.

8.8.5.8.2

8.8.5.8.2.2


The shutoff valves on the main fuel header and igniter fuel header shall open only upon the light up of the first igniter or duct burner and remain open as each individual burner and igniter are lighted up.

8.8.5.8.2.6


The individual igniter shall be shut off fifteen seconds after the shutoff valve of its associated burner is opened.

8.11 Combustion Turbine Exhaust System.

8.11.3 Selective Catalytic Reduction (SCR) Systems.

8.11.3.2


A tempering air system shall not be used on the SCR system.


Page 48

PART IV AMENDMENTS/SUPPLEMENTS TO EN 746-2 (MAY 2010 EDITION)

This Section of the DEP is based on EN 746-2 European Standard (May 2010 Edition). It amends, supplements and deletes various clauses of EN 746-2. Clauses of EN 746-2 that are not mentioned in this section shall apply as written.

Where there are conflicts between the guidelines in EN 746-2 and the requirements as


For ease of reference, the clause numbering of EN 746-2 has been used throughout PART IV of this DEP.

5 Safety requirements, measures and verification means

5.2 Gaseous fuels

5.2.1 Gas pipework

5.2.1.2 Connections

Replace paragraph with:

Gas pipework connections shall be of the flanged or welded types. Threaded connections shall not be used – other than threaded connections on burner mountings.

The number of connections shall be kept to a minimum.

The design of pipework shall be such as to avoid tensile loading of the joints.

Any pipe passing through an unventilated space shall not have a connection except welded joints.

Flanges shall comply with ISO 7005, Parts 1 and 2 as appropriate.

Arc welding shall comply with EN ISO 5817, quality Level C.

5.2.1.3 Unconnected pipework

Add to this clause:

Any low points shall be drained to avoid trapped liquids. See 5.2.1.8.

5.2.1.5 Flexible tubing and couplings

Add to this clause:

Flexible tubing shall not be used unless approved by the Principal.

5.2.1.11 Pressure relief devices and flame arrestors on pipework

Add to this clause:

The setpoint of the pressure relief device shall be at or below the maximum working pressure of all piping and components downstream of the pressure relief device.

5.2.1.15 Isolation of required safety devices

Replace the last sentence with:


Page 49

A maintenance override procedure, including increased operations surveillance shall be in place and enforced when equipment is operated with selected safety devices bypassed. Safety devices shall not be bypassed during normal operation of the equipment.

5.2.2 Required safety devices

5.2.2.3 Automatic shut-off valves

5.2.2.3.1 General

Replace 3rd paragraph with:

Low cycling applications (plants intended to operate continuously for periods longer than 1 year) shall have provisions for testing the effective closure of the valves in accordance with SIL-classification (e.g., double parallel automatic shut-off valve system that allows to test one system when the other is in operation). See Annex C in EN 746-2, e. g., Figure C5.

5.2.2.3.2 Single burner equipment

Replace 4th paragraph with:

The automatic shut-off valves shall not open or shall shut off the fuel to the burner when the limit of any safety condition is reached. Refer to (Part I, 3.3.5) of this DEP for the minimum limits of safety condition required.

5.2.2.3.3 Multiple burner equipment


The automatic shut-off valve(s) shall not open or shall shut off the fuel to the entire IThE or independent zone when the limit of any safety condition is reached. Refer to (Part I, 3.3.5) of this DEP for the minimum limits of safety condition required.

Replace 2nd bullet point in 3rd last paragraph “ a leak tightness test……” with:

“A leak tightness test shall be conducted based on a frequency as determined by SIL analysis”.

Replace 2nd to last paragraph with:

The capacity control functions (valves and circuitry) shall not override the automatic shut-off functions. The automatic shut-off valves shall not be used for capacity control.

5.2.2.3.4 Valve proving system


Unless otherwise specified, valve proving system should not be used. Valve proving shall be done in line with SIL requirements.

5.2.2.4 Gas pressure regulator

Add to this clause:

A pressure controller cannot be used in place of a gas pressure regulator unless approved by the Principal.

5.2.2.5 Air and gas flow and pressure detectors

5.2.2.5.1 Air

Replace 3rd paragraph which reads as follows:

“The air-proving device shall be checked in the 'no flow' state prior to start-up (e.g., by stopping the combustion air supply or by interrupting the air signal to the device(s) in such a


Page 50

way as to simulate stopping the combustion air supply). Failure to prove the device in the "no flow" condition shall prevent start-up” with

with the following text:

“The air-proving device shall be manually checked in line with SIL requirements”.

Remove 1st bullet point “by pressure sensing”

5.2.2.5.2 Gas

5.2.2.5.2.1 Low gas protection

Replace 1st paragraph with:

“Low gas pressure protection to prevent insufficient gas flow shall be fitted in case main flame detection is not applied.”

5.2.2.5.2.2 High gas protection

Add to this section:

The high gas protection shall initiate a ‘trip to minimum firing’.

5.2.3 Combustion air and pre-purging the combustion chamber and flue passages

5.2.3.2 Pre-purging of the combustion chamber

Add to 3rd paragraph:

After a heater trip, the pre-purge time may be limited to 5 minutes as long as the combustion air flow has not dropped below 25 % of design.

Delete c) “When recycling………”

5.2.3.3 Air/gas fuel ratio

Add to this clause:

Pneumatic gas/air ratio controls shall not be used unless approved by the Principal.

5.2.5 Burners

5.2.5.3 Start-up and ignition

5.2.5.3.4 Safety time

Replace this clause (including subclauses) with:

For forced draft burners, the first safety time (for starting the ignition burner) shall be 10-15 seconds, provided the mixture of fuel gas from burner and combustion air from the main burner remains below 25 % LEL. In other cases this first safety time shall be 5 seconds.

The second safety time (for starting the main burner) shall be 5 seconds.

5.2.5.3.5 Flame failure

Add to this clause after subclauses:

Recycling shall not be permitted unless approved by the Principal.

Recycling (e.g., for regeneration gas heaters) is only allowed where each main burner is fitted with an independently supervised pilot – such supervision shall be done by individual flame detection in combination with a high/low pressure trip on the common pilot gas supply.

5.2.6 Automatic burner control systems


Page 51

5.2.6.1 General

Add to 1st paragraph:

Exceptions are only permitted when equipment safety is not compromised (e.g., see 5.2.6.2 and 5.2.6.3) and approved by the Principal.

Replace 2nd and 3rd paragraphs with:

For equipment fitted with high air-side pressure drop burners, pilot (ignition) burner shall be extinguished during normal operation. A flame detector device to supervise the main flame shall be fitted.

For systems equipped with high air-side pressure drop burners, the use of a continuous

pilot is not permitted unless approved by the Principal – in that case the pilot burners shall have a capacity above 10 % of the nominal main burner capacity.

For systems equipped with low air-side pressure drop burners where the pilot burner remains in use during main burner operation, separate flame detector device to supervise the pilot or main flames shall be fitted, unless it can be proven that the pilot burner will ignite under all circumstances the main flame.

In systems with continuous pilots where a main flame detector device is installed, the main flame detector device shall be positioned such that it will not, under any circumstance, detect the pilot flame.

In all systems with continuous pilots the pilot burner pressure shall be supervised by a high and low gas pressure trip system.

For heaters in recycling service (e.g., regeneration gas heaters) continuous pilots with individual pilot flame detection shall be applied.

5.2.6.2 Low temperature equipment

Add to this clause:

Use of a system as per this section is not permitted unless approved by the Principal.

5.2.6.3 High temperature equipment

Add to this clause:


5.3 Liquid fuels

5.3.1 Liquid fuel pipework

5.3.1.1 General

Add to this clause:

The use of non-metal materials for the piping shall be approved by the Principal.

5.3.1.2 Connections

Replace chapter 5.3.1.2 with:

Liquid fuel pipework connections shall be of the flanged or welded types. The number of connections shall be kept to a minimum.

The design of pipework shall be such as to avoid tensile loading of the joints.

Flanges shall comply with ISO 7005 Parts 1, 2 and 3, as appropriate.


Page 52

Arc welding shall comply with EN ISO 5817, quality level C.

Special requirements for liquefied petroleum gas in the liquid phase shall be considered.

5.3.1.4 Flexible tubing

Add to the beginning of this clause:

Flexible tubing shall not be used unless approved by the Principal. When approved by the

Principal, flexible tubing design shall comply with requirements in 5.3.1.4.

5.3.2 Required safety devices

5.3.2.3 Automatic shut-off valves

Replace 3rd paragraph with:

Low cycling applications (plants intended to operate continuously for periods longer than 1 year) shall have provisions for testing the effective closure of the valves in accordance with SIL-classification (e.g. double parallel automatic shut-off valve system that allows for testing of one system when the other is in operation).


The automatic shut-off valves shall not open or shall shut off the fuel to the burner when the limit of any safety condition is reached. Refer to (Part I, 3.3.4) of this DEP for the minimum limits of safety condition required.

5.3.2.9 Automatic shut-off valves for multiple burners

Replace last paragraph with:

The capacity control functions (valves and circuitry) shall not override the automatic shut-off functions. The automatic shut-off valves shall not be used for capacity control (and vice-versa).

5.3.3 Combustion air and pre-purging the combustion chamber and the flue passages

5.3.3.2 Pre-purging of the combustion chamber

Add to 3rd to last paragraph:

After a heater trip, the pre-purge time may be limited to 5 minutes as long as the combustion air flow has not dropped below 25 % of design.

5.3.5 Burners

5.3.5.2 Start-up and ignition

5.3.5.2.4 Safety times

5.3.5.2.4.2 Maximum safety times


The safety time (for starting the main burner) shall be 5 seconds.

5.3.5.3 Burner capacity control

Add to this clause:

On oil fired burners recycling shall not be permitted.

5.3.5.4 Permanent pilots


Page 53

Use of a permanent pilot is not permitted unless approved by the Principal – in that case

the pilot burners shall have a capacity above 8 % of the nominal main burner capacity.

5.3.6 Automatic burner control systems

5.3.6.1 General

Replace 2nd, 5th and 6th paragraphs with:

For equipment fitted with high air-side pressure drop burners, pilot (ignition) burner shall be extinguished during normal operation. A flame detector device to supervise the main flame shall be fitted.

For systems equipped with high air-side pressure drop burners, the use of a continuous

pilot is not permitted unless approved by the Principal – in that case the pilot burners shall have a capacity above 10 % of the nominal main burner capacity.

For systems equipped with low air-side pressure drop burners where the pilot burner remains in use during main burner operation, separate flame detector device to supervise the pilot or main flames shall be fitted, unless it can be proven that the pilot burner will ignite under all circumstances the main flame.

In systems with continuous pilots where a main flame detector device is installed, the main flame detector device shall be positioned such that it will not, under any circumstance, detect the pilot flame.

In all systems that apply continuous pilots, the pilot burner pressure shall be supervised by a high and low gas pressure trip system.

5.3.6.2 Low temperature equipment

Add to this clause:


5.3.6.3 High temperature equipment

Add to this clause:


5.4 Solid fuels

5.4.1 Pulverised solid fuel pipework

5.4.1.1 General

Replace text (including subclauses 5.4.1 through 5.4.6 ) with:

Principal shall be consulted for the requirements for a solid fuel firing system.

5.6 Oxygen or oxygen-enriched combustion air

Replace text (including subclauses 5.6.1 through 5.6.11) with:

Principal shall be consulted for the requirements for an enriched oxygen fuel firing system.

5.7 Design requirements for electrical and electronic equipment for control system and protective system

5.7.1 General

Replace text with:


Page 54

Electrical equipment shall comply with local codes and standards.

5.7.2 Requirements for protective systems

Replace text with:

A PLC used for safety functions shall comply with IEC 61508 and IEC 61511 or as specified by the Principal.

5.7.3 Fault assessment for a hardwired protective system

5.7.3.3 Hardwired section of protective system

Replace text with:

Reed relays shall not be used for any safety function without approval of the Principal.

5.7.3.5 Switching Devices

Replace text with:

Contactors and other safety switching devices shall conform to the local codes and standards in effect. Deviation shall be approved by the Principal.

6 Verification of the safety requirements and/or measures

Add the following rows to Table 6:

5.2.2.3.5 Safety valves opening time X X X

5.2.2.3.6 Safety valves closing time X X X

7 Information for Use

7.2 Marking

Add the following text:

The equipment shall be supplied with a nameplate in accordance to local codes and standards.


Page 55

PART V AMENDMENTS/SUPPLEMENTS TO EN 12952-8 (MAY 2002 EDITION)

This Section of the DEP is based on EN 12952-8 European Standard (May 2002 Edition). It amends, supplements and deletes various clauses of EN 12952-8. Clauses of EN 12952-8 that are not mentioned in this DEP shall apply as written.

Where there are conflicts between the guidelines in EN 12952-8 and the requirements as


For ease of reference, the clause numbering of EN 12952-8 has been used throughout PART V of this DEP.

4 Fuel supply

4.3 Fuel lines

4.3.3


Connections shall be of the flanged or welded type. Threaded connections shall only be used on connections to burners as required by the burner manufacturers. Materials used for all piping shall comply with project standards.

4.3.4

Add to this clause:

Flexible lines shall not be used unless approved by the Principal.

4.3.5

Add to this clause:

All components downstream of the pressure protection devices shall be rated to the protection pressure.

4.3.6

Add to 2nd paragraph:

The accepted leakage rate for the safety shut-off devices shall be in accordance to the requirements as spelled out in (Part I, 3.4.4) of this DEP.

4.3.7


Where double block and bleed is applied, gas escape lines for intermediate venting and for purging or charging shall be arranged such, that the escaping gas is either reliably ignited and burnt off with a flame trap installed in the pipe where the gases are transferred to the burning device or is safely discharged to the atmosphere if unburnt. The joining together of these lines shall only permitted if no dangerous operating conditions are expected. When necessary, gas escape lines shall be equipped with the necessary draining facilities. Connections for test devices shall be provided so that the adequacy of venting can be checked.

4.4 Safety shut-off devices (Safety trip valves)


Page 56

4.4.1


The fuel supply line shall be equipped with two safety shut-off devices arranged in series immediately upstream of each burner, or burner group. These safety shut-off devices shall be of quick-acting design, and correspond with group A of EN 161.

4.4.3

Insert as Note after Item 14, applicable to all of list:

The following requirements may be checked manually/visually by the operator:

2) (position of stack damper), 5b) (Fuel pressure is less than the minimum pressure)

5 Equipment for air supply and flue gas discharge

5.1 Air supply

5.1.1


Combustion air supply from the combustion air fan shall be monitored via combustion air flow measurement.

5.1.3


In the case of firing systems with several burners to which combustion air is supplied by a common control device, provisions shall be made to ensure that control and safeguard of the air/fuel ratio to individual burners remains safe (burner count module), by taking into account that air flowing through burners that are not in operation will not contribute to combustion. Alternatively each burner may be equipped with a shut-off device (e.g., damper) in the air duct.

Automatically operated individual burner air dampers shall not be used unless approved by

the Principal.

In systems where individual burner air dampers are applied, the air damper to a burner shall be closed in case that burner is tripped. If N/2 or more burners are tripped (N represents the total number of burners), the firing shall be tripped to minimum firing, and all air dampers shall be opened automatically.

The burners shall be designed such that purging, ignition of igniter burner, ignition of main burner and normal operation can be done with the same single burner air register/damper setting.

5.3 Flue gas discharge

Add new clause:

5.3.3 In case no ID fan is applied, the stack damper shall be equipped with a mechanical minimum stop which shall be adjusted such that the combustion chamber cannot be overpressured. In this case, no combustion chamber pressure safeguarding is then required.

