Unmasking & eliminating inadequate

safeguards: Sasol Sasolburg CO

Shift Converter
A faulty steam flow meter resulted in an incorrect low steam to feed gas ratio reading. This can cause
potential unwanted side reactions and downstream effects to the CO Shift Converter. This paper
covers the events leading to a temperature exceedance, the Root Cause Analyses conducted, and how
the risk was addressed to prevent any re-occurrence.

JJ Marais, M Faling, Dr RG Jordi

Sasol South Africa

Introduction supplemental steam to supply the prescribed

steam to feed gas mole ratio.
his paper will describe the sequence of

T events that led to a mechanical design

temperature exceedance that occurred on
the CO Shift Converter in one of the
operating plants of Sasol in Sasolburg,
South Africa. A previous temperature
Year manufactured:
Dimensions:

Catalyst:
1991
4.1 m ID
Height 5.2 m
CO Shift Catalyst
exceedance on the 1st bed of this same convertor Design condition: Max temp: 480°C
occurred in 2005, but it was seemingly Max press: 3400 kPa(g)
safeguarding the reactor with an additional high Operating Temperature range: 330-
conditions 450°C
temperature trip on the first catalyst bed outlet.
Pressure range: 2000-2500
However, it did not manage to prevent this kPa(g)
similar high temperature incident, and therefore Steam to feed gas Normal range 0.6-1.25
a much closer look into the causality of the mol ratio controlled at 0.94
effects.
Table 1: CO Shift Converter design parameters
Contextualizing Background
Table 1 indicates the design and operating
conditions for the CO Shift Converter under
Max Design Temperature
discussion. The converter design has remained Exceedances in July 2022
unchanged over the years other than using a During the start-up of the Ammonia production
different catalyst than initially installed. facility following a planned shutdown, a high
The CO Shift feed gas is supplied from a Rectisol temperature excursion was recorded on the outlet
unit whereby CO2 is removed from an auto- temperature of the CO Shift Converter. The
thermal reformed gas feed stream. The feed gas outlet temperature of the CO Shift Converter
to CO Shift, thus needs to be conditioned with reached 625°C(1157°F), which exceeded the
design temperature of 480°C(896°F) by
145°C(293°F). The initial excursion lasted 30
minutes, with a similar spike a few hours later
(see Figure 1). This temperature excursion was
not identified at the time, as it is suspected that
the operator was distracted by starting other units
simultaneously. The excursions were only
detected the next day when running an OWAP
(operating within agreed parameters) monitoring
tool that is manually run daily. This tool monitors
key operating parameters (e.g. pressures &
temperatures and other fluid conditions like pH)
that could negatively impact the integrity of
assets for sustainable operations.
Figure 1: Catalyst bed temperatures
Initial safeguards in place
In the original design, the CO Shift Converter
was equipped with a thermowell with
temperature indication and alarms 'high' and
'high-high' on all four catalyst beds. The first
alarm allows the operator time to evaluate and
rectify the situation. If the temperature continues
to rise, a second alarm will sound. This alarm
indicates to the operator that the unit must be shut
down or corrective action must be taken
immediately.
The decision to shut down the unit was a
discretionary decision made by the operator, not
a direct trip action. The plant would trip only
when the steam to gas mol ratio falls below 0.45
or if the steam to gas ratio remains between 0.45
and 0.5 for longer than three minutes. Following
a temperature runaway in 2005, a single
temperature trip on the first catalyst bed outlet
was added. During this incident the first bed
temperature was below the trip setting and the
plant did not trip.
Mechanical Investigations
Following the July 2022 incident, the Mechanical
Engineering and Inspection departments
compared the physical design of the bottom
converter outlet nozzle to the allowable pressure
rating at a temperature of 625°C (1157°F). Based
on the calculated results, they were unable to
declare the equipment safe for further operation
without further integrity checks. To enable a full
FFS (fit-for-service) integrity assessment on the
converter and downstream cooling equipment to
determine if the equipment integrity has been
compromised, the equipment had to be taken
offline for inspections by TOFD/Phase array and
Replica and Hardness tests on various sections.
Degassing of the equipment also had to be
performed to enable acoustic emission testing.
The degassing was required to ensure minimum
interference on the inspection procedures by the
presence of hydrogen. The degassing involved
HP steam purging at temperatures and pressures
as close as possible to operating conditions. No
internal inspection was initiated at the outset,
pending a first-round evaluation by the
inspectors. This was to avoid damage to the
catalyst inside the converter when removing it
since no spare catalyst was available,
furthermore the cost impact would also have
been many times higher.
The Acoustic Emission (AE) sensor array sensor
probes were installed in a way that it would
ensure a signal originating from any location on
the vessel's circumferential weld to be recorded
by the AE system. The sensor array probes
installed covered the bottom dome of the vessel
skirt (see Figure 2). However, during the start of
the tests, the sensor probes at the bottom dome of
the vessel stopped responding and were found to
have failed at the end of the vessel warmup
period. An investigation identified that damage
to the probes most probably occurred due to the
probes exceeding their operational temperature
limit, as the wall temperature under the skirt was
measured at around 160⁰C (320°F), and the units
were designed for a max of only 120⁰C (248°F).
Further AE vessel integrity testing was only
conducted with the set of sensors 1 to 10 round
the circumferential weld. Results from these tests
indicated that the vessel is still fit for service and
recommended that the vessel should be tested
again in a minimum of 5 years from the date of
assessment. All other non-destructive tests
(TOFD/Phase array, Replica and Hardness tests)
showed no damage to the equipment. Figure 2: Blue dots depicting the location of the AE
array sensor probes

