36C24420I0363-004.pdf

September 2008 1

VHA Boiler Plant Safety Device Testing Manual Third Edition

By

Thomas Burch David F. Dyer Glennon Maples

Produced Under Contract GS10F0264M With

The United States Department of Veterans Affairs

By

BEI, LLC

P.O. Box 2255

Auburn, Alabama 36831-2255

September 2008

September 2008 2

ACKNOWLEDGEMENT

This document was prepared for use in training and conducting safety reviews for the United States Department of Veterans Affairs under contract GS10F0264M.

DISCLAIMER

The views, opinions, interpretations, and analyses expressed in this manual are those of the authors and any cited references. Although considerable effort has been extended to portray factual information and scientifically authentic technical material, the authors and publisher assume no responsibility in any consequences resulting from use of any part of the information contained herein.

Third Edition Copyright 2008. Thomas Burch, David F. Dyer, and Glennon Maples All rights reserved.

No part of this manual may be reproduced by any means, nor transmitted, nor translated into machine language without the expressed written permission of the publisher. An exception to this prohibition is that the United States Department of Veterans Affairs (VA) is free to use the material in whole or part for any purpose via any means available within the VA only.

Printed in the United States of America Published by: BEI, LLC P.O. Box 2255 Auburn, Alabama 36831-2255

September 2008 3

1 INTRODUCTION

1.1 OBJECTIVE

1.2 BACKGROUND INFORMATION

1.3 GENERAL OBSERVATIONS ON SAFETY TESTING

1.4 NOMENCLATURE

1.5 PREPARATION OF SYSTEM FOR SAFETY TESTING

2 WATER LEVEL CONTROL

2.1 LOW WATER CUTOFFS

2.2 LOW WATER ALARM

2.3 HIGH WATER ALARM

2.4 OVERFLOW DRAIN SYSTEM

3 PRESSURE CONTAINMENT

3.1 SAFETY VALVES

3.2 RELIEF VALVES

3.3 HIGH STEAM PRESSURE LIMIT SWITCHES

3.4 BOILER HYDROSTATIC TESTING

4 FUEL TRAIN SAFETY DEVICES

4.1 LOW PRESSURE FUEL CUTOFF SWITCH

4.2 HIGH PRESSURE FUEL CUTOFF SWITCH

4.3 VENTING BETWEEN AUTOMATIC GAS SHUTOFF VALVES

4.4 LEAK TEST OF AUTOMATIC FUEL SHUT OFF VALVES

4.5 OIL LOW ATOMIZING MEDIA PRESSURE SWITCH

4.6 AUTOMATIC FUEL SHUTOFF VALVE PROOF OF CLOSURE SWITCH26

5 BURNER AND AIR TRAIN SAFETY DEVICES

5.1 THE FLAME SCANNER

5.2 LOW FIRE PROVING SWITCH

5.3 COMBUSTION AIR FLOW SWITCH

5.4 PURGE AIR FLOW PROVING SWITCH

5.5 BURNER POSITION SWITCH

5.6 FORCED DRAFT MOTOR INTERLOCK

5.7 FURNACE PRESSURE INTERLOCK

5.8 OUTLET DAMPER POSITION INTERLOCK

5.9 FORCED DRAFT DAMPER WIDE OPEN PRE-PURGE PROVING

SWITCH

5.10 PRE-PURGE AND POST-PURGE TIMERS

5.11 IGNITER TIMER AND MAIN FLAME IGNITION TIMER

5.12 AUTOMATIC FUEL SHUTOFF VALVE CLOSURE TIME AFTER MAIN

FLAME FAILURE

5.13 AUTOMATIC FUEL SHUTOFF VALVE CLOSURE TIME AFTER

IGNITION FLAME FAILURE

5.14 MINIMUM PILOT FLAME TEST

5.15 CONTROL AIR PRESSURE INTERLOCK

5.16 FLUE GAS RE-CIRCULATION DAMPER SET FOR PRE-PURGE

5.17 LOW FLUE GAS OXYGEN LEVEL INTERLOCK

5.18 INTERLOCK OF OUTSIDE AIR DAMPER WITH BURNER

MANAGEMENT SYSTEM

September 2008 4

Appendix A STEP BY STEP TEST PROCEDURES Appendix A.1 INTRODUCTION Appendix A.2 BASIC INFORMATION Appendix A.3 GENERAL REQUIREMENTS FOR TESTING Appendix A.4 Detailed Test Procedures - Checklists Checklist for High Water Alarm on Condensate Tank (HWACT) Checklist for Low Water Alarm on Condensate Tank (LWACT) Checklist for High Water Alarm on Deaerator Tank (HWADT) Checklist for Low Water Alarm on Deaerator Tank (LWADT) Checklist for Deaerator Overflow Drain System (DAODS) Checklist for Deaerator Safety Valve (DASV) Checklist for Safety Valve Following PRV (SVFPRV) - Steam Checklist for Liquid Relief Valve on Oil Pump Set (LRVOPS) Checklist for Liquid Relief Valve on Economizer (LRVE) Checklist for Control Air Pressure Interlock (CAPI) Checklist for Propane Pilot Backup System Checklist for Carbon Monoxide and Combustible Gas Alarms in the Boiler Plant Checklist for Outside Air Damper Interlock (OADI) Checklist for Low Water Alarm and Cutoffs on Boiler (LWA/LWCO/ALWCO) Checklist for High Water Alarm on Boiler (HWAB) Checklist for Recycle and Non-Recycle Boiler Steam Pressure Limit Switches

(RBSPLS & NRBSPLS)