6 Firing system

6.1 Burners


Page 57

6.1.5

Replace clause by:

Only gas-electric igniters shall be applied.

6.3 Control and monitoring

6.3.3


Flame monitors shall fail-safe and may require self checking devices.

6.3.4

Add to this clause:

Flame detectors shall not be equipped with maintenance override switches. In boilers with 4 or less burners, each burner shall be equipped with 2 flame detectors operating in 2oo2 mode.

6.3.5

Add to this clause:

An overall combustion chamber monitoring system shall not be used unless approved by

the Principal.

6.3.6

Add to this clause:

The ignition safety time is the maximum allowable time between introduction of fuel and the command to be sent to the safety devices from the flame monitoring system.

The ignition safety time for oil firing is to be 10 seconds.

The extinction safety time is the maximum allowable time for the command to be sent to the safety devices from the flame monitoring system. The maximum allowable fuel removal time, comprising the detection of loss of flame, the sending of the command to the safety valve, and the valve closure time, shall be determined by safeguarding reviews and confirmed as part of regular testing of the safeguarding system.

6.4 Electrical equipment

6.4.2

Add to this clause:

One emergency switch shall be installed locally, at a safe distance of at least 15 m (40 ft) from the boiler, another emergency trip switch shall be installed in the main control room. The emergency switch located locally shall be independent of any automatic or safeguarding control systems.

6.5 Safety precautions

6.5.5, 6.5.6 and 6.5.7

Replace these clauses with:

After any individual burner start failure, a minimum purge waiting time of 1 minute shall be adhered to provided the pilot remains proven. The combustion air flow must be above minimum air flow required during this period else a full purge is required.

6.5.8


Page 58

Add to this clause:

In addition, the valve immediately upstream of the burner shall be initially opened slowly to ensure the gas is introduced to the burner during the light off in a controller manner.


Page 59

PART VI AMENDMENTS/SUPPLEMENTS TO API RP 14C APPENDIX A.6 (MARCH 2007 EDITION) and ISO 10418 APPENDIX B.8 (2003 EDITION)

This Section of the DEP is based on API Recommended Practice 14C (March 2007 Edition) and ISO 10418 (2003 Edition). It amends, supplements and deletes various clauses of API RP 14C Appendix A.6/ ISO 10418 Appendix B.8. Clauses of API RP 14C Appendix A.6/ ISO 10418 Appendix B.8 that are not mentioned in this DEP shall be applied as written.

This Section of this DEP shall be read in conjunction with DEP 39.01.00.10-Gen.

Where there are conflicts between the guidelines in API RP 14C, Appendix A.6/ ISO 10418, Appendix B.8 and the requirements as specified in the minimum requirements Section of this DEP, such conflicts shall be conveyed to the Principal who shall then advise on the approach to take.

For ease of reference, the clause numbering of API RP 14C, Appendix A.6 has been used throughout PART VI of this DEP. These same clauses exist in ISO 10418, Appendix B.8 under a different numbering scheme, and are represented in parenthesis.

Although this Standard is intended for offshore production platforms, it can also be applied to onshore fire tube heaters such as heater treaters and glycol reboilers.

A.6 Fired and Exhaust Heated Components

A.6.2 SAFETY ANALYSIS

A.6.2.1 Safety Analysis Table (ISO 10418, B.8.2.1)

Replace this paragraph by:

For both fired and exhaust heated components, the Safety Analysis Table (SAT) is presented in Table A6.1, which shows the undesirable events that can affect these components (ignition of fuel/air mixture inside/outside firing chamber, loss of process containment), the causes, consequences as well as the detectable abnormal conditions during such events. Additionally, the table also provides the applicable DEM1 requirement clauses within this DEP which will provide the required safeguards to avoid such undesirable events.

A.6.2.2 Safety Analysis Checklist

A.6.2.2.3 Pressure Safety Devices (PSH, PSL, and PSV) (ISO 10418, B.6.2.2.3)


A high and low fuel pressure trip (PSH and PSL) shall be installed that shut off the fuel supply in case the fuel pressure is not between PSL or PSH.

If main flame detection is applied a low fuel pressure trip (PSL) is not required.

The air intake pressure of a forced draft burner should be monitored by a PSL sensor to shut off the fuel supply. Alternatively (and preferentially) a low combustion air flow trip (FSL) may be applied.

A combustion air PSL sensor is not required on a natural draft burner.

Add new section:


Page 60

A.6.2.2.4 Flame Detection Safety Devices (ISO 10418 B.6.2.2.4)

Installation of main flame detectors shall be in line with (Part I, 3.3.5.2 and Part I, 3.4.2) of this DEP.

A.6.3 SAFETY DEVICE LOCATION

A.6.3.2 Flow Safety Devices (FSL and FSV) (ISO 10418, B.6.3.2)

Add to this section:

For heaters that are equipped with multiple passes with forced circulation through these passes and that have both liquid and vapour at the outlet, each pass shall be equipped with an FSL sensor.

A.6.3.3 Pressure Safety Devices (PSH, PSL, and PSV) (ISO 10418, B.6.3.3)

Replace this section with the following text:

A PSL sensor in the air intake of a forced draft burner should be located downstream of the blower. The PSH sensor in the fuel supply line should be located between the last pressure regulator and the burner.

The PSL sensor in the fuel supply line should be located between the last fuel control valve and the burner.

A PSV on the tubes of a tube type heater should be located where it cannot be isolated from the heated section of the tubes.

Figure A-6.2 Recommended Safety Devices – Typical Fired Vessel (Forced Draft) (ISO 10418 Figure B.9)

Correction to figure:

Fuel PSL shall be installed between the last fuel control valve and the burner.

Tables A-6.1, A-6.2 and A-6.3 (ISO 10418 B.11, B.12 and B.13)

Replace these tables with:

Undesirable Event

Consequence CauseDetectable Abnormal

Condition(s)Applicable DEM1 requirements

Accumulation and delayed ignition of fuel/air mixture in firing chamber

Fire / Explosion

which could result in equipment damage, loss of production, loss of life, impact on reputation

Unburned fuel in firing chamber during operation, due to flame out

Common to all burners

Flame failure

Low fuel pressure

High fuel pressure

Forced Draft only

Low air pressure

Low air flow

Common to all burners

Clause 3.3.5.1

Clause 3.3.5.10

Clause 3.3.2 (7th paragraph)

Clause 3.3.5.2 (4th paragraph)

Natural draft burners

Clause 3.3.5.3

Forced draft burners

Clause 3.3.5.2 (1st paragraph)

Clause 3.3.5.5


Page 61

Unburned fuel in firing chamber during start-up

Clause 3.3.2 (last paragraph)

Clause 3.4.1

Loss of process containment

Tube rupture due to overheating of process tubes

Low liquid level

Low flow rate

High process temperature

Clause 3.3.3 (2nd paragraph)

Clause 3.3.3 (5th paragraph)

Ignition outside of firing chamber

Fire/Explosion Hot surfaces and/or flame/spark emission

High stack temperature

API RP 14C Table A-6.1/ISO 10418 Table B.11: Safety Analysis Table (SAT) – Fired and Exhaust Heated Components

API RP 14C Table A-6.2/ISO 10418 Table B8.2.2: Safety Analysis Checklist (SAC) — Fired and Exhaust Heated Components

Add to this table:

n) Firetube heaters shall be provided with overheating protection of the fire tube using dedicated Instrumented Protective Functions (IPF). The fire tube overheating protection such as TSH and LSL shall be active for all operating conditions including start-up.

o) The primary means of providing protection to the fire tube shall be to ensure an adequate liquid level in the vessel together with a sufficient liquid hold-up below the low level trip. When the liquid level drops below the low level (LSL), fuel shall be tripped automatically.

p) The system shall be equipped with a safeguarding system that automatically trips the main fuel in case of a flame failure. Identification of such flame failure may be indirect (by means of a combination of High (PSH) and Low fuel pressure (PSL) trip switches) or direct (by means of flame detection).

q) All IPFs that initiate a trip of fuel to the fire tube shall use latching logic and initiate the signal to the relevant fuel control valves to be forced to zero output (or to their minimum stop position). Latching means there shall be no automatic reset.

r) A remote (if specified by the Contractor) and local manual Emergency Shut-Down (ESD) trip switch shall be installed that closes all fuel (pilot and main). Such a trip is normally required to handle an emergency situation not covered by the heater safeguarding system. All other burner stops shall be achieved via a controlled shutdown procedure. Manual ESD trips shall be hardwired into the BMS.

s) The firebox shall be free of combustibles before ignition. A gas test to check for the presence of combustibles per defined operating procedure shall be carried out each time before lighting the pilot burner.

t) The main burner shall be lit by means of a proven ignition system. This may include continuous pilots, interrupted pilots or retractable high-energy igniters, all of which shall be of proven design and appropriately sized for the application.

u) Flame detectors shall not be equipped with Maintenance Override Switches (MOS) that can override the trip action.


Page 62

v) If specified on the datasheet, the stack shall be equipped with a high stack temperature switch (TSH) (as an indication of fire tube failure) that should be located near the base of the stack.


Page 63

PART VII STANDARD CONTROL AND SAFEGUARDING NARRATIVES AND FUNCTIONAL LOGIC DIAGRAMS

The control and safeguarding narratives and functional logic diagrams that satisfy the requirements as laid down in (Part I, 3) of this document.

The Principal shall inform if the Control and IPF system must follow the narratives and

functional logic diagrams given in this Part VII – and shall indicate which of the Annexes shall be applied.

ANNEX A CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A DUAL FUEL FIRED, FORCED DRAFT, SINGLE BURNER FURNACE/BOILER

ANNEX B CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR AN AUTOMATICALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS

ANNEX C CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR AN AUTOMATICALLY-STARTED, DUAL-FUEL FIRED, FORCED DRAFT, MULTI-BURNER FURNACE

ANNEX D CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A MANUALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS


Page 64

ANNEX A CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A DUAL FUEL FIRED, FORCED DRAFT, SINGLE BURNER FURNACE/BOILER

Annex A provides an example of control systems and instrumented protective functions, cause and effect diagram as well as functional logic diagrams for a dual fuel fired, forced draft, single burner furnace/boiler. This annex may also be used for single fuel fired equipment; if the heater is fired on gas only, all fuel oil related instrumentation may be disregarded, and vice versa. Similarly, it may also be used for a natural draft furnace, in which case all relevant combustion air controls and trips may be disregarded.

This annex shall not be used for multi-burner furnaces/boilers.

This annex shall be used together with Standard Drawings S 24.024 (dual fuel) or Standard Drawing S 24.026 (fuel gas).

A.1 CONTROL SYSTEM IMPLEMENTATION CONSIDERATIONS

If the fuel gas flow controller FRC-1 or fuel oil flow controller FRC-3 is forced to manual with 0 % output (minimum stop) by the Safety PLC, the operator shall not be able to change mode and output.

Anti-reset wind-up (ARWU) protection shall be implemented on the master temperature controller TRC-1 and the oxygen controller QRCA-1.

The actual form of the ARWU protection to be implemented will depend on the choice of DCS vendor and the type of controller algorithm used.

If neither fuel is on cascade, the TRC output shall be initialised to the total fuel flow.

If the combustion air is not on cascade, the oxygen QRC output shall be initialised to the (current) air/fuel ratio.

If the chosen DCS / Controller algorithm supports the use of external feedback as ARWU protection, then external feedback can be configured from Y10 to QRCA. This external feedback improves the response of the oxygen QRCA during changes in load of the furnace. The principle behind this external feedback is as follows:

If the load of the furnace is reduced and the airflow is reacting more slowly than the fuel flow (due to parallel lead / lag control configuration), the external feedback ensures a minimum overshoot. If there were no external feedback, the QRCA would react to the excess air and further reduce the air, thereby resulting in an overshoot when approaching the final steady state value.

If the control scheme is implemented in a DCS which does not support external feedback (i.e. only ARWU is used), the QRCA should be tuned to slow response to minimise the overshoot during transients.

The control scheme is not designed to operate with both fuel flow controllers in cascade mode, due to possible interaction between the two loops. Therefore, when switching over between cascade and automatic modes, both flow controllers should be placed in automatic mode. However, this alone does not ensure a bumpless transfer and therefore the appropriate initialisation techniques shall be configured.

For furnaces with a common stack, the low air/fuel ratio trip is considered to be SIL class 1, which implies that in these cases the low A/F ratio trip shall be implemented in the PLC, with dedicated trip transmitters. For furnaces having their own stack, a too low A/F ratio is


Page 65

expected to lead to little or no damage, for which reason the low A/F ratio trip can be implemented as SIL a (i.e., in DCS) in these cases.


Page 66

A.2 LOCATIONS OF ALARMS, SWITCHES, ETC.

The system is designed so that remote starting and stopping of the gas burner is possible.

Since oil firing requires local presence of the operator (for checking atomisers, steaming out of oil guns, etc.), the oil burner is started and stopped locally.

To enable the operator to start/stop fuel gas from the control room, and to start/stop fuel oil locally, the igniter start/stop button is duplicated (on a local panel as well as in the control room).

The above philosophy is reflected in Standard Drawings S 24.024 and S 24.026.

If specified by the Principal, the fuel gas start/stop button shall be located on the local panel (reasons for this may be to standardize with other furnaces or to comply with local regulations). In this case status indications shall be installed on the local panel as well as in the DCS.

A.3 CALCULATION FORMULAS

The following computing formulae shall be used:

NOTE: The numbering of the Y-blocks corresponds to Standard Drawings S 24.024 and S 24.026.

Y1) If the fuel oil TSOV is closed, the oil flow signal to the total fuel flow summer is zero (Y5, Y6).

NOTE: The measured value is still fed to the fuel oil FRC, so that the operator is informed about possible measurement offsets prior to introducing oil.

Y2) If the fuel gas TSOV is closed, the gas flow signal to the total fuel flow summer is zero (Y4, Y6).

NOTE: The measured value is still fed to the fuel oil FRC, so that the operator is informed about possible measurement offsets prior to introducing gas.

Y3) Corrects fuel gas flow measurement for fuel gas density, and (optionally) for pressure and temperature at the transmitter, and converts it into an equivalent flow in SRF.

The actual formula to be used depends on the type of flow meter (vortex orifice type) as well as the type of density meter (line density or Molecular Weight).

In setting up the actual formulae, the following equations shall be used:

Mair stoichiometric = 14.77 (1+2.68/MW) * Mfuel gas [t/d]

Fuel Gas Density = 12.03 (MW * P / T) [kg/m3]

where:

P = Pressure, bar (abs)

T = Temperature, K

Mfuel SRF = Mair stoichiometric / 13.66 [tSRF/d]

The above formula assumes typical refinery fuel gases, i.e. mixtures of paraffinic hydrocarbons and hydrogen (inerts less than 2 %) and is only valid for MW > 5.

It further assumes the stoichiometric air requirement of SRF to be constant at 13.66 kg air/kg (30.1 lbm air/lbm) SRF.


Page 67

If the anticipated MW variations are less than 20 % of the average molecular weight, a fixed (average) value for MW may be used.

Y4) Output = required (total) fuel flow - gas flow - waste gas flow [t/d SRF]

(see Note 1)

Y5) Output = required (total) fuel flow - oil flow - waste gas flow [t/d SRF]

(see Note 1)

Y6) Output = gas flow + oil flow + waste gas flow [t/d SRF]

(see Note 1)

NOTE 1: Waste gas flow shall only be incorporated in calculations if the heat input by waste gas represents more than 15 % of the total design heat input.