Root Cause Analysis

An RCA (root cause analysis) held with all
relevant stakeholders (Production, Technical
Support, Process Safety, Control &
Instrumentation, Maintenance and Mechanical)
revealed the following fault tree (Figure 3):

TEMPERATURE
EXCEEDENCE ON CO
SHIFT CONVERTER

IMPURITIES/
INADEQUATE OXYGEN INGRESS ABNORMAL
FLUCTUATING IRREGULAR STEAM
OPERATOR INTO SYSTEM HEATING RATE TOO FEEDGAS
STEAM FLOW SUPPLY
ATTENTION AND RESULTING IN FAST COMPOSITION
READING FE01
RESPONSE EXOTHERM RESULTING IN HIGH
EXOTHERM

CONDENSATION IN
IMPULSE LINES UNITS OPEN TO
NUMEROUS START
AFTER SHUTDOWN ATMOSPHERE, TOO LOW STEAM TO NO VARIATIONS NO VARIATIONS
UP ACTIVITIES
REQUIRING LINES INADEQUATE GAS RATIO WERE OBSERVED WERE OBSERVED
ONGOING
TO BE BLOWN OUT PURGING

PANEL OPERATOR PANEL OPERATOR

SINGLE TECHNOLOGY OPERATOR PRACTICE IS REQUIRED TO NOT AWARE OF RULED OUT DUE TO STEAM:GAS SOP FT SIDE REACTIONS
IMPULSE LINES WERE TO START-UP STEAM TO WAS FOLLOWED
FOR ALL THREE CONTROL IMPACT OF HIGH NO OPEN SOURCE WITH HIGH
BLOWN OUT IN GAS RATIO IN MANUAL BUT RENDERED
TRANSMITTERS. MULTIPLE UNITS OUTLET FOUND EXOTHERM
STEAD OF BEING MODE UNTIL STEADY DEFICIENT DUE TO
FAILURE MODE IS SIMULTANEOUSLY TEMPERATURE
EQUALISED OPERATION IS REACHED INACCURATE IBL
COMMON
AND THEN SWITCH STEAM FLOW
OVER TO AUTO READING(FE01)
START-UP OF
CASCADE CONTROL NOT ABLE TO
COMPRESSOR
BLOWING OF DETERMINE WHY
REQUIRED MORE
ORRIFICE FLOW IMPULSE LINES ARE THE OPERATOR
ATTENTION DUE
METER IS NOT NORMAL PRACTICE WAS NOT AWARE
TO MODIFICATION
SUITABLE FOR THIS AFTER START-UP, SWITCH OVER TO AUTO
DURING
CRITICAL STEAM BUT WILL CAUSE CASCADE CONTROL WAS ORRIFICE FLOW
SHUTDOWN
FLOW METER INCORRECT FLOW DONE TOO SOON AFTER METER IS NOT
UNTIL STEAM IS START UP. SUITABLE FOR THIS
CONDENSED AGAIN CRITICAL STEAM
AND LINES FLOW METER
EQUALISED CURRENT SOP DOES
NOT SPECIFY
SWITCHOVER BETWEEN
AUTO-CASCADE AND
MANUAL CLEARLY

