Technical Committee on Fluid Heaters

Transcription

1 Technical Committee on Fluid Heaters Date: August 9, 2016 To: Technical Committee on Fluid Heaters From: Eric Nette, Staff Liaison/Engineer Re: Agenda Package NFPA 87 A2017 Second Draft Meeting October 4-6, 2016 Enclosed is the agenda package for the October 4-6, 2016 meeting for the NFPA 87 Second Draft Meeting. Please ensure that you have reviewed the public comments and the other agenda items in advance to prepare for discussion. The agenda and public input will be posted on the document information pages ( Some items to have available during the meeting include: Agenda package with public comments A copy of NFPA 87 (visit the NFPA 87 Document information pages for your free committee copy) Any previous copies of the technical committees standard A laptop Optional items that are sometimes useful include: Review of NFPA s Process, If you have any questions or comments, please feel free to reach me at (617) or by at enette@nfpa.org. I look forward to our meeting to begin the revision cycle! Page 1 of 75

2 NFPA 87 A2017 Second Draft Meeting October 4-6, 2016 DoubleTree Suites by Hilton Hotel Orlando Lake Buena Vista 8:00 a.m. to 5:00 p.m. (Eastern Time Zone) 1. Meeting opening, introduction and attendance 2. Approval of First Draft Meeting Minutes of November 17-19, 2015 (Attachment A. November 17-19, 2015 Meeting Minutes). 3. Chair's remarks, Al Underys 4. Staff Liaison update: a. A2017 Schedule (Attachment B. A2017 Revision Cycle) b. Committee Membership Update (Attachment C. FLU-AAA Membership) c. Standards Process Review (Attachment D. NFPA Process Quick Reference Guide) 5. Old/New Business Order of Consideration/Schedule for Task Group Work and Public Comments a. Public Comments for NFPA 87 (Attachment E. NFPA 87 - A2017 Public Comments) b. Tuesday October 4 i. Chapter 4 ii. Chapter 5 iii. Lunch - noon iv. Chapter 6 v. Chapter 7 c. Wednesday October 5 i. Chapter 8 (Beginning with Task Group Report) ii. Lunch - noon iii. Chapter 8 (cont.) iv. Chapter 9 (Beginning with Task Group Report) v. Adjourn for the day when Chapter 9 is complete d. Thursday October 6 6. Other business i. Chapter 12 ii. Chapter 3 iii. Chapter 1 iv. Chapter 2 Page 2 of 75

3 7. Date/Location of Next Meeting. TBD, next meeting will be during the next revision cycle 8. Adjournment Attachments: A. November 17-19, 2015 Meeting Minutes B. A2017 Revision Cycle C. FLU-AAA Committee Membership D. NFPA Process Quick Reference Guide E. NFPA 87 - A2017 Public Comments Page 3 of 75

4 Attachment A: November 17-19, 2015 Meeting Minutes Page 4 of 75

5 Minutes First Draft Meeting Embassy Suites Lake Buena Vista Resort Orlando, Florida November Attendees: Eric Nette, Al Underys, Rick Martin, Mark Mooney, Kevin Ray, John Kane, Demetrius Venizelos, Jim Oetinger, Jay Hudson, Melissa Wadkinson, Doug Jones, John Pendergraff, Franklin Switzer, Bruce Mickelson, Ted Jablkowski, Jason Darrell, John Stanley, Jonathan Chandler, Adriano Santos, Tom Wechsler, Ryan Northcott (guest), Ruby Evans (guest), Matt Paine (guest) 2. Phone/Web Attendees: Joel Gaither 3. Chair Introduction: a. On Tuesday morning, Al Underys called the meeting to order. b. Al welcomed the attendees to the 3 rd face-to-face meeting of the NFPA 87 Technical Committee (since its inception). c. Al gave a brief history of the origin of NFPA 87 document and technical committee. d. The attendees introduced themselves. 4. Staff Liaison Introduction: a. Eric Nette has been with NFPA since early-2014 and his first committee assignment was NFPA 87. b. Eric described the working guidelines for NFPA technical committees. c. Current makeup of 87 TC: i. 3 Insurance ii. 8 Manufacturer iii. 7 Special Expert iv. 8 User v. (+ 8 alternates) d. See Calendar posted on website ( for NFPA imposed deadlines. e. First Draft balloting date is before February 1, f. First Draft posted in March, and Public Comment closing date is May 16, g. Second Draft meeting is anticipated to be in August, September, or early October h. Next Edition will be 2018 Edition, with effective date of May or August Work Conducted on First Day (Tuesday): a. The Technical Committee addressed three public inputs but did not resolve any, generated at least one committee input, and initiated three First Revisions, but did not finalize them. b. END OF DAY TUESDAY 6. Work Conducted on Second Day (Wednesday): a. The Technical Committee addressed and resolved approximately 7 public inputs, generated approximately 3 committee inputs, and created approximately 7 First Revisions (chapter revisions to facilitate the document s transition from Recommended Practice to Standard). Page 5 of 75

