EP3553377B1 - Safety device for steam generator - Google Patents

Description

FIELD OF THE INVENTION

The invention belongs to the field of steam generators.

More particularly, the invention belongs to the field of the management of the risks inherent in the use of boilers.

More particularly, the invention belongs to the field of the functional safety of boilers.

STATE OF THE ART

The pressures and temperatures involved throughout the operation of the steam generators involve risks for the personnel intended to use such machines. In order to ensure the safety of these systems, it is known to use safety devices making it possible to detect a malfunction in the steam generator and making it possible to restore its correct functioning. For this purpose, it is known to use an emergency stop, one or more pressure switches and water level probes communicating with a safety PLC configured to restore the operation of the steam generator when critical levels of pressure, temperature and water level are detected. Utility certificates CN 203 082 859 U , CN 203 395 910 U , CN 202 032 560 U give examples of steam generators secured by a particular device, and suggesting improvements at the level of a PID regulator, water level control and water level detection probes respectively Despite the availability of safety devices from increasingly efficient, these devices must be checked periodically to guarantee the prevention of the risks associated with their use. A device is therefore desired which makes it possible to space these tests as much as possible and which has a moderate cost.

In order to reduce these risks, SIS Security Instrumented Systems are put in place.

• le niveau et la qualité de l'eau dans le corps de chauffe du générateur vapeur ;
• la surpression de vapeur ;
• les arrêts d'urgence.

In particular, safety systems are put in place concerning:

• the level and quality of the water in the heating body of the steam generator;
• steam overpressure;
• emergency stops.

The management of these safety assemblies is centralized in an electrical cabinet.

The combustion controller also includes means for managing safety devices relating to the burner and to combustion.

A level of risk reduction for a given safety function can be quantified by the safety integrity level SIL ( Safety Integrity Level ), which extends on a scale of 1 to 4. The reliability of the safety instrumented system increases with the LIS. The SIL takes into account the probability of occurrence and the risks and the severity of their consequences.

The figure 2 represents the correspondence table between the SIL safety integrity level and a risk reduction factor RRF ( Risk Reduction Factor ) equal to the inverse of the average probability of failure on demand PFD ( Probability of Failure on Demand in English terminology).

• la gravité G d'un dommage lié à un risque ;
• la fréquence F et/ou durée d'exposition ;
• la probabilité d'apparition P_ap de l'événement dangereux ;
• la probabilité d'évitement P_ev dudit évènement dangereux.

According to IEC 61511, the allocation of a SIL level is done using a risk graph, illustrated on figure 3 , according to four parameters:

• the severity G of damage linked to a risk;
• the frequency F and / or duration of exposure;
• the probability of occurrence P _ap of the hazardous event;
• the probability of avoidance P _{ev of} said dangerous event.

• G₁ : incident mineur ;
• G₂ : blessures graves conduisant à des invalidités ; décès d'une personne ;
• G₃ : décès de deux personnes ;
• G₄ : décès de plus de deux personnes ;
• F₁ : exposition rare au risque ;
• F₂ : exposition permanente au risque ;
• P_ap1 : probabilité faible d'apparition ;
• P_ap2 : probabilité moyenne d'apparition ;
• P_ap3 : probabilité élevée d'apparition ;
• P_ev1 : évènement évitable dans certaines conditions ;
• P_ev2 : évènement inévitable.

Each of these parameters is quantified by a discrete scale:

• G ₁ : minor incident;
• G ₂ : serious injuries leading to disability; death of a person;
• G ₃ : death of two people;
• G ₄ : death of more than two people;
• F ₁ : rare exposure to risk;
• F ₂ : permanent exposure to risk;
• P _ap1 : low probability of occurrence;
• P _ap2 : mean probability of occurrence;
• P _ap3 : high probability of occurrence;
• P _ev1 : avoidable event under certain conditions;
• P _ev2 : inevitable event.

The evaluation of the four parameters G, F, P _ap and P _ev , makes it possible to identify the type of risk and, through the risk graph, the level of SIL required.

On the graph, the presence of a hyphen or an "a" in a box corresponds to the absence of any particular safety requirement. The letter "b" corresponds to a situation in which the use of instrumented systems is insufficient to ensure the safety of operators.

