Modern steam boiler houses are generally well built, using well designed and properly built plant and components, and also reliable. The tendency to reduce the numbers of competent operators in the boiler house is increasing, especially as control and monitoring systems become more automatic. However, taking the man out of the boiler house may not be the answer in every case. Your boiler house technical risk assessment needs to look closely at the control systems and the boilers to determine the best course of action.
View PDF here – Can you get to the boiler in time v2
The worst case scenario for many shell steam boilers is a furnace collapse or a catastrophic failure of the boiler shell. Causes include excessive scale build-up, control system failure and loss of water in the boiler. If you are not routinely testing your boiler water (and the quality of the make-up water and condensate in many installations), you should be; daily is best. It is said that 95% of steam boiler failures can be traced back to water quality issues.
Control system failure could be as a result of sensor failure (foaming around the water level probes or electrical malfunction, for example) but high integrity devices and self-checking routines make this an increasingly rare occurrence.
Loss of water in the boiler
Total loss of boiler water is, thankfully, even less likely. But could it happen to you? And is it total loss we need to be concerned about, or just enough water lost to expose the heated surfaces within the boiler itself, leading to a potentially dangerous situation.
Dropping the water level to below the level of the lock-out probes (or ‘second low’ to those of us who have been in the business for a while) and still applying heat can be caused by a number of events:
- pump failed, with no effective interlock to the burner;
- hotwell empty, with no level alarm/lockout function;
- pump strainer or other feed water component blocked;
- blowdown valve jammed open, with no limit switches connected; etc. etc.
But do you know when a low level lockout alarm sounds if the heat is off or not? If the alarm has sounded but the burner is still firing you must take action, and quickly. If a competent boiler operator is not around, is there someone available AT ALL TIMES who is trained to take action soon enough?
Sinking time
The time the water in the boiler takes to drop from the level of the lockout probe to the highest heating surface (HHS) is generally called the ‘sinking time’; boiler makers calculate sinking time and make it as generous as possible within other restraints of boiler shell construction. The theory behind sinking time is well documented, and it does not really matter how long you have to react (5 or 7 minutes, depending on the fuel generally) – if the water has already dropped out of the gauge glass by the time you arrive, and the heat is still on, you are in trouble anyway.
Discussions about sinking time are somewhat academic here – it is good to know that the boiler operator is aware of the construction of their boiler and the most likely failure modes, but the elapsed time suggested in various specifications and standards is only there to allow for the attendance of a competent operator who can get there in time, or the reaction to an alarm by someone remote who can hit the e-stop as appropriate.
EN 12953 states that the water level 100mm above HHS must be visible; this is reduced to 50mm on slow burning fuels. When carrying out your weekly evaporation test, the boiler has failed the test if water leaves the glass before an alarm sounds, it is therefore better to have the water low in the glass at the point of alarm and have as much water as possible between the bottom of the glass and HHS to maximise operator safety.
in If the competent boiler operator is reasonably close by (on site, within earshot of alarms etc.) it is more likely than not he can react in time and safely. If he is not local to the boiler or the site, it is more likely he is too far away whatever the time limit, so the response to the alarm must be by the trained person who activates the e-stop, and this should be wired to completely different relays and components so that even though the alarms have gone off and maybe the burner has not stopped, the secure (and tested) shut down of the boiler can be assured.
Time to react
Boiler houses that are directly supervised (manned at all times the boiler is operating) and plant that is supervised by a competent operator who is always on site meet the criteria; someone competent to shut the plant down AND NOT START IT AGAIN UNTIL SAFE is available on site. All other supervision modes require secure remote operation of the e-stop or similar device by someone trained to respond to an alarm.
So ‘what do I do about it?’, and the answer is that it might depend on what has gone wrong to create the situation. However, the training for operators should be the same in every case, since the problem only persists if the heat is still being applied, and you cannot identify the problem that has caused low low alarm until you investigate.
Training
Herewith, therefore, a proposed list of training points for all boiler operators, and a reminder to boiler house designers and managers that the operating procedures and boiler house technical risk assessment may need to be reviewed.
- Do not enter a boiler house if you believe (from alarms sounding) that the water level is below the bottom of the gauge glass and heat is still being applied. Hit the e-stop and ensure the heat is off – wait before entering (the time you wait depends on different scenarios).
- Never put cold water into a hot boiler (cold means hotwell temperature or below).
- Never assume that the gauge glass with no water level in it means empty (or full) – it might be blocked also.
- Do not operate manual valves, including the crown valve or other boiler attachments, if there is no water level visible in the gauge glasses. Wait for the boiler to cool.
- When safe to do so, follow site procedures to isolate the faulty plant items and start diagnosis.
- Always find the cause of the problem and fix it before re-filling the boiler.
- Always test the full range of boiler alarms before leaving a repaired boiler on its own.
- Test the e-stops occasionally to prove the shutdown process. Test the remote stop function occasionally (if provided) to prove the shutdown process.
- Ensure that the wiring of the control and alarm system on the boiler/burner and the wiring of the e-stop function are completely separate and fail safe.
- Have different sounding alarms or different alarm lights to help identify issues, such as different lights for low low water and burner lockout. The level of information available at remote alarm panels should be appropriate to the person expected to react to it. It might be useful to separately indicate other unsafe situations in the boiler house such as gas leaks or fire.
Where can I get more information?
If there is a genuine issue in the boiler such as contaminated water or damaged/faulty probes, the boiler is going to need opening up to investigate – responding to a low water event has alerted you to a problem. However, boilers that regularly end up on low water do so because they are overloaded: the answer isn’t to get the boiler up and running quickly again, it’s to look how you stop the surge in demand, which could be by training the plant operators, automating the process, or fitting a surplussing valve.
Risk assessment of all the technical aspects of your boiler house will get you closer to a safe and secure operation – ask the Combustion Engineering Association for more information or come to our next conference.