6 b. END OF DAY WEDNESDAY 7. Work Conducted on Third Day (Thursday): a. The Technical Committee addressed and resolved approximately 21 public inputs, generated approximately 3 committee inputs, and created approximately 5 First Revisions (chapter revisions to facilitate the document s transition from Recommended Practice to Standard). b. A number of additional First Revisions that entail modifications to specific requirements beyond the basic RP to STD revisions were also generated by the committee and will be balloted individually. c. The committee resolved ALL Public Input items on the agenda before adjournment. d. END OF DAY THURSDAY 8. Tentative Date for 2 nd Draft Meeting: a. The group s consensus was for the staff liaison to attempt to reserve the dates October 4-6, 2016 for the Second Draft Meeting, and for the meeting to be held in Orlando, FL with the Embassy Suites Hotel on Jamaican Court/International Drive being first choice for the meeting location. 9. Chair Closing Statement a. On Thursday afternoon, Al Underys thanked the Technical Committee for their hard work and adjourned the meeting. Respectfully submitted, Rick Martin, Secretary, NFPA 87 Technical Committee Page 6 of 75

7 Attachment B: A2017 Revision Cycle Page 7 of 75

8 NFPA 87 Revision Cycle KEY DATES Annual 2017 NFPA 87 A2017 [FLU-AAA] Important Dates For the Cycle: Public Comment Closing May 16, 2016 (DONE) Posting of Second Draft December 12, 2016 Notice of Intent to Make Motion (NITMAM) February 20, 2017 Issuance of Consent Standard May 12, 2017 (published bit later) NFPA Annual Meeting with CAMs June 4-7, 2017 Issuance of Standard with CAMs August 10, 2017 (published bit later) Page 8 of 75

9 Attachment C: FLU-AAA Committee Membership Page 9 of 75

10 Attachment D: NFPA Process Quick Reference Guide Page 10 of 75

11 New Process (Second Draft Stage) Quick Reference Guide For additional information on the New Regulations visit: A Technical Committee (TC) can take these actions at the Second Draft (ROC) meeting: 1. Resolve a Public Comment Accept Reject, But See Related Second Revision Reject Reject But hold 2. Create a Second Revision NOTE: All actions require a Committee Statement. Resolve Public Comment (TC needs to act upon all the Public Comments) Accept The TC takes the text exactly as submitted by the public comment and creates a second revision. Sample Motion: I move to accept PC#_. Approval by meeting vote (simple majority) and final approval through ballot. Reject but See The TC agrees with the concept of the PC in whole or part but wants to edit the text to create a second revision. Sample Motions: i. I move to reject PC#, but create a second revision using it as a basis. ii. I move to make a second revision using PC# as a basis. Approval by meeting vote (simple majority) and final approval through ballot. Reject The TC disagrees with the proposed changes in the public comment. Sample Motion: I move to reject PC#. Approval by meeting vote (simple majority). Not subject to ballot. Reject, but Hold. The TC may hold any comment until the public input stage of the next revision cycle meeting any of the following criteria: i. New concept that has not had any public review ii. The changed text would require the technical committee to restudy the change iii. The proposed concept cannot be handled in the second draft timeframe Sample Motion: I move to hold PC#. Approval by meeting vote (simple majority). Not subject to ballot. Create a Second Revision (change to the document) TC must create a Second Revision (SR) for each change they wish to make to the document. The TC can either choose to use a Public Comment for the basis of the change or not. Page 11 of 75

12 Using Public Comment for basis: i. See above for ACCEPT or REJECT BUT SEE. Without using Public Comment for basis i. Sample Motion: I make a motion to revise section as follows. Approval by meeting vote (simple majority) and final approval through ballot. Page 12 of 75

13 Comparison to Previous Process: Accept PREVIOUS ACTIONS NEW PROCESS ACTIONS Sample Motion 1) Committee generates a Second Revision and Substantiation (CS) for change 2) Committee provides response (CS) to each PC. 1) I move to accept PC#. Any variation of Accept (APA, APR, APP) on a public comment Rejected Public Comment 1) Committee rejects the comment, but creates a Second Revision 2) Committee provides response (CS) to each PC that is associated with the revision 1) Committee rejects the comment 2) Committee provides response (CS) to PC 1) I move to revise section using PC#_ as the basis for change. 2) I move to reject PC#, but create a second revision using it as a basis. I make a motion to reject PC#_ with the following committee statement. Accepted Committee Comment Committee generates a Second Revision and Substantiation (CS) for change I make a motion to revise section as follows. Committee generates a statement for reason for change. Notes: 1) All meeting actions require a favorable vote of a simple majority of the members present. 2) All Second Revisions will be contained in the ballot and will require a 2/3 affirmative vote to confirm the meeting action. 3) Only the Second Revisions will be balloted. PCs will be contained in the report but will not be balloted. Page 13 of 75