Checklist for Steam Safety Valves on Boiler (SVB) Checklist for Low Fuel Gas Pressure Cutoff Switch (LFGPCS) Checklist for High Fuel Gas Pressure Cutoff Switch (HFGPCS) Checklist for Automatic Fuel Gas Shutoff Valves and Solenoid Vent Valve Seat Leakage (AFGSOV & AFGSVV) – Main Gas Line Checklist for Automatic Pilot Fuel Gas Shutoff Valves and Automatic Pilot Fuel Gas Solenoid Vent Valve Seat Leakage (APFGSOV & APFGSVV) – Pilot Line Checklist for Proof of Closure on Automatic Fuel Shutoff Valves (POC-AFGSOV) – Natural Gas Checklist for Flame Scanner-for main flame out (FSMFO) Checklist for Flame Scanner Not Sensing Igniter Spark (FSNSIS) Checklist for Igniter Timing (IT) Checklist for Main Flame Ignition Timing (MFIT) Checklist for Pre-Purge and Post-Purge Timing (PPT) Checklist for Low-Fire Proving Switch (LFPS) Checklist for Forced Draft Damper Wide-Open Pre-Purge Proving Switch

(FDDWOPS)

Checklist for Combustion Air Pressure Switch (CAPS) Checklist for Purge Airflow Proving Switch (PAPS) Checklist for Forced Draft Motor Interlock Switches (FDMIS) Checklist for Outlet Stack Damper Interlock Switch (OSDI) Checklist for Furnace Pressure Interlock (FPI) Checklist for Low Pilot Fuel Gas Pressure Cutoff Switch (LPFGPCS) Checklist for Flue Gas Recirculation Damper Interlock (FGRDI) Checklist for Low Flue Gas Oxygen Level Interlock (LFGOLI) Checklist for Low Fuel Oil Pressure Cutoff Switch (LFOPCS)

September 2008 5

Checklist for High Fuel Oil Pressure Cutoff Switch (HFOPCS) Checklist for Low Atomizing Media Pressure Switch (LAMPS) Checklist for Low Atomizing Media Differential Pressure Switch (LAMDPS) Checklist for Automatic Fuel Oil Shutoff Valves (AFOSV) - for Seat Leakage Checklist for Proof of Closure on Automatic Fuel Oil Shutoff Valves (POC-AFOSV) – Oil Checklist for Oil Burner Position Switch (OBPS) Checklist for Water Treatment Checklist for General Plant Safety & Reliability Sign In Sheet

September 2008 6

1 INTRODUCTION

1.1 OBJECTIVE

The purpose of this manual used with manufacturers’ manuals and design set points is to support the development of an individual boiler plant safety program for your specific boiler plant. The text presents a concise and thorough treatment of boiler safety as applied to automatically-fired gas and oil, heating and process boilers and boiler support equipment servicing healthcare facilities. The text includes a description of each boiler safety device, how it works, what its purpose is, and how to test the device. The safety devices are organized by categories in four chapters: Water Level Control, Pressure Containment, Fuel Train Safety Devices, and Burner and Air Train Safety Devices. A fifth chapter provides detailed step by step procedures for testing every device covered. This chapter can be used as a checklist and guide for safety testing. Some boilers will not include all of these devices.

The text does not replace existing standards. It succinctly states the main import of the standards. The final guide to safety should include all applicable standards. However, the testing envisioned in this text is far more rigorous than current industrial practice, even though the basic concept of this manual is that all boiler safety devices should consistently function properly. Proper function requires 1) proper installation, 2) proper calibration, and 3) proper activation. In situations that may arise where adherence to this manual would adversely affect the operation of the boiler, special authority may be requested to deviate from the manual through the Director, Health Care Engineering

(10NB).

1.2 BACKGROUND INFORMATION

One must understand that the use of the term “boiler” may refer to the system that includes the generation, distribution, and use of steam. There are many safety devices such as level alarms, safety valves, relief valves, etc that are found on the components involved in the distribution and use of steam. The safety checks are necessary and must be conducted on all devices in the system in order to insure that the system is safe.

It is important that one has the manufacturer’s manuals on all equipment to be tested before beginning the tests described herein. This is essential to know the manufacturer’s recommended operating conditions, the wiring diagram, etc.

1.3 GENERAL OBSERVATIONS ON SAFETY TESTING

1.3.1 Items to be Checked on Any Interlock Device

Many safety devices utilize switches that actuate based on some set point to automatically alarm or shut the boiler off by shutting the two automatic fuel shut off valves. It is extremely important that one recognize that there are four attributes to such systems required for proper operation. These are:

• The switch must be in the right place.

• The switch must have the proper setpoint.

• The switch must activate at the proper setpoint.

• The switch must produce the desired effect.

September 2008 7

All safety testing described in this text involving such switches centers around making sure that all these requirements are met. The most common failure in this regard is a failure to insure that the switch has the proper set point which requires measuring operating parameters in order to determine the proper set point.

1.3.2 Confirming That All Devices Actually Function for Intended Purpose In testing any interlock device that operates through the automatic control system, it is paramount that the testing procedure verifies compliance with the four requirements listed above.

1.3.3 Lockable Valve Requirements

In order to facilitate testing of some types of interlock devices, it is sometimes convenient to temporarily isolate the interlock device and provide test ports by means of manual valves. However, these modifications cannot be allowed to increase risk by locking out a safety device during normal operation and should clearly indicate test and normal position. Any such manual valve that could isolate a safety device from its normal operating circuit should be lockable and the lock should be lockable only in the correct operating position.

1.3.4 Confirming That Jumpers Are Removed and Valves Properly Locked In many cases in order to test a device, it will be necessary to either electrically jumper (bypass) a device or to valve out the device. The safety testing personnel should only carry a fixed number of jumpers and should make sure that at the end of a test that all jumpers being used are accounted for and that all lockable valves are locked in their correct position.