The SIL safety integrity level of a system depends on the safety integrity level of the subsystems constituting it.

Conventionally, a Safety Instrumented System comprises a sensor subsystem (input interface), a logic subsystem and an actuator subsystem (output interface). The devices making up the subsystems can be arranged in series or in parallel.

In order to check that the Safety Instrumented Systems are in good working order, it is necessary to set up periodic tests attesting to this good working order. The frequency of these tests depends on the SIL level associated with the SIS.

The figure 4 represents the change in the probability of failure on the PFD request as a function of time for two sensors A and B associated with a SIL 2 level.

The sensor A, represented by a solid line curve, can be considered to have a SIL 2 level for a unit of time, for example a year. Beyond that, the average probability of PFD failure is too high. It is therefore necessary to ensure after one year that the sensor A is functioning correctly. After verification, sensor A can be reused for one year without verification.

Sensor B, represented by a dotted line curve, can be considered to have a SIL 2 level for five units of time, for example five years. The operating condition of sensor B is therefore only checked every five years.

The boilers currently in use have a SIL 2 safety level. Such a safety level requires numerous periodic tests in order to verify that the safety systems are in good working order. Carrying out these tests implies the unavailability of the boiler being tested.

Currently, the elements implemented to ensure the safety functions require regular tests, at periods of the order of one to six months depending on the elements considered.

DISCLOSURE OF THE INVENTION

The invention proposes a safety system of a steam generator making it possible to obtain a SIL safety integrity level equal to 3 according to claim 1. Such a safety integrity level makes it possible to further space out the verification tests. proper functioning of security systems. In particular, thanks to the device according to the invention, the safety tests are only to be carried out once a year.

• au moins deux pressostats d'excès de pression vapeur ;
• au moins deux sondes de niveau d'eau présentant chacune un niveau d'intégrité de sécurité SIL au moins égal à 3 ;
• au moins deux arrêts d'urgence présentant chacun un niveau d'intégrité de sécurité SIL au moins égal à 3 ;

ledit dispositif de sécurité comporte en outre :

• un automate de sécurité relié à l'au moins deux pressostats, à l'au moins deux sondes et à l'au moins deux arrêts d'urgence;
• un ensemble de relayage raccordé aux sorties dudit automate de sécurité et apte à agir sur un automate de combustion, une pompe alimentaire et un automate de régulation dudit générateur de vapeur pour arrêter ce dernier en cas d'urgence ;
  où :
  • les au moins deux pressostats présentent chacun un niveau d'intégrité de sécurité SIL au moins égal à 2 ;
  • les pressostats, les sondes et les arrêts d'urgence sont indépendants les uns des autres dans leur fonctionnement.

The safety device according to the invention is intended to be implemented on a steam generator, and comprises:

• at least two excess steam pressure switches;
• at least two water level probes each having a SIL safety integrity level of at least 3;
• at least two emergency stops each having a SIL safety integrity level of at least 3;

said safety device further comprises:

• a safety PLC connected to at least two pressure switches, to at least two probes and to at least two emergency stops;
• a relay assembly connected to the outputs of said safety automaton and able to act on a combustion automaton, a food pump and a regulating automaton of said steam generator to stop the latter in an emergency;
  or :
  • the at least two pressure switches each have a SIL safety integrity level of at least 2;
  • the pressure switches, probes and emergency stops are independent of each other in their operation.

The invention also relates to a steam generator comprising a combustion automaton, a food pump, a regulation automaton and a safety device according to the invention.

• un corps de chauffe ;
• un brûleur commandé par l'automate de combustion ;
• une cuve d'eau alimentaire alimentant le corps de chauffe, la pompe alimentaire étant disposée entre ledit corps de chauffe et ladite cuve d'eau.

In one embodiment, the steam generator comprises:

• a heating body;
• a burner controlled by the automatic combustion machine;
• a food water tank supplying the heating body, the food pump being arranged between said heating body and said water tank.

In one embodiment, the regulator acts on the combustion automaton and on the food pump.

In one embodiment, the steam generator is a boiler.

