UPGRADING AMMONIA PLANT

EMERGENCY SHUTDOWN SYSTEMS

An Emergency Shutdown systems (ESD) is the last line of defense for safe operation of an ammonia
plant. They are expected to provide coverage in case of equipment failure, process upset or human
error. Essentially these systems are expected to bring the plant to a predefined safe state through a set
of logical actions on fulfillment of certain conditions i.e. process variable going to a safety high risk
zone.This paper shares the experience of upgrading an old and obsolete pneumatic shutdown system
of a 1970 vintage ammonia plant to state of the art Triple Modular Redundant (TMR) electronic
system. It also covers the experience of adding new shutdown securities at furnace, compressor along
with upgrading of control systems to avoid high hazardous events.

Syed Salman bin Aslam

Engro Chemical Pakistan Ltd., Pakistan

Introduction to Engro Chemical of aligning itself with DuPont Safety Resources. Earlier
it used to follow Exxon systems. The TRIR (Total Re-

E ngro Chemical Pakistan limited is the sec-

ond largest manufacturer of Urea N46 in
Pakistan. The manufacturing site is located
in a small rural town of Pakistan known as Daharki
which is 600 km north of famous port city of Karachi.
cordable Injury Rate) is below 1.0 for last twenty years.

Manufacturing Site history

The site was setup in 1965 after discovery of vast re-
sources of natural gas in vicinity and was named as
Esso Chemical Pakistan, which was later named as
Exxon Chemical Pakistan. In 1991 Exxon decided to
divest its equity from global fertilizer manufacturing.
At that time Pakistan based employees of Exxon along
with reputable international investors decided to pur-
chase major share holding. Exxon’s patent of “Engro”
was also a part of the deal. We elaborate the name En-
gro as Energy for Growth.
The company gives highest value to Safety and be-
lieves that first dimension of growth is Safe Operations
of all business activities and is currently in the process
The Company's original plant was commissioned
on December 4, 1968, and since then, except for short
maintenance shutdowns, the plant has been in continu-
ous operation. The initial capacity was increased from
173,000 to 268,000 tons per annum till 1993.
In 1993, Engro relocated Bechtel design Ammonia
and a TOYO Total Recycle Urea plants from USA and
UK respectively and increased its capacity to 600,000
tons per year. In 1995, the capacity was expanded to
750,000 tons per year. In 1998 urea production capacity
was increased from 750,000 to 850,000 tons along with
an overall energy efficiency of 7%. Further to this other
projects were implemented which have increased en-

