US3415232A

US3415232A - Safety system for steam generator

Info

Publication number: US3415232A
Application number: US569349A
Authority: US
Inventors: Jr Carlos J Garrett; Richard D Hottenstine
Original assignee: Combustion Engineering Inc
Current assignee: Combustion Engineering Inc
Priority date: 1966-08-01
Filing date: 1966-08-01
Publication date: 1968-12-10
Anticipated expiration: 1985-12-10
Also published as: NL136050C; DE1551946A1; ES341536A1; BE699687A; NL6708502A; GB1178458A; SE335777B

Description

Dec. 10, 1968 Filed Aug. 1, 1966 C. J. GARRETT, JR. ET AL SAFETY SYSTEM FOR STEAM GENERATOR 2 Sheets-Sheet 1 /62 250.0 OUTPUT Fl-l INVENTOR ax GAEZE'TT, JR 2.12 HOTT'E/VSTINE AGENT 1968 c. J. GARRETT, JR.. ET AL.

SAFETY SYSTEM FOR STEAM GENERATOR 2 Sheets-Sheet 2 Filed Aug. 1, 1966 INVEN T02 AGENT C.J. @4225 T7, .71? BP- HOTTENST/NE 5 X Kw United States Patent SAFETY SYSTEM FOR STEAM GENERATOR Carlos I. Garrett, Jr., Granby, and Richard D. Hottenstine, Windsor, Conn., assignors to Combustion Engineering, Inc., Windsor, Conn., a corporation of Delaware Filed Aug. 1, 1966, Ser. No. 569,349 50 Claims. (Cl. 122-448) ABSTRACT OF THE DISCLOSURE A safety system for a steam generator with the steam generator having an independent simultaneously operating control system. The safety system determines the ratio of air and fuel inputs and of fuel and feedwater inputs. Only when either of the ratios deviates a preselected amount from a preselected ratio does the safety system take controlling action, overriding the actions of the independent simultaneously operating system. The safety system at this time controls the inputs until the ratio returns to within the preselected ratio range, then releasing control of the inputs to the independent control system. Each ratio is determined by two independent means and the determinations compared. An alarm is sounded if the determinations do not agree, and corrective action is taken only if each of the two determinations of any paricular ratio indicate an excessive deviation.

This invention relates to steam generators and in particular to a control system expressly for steam generator safety.

The principal dangers in the operation of steam generators are furnace explosions and extreme variations in the steam temperature. While overpressure could also be extremely hazardous, this particular danger is avoided by the use of reliable safety valves.

The furnace explosion hazard comes from an unbalance between the fuel and air. If the furnace goes air-rich, the flame may be extinguished, but there is no explosion hazard. On the other hand, should the furnace go fuelrich, the flame will be extinguished but a hazard exists, since air must be passed through the fuel-rich furnace at some time. This means that the air-fuel mixture will reach explosive proportions.

Extremely high steam temperatures create an obvious hazard since the strength of the pressure parts is reduced at high temperature and due to thermal stresses set up by rapid changes in temperature. Thermal stresses due to temperature change occur whether the problem is one of high temperature or low temperature. Rapid temperaturejchange with thick structures causes the temperature of the steam touched surface to change temperature rapidly, while the outer portion of these parts lags behind. This temperature difference with its concomitant expansion difference can cause considerable stress within the pressure parts.

The three inputs to the steam generator which concern us are fuel, air and feedwater. A known fuel-air ratio is required for satisfactory combustion of the fuel, and this combustion results in the dependent variable, the composition of the flue gases. This composition is generally determined by a C0 or 0 meter. Such a determination of the fuel-air ratio, while very accurate, can determine a dangerous situation only after an unbalance has existed for a sufiiciently long time to permit the unbalance to integrate through the boiler system. Similarly, in oncethrough units the steam temperature is a function of the feedwater-fuel ratio. Too much feedwater for the amount of fuel results in low temperatures, while too little feedwater results in high temperatures. Again while measurement of the actual steam temperature is quite precise, it is only detected after the feedwater-fuel unbalance has existed long enough to permit it to integrate throughout the boiler system.

Use of the dependent variables in determining a dangerous situation means that corrective action can be taken only after the unbalance has existed for some time. The dangerous situation therefore is established and gets a headstart on the safety system not only because of the process lag but also because of the measurement lag, which can be considerable in the case of flue gas analysis. Any effort to reduce the lag by decreasing the tolerances of the dependent variable error can result in nuisance trips during normal operation.

While ordinary control systems are very reliable, it is obvious that with a multiplicity of components, any individual component can fail resulting in failure of the system. It has been suggested that check circuits be provided around each of the many components so that failure of the component can be detected. Such checking circuits alert the operator to the failure and identify the defective component. Some lock the controls in place on malfunction. These systems, however, leave it up to the operator to take necessary corrective actions, are extremely expensive, and do not cover operator error.

In a restricted sense our invention is as follows. The ratio of fuel flow to air flow is determined. When this ratio deviates a preselected amount above the proper condition, the safety control system seizes control of the steam generator from both the normal automatic control system and the boiler operator. This ratio is selected so that the air-fuel ratio does not reach dangerous proportions. The air fiow is increased and the fuel flow is decreased until the ratio comes within the preselected limits.

Independent sensing and computing means can be provided to determine the fuel-air ratio with parallel equipment. Corrective action is taken only if both sets ofequipment indicate a dangerous situation. As a check against malfunction of the computing network and sensing equipment, the independently obtained fuel-air ratios are continuously compared, and an alarm is sounded if there is any difference in the two networks. Fuel-feedwater ratios are similarly determined with alarms or corrective action being taken when the fuel-water ratio deviates a preselected amount from the normal ratio in either direction.

It is an object of our invention to provide a control system which checks the sum total of the control system components, including the boiler operator, and takes corrective action automatically to avoid an unsafe condition.

It is a further object of our invention to alarm and take corrective action before a dangerous situation occurs rather than rapidly correcting it after it occurs.

It is another object to provide a safety backup to the normal control system whereby more aggressive anticipatory action may be taken through the normal control system with the safety backup system preventing a hazardous situation.