Y7) Sets a minimum limit for the combustion airflow.

Output = 0.95 * Total fuel flow

Y8) Calculates a maximum allowable fuel flow

Output = Mair / ( 0.95 * 13.66 * [0.8 + 0.8 * QRC]) ;

in which: QRC = Output of oxygen controller [signal 0-1]

Mair = Measured airflow [t/d]

The formula limits the air/fuel ratio between 0.8 and 1.6 (times 0.95).

Y9) Calculates the required airflow.

Output = Fuel flow * 13.66 * [0.8+0.8 * QRC]

in which the fuel flow is the master signal or (0.95 * total fuel flow), whichever is higher. The formula limits the air/fuel ratio between 0.8 and 1.6.

Y10) Calculates air/fuel ratio for low alarm and trip.

Output = Mair / (13.66 * Total fuel flow);

Alarm shall be set at a ratio of 1.0.

Trip to minimum firing shall be set at 0.8.

The total fuel flow shall be given a minimum value to avoid "division by zero", which can give spurious alarms when the furnace is out of operation.

Calculation blocks for (optional) feed-forward:

NOTE: Anti-reset wind up of TRC is always required.



For feed-forward from process flow through furnace:

Y12) Output = Fuel Flow / Process Flow

Y13) Output = [process flow] * [TRC output]

For feed-forward from process flow and furnace feed inlet temperature:

Y12) Output = Fuel Flow / Process Flow + k * Tin


Page 68

Y13) Output = [process flow] * {[TRC output] - k * [inlet temperature]}

Where:k = Specific heat process fluid / (fuel LHV * furnace efficiency)

Y16) Low selector to set a maximum to the signal to the fuel flow controllers.

Y17) High selector to set a minimum to the signal to the airflow controller.


Page 69

A.4 DESCRIPTION OF INSTRUMENTED PROTECTIVE FUNCTIONS

The instrumented protective functions described by the functional logic diagrams (Appendix A) and by the IPF narrative as given below shall be applied.

The functional logic diagrams are set up in a modular structure. This Section follows the same structure. However, it only describes the main modules. Assisting modules such as the "general trips" module are not described separately. Their functionality is described in the modules where they are relevant.

A.4.1 Safe atmosphere module

The function of this module is to continuously check for, and if necessary re-establish by purging, a safe atmosphere for firing the furnace.

If: i. the combustion airflow is not low; and

ii. the local and panel trip switches are in the healthy position; and

iii. both main fuel gas TSOVs and the fuel oil TSOV are detected closed (start condition only); and

iv. no flame is detected (start condition only); then

the purge sequence is automatically started.

This initiates the maximum purge timer to start running.

This maximum purge timer is set to give a minimum of 5 complete air changes of the firebox (assuming a minimum combustion airflow of at least 25 %).

If there are no disruptions of the above conditions and after the maximum purge timer has run out, a “safe conditions” indication is given.

If: i. the purge is completed; and

ii. the combustion airflow is not low; and

iii. the local and panel trip switches are in the healthy positions,

a safe atmosphere signal is given to the header modules and to the igniter modules.

If during normal furnace operation any one of the above conditions fails, the safe atmosphere signal disappears. Then a complete new maximum purge is required.

As long as above safe conditions signal remains healthy, no “full purge” cycle is required. However, after any total trip of the furnace (shown in the functional logics by the closing signal to the header TSO valves), the “safe conditions” signal disappears and a ‘short’ purge cycle of 5 min is automatically started via the ‘minimum purge timer’ timer.

Similar to the maximum purge, the minimum purge is only started if no flames are detected and all header and burner TSO valves are detected closed.

If there are no disruptions of the above conditions and after the purge timer has run out, a “safe conditions” indication is given.

During purging a “purge in progress” indication is given.

NOTE: In none of the purge cycles is the airflow changed from its original value.


Page 70

A.4.2 Minimum stop module

The purpose of this module is to control the set and release of the fuel minimum stops.

If:

i. the "not minimum firing" signal from the process (e.g., high temperature trip to minimum firing) is present (where applicable); and

ii. the air/fuel ratio is healthy; and

iii. the fuel gas pressure is not high high; and

iv. the module receives a "gas flame on" signal; then

the fuel gas flow controller can be taken into operation by activating the gas minimum firing reset in the control room.

If:

i. the "not minimum firing" signal from the process (e.g. high temperature trip to minimum firing) is present (where applicable); and

ii. the air/fuel ratio is healthy; and

iii. the fuel oil pressure is not high high; and

iv. the module receives a "oil flame on" signal; then

the fuel oil flow controller can be taken into operation by activating the oil minimum firing reset in the control room.

NB. For furnaces with a common stack, the low air/fuel ratio trip is considered to be SIL class 1, which implies that in these cases the low A/F ratio trip shall be implemented in the PLC, with dedicated trip transmitters.

A.4.3 Igniter module

The function of this module is to monitor all the conditions required to fire and to control the igniter.

If: i. the module does not receive a "burner start inhibit signal"; and

ii. the igniter stop button is not activated; and

iii. there is no high level in the fuel gas KO drum; and

iv. the safe atmosphere module produces a "safe conditions" signal; and

v. the igniter start button is activated; then

the igniter module produces the following signals:

a) open igniter TSOV

b) ignition spark signal for a period of 10 s.

After the flame stabilisation timer has run out (after 15 s), the ignition flame shall be detected by the ionisation rod, and an "ignition flame present" signal is sent to the oil and gas burner modules.

If the igniter start trial was unsuccessful, restart is inhibited for a period dictated by the igniter restart inhibit timer (about 30 s).


Page 71

An indefinite number of restarts of the igniter can be attempted without a new purge cycle being required. It is assumed that the capacity of the igniter is sufficiently low to ensure that the overall gas/air mixture is below the lower explosion limit.

After the igniter has been successfully started, it will run for a maximum period of 15 min It will be automatically stopped by the main burner module 5 s after opening of the oil or gas burner TSOV.

After the main burner has started the igniter can be re-started at any time (for testing purposes). After 15 minutes the igniter is stopped again.

A.4.4 Gas burner module

The function of this module is to monitor all the conditions required to open and close the gas burner TSOVs and to control their actions.

There are two parallel TSOVs to allow tightness testing during operation. By means of a selector switch, either gas header A or gas header B can be selected to be in operation.

If: i. the module receives a "safe conditions" signal; and

ii. the other process conditions are healthy (process trips); and


iv. the "stop gas firing" button is not activated; and

v. the ignition burner is on, or the oil burner is on; and

vi. the "start gas firing" button is activated; then

the module produces the following signals:

a) Open preselected gas burner TSOV. At the same time the output of the gas flow meter is incorporated in the firing and air/fuel ratio control.

b) After the start timer has run out (typically 5 s after the burner TSOV has opened) the module gives a "stop igniter" pulse.

The start timer is set at 5 s. This timer setting shall not be confused with the so-called maximum allowable Trial For Ignition Time. The reason is that in practice all systems should be able to achieve a reliable start-up within 5 s – longer times would only reduce the safety level, and shorter times reduce the robustness of the start system.

If: i. either conditions i to iv fail; or

ii. the main flame is not detected within 5 s; then

the gas burner TSOV closes, and a new purge cycle is required (only if the oil TSOV is not open).

If the gas burner TSOV is open and the main flame is detected, the gas burner module produces a "gas burner on" signal.

The main flame is detected by means of two flame detectors of which at least one has to detect a flame.

A.4.5 Oil burner module

The function of this module is to monitor all the conditions required to open and close the oil burner TSOV and to control its action.

If: i. the module receives a "safe conditions" signal; and

ii. the other process conditions are healthy (process trips); and


Page 72

iii. the atomising steam pressure is not low; and

iv. the "stop oil firing" button is not activated; and

v. the ignition burner is on, or the gas burner is on; and

vi. the "start oil firing" button is activated; then

the module produces the following signals:

a. Open the oil burner TSOV. At the same time the output of the oil flow meter is incorporated in the firing and air/fuel ratio control.

b. After the trial for ignition timer has run out (5 s after the burner TSOV has opened) the module gives a "stop igniter" pulse.

If: i. either conditions i to iv fail; or

ii. the main flame is not detected within 5 s; then

the oil burner TSOV closes, and a new purge cycle is required (only if the gas TSOV is not open).

If the oil burner TSOV is open and the main flame is detected, the oil burner module produces an "oil burner on" signal.

The main flame is detected by means of two flame detectors of which at least one has to detect a flame.

A.4.6 Waste gas firing module (optional)

The function of the waste gas firing module is to monitor all conditions required to open and close the waste gas TSOV(s) and to control this (these) valve(s).

If: i. the module receives a "furnace NOT on minimum stop" signal; and

ii. there is no high level in the waste gas KO drum (if applicable); and

iii. the module receives an "main burner in operation" signal; and

iv. the waste gas firing stop button is not activated; then

the waste gas TSOV to the furnace can be opened by activating the waste gas reset button. Usually the waste gas TSOV to the furnace is operated in conjunction with a vent TSOV (i.e. the vent TSOV is automatically opened when the furnace TSOV is closed).

Once the TSOV is opened, the waste gas flow signal is accounted for in the air/fuel ratio control system (only if the anticipated waste gas flow represents more than 15 % of the total design heat input of the furnace).

A.5 CAUSE AND EFFECT DIAGRAM

The Cause and Effect diagram is given in Table A1.

Table A1 Cause and effect diagram

Initiators Actions

TAG Service Abort/Inhibit start

sequence

Fuel gas TSOVs close

Fuel oil TSOV close

Trip to minimum

firing

Igniter TSOV close

FZA-01-LL Combustion air X x x x x


Page 73

Initiators Actions

XZA-01-LL Air/fuel ratio - - - x -

XZA-11 Flame detection ignition burner

X - - - 0

XZA-13/14 Flame detection main burner

- x x x -

HZA-01/02 Manual trips X x x x x

GBSA-02/03 Fuel gas TSOVs closed

X - - - -

GBSA-01 Fuel oil TSOV closed

X - - - -

LZA-01-HH Fuel gas KO drum

- x - x x

PZA-01-HH Fuel Gas - - - x -

PZA-02-HH Fuel Oil - - - x -

PZA-05-LL Atomising steam - x x x x

Process trips I General - - - x -

Process trips II General - x x x x


Page 74

ANNEX A – APPENDIX A FUNCTIONAL LOGIC DIAGRAMS FOR A SINGLE BURNER FURNACE

t = X sec

t 0

t = X sec

0 t

t = X sec

t = X sec

t = X sec

1

in

out

in

out

in

out

in

out

in

out

0 X 0 XDelay-on

Delay-off

Pulse-up (not-resettable)

Pulse-down (resettable)

Pulse-up (resettable)

xy

TagService

Input symbols

x Physical condition corresponding to alogical ‘1’ at (a)

y Physical condition corresponding to alogical ‘1’ at (a)

(a)

x Physical condition corresponding to alogical ‘1’ at (b)

y Physical condition corresponding to alogical ‘1’ at (b)

(b) x

yTagService

Output symbols

Logical symbols

& AND gate : Output is ‘1’ in case all inputs are ’1'

> OR gate : Output is ‘1’ in case at least one input is ’1'

Invertor : Output is ‘1’ when input is ‘0’ and vice versa

& AND gate with inverted input

Explanation of logic symbols SYMBOLS

Timers

x-yz

Transfer Indicators

Signal y from sheet x is transferred to sheet z


Page 75


Page 76

FURNACE SAFEGUARDING LOGICSLogics 24Sheet 0

Furnace safeguarding logics for single burner furnace

References:

S24.024:Fuel oil and fuel gas system for a single burner heater or boiler

S24.026:Fuel gas system for a single burner heater or boiler

Note:When these logics are used for a single fuel system, e.g. gas only,the relevant fuel oil signals must be disregarded / deleted whereapplicable.

Sheets:

1. Safe atmosphere3. General trips4. Minimum stop8. Fuel gas TSOV selection

12. Igniter13. Fuel gas burner14. Fuel oil burner15. Flame detection

99. Status indications, alarms, switches


Page 77

Logics for a dual fuel fired, single burner furnace - Safe atmosphereLogics 24Sheet 1

15-11

Flame detected

HZ-1Local trip

&On Status

“Purge inprogress”Off

ON

OFF

Status“Safeconditions”

3-11

Combustion airflow healthy

>

Safeconditions

14-11

13-11

Open oilheader TSOV

Open gas headerTSOV

>&

t = purge time

t 0

t = 2 sec

>

&

>

t = 5 minutes

t 0

&

Maximum purge timer

Minimum purge timer

&

>

&

8-11

8-41

Fuel gas TSOV Bdetected closed

Fuel gas TSOV Adetected closed

14-71

Fuel oil TSOVdetected closed

1-414

1-212

1-113

t = 4 sec

0 t

HZ-2 ControlRoom trip


Page 78

Logics for a single burner furnace - General tripsLogics 24Sheet 3

3-614MOS

MOS

PZA-05Steam headerpressure

LZA-01Fuel gasKO drum

3-412

3-513

> LL

< HH

ON Alarm “Lowatom.steam press.”OFF

ON Alarm"High levelKO drum”OFF

(NOT) lowatom. steam

>

>Not high levelfuel gas KO

drum

MOS3-84

PZA-01Fuel gaspressure

< HH ON Alarm “Highfuel gaspressure”OFF

> No high highfuel gas pressure

MOS 3-74

<HHPZA-02Fuel oilpressure

ON Alarm “Highfuel oilpressure”OFF

> No high highfuel pressure

MOS

MOS

3-34

3-11>

FZA-02Combustionair flow

> LL

ON Alarm"Low A/Fratio”OFF

ON Alarm“Low comb.air flow”OFF

>

FT-03Fuel Gasflow

QT-03Fuel GasDensity

FT-04Fuel Oil flow

CalculationBlock t = 10 sec

0 t

No low low A/F ratio

No low lowcombustion air flow

NB. Dedicated transmitters in PLC only required in case low A/F ratio trip has to beimplemented as SIL class I (typically only for furnaces with common stacks)


Page 79

Logics for a single burner furnace - Minimum stopLogics 24Sheet 4

HS-2 Resetgas firingminimum stop

3-34

14-64

&

EXT

Not minimumfiring (fromprocess)

Gas flame on

A/F ratio healthy

HS-6 Reset oilfiring min. stop

>

>

&

ON Status “Fuel oilon min. stop”OFF

ON Status “Fuelgas on min.stop"OFF

Fuel gas FRCmanual 0 %MN

Fuel gas min.stop solenoidMN

MN

Fuel oil min.stop solenoid


Oil flame on

(via 30 sec ramp)

Fuel oil FRCmanual 0 %MN

EXT

13-64

DCS

DCS

t = 30 sec

0 t

t = 30 sec

0 t

(via 30 sec ramp)

3-84

No high highfuel gas pressure

3-74

No high highfuel pressure


Page 80

Logics for a single burner furnace - Fuel gas TSOV selectionLogics 24Sheet 8

CGBSA-03 FGheader Blimit switch

HS-3 FGheader valveselection

MOS

Open fuel gasheader

ON Status “FGheader A inuse”OFF

ON Alarm “FGheader Bclosing failure”OFF

ON Alarm “FGheader Aclosing failure”