1.4 NOMENCLATURE

AFOSV Automatic Fuel Oil Shutoff Valves ALWCO Auxiliary Low Water Cutoff

APFGSOV Automatic Pilot Fuel Gas Shutoff Valves APFGSVV Automatic Pilot Fuel Gas Solenoid Vent Valve CAPI Control Air Pressure Interlock

CAPS Combustion Air Pressure Switch DA Deaerator DAODS Deaerator Overflow Drain System DASV Deaerator Safety Valve

FDDWOPS Forced Draft Damper Wide-Open Pre-Purge Proving Switch FDMIS Forced Draft Motor Interlock Switches FGRDI Flue Gas Recirculation Damper Interlock

AFGSOV Automatic Fuel Gas Shutoff Valves and Solenoid Vent Valve AFGSVV Automatic Fuel Gas Shutoff Solenoid Vent Valve FPI Furnace Pressure Interlock FSMFO Flame Scanner-for main flame out

FSNSIS Flame Scanner Not Sensing Igniter Spark HFGPCS High Fuel Gas Pressure Cutoff Switch HFOPCS High Fuel Oil Pressure Cutoff Switch

HWAB High Water Alarm on Boiler HWACT High Water Alarm on Condensate Tank HWADT High Water Alarm on Deaerator Tank

September 2008 8

IT Igniter Timing LAMDPS Low Atomizing Media Differential Pressure Switch

LAMPS Low Atomizing Media Pressure Switch LFGOLI Low Flue Gas Oxygen Level Interlock LFGPCS Low Fuel Gas Pressure Cutoff Switch LFOPCS Low Fuel Oil Pressure Cutoff Switch

LFPS Low-Fire Proving Switch LPFGPCS Low Pilot Fuel Gas Pressure Cutoff Switch LRVE Liquid Relief Valve on Economizer

LRVOPS Liquid Relief Valve on Oil Pump Set LWA Low Water Alarm LWACT Low Water Alarm on Condensate Tank LWADT Low Water Alarm on Deaerator Tank

LWCO Low Water Cutoff MFIT Main Flame Ignition Timing MV Manual Valve

NRBSPLS Non-Recycle Boiler Steam Pressure Limit Switch OADI Outside Air Damper Interlock OBPS Oil Burner Position Switch OSDI Outlet Stack Damper Interlock Switch

PAPS Purge Airflow Proving Switch POC_AFOSV Proof of Closure on Automatic Fuel Oil Shutoff Valves POC-AFGSOV Proof of Closure on Automatic Fuel Shutoff Valves

PPT Pre-Purge and Post-Purge Timing PRV Pressure Reducing Valve RBSPLS Recycle Boiler Steam Pressure Limit Switch

SVB Steam Safety Valves on Boiler SVFPRV Safety Valve Following PRV

TP Test Port

1.5 PREPARATION OF SYSTEM FOR SAFETY TESTING

The normal boiler installation does not generally allow easy access and control for testing. Safety testing is an ongoing activity for safe boiler plant operation.

Modifications should be made to allow safe convenient testing. In this section a discussion is given of system modifications that will allow easy testing. The discussion is organized around classes of different safety devices. For detailed drawings illustrating a convenient test setup for each device, refer to the safety testing procedures given in the appendix.

1.5.1 Setup for testing a Steam Safety Valve Following a PRV

In order to test a safety valve following a PRV, a manual isolation valve should be installed downstream of the safety valve so that the valve can be tested without raising the pressure on the system downstream of the valve. (See Figure 1.1)

September 2008 9

HWA (PROBE)

OVERFLOW PROBE

Steam

Makeup / Condensate

Vent

10 Psig 500-1000 lb/hr

Vac Breaker

DASV

SVFPRV

Vent

DA TANK

PRV

Bypass Valve

MV

Figure 1.1 Safety Valve Following a PRV

1.5.2 Setup for testing a combustion air switch, purge air switch, furnace pressure switch, control air pressure switch, and high pressure switches for main gas and pilot.

In order to test these switches it is convenient to be able to temporarily isolate these switches from the normal pressure source and to apply test pressures that can be accurately measured. At the same time the piping should be such that the actual pressure that the switch senses can also be measured. The arrangement that is pictorially shown in Figure 1.2 for testing the combustion air pressure switch allows this objective to be met for all switches covered in this section.

September 2008 10

TP

Inlet

Outlet

Inlet

Vanes Vanes Outlet

Lock TP

TP

CAPS

Open

Figure 1.2 Air Pressure Switch

1.5.3 Setup for Leak Checking Oil and Gas Block Valves and Gas Bleed Vent

Valve In order to easily test for leaks in the block valves a test port (TP) and pressure gage must be available both in the line between the valves and downstream of the second valve. Also in the case of gas, a lockable manual valve downstream of the solenoid bleed vent valve is required. A port and pressure gage in the line between the solenoid valve and lockable manual valve is also needed. Note, there are two test ports (TP) for determining normal operating pressures and one test port (TP) for testing the isolated interlock. This arrangement is schematically shown for natural gas in Figure 1.3 and Figure 4.4 for oil fuel.

September 2008 11

LFGPCS

HFGPCS

LOCK OPEN

C

NO

LO

RT

FL

WO

LFGPCS AFGSOV

BLOCK AND BLEED SYSTEM

Main Gas Line

HFGPCSAFGSOV

TP

TP

TP

TP

AFGSVV

CONTROL

FUEL FLOW

LOCK OPEN

Figure 1.3 Leak Checking Automatic Shutoff Valves

1.5.4 Setup for Checking Dangerous Gas Detection System For the Building Sample gas with a level of CO and combustibles slightly exceeding the sensor set points should be available with a means to supply the gas to the sensor per the manufacturers test procedures.

1.5.5 Setup for Checking the Deaerator Overflow System and Oil Liquid

Relief Valve A sight glass with turbine wheel should be installed downstream of the valve in order to visually confirm that flow exists. The oil liquid relief valve also requires a pressure gage at the pump discharge.