14 Term Comparison between Current and Old: CURRENT TERM Input Stage Public Input (PI) First Draft Meeting Committee Input Committee Statement (CS) First Revision (FR) First Draft Report First Draft Comment Stage Public Comment Second Draft Meeting Committee Comment Committee Action Second Revision Second Draft Report Second Draft OLD TERM ROP Stage Proposal ROP Meeting Committee Proposal that Fail Ballot Committee Statement Committee Proposal or Accepted Public Proposal ROP ROP Draft ROC Stage Public Comment ROC Meeting Committee Comment that Fail Ballot Committee Action Committee Comment or Accepted Public Comment ROC ROC Draft Note: The highlighted terms are the ones that will be most applicable at the Second Draft Meeting. Page 14 of 75

15 Attachment E: NFPA 87 A2017 Public Comments Page 15 of 75

16 Public Comment No. 11-NFPA [ New Section after ] Flame Detector. A safety device directly responsive to flame properties that senses the presence or absence of flame using flame sensors. [86, 2015] Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Clarify definition of flame detector used elsewhere in document.. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 11:38:08 EDT 2016 of 30 Page 16 of 75 8/2/2016 8:25 PM

17 Public Comment No. 12-NFPA [ New Section after ] Supervised Flame. A flame whose presence or absence is detected by a flame detector. [86, 2015] Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Adds further definition to term used elsewhere in document. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 11:40:26 EDT 2016 of 30 Page 17 of 75 8/2/2016 8:25 PM

18 Public Comment No. 13-NFPA [ New Section after ] Flame Failure Response Time (FFRT). The period of time that starts with the loss of flame and ends with the deenergizing of the safety shutoff valve(s) [86, 2015] Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Adds definition ot term used elsewhere in document Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 11:42:33 EDT 2016 of 30 Page 18 of 75 8/2/2016 8:25 PM

19 Public Comment No. 5-NFPA [ Section No ] Combustion Safeguard. A safety control directly responsive to flame properties that senses device that responds to the presence or absence of flame and de-energizes the fuel safety shutoff valve in the event of flame failure properties using one or more flame detectors and provides safe start-up, safe operation, and safe shutdown of a burner under normal and abnormal conditions. Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Updates definition to be consistent with use of PLCs for combustion safety. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consulting Street Address: City: State: Zip: Submittal Date: Wed May 11 12:18:31 EDT 2016 of 30 Page 19 of 75 8/2/2016 8:25 PM

20 Public Comment No. 8-NFPA [ New Section after ] Authorized Personnel is a person approved or assigned to perform specific types of duties or to be at a specific location at the job site [1901, 2016]. Statement of Problem and Substantiation for Public Comment This statement adds definition to the term Authorized personnel based on NFPA 1901 definition. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Thu May 12 12:07:49 EDT 2016 of 30 Page 20 of 75 8/2/2016 8:25 PM

21 Public Comment No. 9-NFPA [ New Section after ] Qualified personnel is a person who has skills and knowledge related to the construction and operation of the fluid heating system, its operation and installation and has received safety training to recognize and avoid the hazards involved Statement of Problem and Substantiation for Public Comment This definition further qualifies definition of qualifications needed to access safety logic, similar to statements from NFPA 70. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering Consult Street Address: City: State: Zip: Submittal Date: Thu May 12 12:11:05 EDT 2016 of 30 Page 21 of 75 8/2/2016 8:25 PM

22 Public Comment No. 10-NFPA [ Section No ] Safe-Start Check.* A test incorporated in a combustion safeguard that prevents start-up if a flame-detected condition exists due to component failure within the combustion safeguard or flame detector(s) due to the presence of actual or simulated flame. [86, 2015] A Safe-Start Check. A flame-detected condition could exist due to the presence of actual or simulated flame or due to component failure within the combustion safeguard or flame detector(s). [86, 2015] Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Further Clarification explanatory Annex Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 11:32:35 EDT 2016 of 30 Page 22 of 75 8/2/2016 8:25 PM

23 Public Comment No. 6-NFPA [ Section No ] Safe-Start Check. A test incorporated in a combustion safeguard that prevents start-up if a flame-detected condition exists due to component failure within the combustion safeguard or flame detector(s) due to the presence of actual or simulated flame. [86, 2015] Statement of Problem and Substantiation for Public Comment Align with NFPA 86, Improved definition consistent with use of PLCs as combustion safeguards Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Public Input No. 15-NFPA [Chapter 6] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Wed May 11 14:12:43 EDT 2016 of 30 Page 23 of 75 8/2/2016 8:25 PM

