123doku.com

White paper Safety Compliance and Cost-effectivenessFinally, many of the operatingstrategies and capabilities requiredto accommodate various options thatwater-tube boilers need cannot beaccommodated with these typesof BMSs.Comparison of microprocessorand PLC-based BMS solutionsMicroprocessor-based BMS Provides limited flexibility Is not appropriate for multi-burner systems Has a single flame scanner Yields limited information regarding statusand shutdowns Difficult networking communicationsPLC-based BMS Provide great flexibility Extend communications capabilitiesdramatically Have both single- and multiple-burnercapability Provide diagnostics, if programmed intothe PLC Are much easier to troubleshoot Allow use of various flame scannersThe rise of the PLC-based BMSOf all BMS designs, PLC-based systemsoffer the most capabilities andbenefits, especially implementationflexibility. When these systems firstdebuted, they replaced relays andtimers, which helped reduce wiring,and could be programmed. Early PLCbased BMS solutions often came withpanel indicator lights, push-buttons andselector switches instead of today’ssophisticated HMIs.Typically in these early PLC-based BMSs,if another function was required, thenanother indicator light had to beadded to the panel. This meant thatif an application needed many safetydevices or options, then it would havea multitude of lights and operatorswitches. The problem with thesekinds of systems is that operatorshave to watch for the indicator lightsto go on or off. If they overlook theindicators because they’re not presentor distracted, an operating issue canturn critical, leading to an accident.Today’s HMIs, in contrast, offer muchmore information to operators andmaintenance personnel via specificsoftware packages or flat-panelcomputers whichever they may prefer.Among the main advantages of a PLCbased BMS is more flexibility, especiallyin designing systems for specificapplications. In water-tube boilers,for example, customers typicallyrequire a wide variety of features andalso want their BMS to connect withexisting systems, such as a buildingmanagement system, a manufacturingexecution system, distributed controlsystem, or to other parts of their plant.PLC-based BMS solutions can controlsingle burners or multiple burners,while providing much more operatinginformation and diagnostics. Forexample, they can indicate whethera specific damper is not open or notclosed, or if particular valves arefunctioning as they should. BMSdesigners can choose flame scannersfrom any manufacturer. For redundancy,they can use more than one flamescanner. As one of the examples,when coupled with special voting logicin the PLC, this redundancy can providethe basis for high integrity systemsthat eliminate unnecessary shutdownsdue to faults in an I/O circuit or fielddevice. Predictive maintenance canbe programmed into the systems, whilediagnostics make them much easierto troubleshoot.Safety standards governingBMS designMany standards govern BMS design,among them are the NFPA, ISA,and TÜV as previously described.Equipment standards also apply, suchas the Underwriters Laboratories (UL)that govern the components that arein such a system, as well as approvalsfrom FM and IRI organizations. Mostof these standards refer to what iscalled “as listed,” a term used frequently.But what’s not common is a pieceof equipment that’s standards-listedas a whole. Altogether, manystandards have roles in decidingBMS safety requirements.A white paper issued by: Siemens. Siemens Industry, Inc. 2018. All rights reserved.In the U.S., implementation isgoverned by the NFPA. NFPA 85applies to boilers, while NFPA 86applies to furnaces and ovens. The2015 revision updated many partsof these standards. NFPA 85 allowsthe use of safety PLCs, when SIL 3capable, for both BMS and combustion(process) control in single burnerboilers. It does require that multiburner boilers feature a masterfuel trip (MFT) relay, which is anelectromechanical relay used to tripall required system components,including the fuel shutoff valves, incase of unsafe conditions. It alsomandates that a hard-wiredconnection exist between the MFTrelay and a flame safeguard. This canshut down the boiler’s fuel supply,if sensors indicate that its flamehas failed.In contrast, NFPA 86 does not requirean MFT relay, providing for directvalve control of fuel gas or oil. It alsoremoves the hard-wired connectionrequirement of the flame safeguard.This allows the use of safety-rated PLCsin BMS and combustion control systemdesigns. (NOTE: While this implies thatsafety PLCs can only be used on NFPA86 applications, they can be usedequally well with NFPA 85 and 86. Infact, we have used them on boilers.)In NFPA 86-2015, for example, ratingsof the Safety Integrity Levels (SILs) ofan overall system design depend onthe lowest (less safe) SIL level of asystem component – the lowestcommon denominator. So, if a systemincorporates a safety PLC with a SIL 3rating, but the sensors and limitswitches are wired in a way thatachieves a SIL 1 rating, the overallsystem will be rated SIL 1.NFPA 86-2015 specifically defineskey terminology as related to furnaceapplications. Most important is thedefinition of a flame safeguard. It’sa safety control device that respondsto flame properties, senses a flameand indicates if a flame is present ina burner.

