Unmasking & eliminating inadequate

safeguards: Sasol Sasolburg CO

Shift Converter
A faulty steam flow meter resulted in an incorrect low steam to feed gas ratio reading. This can cause
potential unwanted side reactions and downstream effects to the CO Shift Converter. This paper
covers the events leading to a temperature exceedance, the Root Cause Analyses conducted, and how
the risk was addressed to prevent any re-occurrence.

JJ Marais, M Faling, Dr RG Jordi

Sasol South Africa

Introduction supplemental steam to supply the prescribed

steam to feed gas mole ratio.
his paper will describe the sequence of

T events that led to a mechanical design

temperature exceedance that occurred on
the CO Shift Converter in one of the
operating plants of Sasol in Sasolburg,
South Africa. A previous temperature
Year manufactured:
Dimensions:

Catalyst:
1991
4.1 m ID
Height 5.2 m
CO Shift Catalyst
exceedance on the 1st bed of this same convertor Design condition: Max temp: 480°C
occurred in 2005, but it was seemingly Max press: 3400 kPa(g)
safeguarding the reactor with an additional high Operating Temperature range: 330-
conditions 450°C
temperature trip on the first catalyst bed outlet.
Pressure range: 2000-2500
However, it did not manage to prevent this kPa(g)
similar high temperature incident, and therefore Steam to feed gas Normal range 0.6-1.25
a much closer look into the causality of the mol ratio controlled at 0.94
effects.
Table 1: CO Shift Converter design parameters
Contextualizing Background
Table 1 indicates the design and operating
conditions for the CO Shift Converter under
Max Design Temperature
discussion. The converter design has remained Exceedances in July 2022
unchanged over the years other than using a During the start-up of the Ammonia production
different catalyst than initially installed. facility following a planned shutdown, a high
The CO Shift feed gas is supplied from a Rectisol temperature excursion was recorded on the outlet
unit whereby CO2 is removed from an auto- temperature of the CO Shift Converter. The
thermal reformed gas feed stream. The feed gas outlet temperature of the CO Shift Converter
to CO Shift, thus needs to be conditioned with reached 625°C(1157°F), which exceeded the
design temperature of 480°C(896°F) by was added. During this incident the first bed
145°C(293°F). The initial excursion lasted 30 temperature was below the trip setting and the
minutes, with a similar spike a few hours later plant did not trip.
(see Figure 1). This temperature excursion was
not identified at the time, as it is suspected that Mechanical Investigations
the operator was distracted by starting other units Following the July 2022 incident, the Mechanical
simultaneously. The excursions were only Engineering and Inspection departments
detected the next day when running an OWAP compared the physical design of the bottom
(operating within agreed parameters) monitoring converter outlet nozzle to the allowable pressure
tool that is manually run daily. This tool monitors rating at a temperature of 625°C (1157°F). Based
key operating parameters (e.g. pressures & on the calculated results, they were unable to
temperatures and other fluid conditions like pH) declare the equipment safe for further operation
that could negatively impact the integrity of without further integrity checks. To enable a full
assets for sustainable operations. FFS (fit-for-service) integrity assessment on the
converter and downstream cooling equipment to
determine if the equipment integrity has been
compromised, the equipment had to be taken
offline for inspections by TOFD/Phase array and
Replica and Hardness tests on various sections.
Degassing of the equipment also had to be
performed to enable acoustic emission testing.
The degassing was required to ensure minimum
interference on the inspection procedures by the
presence of hydrogen. The degassing involved
HP steam purging at temperatures and pressures
as close as possible to operating conditions. No
Figure 1: Catalyst bed temperatures internal inspection was initiated at the outset,
pending a first-round evaluation by the
Initial safeguards in place inspectors. This was to avoid damage to the
In the original design, the CO Shift Converter catalyst inside the converter when removing it
was equipped with a thermowell with since no spare catalyst was available,
temperature indication and alarms 'high' and furthermore the cost impact would also have
'high-high' on all four catalyst beds. The first been many times higher.
alarm allows the operator time to evaluate and
The Acoustic Emission (AE) sensor array sensor
rectify the situation. If the temperature continues
probes were installed in a way that it would
to rise, a second alarm will sound. This alarm
ensure a signal originating from any location on
indicates to the operator that the unit must be shut
the vessel's circumferential weld to be recorded
down or corrective action must be taken
by the AE system. The sensor array probes
immediately.
installed covered the bottom dome of the vessel
The decision to shut down the unit was a skirt (see Figure 2). However, during the start of
discretionary decision made by the operator, not the tests, the sensor probes at the bottom dome of
a direct trip action. The plant would trip only the vessel stopped responding and were found to
when the steam to gas mol ratio falls below 0.45 have failed at the end of the vessel warmup
or if the steam to gas ratio remains between 0.45 period. An investigation identified that damage
and 0.5 for longer than three minutes. Following to the probes most probably occurred due to the
a temperature runaway in 2005, a single probes exceeding their operational temperature
temperature trip on the first catalyst bed outlet limit, as the wall temperature under the skirt was
measured at around 160⁰C (320°F), and the units
were designed for a max of only 120⁰C (248°F).
Further AE vessel integrity testing was only
conducted with the set of sensors 1 to 10 round
the circumferential weld. Results from these tests
indicated that the vessel is still fit for service and
recommended that the vessel should be tested
again in a minimum of 5 years from the date of
assessment. All other non-destructive tests
(TOFD/Phase array, Replica and Hardness tests)
showed no damage to the equipment. Figure 2: Blue dots depicting the location of the AE
array sensor probes