1.5.6 Setup for Checking Proof of Closure Switches, Low Fire Proving Switch, Force Draft Damper Vane Interlock, Outlet Stack Damper Interlock, Recycle Steam Pressure Switch, Non-recycle Pressure Switch, Primary Low Water Cutoff, and Recirculation Damper Interlock

It is necessary to electrically isolate these switches for testing. The two electrical leads from each of these switches should be wired into an electrical control panel and the terminals to which they run should be clearly identified. Only one wire should be under a given terminal.

1.5.7 Setup for Hydrostatic Testing

In order to hydrostatically test any device it is necessary that valves are available to isolate the device, a test port is available to apply the test pressure, and a pressure gage is available to monitor the pressure in the device (See Figure 1.4). All devices that could be damaged by the test pressure must be removed prior to conducting the hydrostatic testing.

September 2008 12

In from DA

Drain

Economizer

MV

MVMV

TP

LRVE

View Port Boiler Feedwater

Figure 1.4 Hydro Testing

September 2008 13

2 WATER LEVEL CONTROL

2.1 LOW WATER CUTOFFS

2.1.1 Description

A low water cutoff is a device that causes causing the automatic fuel safety shutoff valves to close if the water level in the boiler drops below a pre-set safe level. Low water causes about 50 percent of all boiler incidents. Low water can cause the boiler to overheat which could lead to the failure of the pressure vessel with enormous potential damage (explosion). Two low-water cutoffs are required. Low-water cutoffs operate either on a “float” system or electrode system. In the float system there is a cross arm connection to the boiler (high and low connection points). Between these connection points there is a vertical section containing a volume sufficient to house the float. If the water level falls below a prescribed level, the falling float will cause a switch to actuate causing the automatic fuel valves to close. (See Figure 2.1)

LWCO

FLOAT

FLOAT

SHUNT

LWCO

PROBE

SHUNT

PROBE

Figure 2.1 Low Water Cutoff

In the electrode system, there is a similar cross arm arrangement as in the float system.

Probes extend vertically downward into the vertical pipe connecting the cross arms. The electrodes are located at the bottom of the probe and are used to measure the conductivity of the media in which the electrodes are immersed. The conductivity of water is much higher than steam. Hence, if the water level drops below the probe, a drastic change in conductivity occurs. This change is used in an electrical circuit to cause the automatic fuel shut-off valves to close. Most safety codes require at least one float system be included to protect against low water. This is shown in Figure 2.1. The

VA requires one float and one probe. True redundancy requires two separate cross arm arrangements. Use of a single cross arm could lead to a situation in which blockage in the cross arm renders both level control safety devices useless.

Some low-water cutoffs are provided with non-latching “shunt” switches by which the cutoff switch is bypassed. Arrangements for shunt switches include individual shunt

September 2008 14 switches on one or both cutoffs or a switch which shunts both cutoffs. Operators can use the shunt switch in “testing” of the low-water cutoff to prevent the boiler from shutting off. Operators electrically check the low-water cutoff using this method. When no shunt is available or the shunt is across both low water cutoffs, it is necessary to use an electrical jumper to temporarily by-pass one cutoff in order to test the other cutoff.

A boiler control system should never allow the boiler to automatically restart after a low-water cutoff has actuated to stop boiler operation.

A detailed step by step test procedure is given in Appendix A.

2.1.2 Consequences of Low Water Cutoff Failure

If the low water cutoffs both fail, the boiler would then be fired with no water in the boiler. This will cause the metal temperatures to rise rapidly and the metal strength to be significantly decreased. In fire tube boilers the main Morrison tube typically collapses which could allow steam onto the boiler fireside. The steam pressure has been known to blow the ends out of the boiler through concrete block walls a distance of hundreds of feet. Similar catastrophes could occur in water tube boilers.

2.1.3 Testing a Low Water Cutoff

Low-water cutoffs must be tested in a mode in which they fail. Testing is basically done by allowing the water level to lower in a “slow drain”. In order to be in a realistic mode, one must not follow a procedure that actuates the cutoff by rapidly blowing off a volume of water from the cross arms. This is very important in testing a float type cutoff. It is recommended that the rate of decrease in water level be a maximum of 1 inch/minute.

A detailed step by step test procedure is given in Appendix A.

2.2 LOW WATER ALARM

2.2.1 Description

The low water alarm provides audible and visual warnings that the water level is approaching a dangerously low level. These alarms are based either on a conductivity probe or float as described in the previous section. These alarms are used on the boiler, deaerator and condensate receiver tanks. On the boiler, the low water alarm must be set to activate before either of the low water level cutoff switches shuts off the boiler.

On the deaerator and condensate receiver tanks, the alarm is the only indication of a low water problem. On these devices the setting should be above the point of pump cavitation and with visible water in the sight glass. The alarm should not be set so high that it causes excessive alarm activation. Of course lack of water in the deaerator or condensate receiver will quickly result in loss of water to the boiler with the problems described in the section of low water level control.

The alarm testing should include a careful consideration as to whether the alarm setpoint is at the correct level for its intended purpose.

2.2.2 Consequence of Water Level Alarm Failure

Low water in a condensate or deaerator tank is a precursor to low water failure in a boiler with the problems described above. There is also the hazard of damage to a

September 2008 15 condensate transfer or boiler feed pump from running dry. A low water alarm on a boiler is a warning to operators of an impending potential problem of a “boil out” of water.

2.2.3 Testing Low Water Alarms

This alarm is tested by causing a drop in water level in the vessel being tested. The alarm should activate at the desired setpoint (the setpoint must be above the level at which dangerous operations will occur, at a level allowing operators to restore the proper level, and visible in the appropriate sight glass).

A step by step procedure is given in Appendix A for three situations: boilers, deaerators, and condensate tanks.

2.3 HIGH WATER ALARM

2.3.1 Description

A high water alarm is used on a boiler, deaerator, and condensate tanks to aid in preventing overfilling. Due to the failure rate of float type devices used for this purpose, high water alarms should always be a conductivity probe type device.