O Fuel gasheader BC

GBSA-02 FGheader Alimit switch

13-28

MOS

8-11

Gas header Bdetected closedOR open signalpresent

8-41

Gas header Adetected closedOR open signalpresent

ON Status “FGheader B in

use”OFF

O Fuel gasheader AC

OFF

t = 10 sec

t = 10 sec

C

A

B

>

>

0 t

0 t

>

&

&

&

>

&

>

>t = 15 sec

0 t

t = 2 sec

t 0

t = 2 sec

t 0

t = 15 sec

0 t


Page 81

Logics for a single burner furnace - IgniterLogics 24Sheet 12

13-412

Stop igniter(gas burner)

&

3-412

Stop igniter(oil burner)

&

>

O IgniterTSOC

1-212

Not high levelfuel gas KO drum

&

>

ON Status“Igniter on”OFF

Safe conditions

12-114

12-213

Igniter present

14-412

HS-17Start igniter

HS-11Start igniter

HS-18Stop igniter

HS-12Stop igniter

XZA-11Flame rodigniter

> LL

ON SparkerigniterOFF

t = 30 sec

t = 15 sec

t = 10 sec

Igniter start timer

Igniter startinhibit timer

Spark timer

Max igniteroperation timer &

t = 15 min

t 0

1


Page 82

Logics for a single burner furnace - Fuel gas burnerLogics 24Sheet 13

Open gas TSO

13-412

(NOT) stopigniter

>

13-514

ON Status“Fuel gasflame on”OFF

Gas flame on

HS-13Start fuel gasfiring

HS-14Stop fuelgas firing

14-513

12-213

EXT

3-513

1-113

15-213

&

t = 5 sec

>

>

&

&

Oil flame on

Igniter on

Process trips

No high level infuel gas KO drum

Safe conditions

Flame detected

t = 2 sec

13-64

13-11 Open gas TSO

13-28

1

Burner start timer

Stop igniter


Page 83

Logics for a single burner furnace - Fuel oil burnerLogics 24Sheet 14

13-514

Gas flame on

CGBSA-05FO-TSOVlimit switch

>

>

ON Alarm"Oil TSOVclosing failure"OFF

EXTProcess tripsO

Fuel oil TSOVC

3-614

Atom. Steampressure not low

1-414

Safe conditions

>

ON Status"Fuel oil flameon"OFF

&

14-64

Igniter on

HS-15Start fuel oilfiring

HS-16Stop fuel oilfiring

Flame detected

Oil TSOVdetected closedOR open signalpresent

(NOT) stopigniter

Oil flame on

&

t = 5 sec

t = 2 sec

MOS

12-114

15-314

14-71

14-412

14-513

Burner start timer

Stop igniter

14-11

Open oil TSOV

&

>

>

1

t = 2 sec

t 0


Page 84

Logics for a single burner furnace - Flame detectionLogics 24Sheet 15

ON Status flamedetector 1failureOFF

>LLXZA-02Flamedetector 1

15-314

15-11 flame detected

>

ON AlarmNo flamedetectedOFF

15-213

ON Status:Flame detector 2failureOFF

>LLXZA-03Flamedetector 2


Page 85

Logics for a single burner furnace - status lights, alarms, switchesLogics 24Sheet 99

HS-2 HS-3

HS-6

HS-15

HS-11 HS-12

HS-13 HS-14

HS-17

LOCAL PANEL (for oil firing only)

HS-16

HS-18

Safe conditions

Purge in progressLow combustion

air flow

Air / fuel ratio low

High level fuelgas KO drum

Fuel gas onminimum stop

Reset fuel gasminimum stop

Fuel gas header Bselected

Fuel gas header Bclosing failure

Gas header selector

Fuel gas header Aselected

Fuel gas header Aclosing failure

Reset fuel oilminimum stop

Fuel oil onminimum stop

Fuel oil headerclosing failure

Steam headerlow pressure

No flame detected

Flame detector 1 Flame detector 2

Start igniter

Igniter on

Stop igniter

Start gas firing

Gas flame on

Stop gas firing

Oil flame on

Flame detector1 Flame detector 2

Start igniter Stop igniter

Igniter startinhibited

Oil flame on

Igniter on Gas flame on

Start oil firing Stop oil firingHS-15

HS-17

HS-16

HS-18

Flame detector 1 Flame detector 2

Start igniter Stop igniter

Oil flame on

Igniter on Gas flame on

Start oil firing Stop oil firing

LOCAL PANEL (for oil only firing)


Page 86

ANNEX B CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR A AUTOMATICALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS

Annex B provides an example of control systems and instrumented protective functions, cause and effect diagram as well as functional logic diagrams for an automatically started, gas fired, natural draft, multi-burner furnace, safeguarded by pilot burners. This annex shall not be used for any other equipment or firing configuration.

This annex shall be used together with Standard Drawing S 24.033.

B.1 CONTROL SYSTEM IMPLEMENTATION CONSIDERATION

The minimum fuel gas pressure controller (PIC-1) shall be locked in auto mode. The operator may be given limited control over the setpoint of the minimum pressure controllers (PIC-1) up to 2 times the minimum pressure. The latter flexibility is sometimes useful to prevent flame loss due to too low a pressure when manipulating burners. Changes to critical fuel set points shall be done through a Management of Change (MOC) process.

The minimum pressure controllers (PIC-1) shall be fast-acting (similar to compressor anti-surge controllers).

If the normal fuel gas pressure controller PIC-2 is forced to manual with 0 % output (minimum stop), the operator shall not be able to change mode or output.

For furnaces with 3 or more burners, equal percentage valves shall be used so that the performance of the (minimum stop) pressure controller is independent on the number of burners in operation.

The interfacing between the instrumented protective system and the DCS shall be hard-wired for those connections which are safety related (no serial link). This applies for example to the force to minimum stop. Although the latter is classified as IPF class II, a delay (related to the serial link) may finally result in another trip initiator to initiate a total furnace trip.

The Anti Reset Wind-Up (ARWU) to the fuel PICs is present to ensure bumpless transfer when one controller overrides another.

ARWU protection shall also be implemented on the master temperature controller TRC-1.

B.2 LOCATIONS OF ALARMS, SWITCHES, ETC.

The system is designed such that remote starting and stopping of burners is possible. i.e., all pilot and main burner start/stop switches are located in a DCS panel in the main control room.

The above philosophy is reflected in Standard Drawing S 24.033.

If specified by the Principal, the fuel gas start/stop buttons shall be located on the local panel. (Reasons for this may be to standardize with other furnaces or to comply with local regulations). In this case status indications shall be installed on the local panel as well as in the DCS.

B.3 DESCRIPTION OF INSTRUMENTED PROTECTIVE FUNCTIONS

The IPFs described by the functional logic diagrams (Appendix B) and by the IPF narrative given below shall be applied.


Page 87

The functional logic diagrams are set up in a modular structure. This section follows the same structure but only describes the main modules. Assisting modules such as the "general trips" module are not described separately. Their functionality is described in the modules where they are relevant.

B.3.1 Safe atmosphere module


If: i. no flame is detected (start condition only); and

ii. the fuel gas header TSOVs, the pilot header TSOV and the individual main burner TSOVs are closed; and

iii. burner TSOV testing is not in progress; and

iv. the local and panel trip switches are in the healthy position; and

v. the level in the fuel gas KO drum is not high; and

vi. the “no purge required signal” from the pilot header module is healthy;

vii. the PZA-LL is indicating <LL; and

viii. the "safe conditions" signal is not present; then

the purge timer starts automatically.

If there were no interruptions to the above conditions and after the timer has run out, a “safe conditions” indication is given.

The “safe conditions” signal remains healthy as long as conditions iv to vi remain healthy.

B.3.2 Minimum stop module

The purpose of this module is to control the set and release of the fuel minimum stops.

If: i. the "not minimum firing" signal from the process is present (where applicable) and

ii more than N/2 burners are in operation (in which N is the total number of installed burners); and

iii. the fuel gas pressure is not above "high-high"; and

iv. the module is not set to minimum by the sequence controller (optional); then

the main fuel gas pressure controller (PIC-1) can be taken into operation by activating the gas minimum firing reset in the control room, or, via an external signal from e.g. a sequence controller.

If, 30 seconds after a trip to minimum firing, the fuel gas pressure is not below 4 times the set pressure of the minimum stop, the module produces a "failure trip to minimum firing" signal to the fuel gas header module.

An alternative to the reset button is that the “force to manual”, zero output remains on until conditions (i) through (iv) are healthy.

B.3.3 Pilot header module

The function of this module is to monitor all the conditions required to open and close the pilot header TSOV and to control this valve.

If: i. the safe atmosphere module produces the "safe conditions" signal; and


Page 88

ii. pilot gas pressure is above LL (to be healthy within 10 seconds after opening of the TSOV); and

iii. at least one of the pilot burner modules produce a “open pilot burner header” signal; then

the pilot header TSOV will remain open.

Upon closing the pilot header TSOV, the “no purge required” signal disappears for a short period.

If the header TSOV proximity switch (GBSA-04) does not indicate the valve being closed within 15 seconds after initiating the valve to close, a “TSOV not closed” alarm is given.

B.3.4 Fuel gas header and vent module

The function of this module is to monitor all the conditions required to open and close the fuel gas header and vent TSOVs and to control these valves.

There are two parallel TSOVs to facilitate tightness testing during operation. By means of a selector switch either gas header A or gas header B can be selected to be in operation.


ii. other process conditions (process trips) are healthy; and

iii. the stop gas firing switch is not activated; and

iv. the fuel gas pressure is not below LL, or the burner TSOVs are closed; and

v. the "(NOT) failure to minimum stop" signal is healthy; and

vi. the fuel gas control valve is in the start position or any burner TSOV is open; then

the gas header module produces a "healthy for gas firing" signal for the gas burner modules.

If the gas header module receives at least one "open gas header" signal from the gas burner modules the pre-selected gas header is automatically opened and the vent TSOV is automatically closed.

If one of the above conditions fails to exist the gas header TSOV closes, the vent TSOV opens and the "healthy for gas firing" signal disappears. If all "open gas header" signals from the gas burner modules disappear the gas header TSOV closes also.

If the vent TSOV proximity switch (GBSA-09) does not indicate the valve being closed within 15 seconds after initiating the valve to close, an alarm is given.

If the header TSOV proximity switch (GBSA-02/03) does not indicate the valve being closed within 15 seconds after initiating the valve to close, an alarm is given.

If, after all main gas burners are stopped, the control valve is not in its start position within 15 seconds, a "control valve not in start position" alarm is given.

B.3.5 Pilot burner modules

Each pilot burner is equipped with its own pilot burner module.

The function of these modules is to monitor all the conditions required to fire the individual pilots and to control the pilots.

If: i. the module receives a ‘safe conditions’ signal; and

ii. the pilot burner stop button is not activated; then


Page 89

the pilot can be started by activating the pilot start button.

The module than produces the following signals:

a. open pilot header

b. open pilot TSOV

c. ignition spark signal for a period of 10 seconds.

After the flame stabilisation timer has run out (after 15 seconds) the pilot flame shall be detected by the ionisation rod, and a "pilot flame present" signal is sent to the respective main burner module.

If the pilot start trial was unsuccessful, restart is inhibited for a period dictated by the pilot restart inhibit timer (about 30 seconds).

B.3.6 Gas burner modules

Each burner is equipped with its own gas burner module.

The function of these modules is to monitor all the conditions required to open and close the gas burner TSOVs and to control their actions.

If: i. the gas burner module receives a "healthy for gas firing" signal; and

ii. the gas burner stop button is not activated; and

iii. the module receives a "pilot on" signal; then

the gas burner can be started by activating the main burner start signal. The gas burner module produces the following signals:

a. Open gas burner TSOV.

b. "Open gas header" signal to the fuel gas header module.

If: i. the "healthy for gas firing" signal remains present; and

ii. the gas burner stop button is not activated (or no external stop signal is produced); and

iii. the “pilot flame present” signal remains healthy; then

the module produces a "gas flame on" signal.

If one of the above conditions fails to exist the gas burner TSOV is closed and the "open gas header" signal disappears. If no other gas burner modules produce an "open gas header" signal the gas header TSOV is closed and the vent TSOV opened.

If the gas burner TSOV proximity switch (GBSA-14-N4) does not indicate the valve being closed within 15 seconds after initiating the valve to close, an alarm is given.

B.3.7 Burner TSOV tightness test module

To be able to test the tightness of the individual burner gas TSOVs during shutdown or when firing only oil, the gas header TSOV can be opened for a short period by pressing HS-9.

Pressing this button will only result in opening of the header TSOV, if:

i. All gas burner TSOVs are confirmed closed; and

ii. Neither the "purge ready" signal, nor the "purge in progress" signal is present.


Page 90

If these conditions are valid and HS-9 is activated, the header TSOV is opened for about 5 seconds. The vent is closed at the same time and kept closed during the test. During the whole testing period starting is interlocked via the "inhibit start" signal to the safe atmosphere module.

After the testing period has expired (normally about 5 minutes) the vent is opened and the "inhibit start" signal disappears.

B.3.8 Waste gas firing module


Two configurations are possible, dependent on the anticipated heat input of the waste gas:

B.3.8.1 Waste gas heat input not more than 15 % of design

If the anticipated waste gas flow represents less than 15 % of the total design heat input of the furnace, the waste gas to all burners is supplied via one common TSOV.



iii. the module receives an "all burners in operation" signal; and


the waste gas TSOV to the furnace can be opened by activating the waste gas reset button. Usually the waste gas TSOV to the furnace is operated in conjunction with a vent TSOV (i.e. the vent TSOV is automatically opened if the furnace TSOV is closed).

The individual burners are equipped with manually operated valves. If short-term venting to atmosphere cannot be accepted (e.g. when burner guns are being cleaned), the manual valves shall be equipped with proximity switches which can be used to override the relevant flame detector signal (i.e., if the waste gas cock on a burner is detected closed, the waste gas TSOV is not tripped when this burner is taken out of operation).

B.3.8.2 Waste gas heat input more than 15 % of design

If the anticipated waste gas flow represents more than 15 % of the total design heat input of the furnace, the burners are equipped with individual waste gas TSOVs in addition to the common waste gas TSOV.

A. Common waste gas TSOV module



iii. the waste gas firing stop button is not activated; then

the module produces a "healthy for waste gas firing" signal to the individual waste gas burner modules.

If at least N/2 waste gas burner TSOVs are opened the common TSOV can be opened by activating the waste gas firing reset button.

If any of the conditions i to iii fail to exist or if the "at least N/2 waste gas burner TSOVs open" signal disappears, the common TSOV closes again.

Usually the common waste gas TSOV to the furnace is operated in conjunction with a vent TSOV (i.e., the vent TSOV is automatically opened if the furnace TSOV is closed).


Page 91

B. Burner waste gas TSOV module

If: i. the module receives a "healthy for waste gas firing" signal; and

ii. the module receives a "main burner on" signal; and

iii. the waste gas burner stop switch is not activated; then

the TSOV can be opened by activating the start waste gas burner reset button.

