MJC,
I found these links via the magic of google.
The first one deals with the issues discussed in simple easy to understand terms, but the second one gives some better solutions IMHO.
I don't completely agree with the author of the Federal Corp article in his last paragraph of his 2 element control section in that with the use of a differential pressure control valve ahead of the FW regulator valve a constant DP can be maintained across the FW regulator making its flow linear across its range (even and especially if the characteristic of the trim isn't linear). In other words, if the valve is sized for a 25 PSI dp across it, a DP Regulator will maintain dp across the valve regardless of where the FW pumps are on their curve(s).
A 3 element doesn't care in that it measures true water flow and balances that against steam out trimmed by level of course.
The Siemens article correctly shows pressure compensated steam flow meters which are mandatory for boiler control of boilers with any type of swinging loads which most industral/process boilers are to some extent.
Now, after reading the first article and doing some contemplating, let's return to the OP's question and see what happens when his third pump trips. Assume for the purpose of this harangue that the boiler is steady state unless noted otherwise.
With the FW regulator valves set (meaning pinched back) to control drum level with all three pumps running which would mean that the 3 pumps would each be running farther back on their curves than two would, when one pump trips, the other two immediately run out on their curves reducing the inlet pressure to the FW regulator, and hence reducing the total flow of water passed by the valves at that position. So now somewhat less water is going to the drum than immediately before the pump tripped.
As I noted earlier, there will be a momentary dip in drum level until the drum level controller sees the drop in level and its error function begins to call for a change in valve position. How fast this happens depends on its tuning.
This will cause the drum level to drop (at least enough to create the error signal) and continue to drop until the valves open and the increased flow restores the drum to its normal level.
But, too, since and while the inlet BFW flow is reduced, the reduced inflow of cooler (or cold) BFW will cause the firing rate set at that time to increase the pressure in the drum (it has less cold water to heat to generate the steam) so the pressure will rise, which naturally causes shrinkage in the drum level.
At this point, no additional cold water has hit the drum yet, only a reduced flow of what water was being admitted.
The drum level controller will see this shrinkage and will create a greater error signal calling for the FW regulators to open even more, and slug the drum with what the Federal Corp author calls "phasing" which is the sudden introduction of an abnormal amount of colder water which will quench boiling in the down comer tubes and will cause its own shrinkage.
The slug of colder water will also drop the pressure, but this will not cause as much of the swell effect that the author mentions because the water in the drum in the immediate vicinity of the water distribution header in the drum will be sub-cooled for the operating pressure of the drum. The firing rate controller will see this drop in pressure and increase the firing rate to bring all this new cold water back to boiling temperature for the pressure set point, and soon all will be well. (Unless, of course, the process becomes unhappy with the slight drop in steam pressure mentioned above and calls for more steam which would then of course cause swell in the drum-bad if that occurs just about the time that the firing rate increase takes effect.)
So, as I see it Ghamsa, you shouldn't be worried as much about swell in this situation, rather shrinkage and maybe some serious shrinkage. Where are your low water cut off's set compared to drum level?
rmw