24 Public Comment No. 1-NFPA [ New Section after ] Fluid heaters vessels operating at pressure greater than 15 psi (100 kpa) shall be built and stamped to ASME Boiler and Pressure Vessel Code Section 1 or ASME Code Section VIII, Division 1 pressure vessels. Statement of Problem and Substantiation for Public Comment Section already references the appropriate ASME standards. Since industry recognizes that NFPA 87 should be a standard, it provides a jurisdictional authority the ability to incorporate it as an adopted Standard thereby making it an extremely useful public/employee safety tool. Utilization of the ASME Codes should be profoundly clear for safety and clearly delineated under this section appropriately titled 4.1 Approvals, Plans, and Specifications. ASME Boiler and Pressure Vessel Codes already have widespread adoption by most jurisdictional authorities and provinces. Related Item First Revision No. 16-NFPA [Global Input] Submitter Information Verification Submitter Full Milton Washington Name: New Jersey Dept Labor and Workforce Develoment, Division of Public Organization: and Occupational Safety & Health, Mechanical Inspection Bureau of Boiler and Pressure Vessel Compliance Street Address: City: State: Zip: Submittal Date: Mon Mar 07 17:45:32 EST 2016 of 30 Page 24 of 75 8/2/2016 8:25 PM

25 Public Comment No. 3-NFPA [ Section No ] Where seal leakage or diaphragm failure in a device can result in flammable gas or flammable liquid flow through a conduit or cable to an electrical ignition source, a conduit seal or a cable type that is sealed shall be installed. Statement of Problem and Substantiation for Public Comment Since this requirement pertains to a requirement for the electrical system, I suggest it be located under Electrical. Related Item First Revision No. 152-NFPA [New Section after 5.3] Submitter Information Verification Submitter Full Name: Ted Jablkowski Organization: Fives North American Combustion Street Address: City: State: Zip: Submittal Date: Mon May 02 17:21:43 EDT 2016 Page 25 of 75 0 of 30 8/2/2016 8:25 PM

26 Public Comment No. 4-NFPA [ Section No ] Exhaust Except as permittted by , exhaust ducts shall not discharge near openings or other air intakes where effluents can be entrained and directed to locations creating a hazard. Statement of Problem and Substantiation for Public Comment Add clarification that mixing exhaust gasses with combustion air is permitted for systems using Flue Gas Recirculation. Related Item First Revision No. 45-NFPA [Section No ] Submitter Information Verification Submitter Full Name: Ted Jablkowski Organization: Fives North American Combustion Street Address: City: State: Zip: Submittal Date: Mon May 02 17:28:44 EDT 2016 Page 26 of 75 1 of 30 8/2/2016 8:25 PM

27 Public Comment No. 2-NFPA [ New Section after ] Handheld igniters shall not utilize high voltage to generate electric sparks. Accompanying Annex material: A Fixed igniters that utilize high voltage to generate electric sparks have been proven safe in vast numbers of systems. However, handheld sparking igniters utilizing high voltage transformers (especially homemade igniters not constructed with suitable electrical insulation and safety guards) pose a severe electrocution hazard and should not be used to light gas-fired burners in ovens or furnaces. Sparking igniters that rely on piezoelectric energy to generate a spark are not intended to be precluded by this prescriptive requirement. Statement of Problem and Substantiation for Public Comment Fixed igniters that utilize high voltage to generate electric sparks have been proven safe in vast numbers of systems. However, handheld sparking igniters utilizing high voltage transformers (especially homemade igniters not constructed with suitable electrical insulation and safety guards) pose a severe electrocution hazard and should not be used to light gas-fired burners in ovens or furnaces. Sparking igniters that rely on piezoelectric energy to generate a spark are not intended to be precluded by this prescriptive requirement. Related Item Committee Input No. 57-NFPA [Section No ] Submitter Information Verification Submitter Full Name: Richard Martin Organization: Martin Thermal Engineering, Inc Street Address: City: State: Zip: Submittal Date: Sat Apr 02 00:14:13 EDT 2016 Page 27 of 75 2 of 30 8/2/2016 8:25 PM

28 Public Comment No. 15-NFPA [ New Section after ] [TJ1] * Safety devices not identified in shall be listed for the service intended or approved if a listed device is not commercially available. A The AHJ should consider reliability and durability during the selection process when approving a device. [TJ1] NFPA editor to number appropriately. Statement of Problem and Substantiation for Public Comment Adds further, more specific clarifications Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 12:06:09 EDT 2016 Page 28 of 75 3 of 30 8/2/2016 8:25 PM

29 Public Comment No. 14-NFPA [ Section No ] All safety devices shall meet one of the following criteria: Be listed for the service intended Be approved, where listed devices are not available Be programmable controllers applied in accordance with Section 8.4 *Except as permitted by Section 8.4, combustion safeguards, flame detectors, excess temperature limit interlocks, and safety shutoff valves shall be listed for combustion safety service or approved if a listed device is not commercially available. A A flame rod is not required to be listed. Statement of Problem and Substantiation for Public Comment Adds further, more specific clarification Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 11:59:22 EDT 2016 Page 29 of 75 4 of 30 8/2/2016 8:25 PM