B.4 IPF CLASSIFICATION AND CAUSE AND EFFECT DIAGRAM

The Cause and Effect diagram is given in Table B.1


Page 92

Table B.1 Cause and effect diagram

Initiators Actions1)

TAG Service Abort/ Inhibit start sequence

Header fuel gas TSOVs close

Vent fuel gas TSOV open

Trip to minimum

firing fuel gas

Header pilot

TSOV close

Main fuel gas burner TSOV close

Pilot burner TSOV close

PZA-04-LL Pilot gas - X X X X X X

PZA-01a-HH Fuel gas - - - X - - -

PZA-01b-H Fuel gas X X3) X 3) X 3) - X 3) -

PZA-03-LL Fuel gas - X X - - X -

HZA-01/02 Manual trips X X X X X X X

LZA-01HH Fuel gas KO drum - X X X X X X

GBSA-01-S Fuel gas control valve in start position

X - - - - - -

GBSA-02/03-C Fuel gas header TSOVs closed

X - - - - - -

GBSA-04-C Pilot gas header TSOV closed

X - - - - - -

Process I General process trips2) - - - X - - -

Process II General process trips - X X X X X X

GBSA-14-C Vent TSOV closed - - - - - - -

XZA-11-n1 Pilot flame detection - - - X X X X

GBSA-14-n4-C Gas burner TSOV closed

X - - - - - -

> N/2 burners lit Burner count - - - X - - -

NOTES: 1) - = No action

X = Unclassified, but serves purpose in sequence control.

2) It is assumed that if the (process I) trip to minimum firing does not effectuate, a process II trip is automatically initiated (e.g. if an outlet temperature remains too high for too long a period).

3) High fuel pressure only initiates a total trip in case of failure of trip to minimum firing.

4) Trip to minimum firing implemented, in case of failure of this trip, a total trip will follow.


Page 93

ANNEX B - APPENDIX A FUNCTIONAL LOGIC DIAGRAMS FOR AN AUTOMATICALLY STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE


Page 94


Page 95


Page 96


Page 97


Page 98


Page 99


Page 100


Page 101


Page 102


Page 103


Page 104

ANNEX C CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAMS FOR AN AUTOMATICALLY-STARTED, DUAL-FUEL FIRED, FORCED DRAFT, MULTI-BURNER FURNACE

Annex C provides an example of control systems and instrumented protective functions, cause and effect diagram as well as functional logic diagrams for an automatically-started, dual-fuel fired, forced draft, multi-burner furnace/boiler without individual air shut-off dampers. This annex may also be used for a furnace firing one fuel only, i.e. if the furnace is fired on gas only, all fuel oil related instrumentation may be disregarded, and vice versa. It shall not be used for single burner systems or natural draft furnaces/boilers.

This annex shall be used together with Standard Drawing S 24.030 (dual fuel) or Standard Drawing S 24.034 (fuel gas).

C.1 CONTROL SYSTEM IMPLEMENTATION CONSIDERATIONS

Both minimum and maximum fuel gas pressure controllers for both fuels (PIC-1, PIC-2, PIC-3 and PIC-4) shall be locked in auto mode. The operator shall not be able to change the setpoint of the maximum pressure controllers (PIC-2 and PIC-4). The operator may be given limited control over the setpoint of the minimum pressure controllers (PIC-1 and PIC-3) up to 2 times the minimum pressure. The latter flexibility is sometimes useful to prevent flame loss due to too low a pressure when manipulating burners.

The minimum and maximum pressure controllers (PIC-1, PIC-2, PIC-3 and PIC-4) shall be fast-acting (like compressor anti-surge controllers).

If the fuel gas flow controller FRC-1 or fuel oil flow controller FRC-3 is forced to manual with 0 % output (minimum stop), the operator shall not be able to change mode or output.

If the QRCA (oxygen controller) is forced to manual, it shall retain its last output setting unless manually changed by the operator.

For furnaces with 3 or more burners, equal percentage valves shall be used so that the performance of the (minimum stop) pressure controller is independent of the number of burners in operation.

The Anti Reset Wind-Up (ARWU) to the fuel FRCs and the minimum and maximum pressure controllers is provided to ensure bumpless transfer when one controller overrides another.

ARWU protection shall also be implemented on the master temperature controller TRC-1 and the oxygen controller QRCA-1.

If neither fuel is on cascade, the TRC output shall be initialised to the total fuel flow.

If the combustion air is not on cascade, the oxygen QRC output shall be initialised to the (current) air/fuel ratio.

If the chosen DCS/controller algorithm supports the use of external feedback as ARWU protection, then external feedback can be configured from Y10 to QRCA. This external feedback improves the response of the oxygen QRCA during changes in load of the furnace. The principle behind this external feedback is as follows:

If the load of the furnace is reduced and the airflow is reacting more slowly than the fuel flow (due to parallel lead/lag control configuration), the external feedback ensures a minimum overshoot. If there were no external feedback, the QRCA would react to the


Page 105

excess air and further reduce the air, thereby resulting in an overshoot when approaching the final steady state value.

If the control scheme is implemented in a DCS which does not support external feedback (i.e. only ARWU is used), the QRCA should be tuned to slow response to minimise the overshoot during transients.

The control scheme is not designed to operate with both fuel flow controllers in cascade mode, due to possible interaction between the two loops. Therefore, when switching over between cascade and automatic modes, both flow controllers should be placed in automatic mode. However, this alone does not ensure a bumpless transfer and therefore the appropriate initialisation techniques shall be configured.

For furnaces with a common stack, the low air/fuel ratio trip is considered to be SIL 1 (see C.4.5), which implies that in these cases the low A/F ratio trip shall be implemented in the safety PLC, with trip transmitters separate from control. For furnaces having their own stack, a too low A/F ratio is expected to lead to little or no damage, for which reason the low A/F ratio trip can be implemented as an automatic action in the DCS with the transmitters shared between control and trip (SIL a) in these cases. The low A/F ratio trip however shall not be implemented as an alarm only.

C.2 LOCATIONS OF ALARMS, SWITCHES, ETC.

The system is designed so that remote starting and stopping of gas burners is possible.

Since oil firing requires the local presence of the operator (for checking atomisers, steaming out of oil guns, etc.), oil burners are started and stopped locally.

To enable the operator to start/stop fuel gas from the control room, and to start/stop fuel oil locally, the igniter start/stop buttons are duplicated for dual fuel systems (on a local panel as well as in the control room).

If specified by the Principal, the fuel gas start/stop buttons shall be located on the local panel. (The reason for this may be to standardize with other furnaces or to comply with local regulations). In this case, status indications shall be installed on the local panel as well as in the DCS.

C.3 CALCULATION FORMULAE

The following computing formulae shall be used:

NOTE: The numbering of the Y-blocks corresponds to Standard Drawings S 24.030 and S 24.034.

Y1) If the fuel oil TSOV is closed, the oil flow signal to the total fuel flow summer is zero (Y5, Y6).

NOTE: The measured value is still fed to the fuel oil FRC, so that the operator is informed about possible measurement offsets prior to introducing oil.

Y2) If the fuel gas TSOV is closed, the gas flow signal to the total fuel flow summer is zero (Y4, Y6).

NOTE: The measured value is still fed to the fuel oil FRC, so that the operator is informed about possible measurement offsets prior to introducing gas.

Y3) Corrects fuel gas flow measurement for fuel gas density, and (optionally) for pressure and temperature at the transmitter, and converts it into an equivalent flow in SRF.


Page 106

The actual formula to be used depends on the type of flow meter (vortex or orifice type) as well as the type of density meter (line density or Molecular Weight).

In setting up the actual formulae, the following equations shall be used:

Mair stoichiometric = 14.77 (1+2.68/MW) * Mfuel gas [t/d]

Fuel Gas Density = 12.03 (MW * P / T) [kg/m3]

where:

P = Pressure, bar (abs)

T = Temperature, K

Mfuel SRF = Mair stoichiometric / 13.66 [tSRF/d]

The above formula assumes typical refinery fuel gases, i.e. mixtures of paraffinic hydrocarbons and hydrogen (with inerts less than 2 %) and is only valid for MW > 5.

It further assumes the stoichiometric air requirement of SRF to be constant at 13.66 kg air/kg (30.1 lbm air/lbm) SRF.

If the anticipated Molecular Weight (MW) variations are less than 20 % of the average molecular weight, a fixed (average) value for MW may be used.

Y4) Output = required (total) fuel flow - gas flow - waste gas flow [t/d SRF]

(see Note 1)

Y5) Output = required (total) fuel flow - oil flow - waste gas flow [t/d SRF]

(see Note 1)

Y6) Output = gas flow + oil flow + waste gas flow [t/d SRF]

(see Note 1)

NOTE 1: Waste gas flow shall only be incorporated in calculations if the heat input by waste gas represents more than 15 % of the total design heat input.

Y7) Sets a minimum limit for the combustion airflow.

Output = 0.95 * Total fuel flow

Y8) Calculates a maximum allowable fuel flow

Output = Mair / ( 0.95 * 13.66 * [0.8 + 0.8 * QRC]) ;

in which:

QRC = Output of oxygen controller [signal 0-1]

Mair = Effective Airflow - modified according to number of burners in operation

(output of Y19) [t/d]

The formula limits the air/fuel ratio between 0.8 and 1.6 (times 0.95).

Y9) Calculates the required airflow.

Output = Fuel flow * 13.66 * [0.8+0.8 * QRC]

in which the fuel flow is the master signal or (0.95 * total fuel flow), whichever is higher.

The formula limits the air/fuel ratio between 0.8 and 1.6.

Y10) Calculates air/fuel ratio for low alarm and trip.


Page 107

Output = Mair / (13.66 * Total fuel flow) ;

Mair = Effective Airflow - modified according to number of burners in operation

(output of Y19) [t/d]

Alarm shall be set at a ratio of 1.0.

Trip to minimum firing shall be set at 0.8.

The total fuel flow shall be given a minimum value to avoid "division by zero", which can give spurious alarms when the furnace is out of operation.



For feed-forward from process flow through furnace:

Y12) Output = Fuel Flow / Process Flow

Y13) Output = [process flow] * [TRC output]

For feed-forward from process flow and furnace feed inlet temperature:

Y12) Output = Fuel Flow / Process Flow + k * Tin

Y13) Output = [process flow] * {[TRC output] - k * [inlet temperature]}

Where:k = Specific heat process fluid / (fuel LHV * furnace efficiency)

Y16) Low selector to set a maximum to the signal to the fuel flow controllers.

Y17) High selector to set a minimum to the signal to the airflow controller.

Calculation blocks for correction of not-operated burners:

Y18) Output = Required airflow (Nburners installed / Nburners in operation)

Required airflow equals output Y9.

Nburners in operation 1

Y19) Output = Required airflow (Nburners in operation / Nburners installed)

Nburners in operation 1

C.4 DESCRIPTION OF INSTRUMENTED PROTECTIVE FUNCTIONS

The IPFs described by the functional logic diagrams (Appendix C) and by the IPF narrative given below shall be applied.

The functional logic diagrams are set up in a modular structure. This Section follows the same structure but only describes the main modules. Assisting modules such as the "general trips" module are not described separately. Their functionality is described in the modules where they are relevant.

C.4.1 Safe atmosphere module


If: i. the combustion airflow is not low; and

ii. the local and panel trip switches are in the healthy position; and


Page 108

iii. the fuel oil and fuel gas header TSOVs and the individual main burner TSOVs are detected closed (start condition only); and

iv. no flame is detected (start condition only); then

the purge sequence is automatically started.

This initiates the maximum purge timer to start running.

This maximum purge timer is set to give a minimum of 5 complete air changes of the fire box (assuming a minimum combustion airflow of at least 25 %).

If there are no disruptions of the above conditions and after the maximum purge timer has run out, a "safe conditions" indication is given.

If: i. the purge is completed; and

ii. the combustion airflow is not low; and

iii. the local and panel trip switches are in the healthy positions,

a safe atmosphere signal is given to the header modules and to the igniter modules.

If during normal furnace operation any one of the above conditions fails, the safe atmosphere signal disappears. Then a complete new maximum purge is required.

As long as above safe conditions signal remains healthy, no “full purge” cycle is required. However, after any total trip of the furnace (shown in the functional logics by the closing signal to the header TSO valves), the “safe conditions” signal disappears and a “short” purge cycle of 5 min is automatically started via the “minimum purge timer” timer.

Similar to the maximum purge, the minimum purge is only started if no flames are detected, the airflow is healthy and all header and burner TSO valves are detected closed.

If there are no disruptions of the above conditions and after the purge timer has run out, a “safe conditions” indication is given.

During purging a “purge in progress” indication is given.

NOTE: In none of the purge cycles the airflow is changed from normal.

C.4.2 Minimum stop module

The system is equipped with a minimum pressure controller, which is set to ensure stable flames under minimum heat demand conditions. Since in most cases minimum stable flame conditions can be reached with 25 % firing duty, the set point of the minimum pressure controller is typically set to give 25 % firing duty.

Initial burner operation is always accomplished at minimum load. The purpose of the minimum stop module is to control the set and release of the fuel minimum pressure controller.

If: i. the “not minimum firing” signal from the process is present (where applicable)

and

ii the air/fuel ratio is healthy; and

iii the module receives any “gas flame on” signal; and

iv the fuel gas pressure is not above “high-high”; and

v more than N/2 burners are in operation (in which N is the total number of installed burners); then


Page 109

the fuel gas FRC can be taken into operation by activating the gas minimum firing reset in the control room.

If, 30 s after a trip to minimum firing, the fuel gas pressure is not below 4 times the set pressure of the minimum stop, the module produces a “failure trip to minimum firing” signal to the fuel gas header module.

If: i. the “not minimum firing” signal from the process is present (where applicable)

and

ii the air/fuel ratio is not low; and

iii the module receives any “oil flame on” signal; and

iv the fuel oil pressure is not above “high-high”; and

v more than N/2 burners are in operation (in which N is the total number of installed burners); then

the fuel oil FRC can be taken into operation by activating the oil minimum firing reset in the control room.

If, 30 s after a trip to minimum firing, the fuel oil pressure is not below 4 times the set pressure of the minimum stop, the module produces a “failure trip to minimum firing” signal to the fuel oil header module.

NOTE: For furnaces with a common stack, the low air/fuel ratio trip is considered to be SIL class 1, which implies that in these cases the low A/F ratio trip shall be implemented in the PLC, with dedicated trip transmitters.

C.4.3 Igniter header module

The function of this module is to monitor all the conditions required to open and close the igniter header TSOV and to control this valve.

The igniter header TSOV is fully governed by the igniter modules. As long as one of the igniter burner modules produces an "open igniter header" signal, the igniter TSOV is open.

C.4.4 Fuel gas header and vent module

The function of this module is to monitor all the conditions required to open and close the fuel gas header and vent TSOVs and to control these valves.

There are two parallel TSOVs to facilitate tightness testing during operation. By means of a selector switch either gas header A or gas header B can be selected to be in operation.




iv. the stop gas firing switch is not activated; and


vi. the fuel gas control valve is in the start position or any gas flame is on; then

the gas header module produces a "healthy for gas firing" signal for the gas burner modules.

If the gas header module receives at least one "open gas header" signal from the gas burner modules, the pre-selected gas header is automatically opened and the vent TSOV is


Page 110

automatically closed. At the same time the output of the gas flow meter is incorporated in the firing and air/fuel ratio control.

The control valve shall remain in its start position for at least 20 s. If any one of the other above conditions (i to v) fails the gas header TSOV closes, the vent TSOV opens and the "healthy for gas firing" signal disappears. If all "open gas header" signals from the gas burner modules disappear, the gas header TSOV closes also.

NOTE: If the control valve is installed downstream of the TSO valves, the minimum pressure controller PIC-1 is forced to manual 0 % if the “open gas header” signal is not available. As soon as the “open gas header” signal becomes healthy, PIC-1 is forced to manual, x % opening for a period of 10 s. Thereafter PIC-1 is permanently forced to automatic, with minimum setpoint as required for the burners, whilst maintaining a minimum output limit of x %.