2.3.2 Consequence of High Water Alarm Failure

High water in a condensate tank could lead to backup of condensate in condensate lines. High water in a deaerator will result in poor deaeration but also leads to violent shaking of the vessel. High water in a boiler could result in pushing liquid into the steam line. Slugs of water in the steam system can move at high velocity due to the motive force of steam causing water hammer. Water hammer can cause valves and other fittings to explode and steam piping to rupture. Death and injury from these events is a regular occurrence. This same effect could produce high water levels in the steam supply to a steam powered appliance connected to the system with detrimental effects on the process.

2.3.3 Testing the High Water Alarm

The high water alarm can be tested off-line. Slowly fill the vessel with water, observe the water level in the sight glass, and note the point at which the alarm sounds. Be careful not to overfill the system, above the level at which the alarm should actuate.

A step by step procedure is given in Appendix A for three situations: boilers, deaerators, and condensate tanks.

2.4 OVERFLOW DRAIN SYSTEM

2.4.1 Description

Deaerator tanks and condensate storage tanks have overflow systems to prevent overfilling. The deaerator overflow is shown in Figure 2.2. The overflow system on the condensate tank also helps guarantee that the condensate tank remains at atmospheric pressure and consists of a drain line connected to the vessel. The drain line from a deaerator includes a normally closed device that opens if the water level is too high and allows water to drain either to sewer or into the condensate tank. Three different types of overflow control valve systems have been utilized on deaerator tanks:

September 2008 16

• A float valve which opens when liquid water comes into a standpipe that has an opening near the top of the deaerator.

• An electronic valve which is operated by a conductivity probe indicating that water level is too high. In this case the water should be drained from the bottom region of the tank to avoid the possibility of exhausting steam in case the valve opens before the water level reaches proper height.

• An electronic valve which is operated by a differential pressure cell indicating that water level is too high. In this case the water should be drained from the bottom region of the tank to avoid the possibility of exhausting steam in case the valve opens before the water level reaches proper height.

LWA

HWA (PROBE)

BUTTERFLY VALVE

SOLENOID ACTUATED

OVERFLOW PROBE

Steam

Makeup / Condensate

Vent

10 Psig 500-1000 lb/hr

Vac Breaker

Overflow

To Boiler

DASV

SVFPRV

Vent

DA TANK

PRV

Figure 2.2 Overflow Drain System

2.4.2 Consequence of Overflow Drain Failure

The consequence of an overflow drain failure is the same as that discussed in section 2.3.2.

2.4.3 Testing the Overflow Drain System

The purpose of the test is to determine if the system is capable of draining water from the deaerator at a rate equal to or greater than the maximum potential supply of water to the deaerator. The system can be tested with the deaerator out of service (steam valved out and feedwater pumps off). To test the drain system, fill the deaerator with water at a rate equivalent to the maximum rate that could possibly be supplied to the

September 2008 17 deaerator. Observe the water level in the sight glass. Use the sight glass to confirm that the drain system is capable of maintaining the water level at the drain level.

A step by step procedure is given in Appendix A.

September 2008 18

3 PRESSURE CONTAINMENT

3.1 SAFETY VALVES

3.1.1 Description

The safety valves are connected to a boiler, steam line, or other device that must be protected from over-pressure. Each safety valve discharges into a drip pan ell which discharges through a slip joint into an oversized vent pipe that extends to outside the building. By utilizing drip pan ells, there is no direct connection between the vent pipe and the safety valve so that there is no stress imposed on the safety valve from the thermal expansion of the vent pipe. Liquid relief valves on unheated services, such as fuel oil, can be directly connected to a vent. Safety valves must be present on the boiler, deaerator, any pressurized condensate receiver, and at all points in steam lines just downstream of any pressure-reducing valves. Each safety valve must have a dedicated separate vent line (See Figure 3.1). Properly designed redundant safety systems for this extremely important safety device allow the system to prevent a boiler explosion even if one of the safety valves and / or vent system fails.

DrainDrain

Vent Vent

Roof

SVB SVB

Figure 3.1 Boiler Safety Valves

3.1.2 Consequences of a Safety Valve Failure

Safety valves are the last line of defense against the over-pressurization of the boiler or steam system components. If these valves fail along with all the other measures designed to prevent over-pressurization, a violent explosion could occur. Of course, such an explosion could wipe out buildings and people within several hundred feet of the boiler or system component.

3.1.3 Checking a Safety Valve

The aspects of the safety valve that must be checked include:

• Is the safety valve vented to the outside with proper piping?

• Is the lift pressure set correctly?

• Does the valve open at the correct pressure?

• Are the safety valves present capable of handling the maximum boiler/steam capacity?

• Is the blowdown (set-point minus reseat pressure) correct?

September 2008 19

• Is the safety valve properly drained?

• Can the safety valve be safely checked?

Some authorities recommend doing all safety valve testing on a test stand. However, there is a chance that the valves could be mixed up or damaged in installation so that this test method is not as reliable as testing the valves in situ. Also some authorities check a safety valve by lifting the handle. This test does not confirm that the valve opens at its setting. It does confirm that the valve can vent steam (is not blocked).

This test should never be performed at a working pressure less than 75 percent of the safety valve setting.

A detailed test procedure which allows the 7 points enumerated above to be checked is given in Appendix A for three situations: boilers, deaerators, and piping following a PRV station.

3.2 RELIEF VALVES

3.2.1 Description

Relief valves are spring-loaded valves that open if the liquid pressure in the system that they protect increases above a pre-set limit. They are similar to safety valves with the exception that they do not exhibit “popping” action or blowdown. (Relief valves do not incorporate the “huddling” chamber found on safety valves). These valves are connected to an exhaust pipe that conveys the fluid to the building exterior or storage tank. Two important pieces of equipment requiring relief valves in boiler applications are economizers and oil pump sets

3.2.2 Consequences of a Relief Valve Failure

Failure of a relief valve could lead to a pressure vessel explosion with serious consequences. For example, there are several cases yearly in which the relief valve on domestic water heaters fail with the result that an entire house is “leveled”. A even more devastating event could result from the explosion of an economizer. Failure could also lead to equipment damage due to overheating-e.g. in operation of an oil pump.