Figure 3: Fault tree developed for OWAP temperature exceedance

Fluctuating flow reading on internal steam
flow meter
During normal operation, steam to the CO Shift
Converter is supplied from three sources: the CO
Shift converter waste heat boiler, steam from the
Ammonia converter waste heat boiler and make-
up from the battery limit 38 bar import steam
utility line. During cold start-up of the plant,
there is no steam available from the Ammonia
synthesis waste heat boiler as it is downstream
and would still be offline. All internally
generated steam utilized is measured by a flow
indicator, FE1 (see Figure 4). The ratio setpoint
on the steam to gas ratio is controlled by
controller FV2, which dictates the total steam
requirement from which FE1 is deducted to
determine the amount of 38 bar steam required.
The flow indicator FE1 is a single orifice plate
flow element fitted with three sets of independent
takeoff points to transmitters. These transmitters
are pressure and temperature compensated, with
the median of all three readings used for control.
There are deviation alarms coupled to all three
independent transmitter readings. When one
reading is above the deviation alarm, the average
of the remaining two readings will be used. The
trip condition will be activated when all three
readings are above the deviation alarm.
Figure 4: Cascade-controls on steam to gas ratio to the
CO-Shift Converter
During the incident, FE1 showed a flow even
though PV1 was closed, and the Ammonia
Synthesis unit was offline. There was also a
discrepancy between the three different flow
readings, although it was below the deviation
alarm setting. The faulty reading on FE1 caused
FV2 to cut back the 38 bar steam intake
according to the steam to gas ratio control. Figure
5 indicates the erratic behavior of the gas ratio
during the start-up prior to the temperature
excursion.
The operators were aware of the fluctuations and
requested the Control and Instrument department
to blow through the flow meter impulse lines to
remove condensate that usually interferes with
the transmitter measurements during plant start-
up. The operators usually change the steam to gas
ratio control to manual mode during plant start-
ups to minimize process upsets due to these
anticipated fluctuations. However, during this
start-up, there were time periods when the control
was set to manual and then back to auto-cascade
control. It is a possibility that the change to auto-
cascade was done too quickly, before sufficient
internal steam was produced, and the impulse
lines contained sufficient condensate.
Figure 5: Incorrect steam flow measurement resulting in
low steam to gas ratio
The root cause identified was that although this
critical steam flow meter (FE1) was considered a
redundant system, it has a single failure
mechanism, i.e., the flow meter requires steam to
condense in the impulse lines and the lines to be
equalized for an accurate flow indication (see
Figure 6 for a schematic of the impulse lines in
relation to the flow element and pressure
differential transmitter). When Control and
Instrumentation were called out to blow out the
impulse lines, it resulted in temporary faulty
transmitter readings until adequate condensate
build-up in the impulse lines are restored and
equalized. Equalization of the impulse lines are
thus crucial in restoring accurate flow readings.
Orifice flow meter FE 1
Equalisation line
Pressure
Transmitter
Drain
Figure 6: Impulse and equalization lines in relation to the
flow element and differential pressure transmitter.
An action identified by the RCA was to
investigate and install alternative flow meter
technologies suitable for steam condensing
applications that do not require changeover
between manual and auto control during start-
ups. Until a new flow meter has been installed the
current flow meter will have to be managed as
follows: The current flow meter installation has
the transmitter located at the bottom for the
condensate to be in contact with the transmitter
as the design temperature of the current
transmitters is lower than the steam temperature.
During start-up of the unit, the impulse lines are
blown through to remove dirt. Although these
impulse lines have been fitted with a catch pot,
the catch pot is not accessible. It is therefore
recommended for production to keep the steam
to gas ratio in manual control until the impulse
lines have been filled with condensing process
steam at plant start-up.
Inadequate operator attention and response
During plant start-up there are several units that
are often commissioned simultaneously by the
same panel operator. Therefore, the operator
cannot always focus on a single unit only. During
this specific start-up, several issues were
requiring the operator's attention at the Ammonia
Synthesis unit.
For the commissioning of the CO Shift
Converter, the operators were aware of the trip
on the first catalyst bed of the converter and
focused the control of the converter to prevent a
trip. They did not notice the high temperature
exceedances downstream of the existing trip
location.
Although the issue of the operator's attention and
response is an underlying cause, an operator
should not be expected to operate units in manual
control because of deficient control systems. The
reliability of the internal steam flow
measurement needs to be addressed as previously
mentioned.
An immediate temporary modification was
registered and implemented to add additional
temperature trips after the second, third and
fourth catalyst beds, as well as the outlet of the
converter – these were all set at 465°C (869°F)
(see Figure 7). These trips will close the feed to
the converter and result in a complete plant trip
in a fail-safe mode. Another trip that was
installed is to ensure that the difference between
the catalyst bed temperature and Converter inlet
temperature is less than 150°C to allow for a
lower heating rate. These additional trips ensure
that the operators also focus on these
temperatures whilst starting up. Previously the
second, third and fourth catalyst beds only had
high temperature alarms demanding less operator
attention. The new trips are currently installed on
the DCS only. During the shutdown of January
