After fuel isolation, a stoker-fired wood-chip boiler can ride through a total AC blackout only when its stored water, heat-absorption surfaces, pressure-relief path, and any credited emergency feedwater source cover the residual combustion and stored thermal energy. Running the boiler feed pump, secondary-air fan, or induced-draft fan is not a universal blackout rule; each load must solve a demonstrated hazard without adding air, upsetting furnace pressure, or starting without its supporting equipment.
Where does the shutdown path start?
Follow the energy path. Normal AC power feeds the fuel screw, boiler feed pump, circulating-water pump, forced-draft fan, secondary-air fan, and induced-draft fan. A blackout removes motive power from those devices. Battery and UPS supplies may keep the DCS, protection logic, instruments, turbine turning gear, and DC emergency lube-oil pump alive, but an energized controller cannot move an AC motor or a de-energized actuator.
The first boiler action is to terminate new heat input. Trip the fuel command, de-energize the screw feeder, close every available fuel-isolation device, and confirm that gravity or stored material cannot continue feeding the grate. Use motor feedback, isolator position, feeder speed, and process response rather than the command bit alone. A stopped screw still contains wood chips, but its inventory is only one part of the heat source; fuel already distributed on the stoker grate determines the continuing combustion load.
Separate boiler protection from turbine protection. DC lube-oil service and turning gear protect rotating equipment but do not replace boiler water, establish furnace draft, or remove heat from boiler pressure parts.
Check: Confirm loss of AC power, positive fuel cutoff, zero feeder movement, and valid live boiler instrumentation before evaluating cooling loads.
What must be proved at the physical layer?
Layer one first. Establish the real state of power, fluid paths, and actuators before interpreting control logic. Identify which instruments, transmitters, solenoids, and position switches remain powered by the battery or UPS. A display that remains lit may show a frozen value if its field transmitter or remote I/O lost power.
| Path | Blackout question | Required observation |
|---|---|---|
| Fuel | Did material movement actually stop? | Feeder feedback is stationary and isolation devices indicate their safe positions. |
| Water | Is usable drum inventory present? | Independent level indications agree after allowing for transient swell or shrink. |
| Steam | Can generated steam leave without uncontrolled pressure rise? | Pressure trend and the designed steam or relief path show heat rejection remains available. |
| Air and gas | Did fan coast-down leave a safe furnace condition? | Fan speed, damper position, furnace pressure, oxygen, and carbon-monoxide indications are credible where installed. |
| Emergency power | Which loads can really start? | Source voltage, breaker state, starter availability, and all auxiliary dependencies are confirmed. |
Check valve fail positions and local mechanical indicators. Loss of control power can leave a damper, feedwater valve, or steam valve in a different state from the last commanded value. Verify that a proposed emergency pump has an open suction source, a discharge path, valve actuation power, and enough net flow to reach the boiler.
Check: Reconcile every credited protection function with a powered sensor, an executable final element, and a physically open process path.
What heat remains after the stoker trips?
The post-trip load has three components: combustion of fuel already on the grate, gasification or smoldering after forced air stops, and sensible heat stored in refractory, metal, ash, water, and steam. Calling all of this “latent heat” hides the design problem; latent heat specifically describes energy associated with phase change. The protection calculation must account for residual chemical heat and stored sensible heat as well as evaporation.
In a stoker furnace, part of the fuel gasifies at the grate and much of the heat release occurs above it when secondary air mixes with combustible gases. Fan trip sharply reduces that mixing and normally reduces heat release, but gasification can continue for a period. Carbon monoxide and other combustibles may then accumulate. Starting a secondary-air fan or an IDF without a validated sequence can add oxygen, draw leakage air through the furnace, move a combustible pocket, or rapidly release heat that had been limited by oxygen.
The mass of chips trapped in a stopped screw may be small compared with the thermal mass of the boiler walls and water, but grate inventory must be determined from feeder delivery, grate residence, trip timing, and observed bed condition. Boiler water provides a large heat sink while wetted surfaces remain covered. Low drum level removes that margin and can expose tubes to high metal temperature.