Root Cause Analysis

An RCA (root cause analysis) held with all
relevant stakeholders (Production, Technical
Support, Process Safety, Control &
Instrumentation, Maintenance and Mechanical)
revealed the following fault tree (Figure 3):

TEMPERATURE
EXCEEDENCE ON CO
SHIFT CONVERTER

IMPURITIES/
INADEQUATE OXYGEN INGRESS ABNORMAL
FLUCTUATING IRREGULAR STEAM
OPERATOR INTO SYSTEM HEATING RATE TOO FEEDGAS
STEAM FLOW SUPPLY
ATTENTION AND RESULTING IN FAST COMPOSITION
READING FE01
RESPONSE EXOTHERM RESULTING IN HIGH
EXOTHERM

CONDENSATION IN
IMPULSE LINES UNITS OPEN TO
NUMEROUS START
AFTER SHUTDOWN ATMOSPHERE, TOO LOW STEAM TO NO VARIATIONS NO VARIATIONS
UP ACTIVITIES
REQUIRING LINES INADEQUATE GAS RATIO WERE OBSERVED WERE OBSERVED
ONGOING
TO BE BLOWN OUT PURGING

PANEL OPERATOR PANEL OPERATOR

SINGLE TECHNOLOGY OPERATOR PRACTICE IS REQUIRED TO NOT AWARE OF RULED OUT DUE TO STEAM:GAS SOP FT SIDE REACTIONS
IMPULSE LINES WERE TO START-UP STEAM TO WAS FOLLOWED
FOR ALL THREE CONTROL IMPACT OF HIGH NO OPEN SOURCE WITH HIGH
BLOWN OUT IN GAS RATIO IN MANUAL BUT RENDERED
TRANSMITTERS. MULTIPLE UNITS OUTLET FOUND EXOTHERM
STEAD OF BEING MODE UNTIL STEADY DEFICIENT DUE TO
FAILURE MODE IS SIMULTANEOUSLY TEMPERATURE
EQUALISED OPERATION IS REACHED INACCURATE IBL
COMMON
AND THEN SWITCH STEAM FLOW
OVER TO AUTO READING(FE01)
START-UP OF
CASCADE CONTROL NOT ABLE TO
COMPRESSOR
BLOWING OF DETERMINE WHY
REQUIRED MORE
ORRIFICE FLOW IMPULSE LINES ARE THE OPERATOR
ATTENTION DUE
METER IS NOT NORMAL PRACTICE WAS NOT AWARE
TO MODIFICATION
SUITABLE FOR THIS AFTER START-UP, SWITCH OVER TO AUTO
DURING
CRITICAL STEAM BUT WILL CAUSE CASCADE CONTROL WAS ORRIFICE FLOW
SHUTDOWN
FLOW METER INCORRECT FLOW DONE TOO SOON AFTER METER IS NOT
UNTIL STEAM IS START UP. SUITABLE FOR THIS
CONDENSED AGAIN CRITICAL STEAM
AND LINES FLOW METER
EQUALISED CURRENT SOP DOES
NOT SPECIFY
SWITCHOVER BETWEEN
AUTO-CASCADE AND
MANUAL CLEARLY