AMMONIA TECHNICAL MANUAL 254 2004

ergy efficiency by another 5%. All these projects were
im-plemented on schedule without a single LWI (loss
work day injury)
Daharki site is currently operating one 1550 MTPD
steam reforming ammonia plant and two Toyo Design
Urea plants of combined capacity of 2700 MTPD.
Overall Project Background
Engro place safety ahead of all its business activi-
ties, therefore along with capacity expansions it was felt
necessary to improve the plant’s control and trip sys-
tems. The relocated plants had old pneumatic instru-
mentation, which had number of reliability issues apart
from being obsolete. With both the control and trip sys-
tems the risk associated with continued operation were
high. The ultimate risk with control could be downtime
but for trip systems it can be a disaster.
In the relocated plants many independent trip
valves (Exxon Safety requirement) were missing i.e.
control valves were sharing the purpose as trip valves
as well. New trip valves were provided before commis-
sioning. Additionally many interlocks were still not
provided at the time of relocation.
In 1995, after bitter experiences of secondary re-
former effluent waste heat boiler failure’s it was felt
necessary to reduce human dependence i.e. to improve
interlocks and provide highly reliable automatic fail
safe shutdown coverage. As increasing interlocking on
ob-solescent pneumatic systems was a nightmare, a
deci-sion was made to invest in the field of automation
and control.
A road map was developed which included control
system as well as trip system upgrading in phases. Con-
trols were shifted to the already installed Honeywell
Micro TDC system, which was upgraded further to han-
dle increased requirements of the ammonia plant. For
the Urea plants the Elsag Bailey Infi-90 was adopted
for the control system. As Process Safety Management
systems followed by Engro requires independent trip
system, regardless of electrical isolation therefore for
the trip system of ammonia plant, an ABB August TMR
system was purchased. The improvement of the trip
system was divided in three major phases for ease of
implementation. Two of these phases have been imple-
mented in 1998 and 2002. The third one is planned for
2005.
2004
The following section will discuss trip system of
Ammonia plant only.
Requirement of a Shutdown System
Hazards of an ammonia plant & their classifi-
cation/mitigation
An ammonia plant is classified as a High Hazard-
ous Industry by OSHA guidelines. Major reasons are
handling of extremely flammable hydrogen and highly
toxic ammonia. Engro’s ammonia plant uses steam re-
forming process identical to the Haber process for
manufacturing ammonia.
The furnace, compressors, gas turbine, steam tur-
bines, absorption/de-sorption and catalytic conversion
are the major process units. Each unit has its own safety
and business associated risks. Identification of hazards
is the first element followed by its potential/ probability
of occurrence with ultimate assignment of the appropri-
ate risk classification. Normally the hazards are classi-
fied for potential safety threat or potential business
threat. The technique used for process hazard analysis
can be HAZOP, HAZAN, PHA or pure common sense
thru brain storming sessions. Essentially the skill level
of multidiscipline team and its training to carry out a
perfect job is key to proper hazard identification which
will become basis for all future work.
In Engro a simple matrix was developed initially to
identify potential hazards based on brain storming ses-
sions of knowledgeable individuals. This matrix then
became the base line document. Further more for quan-
tification purposes the HAZOP technique based on
Exxon’s guidelines was used to expand the trip securi-
ties horizon.
One such matrix is shown in Figure-1 which covers
the ammonia plant furnace only.
Human factor & requirement of a shutdown
system
1. 1 The time required to respond to an emer-
gency may be insufficient for human reac-
tion
255 AMMONIA TECHNICAL MANUAL
 2. 2 Humans by their nature are prone to
lsose judg-mental efficiency with increase
in tension of an emerg-ing emergency.
3. 3 This efficiency is also affected by the
fact that tripping a plant manually means
interruption of business for which they
may be questioned.
4. 4 Judgment varies from human to human
based on intellect as well as experience
5. 5 Management does delegate plant tripping
author-ity to responsible individuals in op-
erating units, based on a concept that “It is
possible to start a plant after nuisance trip
but it is not possible to start a plant after
substantial damage”.
The above necessitates an emergency shutdown
system. Engro Chemical had the bitter experience of
dry out operation of the secondary reformer waste heat
boiler which resulted in substantial damage. The inci-
dent occurred due to above factors. This became one of
the justifications for an elaborate automatic shutdown
system.
Old and obsolete pneumatic relay based sys-
tem
As mentioned earlier the plant which was relo-
cated from Cheveron Pascagoula had pneumatic sys-
tems. There were some trip instrumentation available,
however it was not interlocked. In ammonia plant alone
more than 200 pneumatic relay gates were used to build
a highly unreliable trip system. Maintaining these to
high availability levels was extremely difficult. With
time, obsolescence was becoming another cause of
great concern to plant management.
A serious shortcoming was that the health of system
was not known on-line. A failure of one or more de-
vices/pinching of tube in huge logic gate circuit could
have remained un-noticed resulting in failure of the sys-
tem to perform when it was required. This aspect be-
came another basis for an elaborate automatic shut-
down system with self diagnostic features.
Modern trip systems
In the modern era computers have become powerful
enough to be used in high reliable services. As per ISA
guideline S84-01 such trip systems which are the last
AMMONIA TECHNICAL MANUAL
line of defense should be capable of providing SIL-3
(Safety Integrity Level) availability i.e. 99.999% avail-
ability
Engro at the time of selection of a modern system
considered following
1. Real time processing / Self bug detection
and elimination
2. Redundancy (sensor, processor and power)
to en-sure that trip system is available
when needed at opti-mum cost
3. Self diagnostics routines
4. Capability to record events with small du-
ration time spans in magnitude of millisec-
onds
5. Expandability to incorporate future modi-
fications
6. Easy configuration and testing
7. Minimum possible hardware addition
Based on above guidelines ABB August TMR (Tri-
ple Modular Redundant) system was selected. Triple
Modular Redundant concept has been derived from the
fact that
1. Probability of failure of one module will
not im-pact continued operation
2. Failure of another module will push system
to de-cide on its own to run the plant or let
it go to fail safe condition
3. Interlaced communication to ensure that
each module scrutinize the activity of other
modules
4. 2-out-of-3 voting logic on sensor level
Conversion from Pneumatic to Electronic
The conversion from pneumatic hardware to elec-
tronic had histories of learning. Although a good
change, it had the potential to go wrong. This can be at-
tributed to wrongly selected hardware, wrongly con-
figured software and many more possibilities. Another
thing of consideration was the operability and mainte-
nance requirements. Training of individuals becomes
the most important point. Pneumatic systems are always
good w.r.t. to training due to trace-ability. However,
electronic systems are difficult w.r.t. to taggings and
trace-ability.
Owing to the opportunity of change over, there was
the opportunity to include new securities as mentioned
above.
256 2004