Check: Trend drum level, steam pressure, furnace pressure, grate temperature or available furnace temperatures, oxygen, and carbon monoxide from the instant of fuel trip; the trends identify whether heat release is decaying or persisting.
Which symptoms identify the limiting failure mode?
| Observed symptom | Likely mechanism | Decision | Proof before proceeding |
|---|---|---|---|
| Pressure rises while level falls | Residual heat continues boiling water with no replacement flow. | Use the designed steam-disposal path and start credited emergency feedwater if its prerequisites are satisfied. | Pressure stabilizes or falls, level remains within the approved shutdown range, and feed flow is indicated. |
| Level changes abruptly after the trip | Pressure-induced swell or shrink may be affecting indication. | Compare independent level measurements and pressure trend before adding water aggressively. | Indications converge and the level trend matches the mass balance. |
| Carbon monoxide rises after fan coast-down | Fuel is gasifying with incomplete oxidation. | Do not introduce air through an improvised fan start; apply the boiler’s approved combustible-gas and purge sequence. | Gas readings, furnace pressure, and purge permissives meet the approved restart criteria. |
| Furnace pressure moves outside its shutdown band | Damper fail position, natural draft, wind, or uneven fan coast-down is controlling flow. | Establish the required pressure path with the designated damper or backed-up draft equipment. | Independent pressure indication is stable and damper feedback matches local position. |
| Pump runs but drum level keeps falling | No suction supply, closed valve, vapor binding, insufficient head, or inadequate flow. | Verify the complete water path; do not credit motor-running feedback as feedwater delivery. | Measured flow and drum response confirm water reaches the boiler. |
A single symptom must not trigger every large motor. Feedwater addresses inventory, an IDF addresses a defined draft or purge requirement, and secondary air changes combustion chemistry. Treat them as separate protective functions.
Check: Match the active symptom to one physical failure mode and confirm that the selected action reverses its trend.
Which loads belong on emergency power?
Size the safe-shutdown load list from the boiler transient, not from the fact that a motor normally runs during firing. A feedwater source is required when calculated boil-off before heat decay or pressure stabilization would drive drum level below the boiler manufacturer’s approved shutdown limit. That source may be a small dedicated emergency feed pump, a normal BFP with all auxiliaries, or a steam-driven feedwater pump that can operate while usable steam remains.
| Candidate load | When to credit it | Dependency or adverse effect |
|---|---|---|
Normal BFP
|
Its delivered flow and head cover the transient. | It may require a condensate pump, valve power, lubrication, cooling, and starting capacity. |
| Dedicated low-flow emergency pump | Only makeup flow is needed for the decay period. | Its suction inventory, discharge head, and independent power path must be proven. |
| Steam-driven feedwater pump | A qualified steam supply and control path remain during coast-down. | Operation ends when steam conditions fall outside the pump’s usable range. |
IDF |
The approved shutdown analysis requires controlled negative furnace pressure or a defined purge. | Starting it can pull combustion air through leakage paths and requires damper coordination. |
| Secondary-air fan | The approved combustion-extinction sequence explicitly calls for it. | Added oxygen can accelerate oxidation of gasified fuel. |
DCS and protection I/O |
Monitoring, trips, sequencing, and operator control must continue. | Field instruments and final elements need compatible backup power. |
A diesel generator starting after approximately 15-20 seconds cannot be treated as an uninterrupted source. The boiler must passively tolerate that dead interval, or a faster independent source must bridge it. Two independent AC supplies reduce common loss only when their switchgear and upstream sources are genuinely independent.
The absence of an emergency-generator mandate in NFPA 85 does not establish that a particular boiler can coast down without powered equipment. Use the standard to verify combustion-safeguard requirements, then use the boiler manufacturer’s heat balance, pressure-part limits, water inventory, and hazard analysis to select site loads.
Check: Demonstrate that each emergency load has a defined protective purpose, all required auxiliaries, adequate starting power, and a response time inside the transient limit.