Figure 3: Fault tree developed for OWAP temperature exceedance

Fluctuating flow reading on internal steam Synthesis unit was offline. There was also a
flow meter discrepancy between the three different flow
During normal operation, steam to the CO Shift readings, although it was below the deviation
Converter is supplied from three sources: the CO alarm setting. The faulty reading on FE1 caused
Shift converter waste heat boiler, steam from the FV2 to cut back the 38 bar steam intake
Ammonia converter waste heat boiler and make- according to the steam to gas ratio control. Figure
up from the battery limit 38 bar import steam 5 indicates the erratic behavior of the gas ratio
utility line. During cold start-up of the plant, during the start-up prior to the temperature
there is no steam available from the Ammonia excursion.
synthesis waste heat boiler as it is downstream
and would still be offline. All internally The operators were aware of the fluctuations and
generated steam utilized is measured by a flow requested the Control and Instrument department
indicator, FE1 (see Figure 4). The ratio setpoint to blow through the flow meter impulse lines to
on the steam to gas ratio is controlled by remove condensate that usually interferes with
controller FV2, which dictates the total steam the transmitter measurements during plant start-
requirement from which FE1 is deducted to up. The operators usually change the steam to gas
determine the amount of 38 bar steam required. ratio control to manual mode during plant start-
The flow indicator FE1 is a single orifice plate ups to minimize process upsets due to these
flow element fitted with three sets of independent anticipated fluctuations. However, during this
takeoff points to transmitters. These transmitters start-up, there were time periods when the control
are pressure and temperature compensated, with was set to manual and then back to auto-cascade
the median of all three readings used for control. control. It is a possibility that the change to auto-
There are deviation alarms coupled to all three cascade was done too quickly, before sufficient
independent transmitter readings. When one internal steam was produced, and the impulse
reading is above the deviation alarm, the average lines contained sufficient condensate.
of the remaining two readings will be used. The
trip condition will be activated when all three
readings are above the deviation alarm.