New Securities / Additional protection
The plant relocated from Pascagoula as mentioned
earlier didn’t have the interlocks which are necessary to
bring the plant to fail safe position. Additionally many
securi-ties were not present as well such as
1 Furnace Steam to Gas ratio trip
2 Furnace low draft
3 WHB steam drum low level
4 Furnace coils protection w.r.t. BFW circulation
etc.
5 CO2 removal system protections
These securities were added to the existing ones
and the resulting system was much more adequate to
provide overall protection.
Appropriate time delays were provided in the above
securities based on in-house calculations, system re-
sponse and industrial networking.
Interlocking was also suggested as additional pro-
tection. A good trip system is essential for mitigation of
hazard, however it is imperative to avoid these hazard
in first phase.
Avoiding potential Hazards through im-proved
control
In an operating plant hazards are caused by either
mechanical reasons, loss of proper control or human er-
ror. A number of these hazards can be minimized by se-
lection of proper control system. A control system may
fail itself to create nuisance tripping thru trip system,
which may be considered as inherently more safer.
However failure can also cause the control system to
move the process away from trip protection.
In Engro the approach taken was to eliminate the
cause which could lead to a potential hazardous event.
Plant trip history data was used to analyze the operating
data of over 10 years of operation in Daharki. Based on
this database, certain strategies were developed and
shared with management after industrial networking as
well.
This became the basis to improve the hardware for
the control system especially on sensors part. The syn-
thesis compressor seal oil bottles and the ammonia
2004
sepa-rator level sensors were improved from DP cells to
float transmitters. In the past the DP cells on these ser-
vices resulted in a few nuisance trips i.e. creation of an
event which may lead to some safety issue, had the trip
system not performed well.
Trip design and testing
Designing an appro-priate trip system sequence is
imperative in the overall scheme of things. Interlocks,
time delays, bypasses, overrides and trip logic’s have to
be defined up-front. An exercise of this sort should be
conducted by a multi-disciplinary team of Operations,
Process & Instrument interfaces. Competence of this
team is also essential, and it is good to have people of
experience above 10 years preferably in different indus-
tries.
Using a few senior board men , of experience above
15 years and known to have handled many emergencies
effectively at plant, to support to this team work will
improve the working to the best possible levels.
In Engro we used below mentioned strategy to de-
velop an automatic trip system. The steps followed for
its development were
1. Development of appropriate team of opera-
tions, process and instrument engineers
2. Identification of potential hazards and their
ap-propriate classification based on brain
storming ses-sions/HAZOP & PHA tech-
nique
3. Human factor study w.r.t. judgement and
time available to respond
4. Suggestions for addition or deletion of se-
curities based on own experience and in-
dustrial networking
5. Improvement of control system to avoid a
par-ticular event
6. Consideration of physical constraints of an
old plant, especially w.r.t. drilling new
holes for new sen-sors in old vessels
7. Time delays in trip security actuation to
avoid nuisance trips. A minimum of 0.5
seconds time delay is adopted even if proc-
ess simulations do not allow for more time
delay. This is adopted to avoid nuisance
trip-ping due to noise.
8. Interlocks and bypasses
9. Development of one-line diagram for im-
plemen-tation in phases
257 AMMONIA TECHNICAL MANUAL
 10. Scrutinizing the process thru multi-
disciplinary team and refinement after re-
cycling with experienced board men
The result from above activity is the final one-line
diagram with inputs from relevant interfaces for further
work. The approvals were taken from functional man-
agement as well as plant management.
No system can work effectively if the thoughts of
so many people have not been translated properly in
“Lad-der Logic”. Once above activity was completed
the re-quirements were passed on to the Trip system
vendor, who developed the logic and MMI (Man Ma-
chine Inter-face) screens. No matter how smart this de-
velopment team is, it is imperative that the testing of
such super critical system should be audited. Nothing is
better in terms of auditing than “Full Fledged Dummy
Testing” i.e. giving dummy process signals from pri-