BRIEF DESCRIPTION OF THE FIGURES

• La figure 1 représente un schéma simplifié d'une chaudière à vapeur équipée du dispositif de sécurité selon l'invention.
• La figure 2 déjà citée représente un tableau de correspondance entre un niveau d'intégrité de sécurité SIL et une réduction de facteur de risque RRF.
• La figure 3 déjà citée représente le graphe des risques pour la détermination du niveau d'intégrité de sécurité SIL.
• La figure 4 déjà citée représente l'évolution de la probabilité de défaillance à la sollicitation PFD en fonction du temps pour deux capteurs.

The invention will be better understood on reading the following description and on examining the accompanying figures.

• The figure 1 represents a simplified diagram of a steam boiler equipped with the safety device according to the invention.
• The figure 2 already cited represents a table of correspondence between a SIL safety integrity level and a reduction in RRF risk factor.
• The figure 3 already mentioned represents the risk graph for determining the SIL safety integrity level.
• The figure 4 already cited represents the change in the probability of failure on PFD stress as a function of time for two sensors.

DETAILED DESCRIPTION

The invention relates to a safety device intended to be implemented on a steam boiler. Those skilled in the art will understand throughout the description that the invention is not limited to boilers alone but can be implemented more generally on any type of steam generator.

• un corps de chauffe 10 ;
• un brûleur 11 commandé par un automate de combustion 110 ;
• une cuve 12 d'eau alimentaire alimentant le corps de chauffe 10 par le biais d'une pompe alimentaire 120 ;
• un automate de régulation 13 agissant notamment sur l'automate de combustion 110 du brûleur 11 et sur la pompe alimentaire 120.

With reference to the figure 1 , the steam boiler 1 comprises:

• a heating body 10;
• a burner 11 controlled by a combustion automaton 110;
• a tank 12 of food water supplying the heating body 10 by means of a food pump 120;
• a control automaton 13 acting in particular on the combustion automaton 110 of the burner 11 and on the food pump 120.

Of course, the figure 1 shows a steam boiler 1 in a simplified manner, and the boiler 1 comprises other elements not shown, for example a natural gas supply, a vent, a chimney, conductivity probe, control valve, etc.

A heat produced by the burner 11 is transmitted to the feed water contained in the heating body 10. This heat exchange is for example carried out by means of the combustion of a fuel element, such as fuel or fuel. gas (not shown).

Part of the water heated in this way turns into steam which can then be used. The burner 11 is controlled by the combustion automaton 110 which sends it a power setpoint making it possible to manage the quantity of steam produced.

The pressures and temperatures involved involve risks for the personnel intended to use such boilers.

• deux pressostats 20 d'excès de pression vapeur ;
• deux sondes 21 de niveau d'eau très bas ;
• deux arrêts d'urgence 22 ;
• un automate de sécurité 23 ;
• un ensemble de relayage 24.

With reference to the figure 1 , a safety device according to the invention is implemented to ensure personnel safety. The device according to the invention comprises:

• two pressure switches 20 for excess steam pressure;
• two very low water level probes 21;
• two emergency stops 22;
• a safety controller 23;
• a relay assembly 24.

The excess steam pressure switches 40 make it possible to detect an abnormal rise in pressure inside the boiler. The two pressure switches 40 are mounted on the boiler independently. These pressure switches each have a SIL safety integrity level equal to two, for example a pressure switch from the company GEORGIN (registered trademark), and symbolized graphically by a double border.

The very low water level sensors 41 monitor the minimum water level inside the generator. Each of the probes used has a SIL safety integrity level equal to three, symbolized graphically by a triple border. They may, for example, be probes from the company GESTRA (registered trademark).

The two emergency stops 42 are arranged respectively on one side of the heating body 10 and on an electrical cabinet 14 and each have a safety integrity level SIL equal to three, symbolized graphically by a triple border. They can be chosen, for example, from the range of PILZ products (registered trademark).

The pressure switches, water level probes and emergency stops form safety contacts connected to the safety PLC 23 by input electrical connections 25. The safety PLC 23 has an integrity safety level. SIL equal to four, symbolized graphically by a quadruple border.

The relay assembly 24 is connected to the outputs of the safety automaton by means of output electrical connections 26, and acts directly on the combustion automaton 110 associated with the burner 11, on the food supply pump 120 with feed water, and on the regulator 13 to stop the boiler in an emergency. Advantageously, the number of elements making up the relaying assembly is limited compared to the currently existing relaying assemblies in order to limit the probability of failure of an element of the relaying and therefore of the boiler.