It is a still further object to provide a safety control system which provides internal checks against maloperation of the safety systemwhile providing an arrangement which minimizes false danger signals and actions,

Other and further objects of the invention will become apparent to those skilled in the art as the description proceeds.

With the aforementioned objects in view, the invention comprises an arrangement, construction and combination of the elements of the inventive organization in such a manner as to attain the results desired as hereinafter more particularly set forth in the following detailed description of an illustrative embodiment, said embodiment being shown by the accompanying drawings wherein:

FIG. 1 is a schematic illustration of a once-through steam generator and turbine generator combination illustrating the conventional control system as well as the sensing and regulating portions of the safety control system; and

FIG. 2 is a logic diagram of the safety control system.

Our invention relates to an arrangement of common control components in a novel system. The transmitters, voltage sensitive relays, and gates operational amplifiers, etc., are all in common use. An operational amplifier can be connected to add or subtract incoming signals. To clarify the description of the system and term summation point is used when the signals are added and difference point where they are substracted. While described with electrical controls in mind, the system could also use pneumatic or hydraulic controls.

Referring to FIG. 1, the basic once-through steam generator and turbo generator system to be controlled is illustrated. Feedwater is supplied through feedline 2 to the steam generator. In the steam generator it passes serially through the economizer 4, the evaporating section 6 and the superheater 8. Fuel is supplied through fuel line 10 while air is supplied through air line 12 to the furance of the steam generator. The fuel is burned in furnace 14 so that the water passing through the steam generator is evaporated and superheated. This superheated steam passes from the superheater 8 through steam line 16 to the steam turbine 20. The steam rotates the turbine, driving electric generator 22 which generates electric power. Steam from the turbine is condensed in condenser 24 and returned through a feedwater system to feedwater pipe 2.

Feedwater control valve 26, which is driven by valve actuator 28, operates to regulate the flow of feedwater entering the steam generator. Other controls such as feed pump speed could also be used. Turbine throttling valve 30, which is driven by valve actuator 32, operates to regulate the fiow of steam from the steam generator to the turbine.

Fuel control valve 34 regulates the quantity of fuel being suppiled with this valve being driven by valve actuator 36. Instead of a valve any fuel regulating device may, of course, be used such as feeder speed to coal pulverizers. Air control valve 38 which is driven by valve regulator 40 regulates the quantity of air flow to the furnace 14. While this flow control means is illustrated as a valve for simplicity, gas flow dampers would normally be used but other means of control such as variations in fan speed may equally well be used.

Feedwater flow transmitters

42 and 44 sense the feedwater flow and generate a signal which is indicative of the feedwater How. Similar signal transmitting devices are utilized for pressure transmitter 46, temperature transmitter 48,

fuel flow transmitters

50 and 52 and

air flow transmitters

54 and 56. Oxygen content in the flue gases is sensed by oxygen content transmitter 58 which develops the control signal representing the oxygen content. Megawatt transmitter 60 senses the actual megawatt output of the generator and emits a control signal representing this output.

The required output is established by the generation control 62. This device indicates generally the desired output, and it may include the usual frequency bias, limit actions and runback actions. Regardless of what devices are used within this generation control unit, the output is a control signal which is representative of the desired megawatt output of the electric generator. An anticipating control signal is sent through control line 64 directly to summation points 66, 68 70 and 72. This signal is operative whenever there is a change in generation control so that the resepctive controllers start controlling immediately upon the detection of a desired generation change.

It is well known that such an anticipating or demand signal is inadequate for complete steam generator control. A coordinating assembly must be provided which integrates the control actions from the dependent variables. This system then applies these integrated control actions in a non-interacting manner to correct the dependent variables to the set point values. The correction to the turbine throttle valve position combines megawatt error and pressure error so that correction of one will not increase the other. For instance, if megawatts and pressure should both be high, any governor valve action to correct one will aggravate the other. Correction of power inputs from the pressure and megawatt errors are also properly combined to prevent detrimental interaction with the firing rate and feedwater flow. As an example, high megawatts and high pressure both call for decrease in boiler inputs. However, high pressure with low megawatts will call only for opening the turbine throttle valve with no correction to boiler input.

To attain these results the generation control 62 also passes a generation set point signal through control line 74. This is compared with the actual megawatt output signal passing from transmitter 60 through control line 76, with the resultant generation error signal passing through control line 78. This generation error signal is conveyed to difference point and summation point 82.

A pressure error signal is also determined by means of a pressure signal through control line 84 which is compared to the pressure set point 86 generating a pressure error signal passing through line 88. This pressure error signal is also conveyed to difference point 80 and summation point 82.

A temperature error signal is generated by passing a temperature signal through control line 90 which is compared with temperature set point 92 generating a temperature error signal passing through control line 94. This temperature error signal is conveyed to difference point 96 and summation point 98.

An oxygen error signal is generated with the O transmitter passing a signal through control line 100 which is compared to set point 102 generating the oxygen error signal passing through control line 104. This signal is conveyed to summing point 106 and difference point 108.

In summation point 82 the generation error and pressure error signals are added with an input demand cor rection signal then passing through control line 110 to summation point 98 and difference point 96. At summation point 98 this input demand correction is added to the temperature error signal with a feedwater change signal passing through control line 112 to summation point 66. At summation point 66 the signal is added to any anticipating signal which may be present with the signal representing the required feedwater fiow passing through control line 114. This establishes the set point signal for the feedwater flow which is measured by feedwater flow transmitter 42 and compared at set point 116. If movement of the feedwater valve is required, the proper signal then passes through the normally closed

switches

118 and 120 to feedwater actuator 28, which operates to move the feedwater valve 26 in the proper direction. A modulated type control is used with the actuator capable of driving the valve in either direction. The voltage of the control signal causes either a closed or open circuit to be energized until the valve has moved sufficiently to satisfy the control system.

At difference point 96 the difference between the input demand correction and the temperature error signal is determined with a control signal representing this difference passing through control line 122. This signal passes to difference point 108 and summation point 106. At difference point 108 the signal is compared with the oxygen error signal with the differential signal passing through control line 124 to summation point 68. At this point it is added to any anticipating signal which may be present with the signal indicating the required fuel flow passing through control line 126. This establishes the set point for the fuel control with the signal being compared at point 128 with a measured fuel flow signal passing through control line 130 from fuel flow transmitter 50. If a change in the fuel quantity is required, a signal indicating this change passes through the normally closed

switches

132 and 134 to the fuel valve actuator 36 which adjusts the fuel flow in the proper direction. A modulating type control is also used here for fuel flow.