mary sensing elements (Transmitters) and seeing ac-
tions of Final Trip Elements (mostly trip valves) in
field.
See Figure 2 for the Primary Reformer Trip MMI
screen. Each security has its own bypass which is man-
aged in another screen. Each trip logic has its own by-
pass for overriding Security actions. Normally these are
not used in normal operation. Logic’s can be operated,
reset and bypassed from MMI screens as well as Hard
Key panel.
See figure 3 for picture of this Hard key panel.
All possible combinations & permutations of by-
passes, sets of transmitters and many more are used to
test the system and its performance.
A checklist is used to monitor the activity, which
may consume many days from turnaround and in re-
volving shifts. One such sample is appended in Figure
4.
Another factor which needs to be tested w.r.t. sys-
tem is its performance / fall backs on predefined
scheme i.e. on failure of two processor system should
either run or go to fail safe position. With interruption
of field devices power system should go to trip state
and on restoration should stay in trip state etc. These
checks are the ones shown in Figure 5.
AMMONIA TECHNICAL MANUAL
What can go wrong
Some of the lessons learned through implementa-
tion are narrated below
1 Field related modifications w.r.t. addition of pri-
mary sensors is a critical item. Many a times it can be
overlooked resulting in inappropriate resource manage-
ment. Mechanical teams, if not sensitized properly may
not pay due attention to the job which appears simple,
small bore piping. In Engro primary reformer steam
transmitter with a ¾ inch tap leaked during commis-
sioning due to lack of proper supervision and quality
checks. They had the potential of wrong indication on
all three transmitters, which were supposed to work on
2-o-o-3 logic.
2 It is good to have prefabrication done in advance,
however some low bore diameter flanges have the po-
tential of surprise when being opened. In Engro this
happened with one of the synthesis gas compressor seal
oil tapping flange, where the installed one was RT vs.
RF as per piping code. A SS spacer was fabricated to be
installed between the two flanges during execution.
3 The system vendor may not be able to co com-
prehend the severity of service and its implications on
the overall site reliability. This means that the owner
has to be cautious in implementing suggestions and has
to audit to the extreme levels of reliability and permuta-
tions.
4 Operators will not be able to train themselves to
new changes. Management has to arrange training ses-
sion and nothing is better than on-the-job training,
which can be implemented in turnaround only. Opera-
tors should be encouraged to play with system bypass,
reset and other options by disconnecting field devices
through some fuses etc. This activity will ensure that
during training if some unknown combination is tested,
a surprise may not be experienced in future.
Experience with operation
The experience of change over from old pneumatic
system to new electronic system was full of challenges
and unknown surprises. Proper project management,
auditing and testing are keys to minimize these sur-
prises. Since 1998 the system has been working well
with no failure and malfunctions. It is considered to be
the last line of defense and operators do know that if
they can’t control plant in an upset, ESD system will
bring it to fail safe condition for safe re-start.
258 2004
About the Author Ammonia unit. ESD phase-2 designing was his major
responsibil-ity. HYSYS and HTFS are other areas of
Syed Salman bin Aslam is a professional chemical expertise. Since end 2003 he is looking after another
engineer. He got his B.Sc. degree in chemical engi- expansion project of Engro called ENCAP as process
neering from University of Engineering and Technol- section head.
ogy Lahore in 1995 with first position in all four years
of studies. He has worked as Operations engineer of
Engro Ammonia-2 plant for four years in which he im-
ple-mented phase-1 of ESD project and TDC control
system
upgrade project, then he was assigned to revamp
Safety critical system and later transferred to Urea-2
plant as shift engineer. After another year he was as-
signed the responsibility of Shift coordination and then
as a day engineer assisting unit manager and Production
man-ager. Since 2001 he is working in process engi-
neering as Sr. Process Engineer providing contact engi- .
neering support and project management services to

Figure 1

2004 259 AMMONIA TECHNICAL MANUAL

 Figure 2

Figure 3

AMMONIA TECHNICAL MANUAL 260 2004

 Figure 4

Figure 5

2004 261 AMMONIA TECHNICAL MANUAL