30 Public Comment No. 16-NFPA [ Section No ] Safety interlocks shall meet one or more of the following: (1) (2) Be connected to a combustion safeguard (3) Be hardwired without relays in series ahead of the controlled device (4) Be connected to an input of a programmable controller logic system complying with Section 8.4 (5) Be connected to a relay that represents a single safety interlock configured to initiate safety shutdown in the event of power loss (6) Be connected to a listed safety relay that represents one or more safety interlocks and initiates safety shutdown upon power loss Statement of Problem and Substantiation for Public Comment Better aligned with use of PLCs for combustion safety service Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 12:09:18 EDT 2016 Page 30 of 75 5 of 30 8/2/2016 8:25 PM

31 Public Comment No. 22-NFPA [ Section No ] For Where PLCs that are not listed for combustion safeguards safety service or as combustion safeguard, the PLC and its associated input and output ( I/O ) used to perform safety functions shall be as follows: (1) Third-party certified to IEC 61508, Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems, for use in safety applications with a safety integrity level of 3 (SIL) 2 or greater. and either: (A) Be applied to achieve at least an SIL 2 capability per the manufacturer s safety manual or (B) Have hardwire redundant circuits interlocked in series with the main fuel valves for all of the following 1) A watchdog timer 2) The flame detector 3) The high stack limit switch 4) The high process temperature limit 5) E-stop Statement of Problem and Substantiation for Public Comment Quote from our local Allen Bradley SIL expert: You can t implement SIL without a Safety Study. All Contrologix hardware is SIL 2 capable, but you can t implement SIL without the Safety Study to know how to implement it. Being able to use quality PLCs is critical to Exotherm. I have to continue to lobby that we DO NOT require SIL rated PLCs, or at least we do not require they be IMPLEMENTED to SIL. Doing so will force us to make a less safe system without a PLC in order to maintain legitimate NFPA 87 compliance, or go to an extreme burden to do a full SIL implementation. It is not technically correct to require implementation of SIL in only one piece of hardware in a non SIL system. That just isn t how SIL works. Each loop would need a full analysis for correct implementation (per A-B our PLC vendor). NFPA 87 could ask for SIL capable hardware to weed out "junk" PLCs, as has been stated was the only intention. But we cannot say "implement per manufacturer s requirements," as that would then require a full-blown SIL system. Our company experience, and my personal experience, is that dangerous combustion events rarely happen because of hardware or software failure. The dangerous event happens after a hardware failure has caused a shutdown. Human intervention causes the event as a technician attempts to solve a combustion problem and/or get the combustion equipment back on line. The PLC based systems Exotherm has provided have proven to provide much better trending and troubleshooting data to allow for quick and safe restoration of heater function by clearly showing the actual problem. With a PLC the technician does not repeatedly, blindly attempt relights or use a jumper wire to get around the problem. In this regard the PLC makes for a safer overall system by eliminating Page 31 of 75 6 of 30 8/2/2016 8:25 PM

32 the human error. In my experience, and the experience of our programmer and PLC vendors, nothing in a PLC program is going to be randomly changed, such as the purge time or trial for ignition. The values are hard coded in the program, and are not registers available to change from the screen or through the network. Has anyone ever seen a digital clock randomly change time due to an x-ray or cosmic event? I do not see how timing issues warrant SIL requirements. We have had the discussion and agreed that PLC timing functions are more reliable than even "listed" timing devices. We also have selected the most critical trips and hardwired them to the main fuel valves, so that in the event of any of the most critical failures such as flame out, high temperatures, and sometimes low flow, the system will shut down regardless of the PLC. A watchdog timer has traditionally been used as well. In my opinion these layers of protection are safer than relying solely on a SIL rated PLC. We typically do not hardwire low/high gas pressure, low combustion air pressure, or low instrument air pressure. I am confident that the transmitters and PLCs we use are far more reliable than the mechanical pressure switches typically used to monitor these items. People pointed out in one subcommittee call that these trips are critical to air/fuel ratio, which is true. However, nowhere that I am aware of in the NFPA standards do we address using a listed, or high quality non-junk fuel air ratio control system. Are we going to implement in code that a failsafe fuel/air ratio system be used? If not, than these truly are second tier safety trips. At our company we almost always use a listed fuel/air ratio system with an interlocked safety fault that we use as a running interlock. Are we going to mandate such a system in NFPA code? Please consider that by requiring a SIL rated PLC with SIL implementation the NFPA is discouraging the use of PLCs that have proven to make for a safer system by more clearly identifying faults and making it more difficult to jumper a fault. With a traditional non-plc BMS the attempts to get a faulted system back online are often when human error leads to tragic consequences. Attribute of standard BMS: Uses a single interlock string that can be jumpered with one wire, or any single interlock can be jumpered with one wire. Comparable attribute of PLC based system: Typically uses analog inputs for temperature and pressure interlocks. Not easily bypassed. Attribute of standard BMS: Typical inputs are temperature and pressure switch interlocks. All of these are easily mechanically re-adjusted in the field by turning a screw, a knob, or using a keypad. Comparable attribute of PLC based system: Analog pre-alarm and trip alarm set points can be hard coded in the program and/or password protected so that only authorized users can adjust. Much more difficult to tamper with. Few people are capable of getting into the program due to hardware, software, and skill level required to edit the code. Setpoints not easily tempered with. Setpoints are easily displayed. Attribute of standard BMS: May not have a first out annunciator. Without one, trouble shooting is much more difficult, and often leads to a jumper solution until the problem is correctly identified. Even with an annunciator, it is often difficult to understand why a mechanical switch is intermittently tripping as there can be no observation of the pressure reading, or data logging from a mechanical switch. This leads to tampering. Comparable attribute of PLC based system: Provide real time indication of all analog readings and system status on a display screen. This data can be trended, and pre-alarms can be used to spot a problem and address it before it becomes a critical issue. Many customers wanting a PLC will trend and store data, giving good information to maintain safe and reliable information. Attribute of standard BMS: Mechanical switches, listed or not, have many more issues than transmitters. They can get stuck over time and you cannot know if the switch is working or not until you actively test it. Even with yearly testing you could have a bad switch for 1 year. Easily mis-adjusted, Page 32 of 75 7 of 30 8/2/2016 8:25 PM