The difference between the input demand correction signal passing through line 94, which has been determined at difference point 96, also passes to the summation point 106. At this point a signal is added to the oxygen error signal with an air flow correction signal passing through control line 136. At summation point 70 this is added to any anticipatory signal which may be present if the signal serving as set point for air fiowpasses through control line 138. At point 140 this signal is compared to an actual air flow signal passing through control line 142 from air flow transmitter 54. If a change in air flow is required, an appropriate signal passes through the normally closed switches 144 and 146 to the air flow actuator 40. The air flow controlling valve 38 is then movedw in the proper direction to regulate air flow. This is also a modulating type control whereby the valve may be moved in either direction to any position.

The control signals passing through the described normal control system must include the proper proportional and derivative action to effectively tune the system and provide a stable, accurate control system. The illustrated system is only a brief schematic of the system with duplication of these components being required in some cases, such as where there is a plurality of steam lines requiring temperature control. There are also intermediate temperatures to be held, and desuperheating stations to be controlled. A control system of this type for a steam generator capable of driving an 800 megawatt system would cost in the order of $350,000. This includes no check on the control system other than alarms on the dependent variables.

In the illustrated embodiment manual control of feedwater, fuel and air may be used. Manual feedwater contr-oller 148 may be utilized by closing normally open switch 150 while opening the normally closed switch 118 so that a manual control signal may be passed through control line 152 directly to the feedwater actuator 28. Similarly, manual fuel control station 154 operates through the normally open switch 156 and control line 158 to operate fuel flow actuator 36. The air flow may be controlled manually from air flow manual control station 160 which passes a control signal through the normally open switch 162 and control line 164 to the air flow actuator 40.

Our invention operates as a check and protection for the entire automatic and manual control system. If the normal control system is operating properly, the prpper relation between feedwater and air will be maintained. The same relation should be maintained during manual operation. However should any component of the control system fail or should an operator error occur during manual operation, the relation between feedwater, fuel and air can reach limits which introduce the previously described dangerous situations. Accordingly, we have provided 'a supplementary control system which stops the deviation before the dangerous situation is reached and corrects the deviation. It is much simpler than the basic control system and far less expeensive. The safety control system for an 800 megawatt unit, even with the duplicate system described, would cost in the order of $20,000, or about 6 percent of the cost of the regular control system. This safety system will keep the steam generator operating in a safe condition. It will not accurately regulate the fuelair ratio or the temperature nor will it in any way directly control the megawatt output of the system. It does only one thing, that is, regulate the unit so that it operates in a safe condition. It may be used in conjunction with a manual control system, an automatic control system, or both. This safety system will seize the control from either the automatic control or the manual operation should either a component error or a human error by the operator cause a potentially dangerous operating condition. It does this in response to the independent variables, rather than waiting for results from the dependent variables. Feedwater flow, air flow and fuel flow are independent variables. Temperature, pressure, oxygen content of the flue gases and steam flow particularly in a drum type unit are dependent variables.

Since a safety system of this type must be extremely reliable and at the same time it is undesirable to have a safety system take over operation of a unit unnecessarily, double metering is used and a double control system is used. While this duplication is not essential to our invention, since the system has few components and is relatively inexpensive, duplication in the interest of reliability can readily be justified.

One of the two transmitters used at each location may be the one which is used for the conventional control system, as illustrated in FIG. 1.

Feedwater transmitters

42 and 44 send signals representing feedwater flow through control lines E and F respectively.

Fuel flow transmitters

50 and 52 send similar fuel flow signals through lines A and C, respectively, while

air flow transmitters

54 and 56 send air flow signals through control lines D and B respectively. These control signals are preferably normalized, for instance they may vary from 0 volts at 0 load to 30 volts at full load. Therefore, the half load voltage on feedwater, fuel and air would each be 15 volts. Any control signal representing the independent variables is satisfactory.

FIG. 2 is a logic diagram of the safety control system with control lines A, B, C, D, E and F being continued from FIG. 1. Control signals passing through A and B represent fuel and air flows respectively. These signals enter the ratio computer 200 which divides signal A by signal B so that a signal representing A/B is passed through control line 202. Similar signals from the duplicate meters are passed through control lines C and D to the ratio computer 204. A signal representing C/D is then passed through control line 206. If the sensing and transmitting equipment of the safety control system is working properly to this point, the A/B signal should be identical with the C/D signal. In order to check this, these signals are compared at proportional amplifier 208. A control signal indicating a proportion of the two ratio passes through control line 210. If A/B is greater than C/D voltage sensitive relay 212 causes an alarm to sound. If C/D is greater than A/B voltage sensitive relay 214 actuates an alarm. Therefore if there is any error in the safety system ahead of this point, including the transmitters, the operator will be alerted by the sounding of an alarm and the problem may be investigated. If desired three circuits could be used instead of only two, with action depending on at least two agreeing ratios.

If the air fiow to the steam generator increases in proportion to the fuel, no explosive condition is established. The proper fuel-air ratio is the standard ratio, which is unity with normalized signals. However should the fuel increase relative to the air, the previously described explosion hazard will exist. Therefore when the normalized signal of the fuel flow is 10 percent greater than the normalized signal of the air flow, the determined ratio exceeds the standard ratio by 10 percent, and an alarm is sounded. When the determined ratio signal reaches 20 percent in excess of the standard ratio, air flow is increased until the ratio is within this 20 percent range. The particular deviations selected depend on the design of the steam generator, but is always selected to take action before the explosive condition is reached.

The alarm for the 10 percent excess fuel condition opcrates through proportional amplifier 216 which has set point 218 set at 1.1. The A/B signal passes through control line 220 with the signal passing through control line 222 in the event that the A/B ratio exceeds 1.1. This causes the voltage sensitive relay 224 to sound an alarm.