2024, it will be hard wired to the ESD system
dedicated to instrument trips. These trips will
trip the plant in a fail-safe mode and eliminate the
risk of an operator being unaware of a
temperature exceedance due to other start-up
activities.
A further trip on the gradient-of-change in
temperature over the bed temperatures to the inlet
temperature was also evaluated but not installed.
A suitable mean time with adequate resonance,
whereby the plant could still be operated and
commissioned stably whilst protecting the
equipment, could not be determined.
Figure 7: Temperature trips added to the CO Shift
Converter
Oxygen ingress into the system
Feedback from the catalyst supplier was that they
do not expect the high-temperature excursion
observed to be caused by a too-low steam to gas
ratio. They suspected an oxygen ingress, but after
rigorous investigation this was ruled out as a
possibility. This is usually a risk during or after a
shutdown when the unit was opened and the
nitrogen purging, or blanketing was insufficient.
During this shutdown the system was not opened,
and no confirmed source of oxygen ingress could
be found.
The findings from an Aspen reactor model were
that the temperature excursion was more likely
due to additional FT reactions taking place in
conditions of low steam: gas ratio than due to
oxygen ingress and associate combustion.
Heating rate was too fast
The most likely cause for a too fast heating rate
is still believed to be a too low steam to gas ratio.
In this start-up, the Sasol Operating Procedures
were followed correctly, but due to the inaccurate
and fluctuating internal steam flow, the steam to
gas ratio was too low, triggering a runaway
reaction.
A possible reaction that might have taken place
and that is linked to observations relating to the
low steam to gas ratio is the Fischer Tropsch
reaction. The licensor operating manual states:
The steam to dry gas ratio must be maintained to
ensure that olefins are hydrogenated, and that
the Fischer Tropsch reaction does not occur in
the Shift Converter.
The catalyst is likely optimized for selectivity to
the Water Gas Shift reaction, with hydrogenation
of short-chain olefinic species (which is always
an exothermic reaction) a design intention.
However, a second possibility is that a side-
reaction, including methanol synthesis, or the
initiation of the Fischer-Tropsch synthesis
reaction, could liberate further energy during a
temperature runaway. This could account for the
observed temperature excursion once the catalyst
temperature rises beyond the typical operating
envelope. The converter is of large diameter and
insulated, so heat is mainly lost through
convection of process gas.
An equilibrium simulation around the converter
was set up in Aspen to assess the impact of the
ratio of steam to gas on the equilibrium at the
outlet of the converter. Assuming hydrogenation
of olefins, the WGS reaction and the Boudouard
reaction go to equilibrium, the outlet temperature
is ~469°C (876°F). Allowing for these reactions
and Methanation, the predicted outlet
temperature was 705°C (1301°C). The outlet
temperature reached in this incident was 625°C
(1157°F).
This suggests that the temperature exceedance
was most likely caused by the Fischer-Tropsch
(Methanation) reaction taking place.
Impurities/Abnormal feed gas composition
resulting in high exotherm
No variations in feed gas composition with
current monitoring systems were observed
during the plant start-up. To find a causal
mechanism for the high-temperature exceedance
seen in this case as well as earlier incidents,
additional modelling, including CFD, was used
to understand the fluid flow and assess the impact
of additional reaction pathways and the
likelihood of flow maldistribution and
channeling. The belief was that there could be
channeling and/or higher reaction heat generated
than expected resulting in higher bed
temperatures.
The CFD model results were as follows:
Analysis of the CFD model indicate downward
directed jets from the inlet distributor imposing a
velocity > 5 m/s, on the hold down rings, which
is likely sufficient to disturb or shift the hold-
down bed, potentially causing breakage of some
of the porcelain (33 mm x 18 mm x 6.5 mm) hold
down rings. If possible, the plant should inspect
the state of the catalyst bed when opened during
a future catalyst changeout or at another internal
inspection opportunity. Minor modifications to
the existing inlet distributor can be made that will
improve flow distribution, prevent possible
catalyst bed damage, and avoid preferential flows
into the hold-down bed. (non-homogenous
mixing and distribution of the inlet feed).
The CFD velocity profile, seen in Figure 8,
indicates a Rankine vortex at the elephant's foot
outlet support with an inner core flow, with
primarily axial velocity components surrounded
by a tangentially directed outer vortex. This
accounts for the sharp pressure change in the
space between the bed support particles just
outside the outlet support and the gas within it.
Figure 8: Velocities indicated from the CFD model
The channeling hypothesis is based on the
premise that if the porcelain hold-down rings are
shattered by entrainment in the fluid jets
emanating from the poorly designed inlet
distributor, the resulting fines will locally plug
the bed, perhaps in the central zone of the reactor
where they are not agitated.
This could cause a high resistance region lower
down in the bed in the first catalyst layer, with
bypassing occurring away from that plugged
zone. Less reaction would occur in the first
catalyst layer overall, composed of larger catalyst
particles with lower effectiveness factors and
reactivity, before contacting the smaller catalyst
particles in the second catalyst bed having higher
effectiveness factors and reactivity.
Thus, the reaction could occur locally much
faster than anticipated, developing a local high
temperatures and temperature gradients within
the second catalyst bed – perhaps kicking off
methanation and/or other unwanted side
reactions. The presence of a hot zone,
particularly in a zone not well swept by flowing
gas (which would convey energy away) can
transmit energy by bed conduction to
neighboring catalyst and accentuate the problem.

