1. Process Safety Advisory on Boiler Incidents

2. Purpose
The purpose of this Process Safety Advisory is to learn from two boiler explosions that occurred at a refinery.
Background
In a fired boiler, the combustion of fuel gas with air generates hot flue gases, which are then used to heat water and generate steam. Since air and fuel gas can form explosive mixtures at certain compositions, it is im­portant to maintain the right air-to-fuel ratios and to keep the burner flame lit, so that all the fuel is consumed in the combustion.

3. Combustion air is provided by a blower
Combustion air is provided by a blower. The amount of air flow is controlled with a louver. Part of the flue gases from the combustion are recirculated and mixed with the incoming air to decrease the flame temperature, thus reducing the formation of NOx. During normal operation, there is more air supplied than needed for the combustion (excess air), and all the fuel gas is con­sumed. The flue gas contains only combustion gases and some air, but no fuel gas. If the air supply is insufficient to burn all the fuel or if the flame is lost, fuel gas will be present in the off-gas and is then recycled to the air supply, where it mixes with the incoming air. This can lead to an explosive fuel/air mixture in the boiler and an explosion can occur. For that reason, boilers are equipped with flame scanners and with air flow mea­surements, so that the boiler can be shut down in the event the air supply is insufficient or the flame is lost..

4. Incident 1 – Temporary Boiler
An explosion occurred on a rental boiler during a re-start of the boiler. The boiler had been shut down for about a week for the replacement of a faulty flame detector and control mo­dule. Upon restart, cold inlet air mixed with recirculated flue gas containing water vapor. Moisture in the recir­culated flue gas resulted in an unstable flame, so that not all fuel gas was consumed. Because there were no analyzers for oxygen or carbon monoxide, this was not detected. The uncombusted fuel gas was recycled back and mixed with the incoming air, producing an explosive mixture, which was then ignited by the unstable burner flame. Approximately four minutes after the burner was lit, the boiler suffered a minor explosion. The boiler was returned to the rental company after minimal repairs.

5. Root Causes:
Flue gas was recirculated back to the firebox at start-up
No monitoring for O2 or CO was done during start-up
Air temperature 60°F colder than initial set-up, no air-preheat or other cold-weather precautions were taken.
Recommendations:
Close the FGR valve during start-up (manual valve)
Provide temporary O2 monitoring during start-up
Steam trace the air intake to pre-heat the incoming air during cold weather

6. Incident 2 – Boiler B
Boiler B was ramped up to maximum load after Boiler A was shut down. It had been in stable operation for 90 minutes when a faulty/unstable positioner on the fresh-air louver caused it to close suddenly. This decreased the fresh air flow while keeping the same amount of flue gas recirculation and caused the flame to become unstable. The flame scanner picked up a loss of flame and triggered the 4 second shutdown timer for the boiler. After 2 seconds the louver on the air supply re-opened and flame was re-established SCF of natural gas entered the firebox during the 2 second period. The fuel gas mixed with the fresh air, creating an explo­sive atmosphere. Ignition on the re-established flame caused an explosion two seconds after the initial loss of flame, which resulted in significant defor­mation of the fan blower and boiler housing along with multiple tube leaks.
The investigation determined that the subject position­ers were prone to hunt for the setpoint, causing sudden moves of the louver. Also, while the four-second delay in the Safety Instrumented System (SIS) is consistent with industry practice, it did not allow the shut-down system to react quickly enough to prevent the incident.

7. Root Causes:
Fresh air louver positioner provided inadequate position control, causing the louver to close suddenly.
Time from loss of flame detection to the explosion was less than the time delay programmed into the SIS.
Recommendations:
Replace the existing positioners with more reliable positioners.
Shorten the shutdown time delay from four seconds to two seconds.