The runback action is accomplished through the proportional amplifier 226 which has set point 228 set at 1.2. The A/B ratio passes through this amplifier through control line 230 with a signal passing through control line 232 in the event that the ratio exceeds 1.2. The voltage sensitive relay 234 sends a signal indicating that corrective action is required through control line 236 to the AND gate 238. No corrective action will be taken, however, unless the circuit based on the C/D ratio also indicates a need for corrective action. If our invention is used without the duplicate circuit check, action would be taken at this time.

Using the parallel circuit in a manner similar to the A/B circuit, the C/D circuit will sound an alarm at 10 percent deviation by sending the C/D signal through control line 240 to proportional amplifier 242. This has set point 244 set at 1.1 so that a control signal passing through control line 246 as the C/ D signal exceeds 1.1. In this case the voltage sensitive relay 248 will sound an alarm. Similarly, the corrective action is taken through means of proportional amplifier 250 which has set point 253 set at 1.2. The C/D signal passing through control line 252 will generate a signal in control line 254 only if the 1.2 ratio is exceeded. This causes voltage sensitive relay 286 to be energized sending a control signal through control line 258 to AND gate 238.

If both the A/B and the C/D circuits indicate that corrective action is required, the control signal is sent through control line I to run air flow up while a control signal is sent through control line H to run fuel down. The manner of interconnecting these control lines with the general control system is illustrated in FIG. 1. When the increased air fiow signal is passed through control line I, normally open switch 260 closes permitting the control signal to enter the air flow actuator 40. Simultaneously, the normally closed switch 146 opens disconnecting both the automatic control system and the manual operating system. The run fuel down signal passing through control line H passes through the normally open switch 262 which is closed at this time. This permits the control signal to enter the fuel flow actuator 36 decreasing the fuel flow. Simultaneously, the normally closed switch 134 is opened disconnecting both the automatic control system and the manual operating station.

Switches

260, 146, 262 and 134 are operated in response to the activating signal passing through control lines H and I.

It is possible to operate this system by utilizing only one of these two signals, that is to either run air flow up or run fuel down. However since we do not know where the system failure is, it is preferred to use both signals. For instance, the failure may be in the fuel actuator so that fuel cannot be run down even by the safety control system. In this case the air increase signal would avoid the explosive condition in the furnace.

The corrective action taken due to the safety control system changes the fuel and air inputs, and, therefore, the A/B and C/D ratios will soon change. When the ratios come within the percent limits establishing set

points

228 and 252, the safety control system will release control to either the manual or automatic control system on which the unit was operating before the malfunction. If the item which caused the deviation has been corrected in the interim, the unit will continue to operate on either the manual or automatic control system. However should the item causing failure continue, the safety control system will again take control when the fuel-air ratio exceeds the 20 percent limit.

The safety control system will in this case only operate to maintain a safe air-fuel ratio. It does not sense either the actual megawatt output or the required output nor is it responsive to pressure. In this situation where the normal system has failed or there has been an operator error, we must accept the reduced generation output during this period in the interest of furnace safety. Over-pressure of the steam generator would be handled by the normal safety valves while under-pressure can either be tolerated or handled by a conventional minimal pressure controller on the turbine throttle valve.

This safety control system has substantially less components than the conventional control system even though the system as illustrated is entirely duplicated in the interest of reliability. We have a system which not only senses a malfunction of the control system but also an operators error. In the event of such an error, this system seizes control of the unit away from the malfunctioning equipment and continues to operate it at a safe condition until correction can be made in the normal operating equipment. We, therefore, have an inexpensive system which not only monitors the operation but safely takes over operation should the need occur. Obviously, this system is not sufficiently accurate for use as a normal control system. It is only adequate as a safety backup for either manual or automatic controls.

In a drum type steam generating unit the air-fuel ratio only need be monitored. However in the once-through unit steam temperature is directly related to the fuel-feedwater ratio. Substantial deviations from the normal ratio cause dangerous temperature conditions in either direction. Should the fuel-water ratio become low, rapid temperature decreases would occur. Therefore, an alarm is sounded when the ratio is 90 percent of the standard ratio while corrective action is taken if the ratio drops to percent of the standard ratio. On the other hand, should the fuel-water ratio be high, excessive temperatures will result. Therefore, an alarm is sounded if this ratio exceeds 10 percent above the standard ratio, while at 20 percent above the standard ratio corrective action is taken. Again the particular deviations used are a function of the particular steam generator design. The high ratio limit may have a different variation than the low ratio limit, always selected so that corrective action is taken before the danger point is reached. Except for the fact that deviations from this ratio are used in either direction, the circuit for the fuel-water ratio is the same as that used previously for the air-fuel ratio. The fuel signal passing through line A together with the feedwater signal passing through line F enter the ratio computer 300. The A/B ratio passes through the control line 302. At the same time from the optionally used duplicate metering devices control signals passing through control lines C and E enter ratio computer 304 with the C/E ratio being expressed in control line 306. Both the A/F and the C/E ratios are passed to proportional amplifier 308 with the control signal being generated in line 310 if there is any difference in the two ratios. If the A/F ratio is greater than the C/E ratio, voltage sensitive relay 312 causes an alarm to sound. On the other hand, should the C/E ratio be greater than the A/F ratio, voltage sensitive relay 314 will annunciate. This comparison of the two ratios is a check on the safety control system to this point and on the metering devices. The operator will be alerted to any difference in the two systems so that the problem may be investigated. The A/F ratio is also passed to the proportional amplifier 316 which has set point 318 set at 0.9. The A/F signal passing to this amplifier through control line 320 causes a signal to be generated in control line 322 should the ratio be less than 0.9. In this case voltage sensitive relay 324 will sound an alarm.

The A/F ratio is also passed through control line 326 to the proportional amplifier 328. Here this signal is compared to set point 330 which is set at 0.8. Therefore if the A/F signal representing the fuel-water ratio continues to decrease below 0.8, the control signal is passed through control line 332 to the voltage sensitive regulator 334. A signal indicating need for corrective action is passed through the control line 336 to the AND gate 338. While corrective action could be taken at this point, with the duplicate circuit, corrective action will be taken only if the parallel circuit based on control signals through lines C and E also indicate that such action is needed.

The C/ E signal is passed through control line 340 to the proportional amplifier 342. At this point the signal is compared to set point- 344 which is set at 0.9. When the C/E signal drops below'this value, a signal is passed through control line 346' to voltage sensitive relay 348 which sounds an alarm.

