At present, hydrocarbon pricing pays strong dividends for hydrocracking (HC), which leverages low-cost hydrogen (H2), sourced from todays abundant natural gas supply, into high-value liquid fuels. Among hydroprocessing (HP) units, HC units have the greatest H2 uptake, with a typical liquid volume swell of 10%. This earns in the range of $100 million (MM) per year for a 30,000-barrel-per-day (bpd) HC unit based on volume swell alone, in addition to the usual value upgrade of HC conversion.
As a result, hydrocrackerswhich are already one of the hydrocarbon processing industrys most demanding process control challengesare being pushed to greater limits. HC reactors operate at elevated temperatures and pressures, making safety a constant concern. Recovering from temperature upsets can take hours, and recovering from a complete depressurization takes days. Reactions are exothermic, meaning that even minor disturbances in feed, heater or quench controls can rapidly escalate to an urgent situation. For these reasons, HC controls have always demanded vigilant attention to design detail, management of change, and operability. Any oversights can result in, or fail to prevent, depressurization events. Key improvements, on the other hand, can bring large gains in refinery profitability and reliability.
For the past two decades, hydrocracker process control strategy has focused on installing automatic depressurization systems and multivariable predictive control (MPC). While this equipment has brought important gains, experience shows that it leaves many gaps in excursion control and depressure prevention. This article presents an updated hydrocracker control model that robustly addresses traditional hydrocracker control challenges, overcomes outdated hydrocracker control paradigms, and allows hydrocrackers to operate safely, reliably and profitably under todays demanding conditions.
HC process and economics
Fig. 1 shows a common hydrocracker configuration. Heated oil and excess H2 enter a vertical downflow reactor with multiple fixed catalyst beds. The catalyst promotes cracking and hydrogenation of larger hydrocarbon molecules, such as gasoils, cycle oils and coker oils, into lighter, more valuable molecules, such as diesel, jet fuel and naphtha. The overall reaction is exothermic, so temperature increases as flow passes through the bed.
Between beds, cold H2 quench gas is introduced to cool the reaction mix. In this way, the reactor is a succession of cracking beds followed by quenching (Fig. 1 depicts three beds, but often there are more). The overall objective is to achieve the desired amount of cracking (or conversion), which is borne out in the downstream fractionation section product spreads.
Fig. 1. Simplified HC reactor piping and
instrumentation diagram with as-purchased
Maximizing conversion means operating at one or more of the quench constraints. These include a maximum quench valve position, chosen to ensure ample reserve quench should an exothermic excursion occur, and a maximum bed temperature rise, which indicates high cracking severity and increased risk of a rapid onset excursion.
Recent price trends in crude oil and natural gas have shifted HP economics. The price of natural gas has declined, while the price of crude oil and liquid fuels has greatly increased. H2 consumed through a hydroprocessing complex swells the liquid yield, effectively converting a low-cost feedstock into a high-value product.
Among HP units, HC has the greatest H2 uptake, typically around 1,700 standard cubic feet (scf) of H2 per barrel (bbl), with a resulting liquid volume swell of 10%. Therefore, the gross profit margin from volume swell alone is in the range of $100 million (MM) per year for a 30,000-bpd HC unit. This is based on H2 sourced from natural gas at $4/thousand scf, and valuing product fuels at $120/bbl.
Past strategies and present gaps
Over the past 20 years, hydrocracker process control strategy has focused on installing automatic depressurization systems and MPC. While these are important, experience now shows that they leave many gaps in excursion control and depressure prevention.
Auto-depressure controls serve to vent reactor systems to flare in the event of an uncontrolled exothermic excursion, to halt the reaction and prevent vessel temperatures from exceeding metallurgical limits. Temperatures during an exothermic excursion sometimes increase tens of degrees in as many seconds. Industry history shows that manual depressure systems are often not used according to written procedures and that personnel at all levelsmanagerial, supervisory and operationalcan have difficulty balancing production goals with safe use of manual depressure systems.1 This illustrates why auto-depressuremade possible by more reliable thermocouple-based temperature-measurement systems and improved algorithms for excursion detection and temperature-measurement quality handlinghas become essential.
The difficulty with auto-depressure controls is that they tend to act much sooner than traditional, manually initiated systems, and depressuring is to be avoided whenever possible, except as a final layer of safety. Depressuring a reactor brings the unwelcome prospects of prolonged restart, impact on other refinery units, large economic losses, thermal and mechanical stresses to the reactor and associated equipment, environmental flaring violations, and potential harm to the company image in the community and in the industry. The necessary message that often fails to accompany auto-depressure projects is the need for better excursion control to avoid reaching auto-depressure conditions in the first place.