Recommended operator actions to

prevent a runaway reaction
The following recommendations are being
evaluated to minimize the effects of a runaway
reaction:
• Reduce the inlet feed gas flow to prevent
further reactants from entering the converter
• Open the bypass around the feed – effluent
exchanger to cool the inlet temperature to the
converter
• Reduce the converter pressure by venting to
remove reactants from the converter as
quickly as possible
• Purge with cold nitrogen and steam. Even
though steam is a reactant, it is available in
larger quantities than nitrogen and a mix of the
two could be considered.

Impact of this incident

The July 2022 temperature excursion resulted in
the plant being offline for 14 days, incurring
production volume losses over 15,000 tons of
product, requiring extensive costs for the
necessary inspections and acoustic tests that had
to be performed. Had the inspectors requested a
complete evacuation of the vessel for further
internal inspections, the current catalyst would
have had to be replaced, resulting in many weeks
of downtime and additional operational and
capital expenses. Were the vessel to be found
irreparable impacting the plant's ability to fulfill
contractual volumes, it could have resulted in
permanently lost business and substantial
negative publicity. This is an incident Sasol
wishes to avoid in future and with the additional
temperature trips on all catalyst beds and the
converter outlet, that will trip the plant in a fail-
safe mode, the authors are convinced that the
plant is adequately protected