On further deviation the proportional amplifier 350 operates so that corrective action may be taken. The signal being passed to this amplifier through control line 352 is compared to the set point signal 353 which is set at 0.8. When the C/E ratio drops below 0.8, a control signal is passed through"control line 354 to voltage sen-' sitive relay 356. This causes the second control signal to pass to AND gate 338 through control line 358. Should both the A/F and the C/E ratios indicate a need for corrective action,'the propercontrol signals are sent from the AND gate 338 through control lines G and H. The signal passing through control line G will cause waterflow to decrease while the signal passing" thro'ugh'control line H 'will'hold fuel "constant; As indicated in FIG. 1, the feedwater signal -'passing'through controlline G passes through thenormally 'o'pen' switch360 which closes at this time. Simultaneously,'the normally closed switch 120 opens disconnecting the manual station and the automatic control system. The signal for feedwater flow'decrease then enters" the feedwater actuator 28causing this actua'-' tor to'throttle val've26 reducing feedwaterflow. Switches 360 'and 12'0 operate in "responseto the control signal in controllin'e I.

The bold fuel constant signal passing through control line 'H passes only'so 'far'as normally openswitch 262. At' the time this signal is generated the normally closed switch -13'4 is opened in response to the control signal in control line H. Along with the hold-constant signal we do not close switch 262, so that no control signal whatsoever is passed to the fuel' feed actuator 36. This will, therefore, leave fuel feed just where'it is. If desired, only the decrease fuel control circuit tothe valve can'b'e interrupted, so that fuel can be increased by manual control or by the earlier described integrated control system. Accordingly, should the failure haveconi'e due to manual or automatic dercease in fuel, this decrease will be stopped. I 7

'Another path is provided for control action based on fuel-feedwater ratio in the'eventtha't this ratio is high resulting" in high temperatures. Since the same'A/F and C/E signals are used, the checking'circuit using proportional"amplifier308"is still of significa'nce'fFO'r the purpose of alarming the A/ F ratio is 'passedthrough control line 370"to proportionala'r'nplifier 372 where it is compared with set'point 374. Since this set point is set at 1.1, the co'ntrol'si'gnal passes through control line 376 'only if the A/F ratio exceeds this 1.1'.'In thatcase the'voltage sensitive relay 378'sounds'an alarm.

The A/F signal also being passed through control line 380 to proportional'amplifier 382 is compared to set point 384'. Since this'set'point is set at-1.2; a control signal'is established in control line 386 only if the'fuel flow exceeds the water flow by 20 percent. In this event the volt age sensitive relay 388 is activated with the control signal passing through the controll-ine -390-t the AND gate -A parallel circuit based on the C/E ratio uses the proportional amplifier -394-which-receives the- C/E signal through control line 396. This signal is compared to set point 398 which is set at 1.1 establishing a control signal in control line 400 along with'activation of voltage sensitive relay 402 and the sounding of an alarm whenever the ratio exceeds 1.1.

Proportional amplifier 404 compares the C/E signal entering through control line 406 to the set point 408 which is set at 1.2. When this ratio is exceeded, a control signal passes through control line 410 and voltage sensitive relay 412 with the signal indicating a need for corrective action being passed to AND gate392 to control line 414.

Should both the A/F and C/E ratios indicate a high fuel-water ratio, corrective action is taken by establishing a control signal inline G to run feedwater up while simultaneously establishing acontrol signal in line H to run fuel down. Referring to FIG. 1, normally open switch 360 closes at this time and normally closed switch opens in response to the signal in control line G, so that the safety control system will take control of'feedwater; Normally open switch 262 in control line H closes and normally closed switch 134 opens in response to the signal in control line H, so that the safety control system may pass a signal to fuel flow actuator 36 while the manual and automatic control systems are isolated from control. This safety control system will continue to operate to maintain safe ratios in a manner described in the discussion of the air-fuel ratio. The regulating action could be confined to feedwater changes if so desired.

The chart below summarizes the corrective actions taken in the event of a dangerous unbalance of feedwater fuel and/or air:

Action Deviation from normal:

Fuel/Air--High .Increase air, decrease fuel. Fuel/AirLow -No action.

Fuel/Feedwater-High -Increase feedwater, de-

crease fuel.

Fuel/Feedwater-Low .D ecrease feedwater, hold fuel constant.

An examination of the described system shows a number of important concepts. Fuel is never increased. Air is never decreased. Feedwater maybe moved in either direction.

The deviation limit safety control system acts directly on the fuel-air and feedwater actuators. It will always come in to over-ride both the automatic and manual control. Dual metering for all measurements may be included with the computing network also doubled. While direct meter comparison is eliminated in such a situation, the analo g signals representing the ratio of fuel to air and fuel to feedwater are compared from one computation network to the other. If a deviation exists, this fact is annunciated to the operator. The two computation networks are in series; that is, both must agree that the deviation limit has been exceeded or else the deviation limit system will not function. The duplicated system and its adjuncts is an improvement on the basic system in the interest of reliability.

In the foregoing illustration an alarm was sounded when the monitored ratio deviated 10 percent from the normal ratio, and corrective action was taken when this ratio deviated 20 percent. The particular deviation used for the alarm and the corrective action should be selected in line with the requirements of the particular unit to which this system is to be applied. During'steady' state operation the ratios of the normalized values should be very near unity. During load changes, however, these ratios will vary an amount depending on the design ,of the unit and the rate of the load change. For instance, when increasing load on the unit the temperature of the pressure parts absorbing heat must increase due to the increased absorption rate. Heat storage must be, therefore, added to these pressure parts resulting in a temporary fuel feed which is high for the corresponding feedwater flow. Similarly, air flow may lead fuel flow during a load change due to lag in the fuel feed means such as a coal pulverizer. These figures will also vary depending on the excess air quantity which is used for normal operation and the final steam temperature which could be tolerated for short-time operation. I

While we have illustrated and described a preferred embodiment of our invention it is to be understood that such is merely illustrative and not restrictive and that variations and modifications may be made therein without departing from the spirit and scope of the invention. We therefore do not wish to be limited to the precise details set forth but desire to avail ourselves of such changes as fall within the purview of our invention.