Figure 5: Incorrect steam flow measurement resulting in

low steam to gas ratio

The root cause identified was that although this

critical steam flow meter (FE1) was considered a
redundant system, it has a single failure
mechanism, i.e., the flow meter requires steam to
Figure 4: Cascade-controls on steam to gas ratio to the condense in the impulse lines and the lines to be
CO-Shift Converter equalized for an accurate flow indication (see
During the incident, FE1 showed a flow even Figure 6 for a schematic of the impulse lines in
though PV1 was closed, and the Ammonia relation to the flow element and pressure
differential transmitter). When Control and Inadequate operator attention and response
Instrumentation were called out to blow out the During plant start-up there are several units that
impulse lines, it resulted in temporary faulty are often commissioned simultaneously by the
transmitter readings until adequate condensate same panel operator. Therefore, the operator
build-up in the impulse lines are restored and cannot always focus on a single unit only. During
equalized. Equalization of the impulse lines are this specific start-up, several issues were
thus crucial in restoring accurate flow readings. requiring the operator's attention at the Ammonia
Synthesis unit.
Orifice flow meter FE 1
For the commissioning of the CO Shift
Converter, the operators were aware of the trip
on the first catalyst bed of the converter and
focused the control of the converter to prevent a
trip. They did not notice the high temperature
Equalisation line
exceedances downstream of the existing trip
location.
Pressure Although the issue of the operator's attention and
Transmitter
response is an underlying cause, an operator
should not be expected to operate units in manual
control because of deficient control systems. The
Drain reliability of the internal steam flow
measurement needs to be addressed as previously
Figure 6: Impulse and equalization lines in relation to the mentioned.
flow element and differential pressure transmitter.
An immediate temporary modification was
An action identified by the RCA was to registered and implemented to add additional
investigate and install alternative flow meter temperature trips after the second, third and
technologies suitable for steam condensing fourth catalyst beds, as well as the outlet of the
applications that do not require changeover converter – these were all set at 465°C (869°F)
between manual and auto control during start- (see Figure 7). These trips will close the feed to
ups. Until a new flow meter has been installed the the converter and result in a complete plant trip
current flow meter will have to be managed as in a fail-safe mode. Another trip that was
follows: The current flow meter installation has installed is to ensure that the difference between
the transmitter located at the bottom for the the catalyst bed temperature and Converter inlet
condensate to be in contact with the transmitter temperature is less than 150°C to allow for a
as the design temperature of the current lower heating rate. These additional trips ensure
transmitters is lower than the steam temperature. that the operators also focus on these
During start-up of the unit, the impulse lines are temperatures whilst starting up. Previously the
blown through to remove dirt. Although these second, third and fourth catalyst beds only had
impulse lines have been fitted with a catch pot, high temperature alarms demanding less operator
the catch pot is not accessible. It is therefore attention. The new trips are currently installed on
recommended for production to keep the steam the DCS only. During the shutdown of January
to gas ratio in manual control until the impulse 2024, it will be hard wired to the ESD system
lines have been filled with condensing process dedicated to instrument trips. These trips will
steam at plant start-up. trip the plant in a fail-safe mode and eliminate the
risk of an operator being unaware of a
temperature exceedance due to other start-up
activities.
A further trip on the gradient-of-change in and no confirmed source of oxygen ingress could
temperature over the bed temperatures to the inlet be found.
temperature was also evaluated but not installed.
A suitable mean time with adequate resonance, The findings from an Aspen reactor model were
whereby the plant could still be operated and that the temperature excursion was more likely
commissioned stably whilst protecting the due to additional FT reactions taking place in
equipment, could not be determined. conditions of low steam: gas ratio than due to
oxygen ingress and associate combustion.

Heating rate was too fast

The most likely cause for a too fast heating rate
is still believed to be a too low steam to gas ratio.
In this start-up, the Sasol Operating Procedures
were followed correctly, but due to the inaccurate
and fluctuating internal steam flow, the steam to
gas ratio was too low, triggering a runaway
reaction.
A possible reaction that might have taken place
and that is linked to observations relating to the
low steam to gas ratio is the Fischer Tropsch
reaction. The licensor operating manual states:
The steam to dry gas ratio must be maintained to
ensure that olefins are hydrogenated, and that
the Fischer Tropsch reaction does not occur in
the Shift Converter.
The catalyst is likely optimized for selectivity to
the Water Gas Shift reaction, with hydrogenation
of short-chain olefinic species (which is always
an exothermic reaction) a design intention.
However, a second possibility is that a side-
reaction, including methanol synthesis, or the
initiation of the Fischer-Tropsch synthesis
reaction, could liberate further energy during a
Figure 7: Temperature trips added to the CO Shift temperature runaway. This could account for the
Converter observed temperature excursion once the catalyst
Oxygen ingress into the system temperature rises beyond the typical operating
Feedback from the catalyst supplier was that they envelope. The converter is of large diameter and
do not expect the high-temperature excursion insulated, so heat is mainly lost through
observed to be caused by a too-low steam to gas convection of process gas.
ratio. They suspected an oxygen ingress, but after An equilibrium simulation around the converter
rigorous investigation this was ruled out as a was set up in Aspen to assess the impact of the
possibility. This is usually a risk during or after a ratio of steam to gas on the equilibrium at the
shutdown when the unit was opened and the outlet of the converter. Assuming hydrogenation
nitrogen purging, or blanketing was insufficient. of olefins, the WGS reaction and the Boudouard
During this shutdown the system was not opened, reaction go to equilibrium, the outlet temperature
is ~469°C (876°F). Allowing for these reactions primarily axial velocity components surrounded
and Methanation, the predicted outlet by a tangentially directed outer vortex. This
temperature was 705°C (1301°C). The outlet accounts for the sharp pressure change in the
temperature reached in this incident was 625°C space between the bed support particles just
(1157°F). outside the outlet support and the gas within it.
This suggests that the temperature exceedance
was most likely caused by the Fischer-Tropsch
(Methanation) reaction taking place.