“x” is the minimum opening to achieve a reliable and safe start on the first burner to be started (this opening corresponds to the mechanical minimum stop setting). This opening shall give a higher pressure than that is obtained with the minimum pressure controller (with one burner in operation).

When the gas header TSOV is closed the output of the gas flow meter ceases to influence the furnace controls.

If the vent TSOV proximity switch (GBSA-09) does not indicate that the valve is closed within 15 s after initiating valve closure, an alarm is given.

If the header TSOV proximity switch (GBSA-02/03) does not indicate that the valve is closed within 15 s after initiating valve closure, an alarm is given and any further ignition burner starts are inhibited.

If, after all main gas burners are stopped, the control valve is not in its start position within 15 s, a "control valve not in start position" alarm is given.

C.4.5 Fuel oil header module

The function of this module is to monitor all the conditions required to open and close the fuel oil header TSOV and to control this valve.

If: i. the safe atmosphere module produces the safe atmosphere signal; and


iii. the atomising steam pressure is not low; and

iv. the stop oil firing switch is not activated; and


vi. the fuel oil control valve is in the start position or any oil flame is on; then

the oil header module produces a "healthy for oil firing" signal for the oil burner modules.

If the oil header module receives at least one "open oil header" signal from the oil burner modules, the oil header is automatically opened. At the same time the output of the oil flow meter is incorporated in the firing and air/fuel ratio control.

The control valve shall remain in its start position for at least 20 s. If any one of the other above conditions (i to v) fails, the oil header TSOV closes and the "healthy for oil firing" signal disappears after 2 s to allow for depressurisation of the line. If all "open oil header" signals from the oil burner modules disappear, the oil header TSOV closes also.


Page 111

NOTE: If the control valve is installed downstream of the TSO valve, the minimum pressure controller PIC-3 is forced to manual 0 % if the “open oil header” signal is not available. As soon as the “open oil header” signal becomes healthy, PIC-3 is forced to manual, x % opening for a period of 10 s. Thereafter PIC-3 is permanently forced to automatic, with minimum setpoint as required for the burners, whilst maintaining a minimum output limit of x %.

“x” is the minimum opening to achieve a reliable and safe start on the first burner to be started (this opening corresponds to the mechanical minimum stop setting). This opening shall give a higher pressure than that is obtained with the minimum pressure controller (with one burner in operation).

When the oil header TSOV is closed the output of the oil flow meter ceases to influence the furnace controls.

If the fuel oil header TSOV proximity switch (GBSA-05) does not indicate that the valve is closed within 15 s after initiating valve closure, an alarm is given and any further ignition burner starts are inhibited.

If, after all main oil burners are stopped, the control valve is not in its start position within 15 s, a "control valve not in start position" alarm is given.

C.4.6 Igniter modules

Each igniter is equipped with its own igniter module.

The function of these modules is to monitor all the conditions required to fire the individual igniters and to control the igniters.

If: i. the module does not receive a ‘burner start inhibit’ signal (see Note 1) and

ii. the module does not receive a "stop igniter" pulse from the gas or oil burner module; and


iv. the safe atmosphere module produces a "safe conditions" signal; and

v. the igniter stop button is not activated; then

the igniter can be started by activating the igniter start button.

NOTE 1: The burner start is inhibited:

a) If any burner TSOV failed to close (up to 1 minute after recovery of the closing failure).

b) During 1 min after each burner trip (or main burner start failure).

The module then produces the following signals:

a. open igniter header

b. open igniter TSOV

c. ignition spark signal for a period of 10 s.

After the flame stabilisation timer has run out (after 15 s) the ignition flame shall be detected by the ionisation rod, and an "ignition flame present" signal is sent to the respective main burner module.

If the igniter start trial was unsuccessful, restart is inhibited for a period dictated by the igniter restart inhibit timer (about 30 s).

An indefinite number of restarts of the igniter can be attempted without a new purge cycle being required. It is assumed that the capacity of the igniter is sufficiently low to ensure that the overall gas/air mixture is below the lower explosion limit.


Page 112

After the igniter has been successfully started, it will run for a maximum period of 15 min. It will be automatically stopped by the main burner module 5 s after opening of the main burner TSOV.

After the main burner has started the igniter can be restarted at any time (for testing purposes). After 15 min the igniter is stopped again.

C.4.7 Gas burner modules

Each burner is equipped with its own gas burner module.

The function of these modules is to monitor all the conditions required to open and close the gas burner TSOVs and to control their actions.

If: i. the gas burner module receives a "healthy for gas firing" signal; and


iii. the module receives an "igniter on" signal or an "oil flame on" signal; and

iv. the gas burner start button is activated; then

the gas burner module produces the following signals:

a. Open gas burner TSOV.

b. "Open gas header" signal to the fuel gas header module.

c. After the start timer has run out (typically 5 s), stop the igniter.

The start timer is set at 5 s. This timer setting shall not be confused with the so-called maximum allowable Trial For Ignition Time. The reason is that in practice all systems should be able to achieve a reliable start-up within 5 s – longer times would only reduce the safety level, and shorter times reduces the robustness of the start system.

If: i. the "healthy for gas firing" signal remains present; and


iii. the main flame is detected within the start timer setting; then

the module produces a "gas flame on" signal.

If any one of the above conditions fails the gas burner TSOV is closed and the "open gas header" signal disappears. If no other gas burner modules produce an "open gas header" signal, the gas header TSOV is closed and the vent TSOV opened.

The start inhibit timer inhibits the start for 1 min, after an unsuccessful start or after a stop of any burner.

If the gas burner TSOV proximity switch (GBSA-14-N4) does not indicate that the valve is closed within 15 s after initiating valve closure, an alarm is given and any further ignition burner starts are inhibited.

C.4.8 Oil burner modules

For single oil fired installations, see the 2nd Note in (C.3.4).

Each burner is equipped with its own oil burner module.

The function of these modules is to monitor all the conditions required to open and close the fuel oil burner TSOVs and to control their actions.


Page 113

If: i. the oil burner module receives a "healthy for oil firing" signal; and

ii. the oil burner stop button is not activated; and

iii. the module receives an "igniter on" signal or a "gas flame on" signal; and

iv. the oil burner start button is activated; then

the oil burner module produces the following signals:

a. Open oil burner TSOV.

b. "Open oil header" to the fuel oil header module.

c. After the start timer has run out (usually 5 s) stop the igniter.

If: i. the "healthy for oil firing" signal remains present; and

ii. the oil burner stop button is not activated; and

iii. the main flame is detected within the start timer setting; then

the module produces an "oil flame on" signal.

If any one of the above conditions fails the burner TSOV closes and the "open oil header" signal disappears. If no other oil burner modules produce an "open oil header" signal the oil header TSOV is closed.

The start inhibit timer inhibits the start for 1 min, after an unsuccessful start or after a stop of any burner.

If the oil burner TSOV proximity switch (GBSA-15-N5) does not indicate that the valve is closed within 15 s after initiating valve closure, an alarm is given and any further ignition burner starts are inhibited.

C.4.9 Main flame detection modules

The function of these modules is to provide an individual detector failure alarm and a "flame failure" signal to the burner modules. The main flame detection module produces a soft alarm if either of the two detectors does not detect a flame.

The main flame detection module produces a "flame detection failure" signal to the oil and gas burner modules if both detectors do not detect a flame.

The flame detectors SHALL [PS] not be equipped with Maintenance Override Switches.

C.4.10 Burner count module

The function of the burner count module is to provide a correction factor for the measured airflow, so that air supplied to burners which are not in operation is not included in the air/fuel ratio computation. In addition, it forces the QRCA (oxygen in flue gas) to manual if not all burners are in operation.

It further provides a signal "more than N/2 burners in operation" to the minimum stop module.

The module calculates the ratio of the total number of burners installed to the number of burners in operation.

To do this it makes use of the "oil flame on" and "gas flame on" signals of individual oil and gas burner modules (i.e. a burner is taken to be in operation if either the "oil flame on" signal or the "gas flame on" signal, or both signals, are healthy).

The output of the burner count module is sent to both the DCS and the PLC air/fuel calculations.


Page 114

NOTE: If the furnace consists of multiple radiant boxes with a common air/fuel ratio control, the signal "more than N/2 burners in operation" shall be interpreted for each radiant box individually. For example, if the furnace has three radiant boxes, each having 4 burners, than on each radiant box more than 2 burners shall be in operation to allow the reset from minimum firing to be activated.

C.4.11 Waste gas firing module


Two configurations are possible, depending on the anticipated heat input of the waste gas:

C.4.11.1 Waste gas heat input not more than 15 % of design

If the anticipated waste gas flow represents less than 15 % of the total design heat input of the furnace, the waste gas to all burners is supplied via one common TSOV.



iii. the module receives an "all burners in operation" signal; and


the waste gas TSOV to the furnace can be opened by activating the waste gas reset button. Usually the waste gas TSOV to the furnace is operated in conjunction with a vent TSOV (i.e. the vent TSOV is automatically opened if the furnace TSOV is closed).

The individual burners are equipped with manually operated valves. If short-term venting to atmosphere cannot be accepted (e.g. when burner guns are being cleaned), the manual valves shall be equipped with proximity switches which can be used to override the relevant flame detector signal (i.e. if the waste gas cock on a burner is detected closed, the waste gas TSOV is not tripped when this burner is taken out of operation).

C.4.11.2 Waste gas heat input more than 15 % of design

If the anticipated waste gas flow represents more than 15 % of the total design heat input of the furnace, the burners are equipped with individual waste gas TSOVs in addition to the common waste gas TSOV.

A. Common waste gas TSOV module



iii. the waste gas firing stop button is not activated; then

the module produces a "healthy for waste gas firing" signal to the individual waste gas burner modules.

If at least N/2 waste gas burner TSOVs are opened the common TSOV can be opened by activating the waste gas firing reset button.

If any of the conditions i to iii fail or if the "at least N/2 waste gas burner TSOVs open" signal disappears, the common TSOV closes again.

Usually the common waste gas TSOV to the furnace is operated in conjunction with a vent TSOV (i.e. the vent TSOV is automatically opened if the furnace TSOV is closed).

B. Burner waste gas TSOV module

If: i. the module receives a "healthy for waste gas firing" signal; and


Page 115

ii. the module receives a "main burner on" signal; and

iii. the waste gas burner stop switch is not activated; then

the TSOV can be opened by activating the start waste gas burner reset button.

C.5 CAUSE AND EFFECT DIAGRAM

The Cause and Effect diagram is given in Table C-1.


Page 116

Table C-1 Cause and effect diagram

Initiators Actions

TAG Service Abort/ Inhibit start sequence

Header fuel oil TSOV close

Trip to minimum

firing fuel oil


Vent fuel gas TSOV open

Trip to minimum

firing fuel gas

Header igniter TSOV close

Main fuel gas burner TSOV close

Main fuel oil burner TSOV close

Ignition burner TSOV close

Switch QRC-1 (O2)

manual

Switch oil flow

meas. to zero

Switch gas flow meas.

to zero

FZA-01-LL Combustion air x x x x x X x x x x - - -

XZA-01-LL Air/fuel ratio - - x - - X - - - - - - -

PZA-01a-HH Fuel gas - - - - - X - - - - - - -

PZA-01b-H Fuel gas x - - x x X - x - - - - -

PZA-03a-HH Fuel oil - - x - - - - - - - - - -

PZA-03b-H Fuel oil x x x - - - - - x - - - -

PZA-05-LL Atomising steam - x x - - - - - x - - - -

HZA-01/02 Manual trips x x x x x X x x x x - - -

LZA-01HH Fuel gas KO drum - - - x x X x X - x - - -

GBSA-01-S Fuel gas control valve in start position

x - - - - - - - - - - - -

GBSA-02/03-C Fuel gas header TSOVs closed

x - - - - - - - - - - - -

GBSA-06-S Fuel oil control valve in start position

x - - - - - - - - - - - -

GBSA-05-C Fuel oil header TSOV closed

x - - - - - - - - - - - -

Process I General process trips - - x - - X - - - - - - -

Process II General process trips - x x x x X x X x x - - -

GBSA-14-C Vent TSOV closed - - - - - - - - - - - - -

XZA-11-n1 Ignition flame detection x - - - - - x - - x - - -


Page 117

Initiators Actions

XZA-12-n2 Main flame detection - - - - - - - X x x - - -

All XZA-12 to n2 All main flame detectors - x x x x X - - - - - - -

GBSA-14-n4-C Gas burner TSOV closed x - - - - - - - - - - - -

GBSA-15-n5-C Oil burner TSOV closed x - - - - - - - - - - - -

> N/2 burners lit Burner count - - x - - X - - - - - - -

(Not) all burners lit - - - - - - - - - - x - -

(Not) healthy for oil firing - - - - - - - - - - - x -

(Not) healthy for gas firing - - - - - - - - - - - - x


Page 118

ANNEX C APPENDIX A FUNCTIONAL LOGIC DIAGRAMS FOR A FORCED DRAUGHT MULTI-BURNER FURNACE


Page 119

t = X sec

t 0

t = X sec

0 t

t = X sec

t = X sec

t = X sec

1

in

out

in

out

in

out

in

out

in

out

0 X 0 XDelay-on

Delay-off

Pulse-up (not-resettable)

Pulse-down (resettable)

Pulse-up (resettable)

xy

TagService

Input symbols

x Physical condition corresponding to alogical ‘1’ at (a)

y Physical condition corresponding to alogical ‘1’ at (a)

(a)

x Physical condition corresponding to alogical ‘1’ at (b)

y Physical condition corresponding to alogical ‘1’ at (b)

(b) x

yTagService

Output symbols

Logical symbols

& AND gate : Output is ‘1’ in case all inputs are ’1'

> OR gate : Output is ‘1’ in case at least one input is ’1'

Invertor : Output is ‘1’ when input is ‘0’ and vice versa

& AND gate with inverted input

Explanation of logic symbols SYMBOLS

Timers

x-yz

Transfer Indicators

Signal y from sheet x is transferred to sheet z


Page 120

FURNACE SAFEGUARDING LOGICSLogics 30Sheet 0

Furnace safeguarding logics for a forced draught multi burnerfurnace

References:

S24.030:Fuel oil and fuel gas system for an automatically started dualfuel fired, forced draught, multi burner heater or boiler.

S24.034:Fuel gas system for an automatically started, gas fired, forceddraught, multi burner heater or boiler (< 16 burners).

Note:When these logics are used for a single fuel system, e.g. gas only,the relevant fuel oil signals must be disregarded / deleted whereapplicable.