What is claimed is:

1. A safety system for a steam generator, said steam generator having air supply means, feedwater supply means, fuel supply means, simultaneously operating means for controlling the output and supply means of the steam generator independent of the safety control system, comprising: means for determining the How rate of two independent variables; means for determining the ratio of the flow rates of the two independent variables; means for comparing said determined ratio to a standard ratio; sensing means for determining a preselected deviation of said determined ratio from the standard ratio; means for taking corrective action by changing-the rate of flow of at least one of the independent variables in response to said sensing means in a direction to return the determined ratio toward the standard value.

2. An apparatus as in claim 1 wherein said simultaneously operating means comprises means for automatically regulating the supply means in response to the steam generator output.

3. An apparatus as in claim 1 where the independent variables are fuel flow and air flow.

4. An apparatus as in claim 3 wherein said simultaneously operating means comprises means for automatically regulating the supply means in response to the steam generator output.

5. An apparatus as in claim 3 wherein said means to take corrective action comprises means to decrease fuel flow in response to a preselected high deviation of the determined fuel-air ratio.

6. An apparatus as in claim 5 wherein said means to take corrective action comprises also means to increase air flow.

7. An apparatus as in claim 1 wherein the independent variables are fuel flow and feedwater fiow.

8. An apparatus as in claim 7 wherein said simultaneously operating means comprises means for automatically regulating the supply means in response to the steam generator output.

9. An apparatus as in claim 7 wherein said means to take corrective action comprises means to decrease fuel flow in response to a high determined fuel-feedwater ratio.

10. An apparatus as in claim 9 wherein said means to take corrective action comprises also means to increase the feedwater flow.

11. An apparatus as in claim 7 wherein said means to take corrective action comprises means to increase feedwater flow in response to a low determined fuel-feedwater ratio.

12. An apparatus as in claim 10 having also means for taki g corrective action in response to a low determined fuel-feedwater ratio including means to increase feedwater flow.

13. An apparatus as in claim 11 wherein said means to take corrective action comprises also means to hold fueHiow constant.

14. A safety system for a steam generator, said steam generator having air supply means, feedwater supply means, fuel supply means, simultaneously operating means for controlling the output and supply means of a steam generator independent of the safety control system, comprising: means for determining the air flow rate; means for determining the fuel flow rate: means for determining the feedwater flow rate; means for determining the fuel-air ratio; means for comparing said determined fuel-air ratio to a standard fuel-air ratio; first sensing means for determining a preselected deviation of said determined fuel-air ratio from the standard fuel-air ratio;

means for taking corrective action by changing the rate of flow of at least one of the independent variables forming the fuel-air ratio in response to said first sensing means and in a direction to return the determined fuel-air ratio toward the standard fuel-air ratio; means for determining the fuel-feedwater ratio; means for comparing said determined fuel-feedwater ratio to a standard fuel-feedwater ratio; second sensing means for determining a preselected deviation of said determined fuel-feedwater ratio from the standard fuel-feedwater ratio; means for taking corrective action by changing the rate of fiow of at least one of the independent variables forming the fuel-feedwater ratios in response to said second sensing means and in a direction to return the determined fuel-feedwater ratio toward the standard fuel-feedwater ratio.

15. An apparatus as in claim 14 wherein said simultaneously operating means comprises means for auto matically regulating the supply means in response to the steam generator output.

16. An apparatus as in claim 14 wherein said means for taking corrective action in response to said first sensing means comprises means for decreasing the fuel flow and means for increasing the air flow; said means for taking corrective action in response to said second sensing means comprising means for decreasing fuel fiow and means for increasing feedwater flow in response to a high fuel-feedwater ratio, and means for decreasing the feedwater fiow in response to a low fuel-feedwater ratio.

17. An apparatus as in claim 16 wherein said means for taking corrective action in response to said second sensing means includes also means for holding fuel flow constant in response to a low fuel-feedwater ratio.

18. An apparatus as in claim 1 wherein said means for taking corrective action includes means for isolating said means for controlling the output of the steam generator independent of the safety control system.

19. An apparatus as in claim 18 wherein said simultaneously operating means comprises means for automatically regulating the supply means in response to the steam generator output.

20. An apparatus as in claim 6 wherein said means for taking corrective action includes: means for preventing operation of said means for controlling the output of the steam generator independent of the control system, at least insofar as said control system is capable of changing one of the independent variables in a direction such as to increase the difference between the determined ratio and the standard ratio.

21. An apparatus as in claim 7 wherein said means for taking corrective action includes: means for preventing operation of said means for controlling the output of the steam generator independent of the control system, at least insofar as said control system is capable of changing one of the independent variables in a direction such as to increase the difference between the determined ratio and the standard ratio.

22. An apparatus as in claim 14 wherein said means for taking corrective action in response to said first and second sensing means each includes also means for preventing operation of said means for controlling the output of the steam generator independent of the safety control system, at least insofar as said control system is capable of changing feedwater flow. fuel flow, or air flow in a direction such as to increase the difference between the determined ratio and the standard ratio.

23. An apparatus as in claim 1 having also a second and independent means for determining the fiow rate of each of the independent variables; a second and independent means for determining the ratio of said independent variables; means for comparing the ratio as determined by the first ratio means to the ratio determined by said second and independent means; means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree.

24. An apparatus as in claim 3 having also a second and independent means for determining the air flow rate; a second and independent means for determining the fuel flow rate; a second means for determining the ratio of fuel flow and air flow; means for comparing the ratio as determined by the first ratio determining means to the ratio determined by said second ratio determining means; and means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree with each other.

25. An apparatus as in claim 7 having also a second and independent means for determining the feedwater flow rate; a second and independent means for determining the fuel flow rate; a second means for determining the ratio of fuel flow rate and feedwater flow rate; means for comparing the ratio as determined by the first ratio means to the ratio determined by said second ratio determining means; and means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree with each other.