33 Comparable attribute of PLC based system: Almost all modern transmitters have on board diagnostics and can be programmed to fail safe (hi or low). If readings make sense and agree with past history, it is a pretty good indication the transmitter is working. With a PLC you could even program a prestart check to ensure readings are where they should be in the shutdown condition, beyond what a standard FSG can do. Settings password protectable. Attribute of standard BMS: Uses hard coded timers for purge and NFPA required sequencing that are not adjustable by the user. Comparable attribute of PLC based system: Uses hard coded timers for purge and NFPA required sequencing that are not adjustable by the user. Related Item Committee Input No. 15-NFPA [Chapter 8] Submitter Information Verification Submitter Full Name: John Pendergraff Organization: Exotherm Corporation Street Address: City: State: Zip: Submittal Date: Mon May 16 14:49:05 EDT 2016 Page 33 of 75 8 of 30 8/2/2016 8:25 PM

34 Public Comment No. 7-NFPA [ Section No ] Page 34 of 75 9 of 30 8/2/2016 8:25 PM

35 8.4.2 * Page 35 of 75 0 of 30 8/2/2016 8:25 PM

36 For Where PLCs that are not listed for combustion safeguards safety service or as combustion safeguard, the PLC and its associated input and output ( I/O ) used to perform safety functions shall be as follows: (1) Third-party certified to IEC 61508, Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems, for use in safety applications with a safety integrity level of 3 or greater. safety integrity level (SIL) 2 or greater (2) Applied to achieve at least an SIL 2 capability per the manufacturer s safety manual A Compliance with the manufacturer s safety manual would achieve actions such as, but not limited to, the PLC detecting the following: (1) Failure to execute any program or task containing safety logic (2) Failure to communicate with any safety I/O (3) Changes in software set points of safety functions (4) Failure of outputs related to safety functions (5) Failure of timing related to safety functions A SlL-2 or greater- capable PLC should include third-party certification, the actions above, and partitioning to separate safety logic from process logic. The requirements for SIL capability in pertain only to the PLC and its I/O and not to the implementation of the burner management system. The purpose of the SIL capability requirement is to provide control reliability. Annex Material: A Compliance with the manufacturer s safety manual would achieve actions such as, but not limited to, the PLC detecting the following: (1) Failure to execute any program or task containing safety logic (2) Failure to communicate with any safety I/O (3) Changes in software set points of safety functions (4) Failure of outputs related to safety functions (5) Failure of timing related to safety functions The requirements for SIL capability in pertain only to the PLC and its I/O and not to the implementation of the burner management system. The purpose of the SIL capability requirement is to provide control reliability. A SIL 3 capable PLC includes third-party certification, the actions above, and partitioning to separate safety logic from process logic. SIL 3 capable PLCs automate many of the complexities of designing a safety system, namely; The PLCs have separate safe and non-safe program and memory areas and the safe areas can be locked with a signature. The inputs and outputs are monitored for stuck bits and loss of control. The firmware, application code, and timing is continually checked for faults. The outputs are internally redundant to ensure they will open even with a hardware failure. By contrast, SIL 2 capable PLCs require that many of these functions be implemented by the application code developer. Codes have traditionally relied on independent third party companies to test and approve safety devices suitable for use in the specific application. In the USA, there are companies like FM and UL that develop design standards and test safety equipment to those standards to ensure the device will operate properly when properly applied. Safety shutoff valves, scanners, combustion safeguards and pressure switches are some of the items that need to be approved for their intended service. Combustion systems have become far more complex requiring greater computing power and greater flexibility so the industry has turned to programmable logic controllers (PLCs) to address the increased complexity. Using a PLC as the burner management system (BMS) makes the PLC a safety device. Just like every other safety component, the PLC must be held to a minimum standard to ensure that it performs predictably and reliably and that its failure modes are well understood. Page 36 of 75 1 of 30 8/2/2016 8:25 PM

