{"id":1622,"date":"2021-05-10T20:28:56","date_gmt":"2021-05-10T20:28:56","guid":{"rendered":"https:\/\/www.thepyroscope.com\/blog\/?p=1622"},"modified":"2021-05-10T20:29:35","modified_gmt":"2021-05-10T20:29:35","slug":"watchdog-circuits-in-burner-management","status":"publish","type":"post","link":"https:\/\/www.thepyroscope.com\/blog\/watchdog-circuits-in-burner-management\/","title":{"rendered":"Watchdog Circuits in Burner Management"},"content":{"rendered":"\n

-Howard Wells, Preferred Utilities, Danbury, CT<\/em><\/p>\n\n\n\n

Introduction<\/strong><\/p>\n\n\n\n

Have you ever seen a PLC-based burner management system and wondered \u201cWhy are the inputs turning on and off every few seconds?\u201d This \u201cflashing\u201d of the inputs is a type of error checking for the PLC discrete input channels and is required by NFPA 85 for all non-SIL3 rated PLC-based burner management systems. In the following article, we will explore the reason why NFPA requires these error-checking measures and discuss the primary methods of hardware error checking in PLC-based burner management systems.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

No Single Point of Failure<\/strong><\/p>\n\n\n\n

A burner management system is the control responsible for ensuring that a burner is operated in a safe manner. This includes monitoring the safety limits (such as \u201cLow Fuel Pressure\u201d and \u201cLow Combustion Air Flow\u201d) and shutting the burner down if any of these limits change to an unsafe state. Burner management system design requirements are set by the National Fire Protection Agency and published in NFPA 85: Boiler and Combustion Systems Hazard Codes. It is this document that all system creators must adhere to when designing a burner management system. Within NFPA 85, a basic design requirement for burner management systems is that no single point of failure within the system should prevent a burner shutdown.<\/p>\n\n\n\n

NFPA 85, 4.11.3 The logic system for burner management shall be designed specifically so that a single failure in that system does not prevent an appropriate shutdown.<\/p>\n\n\n\n

It is for this reason that IO modules are error checked, as their failure can create a single point of system failure. Consider the input channels that monitor boiler safety limits; if one of these inputs were to fail in the \u201con\u201d or \u201csafe\u201d state, the burner management system would be unaware if the safety limit in question were to change to an unsafe state, creating a potentially dangerous situation. Also consider the output channel responsible for opening pilot fuel solenoids; if this output fails in the \u201con\u201d state, the burner management system, commanding it to turn \u201coff,\u201d would otherwise be unaware that the valves were still open, creating another potentially dangerous situation. These examples of a single component failure within the burner management system would prevent a safe burner shutdown, and they are precisely what the creators of NFPA 85 want to avoid.<\/p>\n\n\n\n

NFPA Requirements<\/strong><\/p>\n\n\n\n

In section 4.11.6, NFPA 85 states that \u201cthe burner management system designer shall evaluate the failure modes of components\u201d including \u201cInputs and outputs (fail-on, fail-off),\u201d and section 4.11.7 states \u201cNo single component failure within the logic system shall prevent a mandatory master fuel trip.\u201d In order to follow these guidelines and prevent IO module failures from being single points of failure for the entire burner management system, the system must be designed to continually \u201cerror check\u201d these input and output modules. (SIL 3 capable PLC\u2019s have built-in IO module error checking and, as such, are not required to have external error checking). The error checking methods typically used are described below.<\/p>\n\n\n\n

Error-checking Methods<\/strong><\/p>\n\n\n\n

In PLC-based burner management systems, both the input and output channels that monitor or control critical devices, such as safety limits and fuel shutoff valves, are continually error checked to ensure that they do not fail in an unsafe state. Inputs are monitored by a 120V \u201cwatchdog circuit\u201d that operates as follows:<\/p>\n\n\n\n

1.      All safety limits (also referred to as \u201ccritical inputs\u201d) are powered with \u201cwatchdog\u201d electricity. This electricity originates from an output on the BMS and cycles off every 3 seconds; all critical inputs receive 120V for 2.8 seconds and 0V for 0.2 seconds.<\/p>\n\n\n\n

2.      The inputs are monitored by logic within the BMS; if any of the critical inputs stay powered for longer than 3 seconds without cycling off, the BMS interprets this as a failure of that input channel and initiates a lockout.<\/p>\n\n\n\n

3.      This is done to ensure that no input channel fails in the \u201con\u201d state, which would otherwise be interpreted by the BMS as permission to run the burner.<\/p>\n\n\n\n

4.      The watchdog electricity is also monitored by a series of external watchdog timer relays that are tied directly to the \u201cmaster fuel trip\u201d relay; if these watchdog relays detect that the watchdog electricity has not cycled within 3 seconds, they can open the master fuel trip relay and shut the burner down independently of the PLC, complying with NFPA requirements 4.11.7 (7) and (8).<\/p>\n\n\n\n

5.      This is to ensure that, even in the event of a complete BMS failure where all outputs are frozen in the \u201con\u201d position, the burner will still be shut down.<\/p>\n\n\n\n

Output channels that control critical devices, such as fuel shutoff valves, are error checked in the following manner:<\/p>\n\n\n\n

1.      Each output channel is tied to an independent input that monitors the state of the output.<\/p>\n\n\n\n

2.      If the output proves to be in a different state than what was commanded by the BMS, the BMS interprets this as a failure of the output channel and initiates a lockout.<\/p>\n\n\n\n

3.      This is to ensure that no output channel providing electricity to a critical device will fail in the \u201con\u201d state, which, if unchecked, could cause a fuel valve to open in an uncontrolled manner.<\/p>\n\n\n\n

Conclusion<\/strong><\/p>\n\n\n\n

Burners, if not controlled properly, have the potential to be very dangerous. However, the goal of NFPA 85 is to mitigate this inherently unsafe operation by providing a set of design standards for burner management systems. One of these guidelines is to perform a failure mode analysis on all components within the burner management system and design the system so that no single component failure can prevent a safe burner shutdown. It was this guideline that led to the development of IO module error checking, a practice now viewed as standard for all non-SIL3 rated PLC-based burner management systems. <\/p>\n","protected":false},"excerpt":{"rendered":"

-Howard Wells, Preferred Utilities, Danbury, CT Introduction Have you ever seen a PLC-based burner management system and wondered \u201cWhy are the inputs turning on and off every few seconds?\u201d This \u201cflashing\u201d of the inputs is a type of error checking for the PLC discrete input channels and is required by NFPA 85 for all non-SIL3 rated PLC-based burner […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[12,7],"tags":[],"_links":{"self":[{"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/posts\/1622"}],"collection":[{"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/comments?post=1622"}],"version-history":[{"count":3,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/posts\/1622\/revisions"}],"predecessor-version":[{"id":1627,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/posts\/1622\/revisions\/1627"}],"wp:attachment":[{"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/media?parent=1622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/categories?post=1622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thepyroscope.com\/blog\/wp-json\/wp\/v2\/tags?post=1622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}