26. An apparatus as in claim 14 having also a second and independent means for determining the air flow; a second and independent means for determining the fuel flow; a second and independent means for determining the feedwater flow; a second means for determining the ratio of fuel flow and air flow; means for comparing the ratio as determined by the first-mentioned fuel-air ratio determining means to the ratio determined by said second fuel-air ratio means; means for sounding an alarm in response to the comparison of said fuel-air ratios in the event that said ratios do not agree with each other; a second means for determining the ratio of fuel flow and feedwater flow; means for comparing the ratio as determined by the firstmentioned fuel-feedwater ratio determining means to the ratio determined by said second fuel-feedwater ratio determining means; and means for sounding an alarm in response to the comparison of said fuel-feedwater ratios in the event that said ratios do not agree with each other.

27. An apparatus as in claim 23 having second and independent means for comparing said second determined ratio to a standard ratio; second and independent sensing means for determining a preselected deviation of said second determined ratio from the standard ratio; and means for blocking the corrective action in response to the firstnamed sensing means unless said second sensing means also exceeds the preselected deviation of said determined ratio from the standard ratio.

28. An apparatus as in claim 24 having second and independent means for comparing said second determined fuel-air ratio to a standard fuel-air ratio; second and independent sensing means for determining a preselected deviation of said second determined fuel-air ratio from the standard fuel-air ratio; and means for blocking the corrective action in response to the first-named sensing means unless said second sensing means also exceeds the preselected deviation of said determined fuel-air ratio from the standard fuel-air ratio.

29. An apparatus as in claim 25 having second and independent means for comparing said second determined fuel-feedwater ratio to a standard fuel-feedwater ratio; second and independent sensing means for determining a preselected deviation of said second determined fuelfeedwater ratio from the standard fuel-feedwater ratio; and means for blocking the corrective action in response to the first-named sensing means unless said second sensing means also exceeds the preselected deviation of said determined fuel-feedwater ratio from the standard fuel-feedwater ratio.

30. An apparatus as in claim 26 having second and independent means for comparing said second determined fuel-air ratio to a standard fuel-air ratio; third and independent sensing means for determining a preselected deviation of said second determined fuel-air ratio from the standard fuel-air ratio; means for blocking the corrective action in response to said first sensing means unless said third sensing means also exceeds the preselected deviation of said determined fuel-air ratio from the standard fuel-air ratio; a second and independent means for comparing said second determined fuel-feedwater ratio to a standard fuel-feedwater ratio; fourth and independent sensing means for determining a preselected deviation of said second determined fuel-feedwater ratio from the standard fuel-feedwater ratio; and means for blocking the corrective action in response to said second sensing means unless said fourth sensing means also exceeds the preselected deviation of said predetermined fuel-feedwater ratio from the standard fuel-feedwater ratio.

31. A safety system for a steam generator, said steam generator having air supply means, feedwater supply means, fuel supply means, means for automatically controlling the output of the steam generator by regulating the fuel, air and feedwater flows in response to the independent variables of the steam generator, and means for manually regulating the air, fuel and feedwater supply to said steam generator from remote manual operating stations, comprising: first means for measuring fuel flow and a second means for measuring fuel flow; a first means for measuring air flow and a second means for measuring air flow; a first means for measuring feedwater flow and a second means for measuring feedwater flow; means for determining a first fuel-air ratio from said first fuel and air flow measuring means; and means for determining a second fuel-air ratio from said second fuel and air flow measuring means; means for comparing said first and second determined fuel-air ratios; means for sounding an alarm in response to said comparison when said determined fuel-air ratios do not agree; means for comparing said first determined fuel-air ratio to a preselected standard fuel-air ratio and first sensing means for determining when said determined fuel-air ratio deviates a preselected amount from the standard fuel-air ratio; first means for taking corrective action in response to said first sensing means by changing the rate of flow of fuel or air in a direction to bring said determined fuel-air ratio toward the standard fuel-air ratio; means for determining a first fuel-feedwater ratio from said first fuel and feedwater flow measuring means; means for determining a second fuel-feedwater ratio from said second fuel and feedwater flow measuring means; means for comparing said first and second fuel-feedwater ratios; means for sounding an alarm in response to said fuel-feedwater ratio comparison when said fuel-feedwater ratios do not agree; means for comparing said first fuel-feedwater ratio to a preselected standard ratio and second sensing means for determining when said ratio deviates a preselected amount from said standard ratio; second means for taking corrective action in response to said second sensing means by changing the rate of fiow of fuel or feedwater in a direction to bring said determined fuel-feedwater ratio toward the standard ratio.

32. An apparatus as in claim 31 wherein said first means for taking corrective action includes means for preventing operation of said means for automatically controlling the output of the steam generator and said means for manually regulating the air, fuel and feedwater supplies, at least so far as they are capable of increasing fuel flow or decreasing air flow; the second means for taking corrective action including means for preventing operation of said means for automatically controlling the output of the steam generator and said means for manually regulating the air, fuel and feedwater supply, at least so far as they are capable of increasing fuel or decreasing feedwater flow in response to a high fuel-feedwater ratio and at least so fas as they are capable of decreasing fuel and increasing feedwater flow in response to a low fuelfeedwater ratio.

33. An apparatus as in claim 32 having also second means for comparing said determined fuel-air ratio with a standard fuel-air ratio; first alarm sensing means for determining when said determined fuel-air ratio deviates from said standard fuel-air ratio by a selected amount, less than the preselected amount; and means for sounding an alarm in response to said first alarm sensing means; second means for comparing said determined fuel-feedwater ratio with astandard fuel-feedwater ratio; second alarm sensing means for determining when said determined fuel-feedwater ratio deviates from the standard fuel-feedwater ratio by a selected amount, less than the preselected amount; and means for sounding an alarm in response to said second alarm sensing means. 7

. 34. An apapratus as in claim 31 having also means for comparing said second determined fuel-air ratio to a preselected standard fuel-air ratio and third sensing means for determining when said second determined fuel-air ratio deviates a preselected amount from the standard fuel-air ratio; means for blocking the corrective action in response to said first sensing means unless said third sensing means also establishes that the second determined fuel-air ratio has deviated at least a preselected amount from said standard fuel-air ratio; means for comparing said second determined fuel-feedwater ratio to a preselected standard fuel-feedwater ratio, and fourth sensing means for determining when said second determined fuelfeedwater ratio deviates a preselected amount from the standard fuel-feedwater ratio; means for blocking the corrective action in response to said second sensing means unless said fourth sensing means also establishes that the second determined fuel-feedwater ratio has deviated a preselected amount from the standard fuel-feedwater ratio.