How should the blackout sequence be commissioned?
- Record the pre-trip firing condition, grate inventory indicators, drum level, steam pressure, feedwater flow, furnace pressure, and available gas measurements.
- Initiate the master fuel trip and prove that the screw feeder and all upstream fuel paths stop.
- Confirm fan and pump coast-down from feedback signals; verify damper and valve positions locally where safe access exists.
- Validate that
UPS-powered displays receive changing field data rather than retaining stale values. - Track drum level with independent measurements and interpret it with steam-pressure change to separate inventory loss from swell or shrink.
- Track furnace pressure, oxygen, carbon monoxide, and temperature. Block discretionary fan restarts while a combustible atmosphere may exist.
- If the shutdown analysis calls for emergency feedwater, establish suction and discharge paths before starting the pump. Start a required condensate pump before a normal
BFPwhen that pump supplies its suction. - When emergency AC becomes available after the stated
15-20 seconds, connect only the sequenced safe-shutdown loads. Respect source capacity and motor-start dependencies rather than restarting the entire boiler auxiliary bus. - Control makeup flow against the approved shutdown level target and metal-temperature constraints. Avoid a sudden cold-water addition to overheated or potentially uncovered pressure parts.
- Do not start draft or secondary-air fans for restart until the approved furnace inspection, combustible-gas evaluation, purge permissives, and burner-management sequence are satisfied.
Check: The sequence passes only when fuel remains isolated, pressure and level stay inside manufacturer limits, emergency power remains stable, and no fan or pump action creates a worse trend.
How is end-to-end capability verified?
Build a transient energy and mass balance for the highest credible pre-trip load and grate inventory. Use measured or manufacturer-provided residual heat-release data, stored thermal energy, initial drum inventory, steam discharge capacity, heat losses, emergency pump curve, water-source inventory, and restoration time. The governing checks are cumulative energy absorption and cumulative water loss, not just peak motor availability.
Test each segment separately before a controlled integrated test: fuel isolation, instrument ride-through, actuator fail positions, generator start and transfer, pump suction establishment, pump delivery, motor starting sequence, furnace-pressure response, alarms, and operator actions. Include failure of the preferred emergency device so that the fallback action and stop criteria are explicit.
Review the results with the boiler manufacturer and the site’s combustion and pressure-part authorities. Record allowable drum-level, pressure, furnace-pressure, gas, and metal-temperature boundaries from approved documentation rather than inserting generic limits.
Check: Replay the full path from loss of normal AC through heat decay or emergency feedwater operation, and accept it only when time-correlated trends prove fuel cutoff, valid instrumentation, controlled furnace conditions, maintained water coverage, and stable pressure.
FAQ
How do I decide whether a biomass boiler needs an emergency feed pump?
Compare calculated boil-off and drum inventory through the complete heat-decay and power-restoration interval. Specify emergency feedwater when the projected level crosses the manufacturer’s approved shutdown limit, then verify pump head, suction inventory, valve power, and delivered flow.
How do I protect the boiler during a 15-20 second generator delay?
Credit only passive water inventory, pressure relief or steam disposal, and continuously powered controls during the delay. The transient calculation must show that drum level, pressure, and pressure-part temperatures remain within approved limits until the first emergency load delivers its function.
How do I decide whether to restart the IDF or secondary-air fan?
Restart a fan only when the approved shutdown or purge sequence assigns it a specific draft or gas-control function. Check furnace pressure, oxygen, carbon monoxide, damper positions, and purge permissives first because added air can accelerate residual combustion or ignite accumulated gas.
How do I prove the blackout shutdown is safe?
Perform the approved end-to-end simulation or controlled test and capture synchronized trends for fuel isolation, AC loss, emergency-source transfer, feedwater flow, drum level, steam pressure, furnace pressure, gas measurements, and pressure-part temperatures. Final verification is stable pressure with maintained water coverage after fuel cutoff and through the full residual-heat decay period.