37 When assessing a PLC s ability to perform safety functions, the internationally recognized standard is IEC (Functional Safety of Electrical/Electronic Programmable Electronic Safety-Related Systems.) is a detailed quantitative guideline for designing and testing electronic safety systems. By following the directives in this standard, a piece of equipment can be certified by an independent body as capable of meeting a safety integrity level (SIL). The goal of IEC is to quantify the probability that the safety device will fail in an unsafe fashion when commanded to act. The term used is Probability of Failure on Demand (PFD). The data required and the circuit and software expertise to get to the PFD can be quite overwhelming but once calculated they are categorized as follows. Safety Integrity Level (SIL) Probability of Failure on Demand (PFD) Risk Reduction Factor (1/PFD) Safety Availability (1 PFD) 4 > to < > 10,000 to < 100,000 > to < > to < > 1,000 to < 10,000 > 99.9 to < > to < 0.01 > 100 to <1,000 > 99 to < > 0.01 to < 0.1 < 10 to < 100 > 90 to < 99 One can quickly see that the SIL number is a power of 10 change in PFD. The PFD for SIL 1 states that the probability of an unsafe failure in any year is 1% to 10% and SIL 3 has the probability of an unsafe failure in a given year of 0.1% to 0.01%. Stated otherwise, SIL 1 indicates there is the probability of an unsafe failure every 10 to 100 years and a SIL 3 system will have a probability of an unsafe failure, when demanded, once every 1,000 years to 10,000 years. When the PLC, sensor, or final element is certified to SIL 2 it carries the language, SIL 2 capable. This is done because the device in question is capable of performing at that level only when the manufacturer s safety manual has been followed and the installation is correct per the manufacturer s safety manual. Stipulating that the PLC and its associated I/O shall be SIL 2 capable is only setting the floor for performance and helping to ensure that the hardware selected is suitable for use as a safety device nothing else is implied. Confusion may occur when individuals assume that since the hardware has been certified to IEC and it is SIL capable, that this infers that the system must now be designed according to IEC or ANSI/ISA (Functional Safety: Safety Instrumented Systems for the Process Industry Sector) and that is not the intent. IEC is a performance-based standard that offers advice and guidance to quantify, analyze, and subsequently mitigate risks associated with hazards in Safety Instrumented Systems (SIS). When following IEC 61511, each safety function like flame failure, emergency stop, high gas pressure etc., is analyzed. A systematic approach is taken to determine the severity of the failure of that safety function and then the appropriate SIL is assigned to that safety function. Once assigned, the appropriate sensors, logic solvers and final elements are chosen so that three or more of them working together can achieve the required SIL. Placing a sensor in series with a logic solver in series with a final element lowers the SIL and increases the PFD because their individual unsafe failures are cumulative, so it is possible to start with all SIL 2 capable components and end up with a SIL 1 safety function due to the cumulative failures of the individual devices. Offered here is an extremely brief and simple overview of an SIS, however, its proper application is extremely complicated requiring expertise to do correctly. The NFPA 87 requirements do not specify or imply that a Safety Instrumented System must be implemented, nor that a safety function meet a specified SIL target. An extremely effective risk-reducing technique is the use of layers of protection. Analyzing the layers is called layer-of-protection-analysis or LOPA. This technique applies safeties that are independent of other safeties and therefore can t fall victim to common mode errors or failures. As an example, picture a storage tank being filled by a pump that is controlled by a level sensor. It is important to contain the liquid but also not over-pressurize the tank. A layer of protection could be a pressure relief valve because that is independent of the pump control and the level sensor. Another layer could be a dike around the tank in case the pressure relief valve relieves or the tank fails. Again, the dike is completely independent of the other safeties and shouldn t suffer failures that may attack the other safeties. Common mode failures can be insidious. Think about this example of independent safeties and then think about a massive earth quake and tsunami hitting the dike, tanks, and controls all destroyed by a common mode disturbance (e.g. Fukushima). This technique can be effective in providing independent layers of protection that can reduce the risk by a factor of 10 - or an entire SIL. Modern combustion systems take advantage of layers of Page 37 of 75 2 of 30 8/2/2016 8:25 PM

38 protection, thus reducing the SIL of each individual safety function. Examples are; Burner flows are set-up with mechanical locking devices to stay within the burner s stable operating range, gas pressures are monitored for variances, combustion air pressure is monitored, and the flame is scanned. ISA prepared IEC calculations and scenarios on boiler systems and didn t identify any functions above SIL 2, with the majority being SIL 1 or less. Statement of Problem and Substantiation for Public Comment This aligns with NFPA 86, Use of PLCs for BMS Related Public Comments for This Document Related Comment Public Comment No. 5-NFPA [Section No ] Public Comment No. 6-NFPA [Section No ] Public Comment No. 8-NFPA [New Section after ] Public Comment No. 9-NFPA [New Section after ] Public Comment No. 10-NFPA [Section No ] Public Comment No. 11-NFPA [New Section after 3.3.6] Public Comment No. 12-NFPA [New Section after 3.3.6] Public Comment No. 13-NFPA [New Section after 3.3.6] Public Comment No. 14-NFPA [Section No ] Public Comment No. 15-NFPA [New Section after 8.2.2] Public Comment No. 16-NFPA [Section No ] Public Comment No. 17-NFPA [Section No ] Public Comment No. 18-NFPA [New Section after 8.4.4] Public Comment No. 19-NFPA [Section No. 8.9] Public Comment No. 20-NFPA [New Section after A ] Public Comment No. 21-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Thu May 12 11:55:27 EDT 2016 Page 38 of 75 3 of 30 8/2/2016 8:25 PM

