The level control of the boiler is monitored by 2 instrument groups

LIC031017 consisting of three DP transmitters installed within the same manifold

LI031018 is a single point hydrastep device

LIC031017 A, B & C

These inputs are manipulated to allow for pressure compensation of the drum level using PI031021,
only a single pressure indicator is used for all compensation calculations.

There is only one pressure measurement for drum pressure LI031021. The logic could be modified
with PI031027A/B as a back – up.

The systems runs a number of simple addition routines for the following

LIC031017A + LIC31017B to give LIC031017A_B

LIC031017C + LIC31017B to give LIC031017C_B

LIC031017C + LIC31017A to give LIC031017C_A

LIC031017A_B + LIC31017C to give LIC031017A_B_C

Dependent on WINCC settings made by the operator the following selections are made

When Auto mode is selected from the “Median” Screen and if the instrument Selections are not
changed

LIC031017A_B_C is used for control A

When in Man Mode or in Auto and instrument selection modified the operator can pick the
selections below by selecting or deselecting the corresponding instruments.

LIC031017A_B is used for control A

LIC031017C_B is used for control A

LIC031017C_A is used for Control A

LIC031017A is used for Control A

LIC031017B is used for Control A

LIC031017C is used for Control A

The selection is very simplistic and will likely be prone to errors.

I’ve observed that, presently the interface window allows the operator to deselect all transmitters at
the same time, which needs to be prevented. A modified scheme to be implemented.

Control A

Control A carries out the following functions

Drum High High Level => than 80% (Alarm Only)

Drum Lo Lo <= to 35%, this alarm is interlocked to FD_A, FD_B and FGR

If Control A => 75% MOV039006(Intermittent Blow Down) is triggered to Open

 If Control A <= 75% MOV039006(Intermittent Blow Down) is triggered to Close

Provides PV for The PID Loop of LIC031017MV, dependent if 1 element or 3 element control
is selected this is fed forward into PID loops for control of MOV’s for drum level

There are no direct interlocks between the drum level and the operation of the burners. All Burner
interlocks are driven by the PIC035017 being > 200

These signals are hard wired to the individual burners as Boiler healthy signal

There are no direct interlocks between drum level and the combustion burner only that
PIC035003(FD discharge Pressure) > 400

Hard wired signal

There are examples of bad programming as within the interlock routine the same output is directly
written to in separate networks, this can lead to errors in the state of the output.

LIC031017 Controlled Alarms

LIC31017A, B and C each have the following alarms which are indicated on the WinCC but are not
interlocked to equipment

High High at 72.2%

High at 61.1%

Low at 39%

Low Low at 35%

General Comments

At no point are the signals of LIC031017 checked for validity against each other

LI031018 These are not wired to PLC IO panels while site installation.

This input is direct from source and is scaled between 0 and 100% no internal compensation takes
place.

This instrument generates the following alarms

If LI031018 > 72.2% Drum High High

If LI031018 > 61.1% Drum High

If LI031018 > 38.9% Drum Low

If LI031018 > 35% Drum Low Low

These alarms are only used for indication on the WinCC System.