White paper Safety Compliance and Cost-effectivenessIn prior versions, the flame sensordirectly de-energized the fuel safetyvalve in the event of a flame failure.Now the flame safeguard that sensesthe flame only provides an indicationwhether a flame exists or has been lost.It no longer has to be hardwired to thefuel safety valve. This is of criticalimportance, as now the flame safeguardcan be connected to a PLC controller inlieu of a direct connection to the safetyvalve circuit.Regulations SummaryAs BMS systems have evolved, so to havethe standards that govern them andestablish the best practices for theirimplementation and use. The NationalFire Protection Association (NFPA) andUL have written most of the regulations.Other guidelines are provided byfactory documentation.Specifically, NFPA 85 (Boiler andCombustible Systems Hazard Code) coversboilers delivering less than 12.5 millionBTU/hr.; NFPA 86 (Standard for Ovens andFurnaces) covers virtually all applicationsother than boilers. UL 795 (CommercialIndustrial Gas Heating Equipment) appliesto systems delivering less than 400,000BTU/hr., while UL 508 (Industrial ControlEquipment) governs construction standards. Generally accepted design standardscan vary based on the manufacture.For PLC-based BMSs, implementation isgoverned by the NFPA. Implementationof the PLC logic and other components,such as timers and relays, is crucial forsafe systemic operation. Importantly,safety integrity levels (SIL) can be affectedby improper implementation of the hardwired portion of BMS systems, so the BMSsystem design is critical.Other key changes In NFPA 86-2015include the following:l Safety shutdown – This is nowdefined as “stopping operationsby means of a safety control orinterlock that shuts off all fueland ignition energy in a mannernecessitating manual restart.”Another definition change is the“proof-of-closure” switch. Whiledetermining the position of thevalve, whether oil or gas, there istypically a proof-of-closure switchthat verifies a valve is in a full closedposition. Before, the code said thatthis was to be built into the switchby the manufacturer and beactivated when the valve closed.NFPA 86-2015 removed the partthat said it was “installed in a safetyshut-off valve by the manufacturer.”This particular change now allowsthe user to maintain the switch,adjust it and replace it if necessary.Previously the complete fuel valvehad to be replaced.l Emergency shutdown valve – Thismanual shutoff valve cuts off asystem’s fuel, oil or gas, in caseof a problem. The fuel typicallyresides outside the room where theequipment is located or outside thebuilding in case of a small building.This way, if the whole structure is inflames, the burner flame can still beshut off from outside the building.Safety PLC standardsNFPA 86-2015 section 8.4 covers theuse of PLCs in BMS designs, startingwith section 8.4.1 defines PLCs andtheir use. Section 8.4.4 defines therequirements for application of safetyPLCs new. Because it is independentfrom the sections before it, thestandards for conventional PLCs neednot be followed, if a safety PLC is used,given the accepted safety principlesthat are inherent in safety PLCs.The most important point of this partof NFPA 86-2015 is that the processorand I/O will be listed for control reliableservice (not burner-specific) with a SILrating of at least 2.Also, the section states that safetyfunctions shall be restricted to acertain area of the PLC. This answersthe question about needing separatePLCs for combustion control andburner management, the latter ofwhich is essentially a safety function.That is, if a safety PLC can also meetthe code required for combustioncontrol, one safety PLC can do both.Note, however, that this does notapply to boiler BMS designs, which aregoverned by NFPA 85-2015. In otherwords, while combustion and burnercontrol can use same safety PLC inA white paper issued by: Siemens. Siemens Industry, Inc. 2018. All rights reserved.furnaces, these functions must beseparate in boilers. More specifically,NFPA 86-2015 says that all safetyfunction sensors and final controlelements shall be independent ofoperating sensors and final controlelements shall be independent ofoperating sensors and final controlelements. For example, if a limitswitch, a pressure switch or an airflow transmitter is used in a boilerBMS design on the safety side of thesystem, then the same transmittercannot be used on the control side.Safety PLC-based BMS benefits Increased safety at little-to-no addedcost, to lower risk profile and saveinsurance costs, not to mention lives More security, to protect system integrityand provide additional peace of mind Greater deployment flexibility, toprovide cost-saving placement andmulti-burner/facility options Improved operational visibility/efficiency/flexibility, to lower fuel,training and labor costs, as well asfaster troubleshooting Improved uptime, to reduce costlydowntime, via predictive maintenanceand preemptive diagnostics Future-proof, to provide cost-effectiveexpandabilityThere are four exceptions to the use ofa safety PLC:l Manual emergency switches,because a BMS needs to have amanual way of shutting down,irrespective of the state of the PLC.l Continuous vapor controllers mustoperate outside of the PLC. Thisrefers to trying to operate a sensoror an analyzer must be outside thePLC to make the decision when thevapor concentration is too high.l Flame safeguards must operateoutside the PLC. That is, if astandard flame detection systemis used that has a contact closureoutput, that contact closure can bewired to a safety-rated input on aPLC, so the flame sensor becomesa flame switch. This shows if aflame exists or not, so the logicand response can be moved to thesafety PLC.