39 Public Comment No. 18-NFPA [ New Section after ] 8.4.5* Safety PLCs. (A) Where used for combustion safety service, safety PLCs shall have the following characteristics: (1) The processor and the I/O shall be listed for control reliable service with an SIL rating of at least 2 as required by (2) Access to safety related logic shall be separate from access to nonsafety logic. (3) Access to PLC logic dedicated to safety functions shall be embedded in safety logic code and locked to prevent changes by anyone other than authorized and qualified personnel. (4)*All safety function sensors and final elements shall be independent of operating sensors and final elements. (5) Revising the safety logic or safety related set points after commissioning requires a documented management of change procedure to justify and document any changes to PLC safety related logic A The burner management system logic, memory, and I/O and associated hardware should characterized by the following: (1) Independent from nonsafety logic and memory (2) Protected from alteration by non BMS logic or memory access (3) Protected from alteration by unauthorized users A (A)(4) This standard requires that the signal from the safety device be directly transmitted to the safety PLC input. Once the safety PLC processes the signal the resulting data can be used for any purpose. be Statement of Problem and Substantiation for Public Comment Aligns with NFPA 86, 2015 and use of safety PLCs as per PC 7. Adds further clarification to minimum level reliability required, and how to implement it. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 12:22:40 EDT 2016 Page 39 of 75 4 of 30 8/2/2016 8:25 PM

40 Public Comment No. 17-NFPA [ Section No ] Software. PLC Logic Programs Safety The PLC safety -related software logic shall be logically independent from non-safety-related software logic Safety-related software shall be password-protected or otherwise locked so that access is limited to the fluid heater manufacturer or the burner management system manufacturer * Access to the PLC and its logic shall be restricted to authorized and qualified personnel only Software shall be documented as follows: (1) Labeled to identify elements or groups of elements containing safety software (2) Labeled to describe the function of each element containing safety software A listing of the programs with documentation shall be available. A Consideration may be given to allow access at different levels, such as for example: (1) Level 0: Log-in privileges not required; monitoring only (2) Level 1: Password protected; Operations non-critical related functions, such as operating temperature, loop tuning. (3) Level 2: Password protected; Process design non-safety related functions, such as fuel /air curves, and operation limits. Proper review of the process design, consultation with suppliers, and documentation of the change should be required. (4) Level 3: Access by authorized and qualified personnel only. Safety related logic and set points should be embedded in safety logic code. Statement of Problem and Substantiation for Public Comment : Software typically refers to the development and configuration tool eg Excel or RS Logix. This clarifies that the section refers to the programming code itself Annex material provides explanatory example to clarify use of safety levels. Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Page 40 of 75 5 of 30 8/2/2016 8:25 PM

41 Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Submittal Date: Sat May 14 12:15:44 EDT 2016 Page 41 of 75 6 of 30 8/2/2016 8:25 PM

42 Public Comment No. 19-NFPA [ Section No. 8.9 ] 8.9 Combustion Safeguards ( Flame Supervision) Each burner flame shall have a supervised flame monitored by a flame detector and combustion safeguard that has a maximum flame failure response time of are interlocked into the burner management system * The flame failure resonse time shall be 4 seconds or less and that performs a safe-start check Flame Supervision. Each pilot and main burner flame shall be equipped with flame supervision in one of the following ways: (1) Main and pilot flames supervised with independent flame sensors (2) Main and interrupted pilot flames supervised with a single flame sensor (3) Self-piloted burner supervised with a single flame sensor 8.9.3* Where flame-sensing detectors can fail in the flame-proven mode, self-checking features shall be provided unless the burner is operated for periods less than 24 hours and the burner management system includes a safe-start component checking feature. [85: ] 8.9.4* Flame detector devices using ionization sensors (flame rods) shall only make use of the rectification property of the flame. Statement of Problem and Substantiation for Public Comment Clarification to align flame supervision with use of PLCs for safety functions Related Public Comments for This Document Related Comment Public Comment No. 7-NFPA [Section No ] Public Comment No. 20-NFPA [New Section after A ] Related Item Committee Input No. 15-NFPA [Chapter 8] Relationship Submitter Information Verification Submitter Full Name: Tom Wechsler Organization: Wechsler Engineering & Consult Street Address: City: State: Zip: Page 42 of 75 7 of 30 8/2/2016 8:25 PM