The factual part of this post has been taken out of the Spring 2018 BLRBAC meeting minutes.

In September 2017, there was a smelt water reaction (explosion) in a recovery boiler in Canada that resulted in 49 days of loss of production and a substantial damage to the boiler. Fortunately, nobody got hurt. Let's have a look at the sequence of events in the control room, but then also what really happened in the boiler and what each recovery boiler operating company can learn from this.

Control Room Events

September 22nd 2017 - Recovery Boiler running as usual. Two days after an annual shutdown.

13:33 - Low drum level alarm shows on the DCS. Operator is trying to take steps to save the boiler from low drum level trip.

In the subsequent 5 minutes, there are a total of 8 high furnace pressure alarms.

13:38 - Boiler trips on LOW drum level. Operators pull liquor nozzles out of the boiler. Operators are on alert, yet no signs of water entering the lower furnace are observed. Investigation begins in the control room as well as a walk down of the boiler. Feedwater control valve is put into Manual and 37% output as no leak is suspected.

13:47 and 13:50 - Another two HIGH furnace pressure alarms. However still no signs of water leak were observed by operators, such as loud or 'popping' noises. Operators finished the walkdown and were headed back to the control room. Feedwater control valve remains in Manual and output is lowered to 25%.

14:04 - Large explosion is heard from the control room. Five seconds later, emergency shutdown is initiated.

At this point, the recovery boiler experienced significant damage.

The operating company provided this additional information: The high furnace pressure alarm is set at +10 mm of water column (+98 Pa). Delayed trip is set at +125 mm (+1 225 Pa) and instantaneous trip at +200 mm (+1 960 Pa). The furnace pressure did not reach the trip point until the explosion. According to the trend data, furnace pressure reached a maximum of +40 mm (+392 Pa) before the explosion. There was a 'sudden large leak' logic in place that required a combination of furnace pressure to be above +125 mm (1 225 Pa) and low drum level trip, and these two did not occur in this case. The thresholds were being reviewed after this incident.

What actually happened?

What actually happened in this boiler has to do with sootblowers. Sootblower lances usually have two circumferential welds. One between the lance head and the lance tube, and the second one between the lance tube and the flange. In this boiler, the latter weld failed and basically released the entire sootblower lance. The lance under pressure launched into the boiler and eventually fell down onto the smelt bed and the floor. The way it landed however caused a floor tube to rupture that started introducing water right onto the smelt bed.

How much water entered the lower furnace?

This is a pure speculation, but let's try to estimate this.

It is unknown how big of a leak this impact caused or whether the leak was small and eventually grew bigger. Few things however could be deduced.

At 13:33, the low drum level alarm occurred. It is unknown when the lance tube punctured the floor tube, but the leak was significant enough that it caused the drum level to go into LOW alarm. A small leak would have easily been compensated for by feedwater valve and no LOW drum level alarm would take place. Additionally, we also know that an operator 'tried' to save the boiler from tripping (probably by increasing the feedwater flow manually), yet the boiler tripped 5 minutes later anyway. So my personal deduction is that the leak was significant. But let's try to put a number to it, although let's just shoot for an order of magnitude.

We don't know any values for low drum level alarm or a low drum level trip for this boiler, but usually I see these at about -5 and -12 inches of water (-13cm and -30cm) from the centerline of the drum. Estimating the size of the drum and the 7 inches of water to displace, I guess it would take about 87 cubic feet of water (2.5 cubic meters) to displace this space in the steam drum - and that doesn't account for additional water operator may have tried to put in, in order to 'save' the trip. And all this water in 5 minutes. This corresponds to a leak size of about 130 GPM (8 liters / second). (one can say that the drum level was also falling due to reduced heat release in the lower furnace as the water was extinguishing the combustion, but let's set that aside for a moment)

The explosion happened at 14:04, which is 31 minutes from the first low drum level alarm. So neglecting a possible non-linearity of the actual leak flow, just for the sake of the magnitude, it would be about 570 cubic feet of water (16 cubic meters) that might have entered the lower furnace during this time. Even if only 25% of this number would be correct, it is still a lot of water.

Explosion

One of the theories of a catastrophic smelt water reaction states that a large pool of water along with large amount of molten smelt need to be present and available along with a triggering mechanism that sets off the explosion. And I believe this might have been what happened in this boiler. Water might have pooled into one area, or channeled under the smelt bed (it's hard to speculate how or where) and once ready, a triggering mechanism (e.g. falling salt cake) might have triggered the explosion. Remember that up to the point of the explosion, operators did not observe any signs of water entering the furnace (no loud noises, no popping sounds, nothing). But the water was already flashing, that's why the high furnace pressure alarms.

What can we learn from this incident? 2 takeaways

Operations

Whenever a water tube leak occurs, drum level goes down as this water is leaving the boiler circuit. At the same time, this water partially or completely flashes, creating larger mass of flue gas which causes higher furnace pressure. Depending on the size of the leak, the control system may compensate for this so that alarms are never triggered. However, ID fan speed and feedwater flow will show deviations from normal operations.

If the leak is large enough though, they will cause alarms. If a boiler experiences low drum level and high furnace pressure alarms within a short period of time, this almost certainly points to a leak. In this particular boiler, there was even a logic set up to detect this, although threshold values were put into question.

For any recovery boiler operating company, it is recommended to do a statistical analysis of drum levels and furnace pressures for each boiler. Low drum levels happen during normal operations and so do high furnace pressures. However finding the distribution of these values and finding a 90, 95, or 99 percentile values would be beneficial to establish a baseline for tube leaks and avoid false positives. The thresholds should be set accordingly. And let's face it, one false positive that results in an unintended shutdown beats a boiler explosion by a large margin.

If operators decided to perform an ESP during the first 5 minutes, when the low drum level alarm happened with subsequent 8 high furnace pressure alarms, the boiler would have experienced significantly less damage or potentially no explosion at all.

Maintenance

Failed sootblower lances can cause a lot of damage. Although the mechanism of the lance weld failure is not known, it is recommended to non-destructively examine all of the existing and spare sootblower lance welds. When purchasing new sootblower lances, manufacturing company should perform an x-ray examination to ensure defect free welds. Operating company should ensure such examination is done by a manufacturer for all new sootblower lances.

Additionally, if you happen to have a lance tube that failed at the weld interface, it would be beneficial to preserve and send it for a metallurgical analysis and help the industry find the root cause of this failure.