The terminology of input electrical connection / output electrical connection is chosen with reference to the safety PLC assembly 23 and relay assembly 24, the information transmitted by the safety contacts constituting inputs of this assembly, and the orders sent to the combustion automaton 110, to the food pump 120 and to the control circuit constituting outputs of said assembly. The electrical connections are symbolized on the figure 1 by dotted lines.

• niveau d'intégrité de sécurité SIL des contacts de sécurité mis en œuvre, en particulier, mise en œuvre de pressostats de niveau de sécurité SIL égal à deux ;
• redondance et indépendance des contacts de sécurité utilisés, en particulier, les deux pressostats 20 sont indépendants l'un de l'autre, de même les sondes 21 et les arrêts d'urgence 22 sont des éléments qui sont indépendants les uns des autres ;

The safety device according to the invention has a safety integrity level SIL equal to three. The characteristics making it possible to obtain such a level of security are as follows:

• SIL safety integrity level of the safety contacts implemented, in particular, implementation of pressure switches with a SIL safety level equal to two;
• redundancy and independence of the safety contacts used, in particular, the two pressure switches 20 are independent of one another, in the same way the probes 21 and the emergency stops 22 are elements which are independent of one another;

• le matériel utilisé a un niveau de sécurité augmenté et un taux de défaillance inférieur ;
• les essais de sécurité en réel, obligatoires pour valider le bon fonctionnement des sécurités, est à réaliser tous les ans, du fait du niveau de sécurité d'intégrité SIL atteint. Les chaudières de l'art antérieur nécessitant des essais de sécurité espacées d'un maximum d'environ six mois, cet avantage est particulièrement intéressant dans la mesure où la chaudière doit être stoppée lors de ces essais, stoppant des étapes de production nécessitant l'utilisation de la chaudière, et présentant ainsi une contrainte pour les exploitants ayant des répercussions économiques. Une chaudière équipée d'un dispositif de sécurité selon l'invention est ainsi disponible 365 jours consécutifs.

The advantages of a boiler having a safety device according to the invention in comparison with a boiler of the prior art are as follows:

• the equipment used has an increased level of safety and a lower failure rate;
• the real safety tests, compulsory to validate the correct functioning of the safety devices, must be carried out every year, due to the level of SIL integrity safety achieved. The boilers of the prior art requiring safety tests spaced at a maximum of about six months, this advantage is particularly interesting insofar as the boiler must be stopped during these tests, stopping production steps requiring the use of the boiler, and thus presenting a constraint for operators with economic repercussions. A boiler equipped with a safety device according to the invention is thus available 365 consecutive days.

The calculation of the SIL safety integrity level equal to three has been carried out and validated by the notified body APAVE.

Claims (5)

1. A safety device, intended to be implemented on a steam generator, including:

   - at least two pressure switches (20) for excess steam pressure;

   - at least two water level probes (21) each having a safety integrity level SIL of at least 3;

   - at least two emergency stops (22) each having a safety integrity level SIL of at least 3;
   said safety device further including:

   - a safety controller (23) connected to the at least two pressure switches (20), to the at least two probes (21) and to the at least two emergency stops (22);

   - a relay assembly (24) connected to the outputs of said safety controller and able to act on a combustion controller (110), a feed pump (120) and a regulation controller (13) of said steam generator to stop the latter in case of emergency;
   where:

   - the at least two pressure switches (20) each have a safety integrity level SIL of at least 2;

   - the pressure switches (20), the probes (21) and the emergency stops (22) are independent of each other in their operation,

   and in which device the safety integrity level SIL is defined in accordance with the requirements of standard IEC 61511.
2. A steam generator including a combustion controller (110), a feed pump (120), a regulation controller (13) further including a safety device according to claim 1.
3. The steam generator according to claim 2 including:

   - a heating body (10);

   - a burner (11) controlled by the combustion controller (110) ;

   - a feed water tank (12) feeding the heating body (10), the feed pump (120) being disposed between said heating body and said water tank.
4. The steam generator according to claim 2 or claim 3 wherein the regulator (13) acts on the combustion controller (110) and on the feed pump (120).
5. The steam generator according to any one of claims 2 to 4 wherein the steam generator is a boiler.

Images