White paper Safety Compliance and Cost-effectivenessl Excess temperature limitinterlocks that use a temperaturecontroller, wired in series with thegas valve control signal from thePLC, so that the limit controller canshut down the gas valve, even if thePLC fails or is no longer in service.Burner Management Systems:Design best practicesAdvancements in PLC technology,especially safety-rated PLCs, haverevolutionized BMS design. SafetyPLCs are important because safetyis a core goal of a BMS, along withoperational control and efficiency.Today BMS designers can achievethese goals cost-effectively with asafety PLC. With this point in mind,let’s look at the following four bestpractices in BMS system designand then consider each one ingreater detail:l Meet and exceed NFPA safety-standards, up to SIL 3, plus UL,FM, IRI and NEMA standards;l Ensure critical input checking aswell as diagnostics for predictivemaintenance and troubleshooting;l Simplify burner operation via aneasy-to-use HMI, with remoteaccessibility and alarming;l Communicate with higher-levelsystems, such as buildingmanagement systems or DCSsystems for facility- and enterprisewide control;l Meet and exceed NFPA safety-standards While the NFPAstandards clearly define the safetyfeatures that BMS solutions require,many system design generalists –developers of conveyor systems,packaging systems and, today, aBMS – often think that just readingthrough the NFPA standards issufficient for compliance.But it’s not quite that simple. Tocomply with the NFPA standardsup to SIL 3 and, at the same time,meet UL, FM and IRI standards,designers need to properlyimplement the system inputs andoutputs in order to dynamicallymanage the flame controls andsafety features. While NFPAstandards clearly define the safetyfeatures and requirements of aburner management system –developers of conveyor systems,packaging systems, or other controlsystems (companies that might notregularly engage in designing burnermanagement systems) need toknow much more information thanjust what is contained within theNFPA standards. Proper designand implementation of burnermanagement systems requiresburner knowledge, understandingof safety devices and valves, andhow all these components andsystems integrate with the boileror furnace.System security is also important.In many PLC-based BMS solutions,especially earlier generations,operators and maintenancepersonnel could access andmodify the PLC logic, often withoutdocumenting what they did. Inaddition, their modifications mighthave accomplished their intendedoptimization of one or more BMSfeature or function, but theyunknowingly may have sub-optimizedor even disabled a feature or featureset – increasing the system’saccident potential.With a safety PLC, all the front- andback-end logic and security comesbuilt-in, already developed andtested by the manufacturer, such asSiemens. If a safety PLC is used andimplemented correctly in a BMSdesign, the SIL 3 requirement is metright from the start. What’s more,NFPA, FM and IRI requirements willnot only be complied with but alsoexceeded. What’s more, systemsecurity is assured and all logic anddata are backed up on a memorycard. Finally, safety PLCs offer ahigher level of security by leaving ahistorical trail of any modificationsmade to the program.A white paper issued by: Siemens. Siemens Industry, Inc. 2018. All rights reserved.These systems are compatiblewith other PLC systems, too, so ifthere are other ones in the plantwith which the BMS needs tocommunicate, it can be done easily.Last, BMS designs can incorporatesafety PLCs for not much more costthan a standard PLC – but withmuch more functionality, safetyand value.l Ensure critical input checkingCritical input checking refers tothe continuous and automaticassessment by a safety PLC that itsinputs are working. If a BMS doesnot use a safety PLC, then theNFPA mandates that the systemdesigner needs to develop andimplement a strategy to verify thatthese inputs are not failing in an“on-state.” Safety PLCs monitor theiroutputs to ensure they do not fail inan “on” state. This same capability isnot built into a standard PLC, whichotherwise required that layers ofredundancy be built into the systemdesign. Also, the NFPA requiresredundancy on output fuel valvecircuits. For example, some BMSdesigns have three relays, all ofwhich have to open in an on-stateto shut off the safety valve.BMS boiler designs must include awatchdog timer. This is used todetect and shutdown the burner(s)in case of a PLC timing fault. Duringnormal operation, the PLC willregularly send a continuous pulseto the watchdog timer to keep itfrom timing out. Then, should ahardware or software malfunctionoccur the watch dog timer will tripthe burner. Safety PLCs utilize manymore safety algorithms, whicheither eliminate or minimize theneed for a watchdog timer.Good BMS designs provide fail-safeshutdown of the fuel and ignitionsources. The systems should notifythe operator and maintenancepersonnel of the cause of theshutdown, and the system may evenoffer corrective advice to troubleshoot the cause of the shutdown.