3.2.3 Checking a relief valve

There are several aspects of a safety or relief valve that must be checked. These include:

• Is the valve vented with proper piping?

• Is the lift pressure correct?

• Does the valve open at correct pressure?

• Will the valve handle the maximum capacity of the device that it protects?

Testing procedure for the relief valve on an oil pump set and economizers are given in Appendix A.

3.3 HIGH STEAM PRESSURE LIMIT SWITCHES

3.3.1 Description

A boiler should be fitted with two, high-steam-pressure-limit switches (HSPLS). Both switches have the function of causing the two automatic fuel shut off valves to close if a

September 2008 20 preset pressure limit is exceeded. One switch may be a recycle switch meaning that once the pressure falls below the set point pressure the boiler will automatically restart.

The other switch must be a non-recycle switch meaning that it must be manually reset after a pressure excursion above its limit. The pressure setting on the non recycle switch should be slightly higher than the setting on the recycle switch but lower than the maximum working pressure for the boiler. The non-recycle limit should also be lower than the lowest lift pressure for the safety valves. The required differences in the settings described above should be sufficient to allow the boiler to operate without excessive nuisance trips or blowing of safety valves.

3.3.2 Consequences of High Steam Pressure Limit Switch Failure If both HSPLS switches were to fail, the safety valve becomes the last line of defense against a pressure vessel explosion. A tendency of boiler operators is to not worry about the performance of the HSPLS (especially the non-recycle one) because the safety valve is still available to save the operation. This thinking represents the "slippery slope" in safety because true safety relies on redundant measures. In looking at accidents in industry one can almost always find several unsafe factors that led to the particular accident. Ignoring the first warning escalates the risk.

3.3.3 Checking High Steam Pressure Limit Switches

Items to be checked about the HSPLS include:

• Are the limits on the switches set correctly, and

• Do the switches work?

These tests are described in Appendix A.

3.4 BOILER HYDROSTATIC TESTING

3.4.1 Description

A hydrostatic test is performed on a boiler, deaerator, and economizer to determine if it is capable of withstanding the potential operating pressure. It is very important to understand that any leak is a sign of weakness in the vessel and should be thoroughly inspected by a professional and properly repaired before the vessel is put back into operation. (These leaks could represent small cracks or metal thinning/corrosion/etc that is not discernable to the eye).

3.4.2 Consequences of Failure to Hydrostatic Test

If weak spots are present and the vessel is operated, a significant chance exists that a pressure vessel explosion could occur with tremendous loss of property and life. Failure to perform a proper hydrostatic test would allow a weakened vessel to be operated with the attendant dangers of such operation.

3.4.3 Performing a Hydrostatic Test

To perform a hydrostatic test, fill the vessel completely full of water below 200 F.

Remove and plug all safety and relief valves. Close all supply and discharge lines. The boiler should be completely locked and tagged out from all energy sources following OSHA requirements and the fireside opened for inspection. The hydrostatic pressure for the test at about 1.5 times working pressure should be applied for several hours. The dry side should be checked for any sign of leaks. Any leaks should be professionally evaluated in terms of whether the vessel can be operated safely without repair.

September 2008 21

In applying the hydrostatic pressure, care must be exercised not to overpressure the vessel. If the vessel were pressurized above its elastic limit, the vessel would not be fit for further use and should be scrapped!

September 2008 22

4 FUEL TRAIN SAFETY DEVICES

4.1 LOW PRESSURE FUEL CUTOFF SWITCH

4.1.1 Description

The low-pressure fuel cutoff switch causes the automatic fuel shutoff valves to close if the fuel pressure is below the lower limit for safe operation. LPFCS safety devices are found on the main gas line, main oil line, and pilot gas line. The switch in all three of these applications senses the supply fuel pressure after the pressure regulating valve and upstream of any fuel control valve (See Figure 4.1). For the main oil and gas supply lines, the switch is in continuous operation once the boiler is in the run mode.

For the pilot gas supply, the switch operates continuously while the pilot flame is on.

LFGPCS

HFGPCS

LOCK OPEN

C

NO

LO

RT

FL

WO

LFGPCS AFGSOV

PRV

BLOCK AND BLEED SYSTEM

MV

Main Gas LineFlow Burner

HFGPCSAFGSOV

TP

TP

TP

TP

AFGSVV MV

CONTROL

Figure 4.1 Low Pressure Fuel Cutoff

4.1.2 Consequences of Low Pressure Fuel Cutoff Switch Failure Low fuel pressure can result in unstable burning or flameout conditions. When fuel pressure returns to normal, the combustion chamber can overfill with fuel before igniting. This can easily result in combustion explosions that are violent enough to blow the “ends” of the boiler and even through surrounding structures. Extensive property damage, injury, and even death can result.

4.1.3 Checking the Low Pressure Fuel Cutoff Switch

The checking procedure for this switch is designed to answer three questions:

(1) Is the switch in correct place?

(2) Are its limits correctly set?

(3) Does the switch work to produce the desired result?

The switch should never be located upstream of the pressure regulating valve and should never be located downstream of the fuel flow control valve. The low pressure limit should be 80% of the normal regulated supply pressure. (On gas operation, some pressure regulation devices require improvement because they allow a substantial “dip” in supply pressure on initial light-off). A step by step test procedure for the low pressure fuel cut out switch for the main gas and main oil supply systems as well as the pilot gas system is given in Appendix A.

September 2008 23

4.2 HIGH PRESSURE FUEL CUTOFF SWITCH

4.2.1 Description

The high fuel pressure cutoff switch is used to cause the automatic fuel shutoff valves to close if fuel pressure is above a given the higher limit for safe operation. These switches are used for both the main gas and main oil fuel supply systems (See Figure

4.2). In both of these applications the switch senses the supply fuel pressure after the pressure regulating valve and upstream of the fuel control valve. The switch is in continuous operation once the boiler is in the run mode.