35. An apparatus as in claim 31 wherein said first means for taking corrective action comprises means for decreasing the fuel flow and means for increasing the air flow; said second means for taking corrective action comprises means for decreasing fuel flow and means for increasing feedwater flow in response to a high fuel-feedwater ratio, and means for decreasing the feedwater flow and holding fuel flow constant in response to a low fuelfeedwater ratio.

36. An apparatus as in claim 35 wherein said first means for taking corrective action comprises means for decreasing the fuel flow and means for increasing the air flow; and second means for taking corrective action comprises means for decreasing fuel flow and means for increasing feedwater flow in response to a high fuel-feedwater ratio, and means for decreasing the feedwater flow and holding fuel flow constant in response to a low fuelfeedwater ratio. 7

37. An apparatus as in claim 36' having also second means for comparing said determined fuel-air ratio with a standard fuel-air ratio; first alarm sensing means for determining when said determined fuel-air ratio deviates from said standard fuel-air ratio by a selected amount, less than the preselected amount; and means for sounding an alarm in response to said first alarm sensing means; second means for comparing said deter-mined fuel-feedwater ratio with a standard fuel-feedwater ratio; second alarm sensing means for determining when said determined fuel-feedwater ratio deviates from the standard fuel-feedwater ratio by a selected amount, less than the preselected amount; and means for sounding an alarm in response to said second alarm sensing means.

38. A safety system for a process apparatus, said process apparatus having first reactant supply means, second reactant supply means, means for interacting said first and second reactants, and simultaneously operating regulating means for regulating each of the reactant inputs to control the result of the interaction independent of the safety system, comprising: means for determining the flow rate. of said first and second reactants; means for determining the ratio of the flow rates of said first and second reactants; means for comparing said determined ratio to a standard ratio; sensing means for determining a preselected devia- 16 tion of said determined ratio from the standard ratio; means for taking corrective action by changing the rate of fiow of at least one of the reactants in response to said sensing means in a direction to return the determined ratio toward the standard value.

39. An apparatus as in claim 38 wherein said means for taking corrective action includes means for isolating said regulating means.

40. An apparatus as in claim 38 wherein said means for taking corrective action includes: means for preventing operation of said regulating means insofar as said regulating is capable of changing one of the reactant flow rates in a direction such as to increase the difference between the determined ratio and the standard ratio.

41. An apparatus as in claim 38 having also a second and independent means for determining the fiow rate of the first and second reactants; a second and independent means for determining the ratio of said first and second reactants; means for comparing the ratio as determined by the first ratio means to the ratio determined by said second and independent means; means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree.

42. An apparatus as in claim 41 having second and independent means for comparing said second determined ratio to a standard ratio; second and independent sensing means for determining a preselected deviation of said second determined ratio from the standard ratio; and means for blocking the corrective action in response to the first-named sensing means unless said scecond sensing means also exceeds the preselected deviation of said determined ratio from the standard ratio.

43. A safety system for a process apparatus, said process apparatus having first reactant supply means, second reactant supply means, means for interacting said first and second reactants, and simultaneously operating control means for automatically controlling the result of the interaction by regulating the first and second reactant fiows in response to the result of the interaction; comprising: means for determining the flow rate of said first and second reactants; means for determining the ratio of the flow rates of said first and second reactants; means for comparing said determined ratio to a standard ratio; sensing means for determining a preselected deviation of said determined ratio from the standard ratio; means for taking corrective action by changing the rate of flow of at least one of the reactants in response to said sensing means in a direction to return the determined ratio toward the standard value.

44. An apparatus as in claim 43 wherein said means for taking corrective action includes means for isolating said controlling means.

45. An apparatus as in claim 43 wherein said means for taking corrective action includes: means for preventing operation of said controlling means insofar as said controlling means is capable of changing one of the reactant flow rates in a direction such as to increase the difference between the determined ratio .and the standard ratio.

46. An apparatus as in claim 43 having also a second and independent means for determining the flow rate of the first and second reactants; a second and independent means for determining the ratio of said first and second reactant flow rates; means for comparing the ratio as determined by the first ratio means to the ratio determined by said second and independent means; means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree.

47. An apparatus as in claim 46 having second and independent means for comparing said second determined ratio to a standard ratio; second and independent sensing means for determining a preselected deviation of said second determined ratio from the standard ratio; and means for blocking the corrective action in response to the first-named sensing means unless said second sensing 17 means also exceeds the preselected deviation of said determined ratio from the standard ratio.

48. An apparatus as in claim 44 wherein said process apparatus includes remote manual operating means for regulating the input flow rate of said first and second reactants; said means for taking corrective action including means for preventing remote manual regulation of a reactant flow rate in a direction such as to increase the difference between the determined ratio and the standard ratio.

49. An apparatus as in claim 48 having also a second and independent means for determining the flow rate of the first and second reactants; a second and independent means for determining the ratio of said first and second reactant flow rates; means for comparing the ratio as determined by the first ratio means to the ratio determined by said second and independent means; means for sounding an alarm in response to the comparison of said ratios in the event that said ratios do not agree.

50. An apparatus as in claim 49 having second and References Cited UNITED STATES PATENTS 3,216,661 11/1965 Sawyer 236-15 3,236,449 2/ 1966 Brunner l22-448 X 3,244,898 4/1966 Hickox 122448 X 3,284,615 11/1966 Yetter 236-15 X CHARLES I. MYHRE, Primary Examiner.

US. Cl X.R. 122-45 1 H050 UNITED STATES PATENT OFFICE CERTIFICATE OF CORRECTION Patent No. 3,h15,232 Dated December 10, 1968 Inventor(s) C. J. Garrett, Jr. & R. D. Hottenstine It is certified that error appears in the above-identified patent and that said Letters Patent are hereby corrected as shown below:

Column l l, lines 19 and 20, of the patent, change "independent variables" to --output.

SIGNED AND SEALED AUG l-IQTO SEAL) Amer:

Edward M. Fletcher, Ir. WILLIAM E. 'SOHUYIER JR A Officer 1 Comissioner of Patents