White paper Safety Compliance and Cost-effectivenessIf problems do occur, these built-indiagnostics will enable fastertroubleshooting and help tominimize operational disruptions.Good system designs will alsoinclude trending and historicalrecording of operating parameters,which help troubleshooting andare useful for analyzing operatingefficiency. With historical data,operators can quickly tell whatsafety switch might have trippedrepeatedly during the night and fixthat particular switch, rather thanhaving to stand by and wait for asystem fault, then figure out whichswitch caused it. Historical alarmingand trending can prove to be usefultroubleshooting and predictivemaintenance tools that will improvereliability and reduce downtime.l Simplify burner operations viaan easy-to-use HMI Today’s HMI(Human-Machine Interface) hasprogressed far beyond yesterday’sindicator lights, MFTs and e-stopbuttons. Advanced HMIs, such asthe Siemens SIMATIC HMI ComfortPanel, incorporate all theseelements and are designed to beoperator-friendly – that is, easyto learn and to use. These new HMIscoupled with operator promptingmessaging and alarming, providefor easier operation making thetransition from a maintenancetechnician to an operatormuch easier.With a BMS using a Siemens HMI,operator information is readilyavailable and alarms areannunciated right on the HMI, sooperators can walk up and quicklysee all the operating conditions.The typical boiler screen shows theoperator the status of fuel valve(s),with color changes, all recentalarms, and easy navigation toother operator screens providingadditional operating information.It can also show gas and air flowsfor combustion control, animateddamper movements and position,and the status information for allother burner management andother related equipment. TheHMI enables easy viewing of alloperating information.Other HMI screens provideadditional information suchas boiler pressures, flows, valvepositions, valve open/closed statusand the ability to change theoperating set points as well asauto/manual control. Combustioncontrol set up screens provide forone person setting of the fuel aircurves eliminating the need for botha burner service engineer and a PLCexpert. The HMIs can also providepush-button access to schematicwiring drawings, piping andinstrument drawings, as well asdrawings for the furnace, oven orboiler. For example, all drawingscan be accessed with a simple PDFviewer, operators and maintenancepersonnel don’t have documentationis available at the touch of a button.Remote accessibility and alarmingare big conveniences that modernHMIs provide, tied into a safetyPLC-based BMS. Now, operators andmaintenance personnel can securelyconnect with a BMS from anywherein a plant facility, via its wirelessnetwork, or, via the Internet, fromanywhere in the world. They can usetheir smartphones and tablets tocheck in on a BMS and alarms canbe sent to them. This can free themfrom being physically present totake care of operating issues, so theycan attend to more important work.l Communicate with higher-levelDCS systemsAnother big feature of an advancedHMI – and one that best-practiceBMS design should incorporate –is the ability to communicate withother PLCs, higher-level buildingautomation and plant controlsystems, like a manufacturingexecution system (MES). Ofcourse, external communicationrequirements for a BMS will vary,depending on the facility, but plantoperators, environmental managersand management today want toknow more – like what the operatingissues are; what fuel consumptionis; how many run-time hours; andother data – so they can havegreater visibility into overallperformance to ensure maximumsafety and efficiency. HMIs nowfeature integrated USB interfacesfor simple archiving via a USB flashdrive as well as for communicatingvia field bus or Ethernet protocols.Siemens offers two safety PLC-basedBMS solutions:1. A basic, economical BMS based on theSiemens SIMATIC 1200F safety PLC.2. A mid-range BMS based on theSiemens SIMATIC 1500F safety PLC.A white paper issued by: Siemens. Siemens Industry, Inc. 2018. All rights reserved.