LFGPCS

HFGPCS

LOCK OPEN

C

NO

LO

RT

FL

WO

LFGPCS AFGSOV

PRV

BLOCK AND BLEED SYSTEM

Main Gas Line

HFGPCSAFGSOV

TP

TP

TP

TP

AFGSVV

CONTROL

Figure 4.2 High Pressure Fuel Cutoff

4.2.2 Consequences of High Pressure Fuel Cutoff Switch Failure High fuel pressure can cause unstable flame conditions but more importantly it can result in over-firing the boiler. Over-firing can damage burner/boiler materials to the point of meltdown and explosion. The generation of steam can be so intense that a pressure vessel explosion can occur. High fuel pressure can easily occur if a pressure regulator and high-pressure cutoff switch were to fail.

4.2.3 Checking the High Pressure Fuel Cutoff Switch

The checking procedure for this switch is designed to answer three questions:

• Is the switch in correct place?

• Are its limits correctly set?

• Does the switch work?

The switch should never be located upstream of the pressure regulating valve and should never be located downstream of the fuel flow control valve. The high pressure limit should be 120% of the normal regulated supply pressure for natural gas and 110% for light oil.

A step by step test procedure for the high pressure fuel cut out switch for the main gas and main oil supply systems is given in Appendix A.

4.3 VENTING BETWEEN AUTOMATIC GAS SHUTOFF VALVES

4.3.1 Description

The volume between the automatic fuel shutoff valves for gas should be vented to the atmosphere with a system as shown in Figure 4.3 for both the main gas and pilot line automatic shut off valves. While the boiler is running the solenoid valve is shut and gas

September 2008 24 flows through the two automatic shutoff valves to the burner. When the fuel shut-off valves close, the solenoid valve opens and vents any residual gas in the space between the valve and any leakage of gas through the first automatic shutoff valve.

The purpose of the vent system is to insure that even if the first automatic shutoff valve leaks, the gas is vented rather than allowed to move through the second automatic fuel-shutoff valve and then into boiler. The vent line should be vented to the atmosphere.

HFGPCS

LOCK OPEN

C

NO

LO

RT

FL

WO

AFGSOV

BLOCK AND BLEED SYSTEM

HFGPCSAFGSOV

TP

TP

TP

TP

AFGSVV

CONTROL

Figure 4.3 Gas Train Vent Valve

4.3.2 Consequences of a Failed Vent Valve

Fuel leaks into the boiler are obviously dangerous because if both automatic shut off valves leak, gas would fill the boiler furnace while the boiler is off. Fuel mixed with air is an explosive. Any source of ignition could result in disaster. On ignition if purging did not adequately vent this gas, a tremendous explosion would result when igniting the fuel. This combustion explosion could easily wipe out all property and personnel within several hundred feet of the boiler.

4.3.3 Testing the Gas Train Vent Valve (solenoid valve)

Testing of the vent system should include verifying that the correct physical system is in place, that the vent valve is closed (does not leak) when the boiler is firing, and that the vent valve is open when the boiler is not firing. Vent piping should be checked for insect nests that can block the flow of gas.

A detailed step by step procedure to check all these aspects of the vent valve are given in Appendix A.

4.4 LEAK TEST OF AUTOMATIC FUEL SHUT OFF VALVES

4.4.1 Description

A block and bleed system is provided as discussed in section 4.3 to prevent fuel from entering and potentially collecting in the boiler while the boiler is off. This system is used on the main oil and gas supply lines to the burner as well as the pilot gas supply.

(On the main oil supply line a vent is not required.) The two automatic shut off valves

September 2008 25 used in either case are the means by which the boiler is automatically shut down in case any operating limit is not satisfied. It is absolutely essential that these valves do not leak when closed. For both oil and gas, applicable codes require two automatic shut off valves. It is that important.

4.4.2 Consequences of Leaking Automatic Shut off Valves

There is a slight probability that one or more of the automatic fuel shut off valves would leak. If both valves leaked and the vent system did not function in the case of gas, fuel would be introduced into the burner and into the boiler furnace while the boiler is off.

This fuel would produce a combustible mixture in the boiler. Fuel leaks into the boiler are obviously dangerous because it allows the presence of a combustible air-fuel mixture that could explode when the fuel is ignited on startup. This combustion explosion could easily wipe out all property and personnel within several hundred feet of the boiler.

4.4.3 Testing the Automatic Fuel Shut off Valves for Leaks

The testing for leaks can be done when the boiler is off. The best test procedure for gas is a situation in which the leak could be measured with a “bubble test”. This method involves connecting a tube to a confined space downstream of the valve being tested with positive pressure on the upstream side of the valve. The tube is placed approximately 1/16th of an inch below a water surface. Any leak will show up as a bubble generated in the water at the tube exit. Any testing by watching pressure fall is difficult to evaluate because generally there are many potential sources for leaks in the system which will obscure the results. For oil a test port can be provided to visually observe whether oil drains from the test port.

4.5 OIL LOW ATOMIZING MEDIA PRESSURE SWITCH

4.5.1 Description

An atomizing fluid (compressed air or steam) is usually used to aid in the combustion of the oil fuel (See Figure 4.4). A safety switch is required that shuts the boiler off in case of low atomizing pressure. This switch measures pressure in the atomizing fluid line immediately after the pressure regulating system and causes the automatic fuel control valves to close if the atomizing pressure falls below its setpoint. If there is a differential pressure regulator, the sensor should be located upstream of that regulator.