Sheets:

1. Safe atmosphere2. General burner status3. General trips4. Minimum stop5. Igniter header6. Fuel gas header + vent7. Gas firing trips8. Fuel gas TSOV selection9. Fuel oil header10. Fuel oil firing trips

12. Igniter burner 113. Fuel gas burner 114. Fuel oil burner 115. Flame detection burner 1

97. Burner count module

99. Status indications, alarms, switches


Page 121

Logics for a dual fuel fired, multi burner furnace / boiler - Safe atmosphereLogics 30Sheet 1

15-11

N5-11

Flame detectedin burner 1

Flame detectedin burner N

HZ-1Local trip

&On Status

“Purge inprogress”Off

1-16

ON

OFF

Status“Safeconditions”

1-29

2-11

3-11

All TSO valvesdetected closed

Combustion airflow healthy

>

1-1112

Safeconditions

1-1NN2

9-21

6-21

Open oilheader TSOV

Open gas headerTSOV

>&

t = purge time

t 0

t = 4 sec

0 t

t = 2 sec

>

&

>

t = 5 minutes

t 0

&

Maximum purge timer

Minimum purge timer

&

>

&

HZ-2 ControlRoom trip


Page 122

Logics for a dual fuel fired, multi burner furnace / boiler - General burner statusLogics 30Sheet 2

13-52

14-52

Burner 1 gasopen TSOV

Burner 1 oilopen TSOV

2-1NN2

2-1112

N4-52

N3-52

8-12

Burner N gasopen TSOV

Burner N oilopen TSOV

Gasheader A

>

2-11

2-34

8-22

13-72

N3-72

2-24

2-46

2-59

>

>

>

t = 60 sec

&

14-72

9-12

N4-72

Oilheader

Burner 1oil

Burner Noil

Any gas burner TSOV open

Any oil burner TSOV open

Start inhibit timer

Start inhibit timer

Gasheader B

Burner 1gas

Burner Ngas

Any gas burnerTSOV open

Any gas burnerTSOV open

Any oil burnerTSOV open

Any oil burnerTSOV open

(NOT) inhibitstart burner 1

(NOT) inhibitstart burner N

All TSO valvesdetected closed,or “open” signalpresent

t = 60 sec

&

t = 60 sec

t 0

Start inhibit timer

“det

ecte

d cl

osed

” O

R “

Ope

n si

gnal

pre

sent

”

On Status“Burner startinhibited”Off

&

&


Page 123

Logics for a dual fuel fired, multi burner furnace / boiler - General tripsLogics 30Sheet 3

MOS

MOS

3-34

3-11>

>LLFZA-02Combustionair flow

ON Alarm"Low A/Fratio”OFF

ON Alarm“Low comb.air flow”OFF

>

97-23

FT-03Fuel Gasflow

QT-03Fuel GasDensity

FT-04Fuel Oil flow

Number of burnersin operation

CalculationBlock t = 10 sec

0 t

NB. Dedicated transmitters in PLC only required in case low A/F ratio trip has to beimplemented as SIL class I (typically only for furnaces with common stacks)


Page 124

Logics for a dual fuel fired, multi burner furnace / boiler - Minimum stopLogics 30Sheet 4

HS-2 Resetgas firingminimum stop

3-34

2-34

&

EXT


Any gas flame on

More then N/2burners on

HS-6 Reset oilfiring min. stop

>

>

&

ON Status “Fuel oilon min. stop”OFF

ON Status “Fuelgas on min.stop"OFF

ON Alarm Gasmin. stop

failureOFF

OFF

Alarm Oilmin. stopfailure


Any oil flame on

(via 30 sec ramp)

7-24

2-24

7-44

EXT

10-14

10-34

97-14

&

Fuel gas pressurenot high

Fuel gas pressurenot high high

A/F ratio healthy

Fuel oil pressurenot high high

Fuel oil pressurenot high

(via 30 sec ramp)

(NOT) fuel gasminimum stop failure

4-16

>

>

(NOT) fuel oilminimum stop failure

4-29

ON

t = 30 sec

o t

t = 30 sec

o t

Fuel gas FRCmanual 0 %MIN

DCS

Fuel oil FRCmanual 0 %MIN

DCS


Page 125

Logics for a dual fuel fired, multi burner furnace / boiler - Igniter headerLogics 30Sheet 5

> O IgniterheaderTSOV

N2-15

12-15

Open igniterheader(for burner 1)

Open igniterheader(for burner N)


Page 126

Logics for a dual fuel fired, multi burner furnace / boiler - Fuel gas header and vent Logics 30 Sheet 6

4-1 6

&

7-1 6

HS-4 Stop fuel gas firing

>

ON Alarm “CV not in start position OFF

O Vent TSO

C

ON Alarm “Vent TSO closing

failure” OFF >

No high level in fuel gas KO drum

(NOT) Failure trip to minimum stop

1-1 6

EXT

2-4 6

Any gas burner TSO open

Process trips

Open fuel gas header

6-1 8

Healthy for fuel gas firing

6-1N N3

GBSA-09 vent TSO limit switch

GBSA-01 Gas control valve start position

C

MIN

Safe conditions

EXT

6-11 13

To DCS to include gas flow in air/fuel

ratio calculation

6-2 1

&

Fuelgas PIC-1 manual 0 % 0%

D C S

x% Fuelgas PIC-1 manual x %

D C S

MIN Fuelgas PIC-1 forced auto @ minimum

D C S

t = 15 sec

0 t

t = 10 sec

t 0 & X = start position for first burner only

Required if control valve is downstream of TSO valves

t = 20 sec t 0

t = 15 sec 0 t


Page 127

Logics for a dual fuel fired, multi burner furnace / boiler - Gas firing tripsLogics 30Sheet 7

MOS

MOS

7-16

7-1112

7-24

LZA-01Fuel gasKO drum

PZA-01aFuel gaspressure

PZA-01bFuel gaspressure

< HH

< HH

< H

ON Alarm"High levelKO drum”OFF

ON Alarm “Highfuel gaspressure”OFF

t = 5 sec

>

7-N1N2

7-44

>

>


No high highfuel gas pressure

No highfuel gas pressure0 t

“Ignore start-up spike” timer


Page 128

Logics for a dual fuel fired, multi burner furnace / boiler - Fuel gas header valve selectionLogics 30Sheet 8

GBSA-03 FGheader Blimit switch

HS-3 FGheader valveselection

MOS

Open fuel gasheader

ON Status “FGheader A inuse”OFF

ON Alarm “FGheader Bclosing failure”OFF

ON Alarm “FGheader Aclosing failure”

O Fuel gasheader BC

8-22

Gas header BTSOV detectedclosed OR opensignal present

GBSA-02FG header Alimit switch

6-18

MOS

8-12

>

ON Status “FGheader B in

use”OFF

O Fuel gasheader AC

OFF

t = 10 sec

t = 10 sec

t = 15 sec

t = 15 sec

C

C

A

B

>

>0 t

0 t

0 t

0 t

>

&

&

&

>

&>

Gas header ATSOV detectedclosed OR opensignal present

t = 2 sec

t 0

t = 2 sec

t 0


Page 129

Logics for a dual fuel fired, multi burner furnace / boiler - Fuel oil header

Logics 30 Sheet

HS-05 Stop fuel oil firing

GBSA-06 Oil control valve start position

MOS

(NOT) failure trip to minimum stop

ON Alarm oil header TSO closing failure OFF

9-1N N4

Healthy for fuel oil firing

GBSA-05 Fuel oil header limit switch

4-2 9

EXT

9-1 2

Fuel oil header TSOV detected closed OR open signal present

ON Alarm “Oil CV not in

start position” OFF

O Fuel oil header TSO C

t = 15 sec

t = 2 sec

C

MIN

>

0 t

0 t

>

&

Any oil burner TSO open

10-3 9

No low steam header pressure

1-2 9

2-5 9

9-11 14

To DCS to include oil flow in air/fuel ratio calculation

&

EXT

Safe conditions

Process trips

>

9-2 1

Open fuel oil header TSOV

Fuel oil PIC-3 manual 0 % 0%

D C S

x % Fuel oil PIC-3 manual x %

D C S

MIN Fuel oil PIC-3 forced auto @ minimum

D C S t = 10 sec

t 0 &

X = start position for first burner only

Required if control valve is downstream of TSO valve

t = 2 sec

t 0

t = 20 sec t 0

t = 15 sec 0 t


Page 130

Logics for a dual fuel fired, multi burner furnace / boiler - Oil firing tripsLogics 30Sheet 10

MOS

MOS

10-39

10-14

PZA-05Steam headerpressure

<HHPZA-03aFuel oilpressure

PZA-03bFuel oilpressure

< HH

< H

ONAlarm"Low steamheaderpressure”OFF

ON Alarm “Highfuel oilpressure”OFF

> 10-34

>

>

No high highfuel oil pressure

No highfuel oil pressure


Page 131

Logics for a dual fuel fired, multi burner furnace / boiler - Igniter 1Logics 30Sheet 12

14-412

(Not) stop igniter 1(oil burner)

7-1112

Not stop igniter 1(gas burner)

&

>

O Igniter 1TSOC

1-1112


&

>

ON Status“Igniter 1 on”OFF

Safe conditions

12-314

12-213 Igniter 1 present

13-412

HS-17Start igniter 1

HS-11Start igniter 1

HS-18Stop igniter 1

HS-12Stop igniter 1

XZA-11Flame rodigniter 1

> LL

ON Sparkerigniter 1OFF

t = 30 sec

t = 15 sec

t = 10 sec

Igniter start timer

Max igniteroperation timer

Igniter 1 startinhibit timer

Spark timer

2-1112

Igniter 1 present

& >

&

12-15

Open igniterheader

(NOT) inhibitburner start

t = 15 min

t 0

Optionally main flame detector signal may be used

1

15-412


Page 132

Logics for a dual fuel fired multi burner furnace / boiler - Fuel gas burnerLogics 30Sheet 13

13-412

Open gas burner1 TSO

13-197

Burner 1Gas flameon

>

ON Alarm gas burner1 TSO closingfailureOFFCGBSA-14

Burner 1 GasTSOV closed

12-213

14-613

15-213

MOS

&

t = 5 sec

>

>

&

Igniter 1 on

Oil flame 1 on

Healthy for gasfiring

Burner 1 flamedetected

t = 2 sec

13-72

HS-13Start fuel gasfiring

HS-14Stop fuelgas firing

6-1113

>

O Burner 1 gasTSO

C

ON Status“Gas flameburner 1 on”OFF

13-52

13-614

(NOT) Stopigniter 1

Burner 1 gasTSOV detectedclosed OR opensignal present

t = 15 sec

>

TSO 1 closing timer

Stop igniter

0 t

Burner start timer

&

1

t = 2 sec

t 0


Page 133

Logics for a dual fuel fired multi burner furnace / boiler - Fuel oil burner 1Logics 30Sheet 14

14-412

Open burner 1Oil TSO

14-197

Burner 1Oil flameon

>

ON Alarm oil burner1 TSO closingfailureOFF

GBSA-15Oil burner 1TSO closed

12-314

13-614

15-314

MOS

&

t = 5 sec

>

>

&

Igniter 1 on

Gas flame 1 on

Healthy for oilfiring

Burner 1 flamedetected

t = 2 sec

14-72

HS-15Start fuel oilburner 1

HS-16Stop fueloil burner 1

9-1114

>

O Burner 1 oil TSO

C

ON Status“Oil flame burner1 on”OFF

14-613

(NOT) Stopigniter 1

Burner 1 oilTSOV detectedclosed OR opensignal present

t = 15 sec

>

TSO 1 closing timer

Stop igniter

C

Burner start timer

0 t

1

&

t = 2 sec

t 0

14-52


Page 134

Logics for a dual fuel fired, multi burner furnace / boiler - Flame detectionLogics 30Sheet 15

ON Status Burner 1Flame detector 1failureOFF

>LLXZA-12Burner 1detector 1

15-314

15-11

Burner 1flame detected

>

ON

OFF

15-213

ON Status: Burner 1Flame detector 2failureOFF

>LLXZA-13Burner 2detector 2

Alarm: Noflame detectedburner 1

15-412

Optional (ifignition flame isdetected by mainflame detector)


Page 135

Logics for a dual fuel fired, multi burner furnace / boiler - Burner count moduleLogics 30Sheet 97

14-197

N4-197

&

Gas flameon burner N

>

>

AUT AutomaticO2 controlallowedMAN

Oil flameon burner N

No. of burnersin operation(for A/F ratio)

13-197

N3-197

Gas flame onburner 1

Oil flame onburner 1

More thanN/2 burners on

97-14

COUNTER

X>N/2

All burners in operation

X

DCS

DCS

97-23

No. of burners inoperation (for A/F

ratio trip)


Page 136

Logics for a dual fuel fired, multi burner furnace / boiler - status lights, alarms, switchesLogics 30Sheet 99

HS-2HS-3

HS-6

HS-11 HS-12

HS-13HS-14

LOCAL PANEL (for oil firing only)

Safe conditions

Burner start inhibited (1 minutewait or TSO closing failure)

Low combustionair flow

Air / fuel ratio low

High level fuelgas KO drum

Reset fuel gas onminimum stop

Fuel gas header Bselected

Stop gas firingall burners

Fuel gas header Aselected

Fuel gas header Aclosing failure

Reset fuel oilminimum stop

Fuel oil onminimum stop

Failure oil tripto min firing

Fuel oil headerclosing failure

No flame detectedburner 1

Burner 1Flame detector 1


Start igniter 1

Igniter 1 on

Stop igniter 1

Start gasburner 1

Gas burner 1 on

Stop gasburner 1

Oil burner 1 on

Flame detector1

Start igniter

Igniter startinhibited

Igniter on

HS-15

HS-17

HS-16

HS-18

Gas burner 1 on

Start igniter 1


Igniter 1 on

Start oilburner 1

LOCAL PANEL (only required for oil or dual fired systems)

HS-4

HS-5

Vent closingfailure

Fuel gas onminimum stop

Fuel gas header Bclosing failure

Stop oil firingall burners

Fuel gas controlvalve not in start

position

High fuel gas pressure

Failure gas tripto min firing

Gas headerselector

Oil CV not instart position

Fuel oil headerhigh pressure

Steam headerlow pressure

Gas burner 1 TSOvalve closing failure

Oil burner 1 TSOvalve closing failure


Stop igniter 1

Oil burner 1 on

Stop oilburner 1

HS-N5

HS-N7

HS-N6

HS-N8Start igniter N

Burner NFlame detector 1

Igniter N on

Start oilburner N


Gas burner N on

Stop igniter N

Oil burner N on

Stop oilburner N

HS-N1 HS-N2

HS-N3HS-N4

No flame detectedburner N



Start igniter N

Igniter N on

Stop igniter N

Gas burner N on

Stop gasburner N

Oil burner N on

Gas burner N TSOvalve closing failure

Oil burner N TSOvalve closing failure

Start gasburner N

Purge inprogress


Page 137

ANNEX D CONTROL SYSTEMS, IPF NARRATIVES, CAUSE AND EFFECT DIAGRAM AND FUNCTIONAL LOGIC DIAGRAM FOR A MANUALLY-STARTED, GAS FIRED, NATURAL DRAFT, MULTI-BURNER FURNACE SAFEGUARDED BY PILOT BURNERS

This annex provides an example of control systems and instrumented protective functions, cause and effect diagram as well as functional logic diagrams for a manually started, gas fired, natural draft, multi-burner furnace, safeguarded by pilot burners. Safeguarded manual start-up of burners shall be applied only when the calculated maximum allowable “Trial For Ignition Time” (TFIT) is greater than or equal to 15 seconds, otherwise safeguarded automatic start-up of burners shall be applied. This annex shall not be used for any other equipment or firing configuration.

NOTE: This standard may also be applied for forced draft Low Air-Side Pressure Drop Burners, i.e., burners that have low air-side pressure drop (< 50 mm wc or (2 in. wc)) and are capable of natural draft operation.

This annex shall be used together with Standard Drawing S 24.037.

D.1 CONTROL SYSTEM IMPLEMENTATION CONSIDERATIONS

The minimum and maximum fuel gas pressure override controllers shall be locked in auto mode. The operator shall not be able to change the set point of the maximum pressure override controller. The operator may be given limited control over the set point of the minimum pressure override controllers up to 2 times the minimum pressure. The latter flexibility is sometimes useful to prevent flame loss due to too low a pressure when manipulating burners.

The minimum and maximum pressure override controllers shall be fast-acting (similar to compressor anti-surge controllers).

Equal percentage valves shall be used so that the performance of the pressure controller is independent of the number of burners in operation.