White paper Safety Compliance and Cost-effectivenessConclusionA major benefit of a safety PLC-basedBMS with an integrated HMI is easeof operation coupled with theavailability of operator status andalarm information both locally andremotely. Unlike traditional hard-wiredsystems that employ lights and analarm annunciator, an HMI candisplay and track the status of allvariables and alarm points in aconcise, easy-to-understand way.Start-up and trip issues are clearlydisplayed for operator attentionmaking troubleshooting easier.Safety PLC-based BMS systems canefficiently respond to critical eventsbased on a variety of highly robustcontrols and sensors. For integrationwith standard control schemes, thesesame PLCs can communicate withalmost any third-party control ormonitoring systems via a variety ofindustrial networking protocols.Finally, all this offers operators muchless risk and complexity, along withcompliance to all industry standards.At the same time, it provides a flexibledesign configuration that can savecosts and boost productivity.In all, safety PLCs in a BMS solutionincrease safety and system availabilityvia built-in safety checks and standardscompliance. They are easy to program,easy to configure and easy to use, withintegrated diagnostics, clear displaysof critical safety information on theHMI, remote operator access andmaintenance flexibility.A white paper issued by: Siemens. Siemens Industry, Inc. 2018. All rights reserved.

Application example for burnerinstallationsFor burner installations and furnacesolutions (continuous furnaces or boilermelting furnaces), new function blocksare at your disposal. On the one hand,the burner application example for TIAPortal supports all national and international standards EN 746-2, EN 676,EN 298, ISO 13577, NFPA 85/86, etc.and, on the other hand, all relevant andimportant functions such as:l Control of ignition/gas or oil burnersl Performing a (pre) purge of thecombustion chamberl Cleaning/blowing out an oil burnerl Performing a tightness test ongas valvesl Control and monitoring of airdampers (or actuators with discreteposition feedback)l Control and monitoring of analogactuatorsl Function for fail-safe evaluation ofstandard AI valuesThe function blocks are additionallyprepared for realization of an electronicratio control. To receive this burnerapplication example at no charge byemail, please send an email [email protected]: First and Last Name, contact number,Company and Company email address,with the email subject “Request forBurner Application Example”The Burner application example willbe sent to you, as a ZIP-file (@ 5 Mbyte)by email. It includes: Burner Libraryblocks for the PLCs S7-1200F,S7-1500F, Burner Library blocks forPublished bySiemens Industry, Inc. 2018.Siemens Industry, Inc.5300 Triangle ParkwayNorcross, GA 30092usa.siemens.com/safetyOrder No: SFWP-BMSWP-0318Printed in USA 2018 Siemens Industry, Inc.the PLC S7-300F and detailedDocumentation. The (archived) librarymust be integrated into the TIA Portal(Extras Global Libraries RetrieveLibrary ) and will then be available inthe tab “Libraries”.DisclaimerThe products and information,described herein were developed forthe assumption of safety-orientedfunctions as part of an overall systemor machine. A complete safetyoriented system generally comprisessensors, evaluation units, signalingdevices and concepts for safedisconnection.The assurance of a system‘s ormachine‘s correct overall functioningshall lie in the area of responsibilityof the respective system or machinemanufacturer. Siemens AG, includingits subsidiaries and affiliatedcompanies (hereinafter referred to as“Siemens”), is not able to guaranteeall characteristics of an overall systemor machine not designed by Siemens.M

management system (BMS). These systems are used in all boiler designs - water-tubes, fire-tubes and flex-tubes - and in furnaces, ovens and kilns as well as flares. Wherever a flame is present in an industrial environment, safety standards today require a BMS. The purpose of a BMS is to prevent . explosions and to control the