September 2008 26

C

TN

O

ROL

WO

LF

LAMPS

LFOPCS HFOPCS

AFOSOV AFOSOV

LAMDPS

PRV

LOCK OPEN

BURNER

AMSOV

DPR

MV

TP

TP TP

MV

BURNER

Not found on all boilers

Figure 4.4 Low Atomizing Media Pressure Switch

4.5.2 Consequences of Low Atomizing Media Pressure

Low atomizing pressure could cause poor combustion leading to the production of carbon monoxide, flame instability, and possible combustion explosions leading to serious loss of property and injury/death.

4.5.3 Testing the Oil Low Atomizing Media Pressure Switch

There are basically three items that need checking;

• Is the switch correctly set?

• Is the switch located correctly?

• Does the switch work to produce the desired effect?

The setpoint on the oil low atomizing pressure switch should not allow the atomizing media pressure fall below level recommended by the burner manufacturer. Testing is accomplished on-line by slowly lowering the oil atomizing media pressure and observing that the switch operates at the correct set point. In order to test the low oil atomizing media switch a calibrated pressure gage or other method to measure pressure is required. Make certain that the burner is producing negligible combustibles at the set point pressure condition.

4.6 AUTOMATIC FUEL SHUTOFF VALVE PROOF OF CLOSURE SWITCH

September 2008 27

4.6.1 Description

The function of an automatic fuel shutoff valve is absolutely essential. All safety devices that require fuel shutdown rely on the two automatic fuel shutoff valves to perform this task. Proof of Closure switches must be present in both automatic shut off valves. Both oil and gas automatic shut off valves require proof of closure switches. The switches in the two valves should be wired in series so that an indicated failure in either valve will prevent the boiler from starting. The proof of closure switch is an integral part of the automatic fuel shutoff valve. It has a simple function to guarantee that the automatic fuel shutoff valve is closed before allowing the boiler to go through the burner startup sequence. If the automatic fuel shutoff valve is not closed, the proof of closure switch will be open, breaking the circuit and not allowing the burner to start. The proof of closure switch is active only during the startup sequence.

4.6.2 Consequences of a Failed Proof of Closure Switch

If the proof of closure switches fail, they could “stick” closed even with the valve open.

This malfunction would present a false signal to the burner management system indicating that the valve is closed when it might not be closed. This malfunction could allow the fuel to be ignited with a large quantity of fuel in the furnace. Under this scenario, a horrible combustion explosion would occur. The result could be a tremendous loss of property and death as well as physical harm to personnel within several hundred feet of the boiler.

4.6.3 Testing the Automatic Fuel Shutoff Valve (Proof of Closure) Switch In order to test a proof of closure switch one must demonstrate the following:

• That the switch is closed when the valve is closed.

• That the switch opens immediately once the valve starts to open.

• The boiler will not start with the switch open.

A detailed step by step procedure to determine whether the proof of closure switches meet the above requirements is given in Appendix A.

September 2008 28

5 BURNER AND AIR TRAIN SAFETY DEVICES

5.1 THE FLAME SCANNER

5.1.1 Description

A flame scanner is a device that continually monitors the flame to determine whether a flame is present in the combustion chamber. If the flame is extinguished for any reason, the scanner causes the two automatic fuel shutoff valves to close.

Modern flame scanners work by converting either the ultraviolet (UV) or infrared (IR) portion of the thermal radiation produced by the flame to an electrical signal. The UV scanner has some disadvantage in that it can sometimes see the igniter spark as a flame. The IR scanner has a disadvantage in that it can mistake glowing refractory for a flame. Properly adjusted, the UV scanner is superior and is required by the VA. The strength of the electrical scanner signal is then the indication as to whether an adequate flame is present.

UV scanners can fail unsafe, showing a flame detected when none is present. Some organizations do not consider this a problem on boilers that cycle on/off frequently as the burner management system will not allow a burner to start if a flame is “detected” while the burner is off. On V.A. boilers, which operate continuously for long periods, it is necessary to utilize “self-checking” UV scanners. The “self-checking” feature detects a scanner failure and immediately shuts down the burner.”

5.1.2 Consequences of a Failed Flame Scanner

If the flame scanner allows fuel to be supplied to the combustion zone when no flame exists, horrific combustion explosions can occur. The combination of a spark due to some type of “glowing” material and a “pocket” of fuel/air mixture at an explosive ratio can result in an explosion. Another scenario is relighting the boiler with an explosive mixture of fuel and air present. There have been numerous accidents in which the front or back of the boiler have blown off and through masonry walls with loss of life and property damage.

5.1.3 Checking a Flame Scanner

There are many potential tests for a flame scanner depending on the situation. The guiding principle is to try to check the scanner operating in the same mode that a potential failure might occur. The best test is then to cause the flame to extinguish and to determine whether the flame scanner then causes the two automatic fuel shut-off valves to close. It is very important that the flame scanner be checked on both oil and gas firing.

There are really three attributes of the flame scanner that one should check:

1. Is the flame scanner a UV self-checking scanner?

2. Does the flame scanner sense the igniter spark?

3. Will the flame scanner cause the automatic fuel shut-off valves to close within the allowable time (4 sec) when the fire is extinguished?

A detailed step by step procedure is given for testing the flame scanner in Appendix A.

5.2 LOW FIRE PROVING SWITCH

September 2008 29

5.2.1 Description

In the startup procedure for the boiler, the safest way to light the main burner is with a minimum of fuel input. There are electrical position switches located on the control systems for the fuel flow control valves and the combustion air damper that activate when the damper is at low-fire position. These low-fire proving switches have the function of not allowing the main flame to be ignited if the firing position is not a minimum. In some electronic control systems a potentiometer is used to determine the position of the inlet damper by the output of a voltage level to the controller. The required V.A. system is position switches actuated by the fuel control valves and the damper themselves rather than at some point nearer the drive motors that operate the valves and damper. Parallel position systems require separate proof of the low fire position for air and fuel.

5.2.2 Consequences of a Failed Low Fire Proving Switch

Failure of the low-fire proving switch could allow…