Impurities/Abnormal feed gas composition

resulting in high exotherm
No variations in feed gas composition with
current monitoring systems were observed
during the plant start-up. To find a causal
mechanism for the high-temperature exceedance
seen in this case as well as earlier incidents,
additional modelling, including CFD, was used
to understand the fluid flow and assess the impact
of additional reaction pathways and the
likelihood of flow maldistribution and
channeling. The belief was that there could be
channeling and/or higher reaction heat generated
than expected resulting in higher bed Figure 8: Velocities indicated from the CFD model
temperatures. The channeling hypothesis is based on the
The CFD model results were as follows: premise that if the porcelain hold-down rings are
shattered by entrainment in the fluid jets
Analysis of the CFD model indicate downward emanating from the poorly designed inlet
directed jets from the inlet distributor imposing a distributor, the resulting fines will locally plug
velocity > 5 m/s, on the hold down rings, which the bed, perhaps in the central zone of the reactor
is likely sufficient to disturb or shift the hold- where they are not agitated.
down bed, potentially causing breakage of some
of the porcelain (33 mm x 18 mm x 6.5 mm) hold This could cause a high resistance region lower
down rings. If possible, the plant should inspect down in the bed in the first catalyst layer, with
the state of the catalyst bed when opened during bypassing occurring away from that plugged
a future catalyst changeout or at another internal zone. Less reaction would occur in the first
inspection opportunity. Minor modifications to catalyst layer overall, composed of larger catalyst
the existing inlet distributor can be made that will particles with lower effectiveness factors and
improve flow distribution, prevent possible reactivity, before contacting the smaller catalyst
catalyst bed damage, and avoid preferential flows particles in the second catalyst bed having higher
into the hold-down bed. (non-homogenous effectiveness factors and reactivity.
mixing and distribution of the inlet feed). Thus, the reaction could occur locally much
The CFD velocity profile, seen in Figure 8, faster than anticipated, developing a local high
indicates a Rankine vortex at the elephant's foot temperatures and temperature gradients within
outlet support with an inner core flow, with the second catalyst bed – perhaps kicking off
methanation and/or other unwanted side
reactions. The presence of a hot zone,
particularly in a zone not well swept by flowing
gas (which would convey energy away) can
transmit energy by bed conduction to
neighboring catalyst and accentuate the problem.

Recommended operator actions to

prevent a runaway reaction
The following recommendations are being
evaluated to minimize the effects of a runaway
reaction:
• Reduce the inlet feed gas flow to prevent
further reactants from entering the converter
• Open the bypass around the feed – effluent
exchanger to cool the inlet temperature to the
converter
• Reduce the converter pressure by venting to
remove reactants from the converter as
quickly as possible
• Purge with cold nitrogen and steam. Even
though steam is a reactant, it is available in
larger quantities than nitrogen and a mix of the
two could be considered.

Impact of this incident

The July 2022 temperature excursion resulted in
the plant being offline for 14 days, incurring
production volume losses over 15,000 tons of
product, requiring extensive costs for the
necessary inspections and acoustic tests that had
to be performed. Had the inspectors requested a
complete evacuation of the vessel for further
internal inspections, the current catalyst would
have had to be replaced, resulting in many weeks
of downtime and additional operational and
capital expenses. Were the vessel to be found
irreparable impacting the plant's ability to fulfill
contractual volumes, it could have resulted in
permanently lost business and substantial
negative publicity. This is an incident Sasol
wishes to avoid in future and with the additional
temperature trips on all catalyst beds and the
converter outlet, that will trip the plant in a fail-
safe mode, the authors are convinced that the
plant is adequately protected