The Anti Reset Wind-Up (ARWU) to the fuel PICs is present to ensure smooth transfer when one controller overrides another.

ARWU protection shall also be implemented on the master temperature controller TRC-1.

D.2 LOCATIONS OF ALARMS, SWITCHES, ETC.

The DCS in the main control room shall provide alarms and indications on the progress of the logic system and control/trip valve position.

A local panel shall be provided with alarm indication lamps, switches and indications of the progress of burner light-off, position indication lamps of the shut-off valves.

The burner manual isolation valve shall be installed so that the operator can operate (fully open/close only) them while watching the flame.

The above philosophy is reflected in Standard Drawing S 24.037.

D.3 DESCRIPTION OF INSTRUMENTED PROTECTIVE FUNCTIONS

The IPFs are described by the narrative given below.

The functional logic diagrams are to be set up in a modular structure. This section describes the main modules. Assisting modules such as the "general trips" module are not described separately. Their functionality is described in the modules where they are relevant.


Page 138

D.3.1 Safe atmosphere module

The function of this module is to continuously check, and if necessary re-establish by purge timer and combustible measurement, a safe atmosphere for firing the furnace under cold start-up conditions.

If:

i. pilot fuel header TSOV is closed, AND

ii. fuel gas header TSOVs are closed AND vent valve is NOT closed, AND

iii. the local and control panel trip switches are in the desired position,

the ABC pre-test purge sequence starts automatically and "purge in progress" is given. The purge duration shall be minimum ten minutes.

If there were no interruptions to the above purge conditions and after the timer has run out, the "purge completed" signal appears and a “purge completed” signal is given to the ABC test module (if applied) or to the pilot header module.

The "purge completed" signal remains in force as long as the "main trips and the ABC Pre-test permissive conditions remain satisfied.

D.3.2 All Burner Closed (ABC) test module

High temperature heaters such as SMR/HMU heaters or Lower Olefin cracking heaters do not require pilot burners. In such heaters an ABC module shall be applied.

The function of this module is to monitor all the conditions required to perform the ABC test and to provide the signals required to continue the start-up.

If the furnace contains more than one cell, each having its own fuel gas header and TSOV valves, each cell shall have its own ABC test module. Multiple ABC tests may be carried out simultaneously.

The method as described uses fuel gas rather than nitrogen as test medium. The reason for this is to prevent having nitrogen in the gas lines during start-up. This may lead to unacceptably long opening times of burner manual isolation valves without a flame being present.

The system works as follows:

If:

i. the main fuel gas PZALL is activated, AND

ii. the "purge completed" signal present,

then a “ready for ABC test" indication is given. The ABC test can be started by activating the “start ABC test” switch.

If there are no interruptions to the above conditions, the main fuel gas header TSOVs are opened while the vent valve is closed. Downstream control valves / fuel pressure regulation valves open to pressure the header to at least two times greater than the PZALL. The header TSOVs and control/pressure regulation valves close when the fuel gas pressure downstream the TSOVs has reached a value of at least twice the active minimum pressure controller (measured using the same transmitter) or 30 seconds, whichever comes first.

If after 30 seconds this pressure is still not reached, a failure to pressurize alarm is activated.

Upon closure of the TSOV’s and control / pressure regulation valves a timer of 3 minutes begins. If the fuel gas pressure has not dropped below its PZALL level after the expiry of the 3 minutes, an “ABC test passed” signal is given, and the vent valve is opened to discharge the fuel gas to a safe location. The “ABC test passed” signal is valid for 10 minutes after which it will go back to repeat ABC test.


Page 139

If the main fuel gas pressure had dropped below the PZALL during the ABC test, an "ABC test failed" alarm is given as feedback to the operator. The vent valve is then opened to discharge any gas that has accumulated in the system. The pre-purge timer will reset and a complete new purge time is required.

D.3.3 Pilot header module

The function of this module is to monitor all the conditions required to open and close the pilot header TSOV and to control this valve.

If: i. (If installed) the ABC test module produces the "ABC test passed" signal; and

ii. The purge completed signal is present; and

iii Pilot TSOV is closed; then

“Ready for pilot start-up” signal is given. The pilot TSOV can be opened by the pilot reset button. Upon reset, a disarm timer of 1 minute on pilot pressure PZALL and PZAHH will begin and the operator can then proceed to open and light pilots one at a time.

If: pilot gas pressure stays above PZALL and below PZAHH upon expiry of the 1-minute disarm timer (gets in range within 1 minute after opening of the TSOV);

The pilot header TSOV will remain open and a ‘pilot burners on’ signal will be given to the main burner module.

If the header TSOV proximity switch does not indicate the valve being closed within 5 seconds after initiating the valve to close, a “TSOV not closed” alarm is given.

D.3.4 Main fuel gas header module

The function of this module is to monitor all the conditions required to open and close the fuel gas header TSOVs and vent valve and to control these valves.

If:

i. Fuel gas TSOV’s are closed AND the vent valve is not closed, AND

ii. (If installed) The ABC test module produces the “ABC test passed” signal, AND

iii. (If installed) the pilot fuel TSOV is open, AND

iv. the fire box floor pressure is below PZAHH , AND

NOTE: Not required for ethylene cracking furnaces or steam methane reformer furnaces. See section D.5 for minimum requirements of High Fire Box Floor Pressure Trip.

v. the safe atmosphere module produces the "safe conditions" signal; AND

vi. other process conditions (process trips) are acceptable; AND

vii. the “stop gas firing” switch is not activated; AND

viii. the fuel gas control valve is in the start position,

then the gas header module produces a "Ready for main burner start-up" signal for the gas burner modules. The fuel gas TSOV’s can be opened and the vent valve closed, by pushing the main fuel gas reset button. Upon reset, a disarm timer of 600 seconds on main fuel gas pressure PZALL and PZAHH will begin and the operator can then proceed to open and light main burners one at a time.

If during the 600 sec disarm timer the pilot fuel TSOV closes, the main fuel gas header closes.


Page 140

If the main fuel gas pressure stays above PZALL and below PZAHH upon expiry of the disarm timer (gets in range within 600 seconds after opening of the TSOVs); the main fuel gas header TSOVs will remain open.

If any of the conditions iv) to vii) is not satisfied, or if the main fuel gas pressure is above PZAHH or below PZALL after the 600 seconds start-up disarm timer has expired, the fuel gas TSOVs are closed and the vent valve is open.

Upon closure of the fuel gas header TSOVs, the "safe conditions" signal from the general trips module disappears if the pilot TSOV is also closed, thus requiring a new purge cycle to guarantee a safe atmosphere.

In order to prevent full opening of the control valve when the TSOVs are closed, the fuel flow controller as well as the minimum pressure controller are pulsed to manual, with zero output.

D.3.5 Waste gas firing module


If:

i. Waste gas TSOV(s) is (are) closed; AND

ii. Fuel gas TSOVs are open AND the vent valve is closed ; AND

iii. There is no high level in the waste gas KO drum (if applicable); AND

iv. The waste gas pressure is below PZAHH (if applicable); AND

v. The waste gas firing stop button is not activated; then

the waste gas header module produces a "ready for waste gas firing" signal. The waste gas TSOV(s) to the furnace can be opened by pushing the waste gas reset button. The individual burners shall be equipped with manually operated burner cock valves.

If any of the conditions ii) to v) fails to exist, the waste gas TSOV is closed.

D.4 CAUSE AND EFFECT DIAGRAM

For completeness sake the relevant Cause and Effect diagram is given in Table D1.


Page 141

Table D1 Cause and effect diagram

Initiators Actions

HZ-1

Local tripTAG

Service Abort/ Inhibit start

sequence

ABC Test


Vent fuel gas

TSOV open

Header Pilot

TSOV close

Trip Burner CV to Min

Close natural draft doors

HZ-1 Local Trip X X X X X X X

HZ-2 Control Room Trip X X X X X X X

HS-1 Start ABC Test

PZA-02c Burner gas pressure > 2xLL

X

HS-2 Reset ABC Test Failure

HS-3 Pilot Reset

HS-4 Main Fuel Gas Reset

GBSA-01 FG TSOV A limit switch X

GBSA-02 FG TSOV B limit switch X

GBSA-03 vent TSO limit switch X

GBSA-04 Pilot TSOV limit switch X

LZA-01 Fuel gas KO drum X X X X

PZA-01a Pilot gas pressure <LL X

PZA-01b Pilot gas pressure >HH X

PZA-02a Burner gas pressure <LL X X X X

PZA-02b Burner gas pressure >HH

X X X X

HS-6 STOP Main burner Gas X X X X X

PZA-03 Arch Pressure High (Low Nox)

X X X X X X

PZZA-01 Burner CV at Light off Position

X

Process Trips X X X X X

HS-5 STOP Pilot burner gas X


Page 142

D.5 MINIMUM REQUIREMENTS HIGH FIRE BOX FLOOR PRESSURE TRIP

The high fire box floor pressure trip is required for heaters with staged fuel, low air-side pressure drop (< 50 mm wc or (2 in. wc)) burners that are not safeguarded by flame detectors. For heaters that operate well above their autoignition temperatures (AIT) such as ethylene cracking furnaces and steam methane reformer furnaces, this trip is not required.

D.5.1 IPF considerations

1. The high fire box floor pressure trip shall be installed in a 2oo3 voting system. For heater length beyond 60 feet, the Principal shall advice upon.

2. Draught pressure trip setting shall not be higher than 12.7 mm wc or (0.5 in. wc) (above atmospheric). The Principal shall adjust this setting tighter or to a lower number basis experience or equipment design.

3. There shall not be any time delay (0 sec) in the logic solver.

D.5.2 Pressure tapping location

1. On vertical cylindrical heaters, 3 transmitters shall be installed, equally spaced over the circumference of the heater (see Figure D.1); small deviations are allowed in order to satisfy requirements (3) – (6).

2. On rectangular heaters 3 transmitters shall be installed, equally spread over the length of the heater (see Figure 1); small deviations are allowed in order to satisfy requirements (3) – (6).

3. The tappings shall be located on the side wall at an elevation of 0.3 – 0.6 m (1 - 2 ft) above the floor.

4. Tappings shall be located such that the measurement is not influenced by burners – preferred position is between two burners.

5. They shall not be located behind a tube – i.e. tapping hole shall be visible when inspecting within the heater.

6. They shall be at least two feet away from any other opening (e.g. smothering steam connection, inspection door, etc.).

Figure D.1 Location of floor draft transmitters

D.5.3 Transmitter selection and settings

Transmitters shall be able to detect pressure peaks with a frequency of 6 Hz or lower. The following transmitters have been validated and can be used for this application:

1. Validyne transmitter, DR800 series with option 2492 added to the end of the model number. Refer Principal for correct damping settings.

2. Rosemount 3051S Range 2 smart transmitter


Page 143

Damping must be changed from the factory default 0.4 second setting to 0.0 Seconds.

Transmitter should be specified with “Ultra” accuracy instead of “Classic”.

D.5.4 Transmitter impulse line / reference leg

1. The connection to the heater casing shall at least be 1 in. and made of stainless steel. It shall protrude through refractory / ceramic fiber lining with a clear path to the refractory face.

2. The transmitter shall be mounted above the connection to the heater; impulse lines shall be stainless steel and should be as short as possible (maximum 1 meter [3 feet]. Horizontal impulse lines shall be avoided and where required shall be sloping downwards towards heater. In cold climates, transmitter and impulse lines shall be traced.

3. The transmitter shall be equipped with a box enclosure (e.g. O’Brien box) over the entire transmitter and reference leg. The box enclosure should not be purged as this may affect the reference leg pressure. Alternatively, the reference leg shall be equipped with the commercially available Static Air Probe manufactured by Air Monitor Corporation.


Page 144

PART VIII REFERENCES

In this DEP, reference is made to the following publications:

NOTES: 1. Unless specifically designated by date, the latest edition of each publication shall be used, together with any amendments/supplements/revisions thereto.

2. The DEPs and most referenced external standards are available to Shell staff on the SWW (Shell Wide Web) at http://sww.shell.com/standards/.

SHELL STANDARDS

DEP feedback form DEP 00.00.05.80-Gen.

Fuel systems DEP 20.05.60.10-Gen.

Water-tube boilers DEP 30.75.10.30-Gen.

Gas turbine heat recovery steam generators DEP 30.75.10.31-Gen.

Fired heaters (amendments/supplements to ISO 13705) DEP 31.24.00.30-Gen.

Instrumented protective functions (IPF) DEP 32.80.10.10-Gen.

Onshore production installations - Basic process safety systems DEP 39.01.00.10-Gen.

Design Engineering Manual DEM 1 – Application of Technical Standards. http://sww.manuals.shell.com/HSSE/

DEM 1

STANDARD DRAWINGS

Typical arrangement for air flow measurement in suction of F.D. Fans S24.002

Typical arrangement for air flow measurement in discharge of F.D. Fans

S24.005

Fuel-oil and fuel-gas system for a single burner furnace S 24.024

Control and safeguarding system for a furnace with one gas burner S 24.026

Fuel-oil and fuel-gas system for an automatically started forced draught multi-burner furnace/boiler

S 24.030

Fuel-gas system for an automatically started natural draught multiple burner furnace

S 24.033

Fuel-gas system for an automatically started, forced draught, multi-burner furnace/boiler

S 24.034

Control and safeguarding system for a manually started gas fired natural draught multiple burner furnace

S 24.037

Complex control loop for natural draft heaters - with CO as 2nd measurement

S 24.038

Complex control loop for natural draft heaters - with O2 as 2nd measurement

S 24.039

Complex control loop for natural draft heaters - with O2 & CO in equivalent O2 control

S 24.040

AMERICAN STANDARDS

Automatic Valves for Gas Appliances

Issued by: CSA/AM - CSA America, Inc.

ANSI Z21.21/CSA 6.5

http://sww.manuals.shell.com/HSSE/

http://sww.shell.com/standards/


Page 145

Recommended practice for analysis, design, installation, and testing of basic surface safety systems for offshore production platforms

API RP 14C

Burners for fired heaters in general refinery services API RP 535

Instrumentation, control, and protective systems for fired heaters API RP 556

Calculation of heater-tube thickness in petroleum refineries API STD 530

Fired heaters for general refinery services API STD 560

Boiler and combustion systems hazards code NFPA 85

EUROPEAN STANDARDS

Automatic shut-off valves for gas burners and gas appliances EN 161

Industrial thermoprocessing equipment – Part 2: Safety requirements for combustion and fuel handling systems

EN 746-2

Industrial valves – Testing of valves – Part 1: Pressure tests, test procedures and acceptance criteria – Mandatory requirements

EN 12266-1 (2003)

Water-tube boilers and auxiliary installations – Part 8: Requirements for firing systems for liquid and gaseous fuels for the boiler

EN 12952-8

INTERNATIONAL STANDARDS

Functional safety of electrical/electronic/programmable electronic safety-related systems

IEC 61508

Functional safety - Safety instrumented systems for the process industry sector

IEC 61511

Welding — Fusion-welded joints in steel, nickel, titanium and their alloys (beam welding excluded) — Quality levels for imperfections

ISO 5817

Metallic flanges ISO 7005

Petroleum and natural gas industries - Offshore production installations – Basic surface safety systems

ISO 10418

Petroleum, petrochemical and natural gas industries — Calculation of heater-tube thickness in petroleum refineries

ISO 13704

Petroleum, petrochemical and natural gas industries fired heaters for general refinery service

ISO 13705

Documents

32242044_Spec_2013-09_A00