01What each guard covers
High outlet temperature
Probe on the straight run after the heated section. Action: cut heaters first, keep the circulation pump running to carry residual heat away, stop the pump only after the oil falls back.
Low level
Switch on the expansion vessel or the lowest sensible point; a trip opens the main contactor. Low level can expose the heated section — that is dry firing.
Loss of circulation
Flow switch or inlet-outlet differential pressure. Below design velocity the heat is not carried away and film temperature far exceeds bulk oil.
Independent sheath guard
A separate measurement near the shell or terminals, independent of process control, as a second line of defence.
02Why film temperature is the constraint
Oil data sheets quote a maximum bulk temperature, while the film touching the sheath always runs hotter, and ageing is judged on that film. In practice this means keeping heated-section watt density at the low end for static oil (1.5~3 W/cm²) and energising only under flow — both more effective at protecting the oil than any extra alarm.
Check the ceiling against three numbers: the oil manufacturer maximum service temperature, the heated-section watt density, and minimum flow while circulating. If any one is short, reduce the duty (group switching) rather than raising the alarm threshold.
03Sequence and typical missettings
Energise before the pump
Heating starts with no circulation; the first minutes carry the highest film temperature and produce most of the coking.
Stop pump and power together
Residual heat keeps cooking stationary oil — effectively a local dry-fire. Delay the pump stop.
Alarm set on the control value
If the alarm equals the setpoint it can never act first. Separate them by 5~10 °C.
Probe on the return line
Return oil is cooler than outlet, so high-temperature protection lags badly.
04What to confirm during commissioning
Cold commissioning first proves the interlocks: simulate low level, loss of circulation and high temperature one by one and confirm the main contactor opens while the pump stays running, then compare measured phase current with the nameplate. During hot commissioning log one cold-to-temperature ramp; a spike past setpoint followed by fallback means the control band and group switching need adjustment.

