Multiple Flame Scanners - 2oo2

Was trying to get my around this after searching and reading some posts about redundant transmitters, but i thought i will throw the question out to get a discussion going.

We have a BMS for a burner that has two flame scanners. The client wants to have the flame scanners as 2oo2, so they can easily remove one while the burner is in operation to clean them and do maintenance on them. Also both scanners would have to fail for a shutdown.

Was wondering what the best strategy is for safety and operability to meet their request.

Also the exact same scenerio on the surge tank with two level transmitters.

I thought 2oo2 meant both sensor outputs had to be 'true' (flame sensed OK), which would mean the logic would fault trip if one of the sensors was out of service, but I'm not a safety-redundancy guy. (I thought 1oo2 would be the logic for what you want).

Anyhow, here's what Honeywell says about paralleling their UV scanners for your purposes (screen shot from document # 62-003-4)



Be aware that Honeywell's UV scanners only work with Honeywell flame amplifiers which are modular components that are part of the 7800 series flame safety switches/controllers. A flame switch provide a relay output indicating presence/absence of flame. But it's not feasible to connect the scanner itself directly to PLC I/O.

Thanks for the reply DanW.

I am not a safety expert, but i thought 2oo2 meant interms of failure not operation. Will check to correct my terminology. But yes both need to fail for a shutdown.

The honeywell reference is what i was thinking of initially, but the customer doesn't want that. Normally we only supply one scanner, so i don't see a big deal, but want to be careful with any software bugs.

We are using Fireye scanners, so similar to these, they have an analog and discrete signal/status.

I'm snowed in today at home, work is closed, so it took awhile to locate the Fireye application note on parallel UV scanners, but I found it, it's attached here:

Thanks for the attachment Dan. It's a PLC based system, so the scanners are only Fireye.
I have attached a routine i wrote today, just for reference. Have a look and maybe there are more efficient and creative ways to handle this.

Is your client interested in safety or operability?
Transmitters are can be connected in various configurations as "voting systems" such as 1001, 1002, 2002 and 2003. There are others but these are the most common. For burner management systems I would expect safety to be the main priority to protect against the risk of explosions. For safety systems a 2002 is the worst possible combination as both devices have to detect an unsafe condition in order for the system to trip. Should a failure of one device occur in such a way that it does not show a danger situation then the system will never trip should the working device detect a trip condition. Alarms can be configured such that a difference between the two detectors raises an alarm but this then relies on the process operator taking immediate action to get the maintenance technician out to fix it. So a 2002 gives improved availability but less reliability to trip. A 1002 gives less availability because it is more susceptable to nuisance trips but increased reiability for trip conditions and is safer than 2002. The 2002 is the worst method of connection and should be avoided in safety systems

I totally agree with you on that one. But operability is their concern.

But as i mentioned, one flame scanner has been for the norm for us, so with respect to that its not that different.

Had made further changes to the code for individual scanner fault. Not going to post that unless someone wants to see it.

If this burner is running 24/7 then you should be using self-checking uv scanners (the ones with a shutter).

If the burner's shutting off at least once a day then a normal uv detector is ok as long as the flame signal is submitted to a self check during start up. Most burner control boxes do but simple flame relays do not in which case you have to write your own logic to test for flame-off/flame-on during the ignition sequence.

If you are doing one of the above already then I don't see a problem with 2oo2.

The trouble is with most normal uv detectors is that with age they tend to fail in the wrong way, i.e. they see a flame when it's not there.