MPC technology has brought improvements in reactor bed temperature balancing, weighted average bed temperature (WABT) control, and coordination between reactor and fractionator sections (conversion control). However, MPC lacks the speed, reliability and control features necessary to adequately respond to most hydrocracker disturbances before they result in an excursion, or to contain an excursion before it leads to depressure, or to do so in a manner that minimizes overall impact on reactor temperatures and resulting lost production.
Hydrocracker operators are always aware of the many potential excursion initiators. On the other hand, when designing controls (and even during hazard analysis), there is a common tendency to downplay the likelihood, severity and actual history of many excursion scenarios.1 For a hydrocracker (or for any critical process control), an effective approach is for a multidisciplinary team to consider each scenario and the most appropriate control system response. Common excursion scenarios include:
- Loss of oil feed. A feed pump trip normally results in a strong excursion unless quickly quenched, because the oil stops moving through the bed and instead cracks in place, never reaching the quench zone.
- Heater operations. Adding burners, fuel gas upsets, draft or oxygen upsets, etc., can cause feed temperature spikes, triggering an excursion.
- Maldistribution. Bed inlet maldistribution can cause erratic quench controller behavior, especially if a single measurement point is used for control or if inter-bed redistribution internals are not functioning properly. Maldistribution of flow through the catalyst bed creates localized low flow conditions and hot spots where excursions can take hold.
- Production changes. Although operating procedures are designed to implement changes conservatively and safely, excursions commonly occur during changes to feed rates, feed type or temperature (i.e., conversion).
Additional potential excursion triggers are listed in Reference 1. Complex refineries with a variety of feed and product types can be subject to these hazards on an essentially continuous basis. Understanding these causes helps build better controls; however, the control design must also provide effective excursion control, regardless of the cause.
Layers of control
Fig. 2 is a hydrocracker reactor control model that addresses safety, depressure prevention, and excursion control, along with normal operating objectives and optimization. The overlapping of layers indicates robust reliability. For example, excursions may be contained and controlled by Layer 4, 3 or 2 before ever reaching Layer 1 (depressure). In addition, Layers 4 and below are implemented in the base-layer control system, thereby maximizing responsiveness, reliability and operability.
Fig. 2. HC reactor control model
showing layers of control.
- Auto-depressure on high temperature is becoming established as an industry best practice. Key design decisions include whether to implement auto-depressure in the safety instrumented system (SIS) or the distributed control system (DCS); whether to depressure on high temperature rate-of-change (in addition to high absolute temperature); and how to robustly handle low-quality temperature singularities among the bed outlet thermocouple arrays to avoid unnecessary or nuisance depressurization events.
- Auto-quench causes the quench valves to open on high excursion temperature to avoid reaching the depressure limit. It may also trigger preemptively on feed pump trip and initiate heater minimum fire logic. Auto-quench design is a balancing act: it should be robust, like a safety function, but without being so heavy-handed as to result in an extended recovery time; it must trigger early enough to avoid reaching depressure, but without triggering unnecessarily; and it should not interfere with, or be defeated by, quench controls in manual mode. Although auto-quench is a DCS control, conceptually it can be one of the most important functions in a refinery, since it is the final layer of depressure prevention.
- The excursion control layer is designed to handle excursions as routine control disturbances, when possible, to minimize their impacts. This renders most excursions as non-events, such that they go largely unnoticed, except perhaps by the DCS operators. In the past, operators remained alert to take manual control in the event of an excursion, but with excursion controls, operators learn to keep them in the correct mode to ensure reliable automatic response. As one operator noted, These are controllers that work for us, and not the other way around.
The excursion control layer comprises a number of traditional advanced regulatory control (ARC) techniques applied to the bed inlet, bed outlet and heater controllers. An important aspect is converting the Bed 1 quench valve (TC-IN-1A in Fig. 1) to a bed outlet temperature controller (TC-OUT-1A in Fig. 3) and coordinating its action with heater control. This critical valve is often configured problematically (as in Fig. 1), so that it does not respond to an excursion and, when used, can cause the heater(s) to counter with increased firing.
Fig. 3. HC reactor piping and instrumentation
diagram with upgraded controls.
- In retrospect, operating an exothermic reactor without bed outlet control defies common sense, although it is a common practice, especially when MPC is switched off, detuned, clamped or over-constrained. Even if the excursion control features are absent, outlet control at least helps prevent many gradual process variations from reaching excursion thresholds. It also brings increased stability to bed outlet temperatures, WABT and conversion. However, simple outlet controlsans the excursion control features, including MPCusually will not contain an excursion once it begins.
- MPC-based WABT control, when implemented in the new model (Fig. 3), would write to the bed outlet controller setpoints rather than to the bed inlets, as is traditional. The bed outlet controllers provide base-layer stability and excursion control, while MPC provides traditional WABT control and constraint management. As an alternative, WABT control can be implemented as a custom algorithm, providing greater flexibility in how the constraints are managed. This also facilitates a variable WABT ramp rate that can be both faster and safer during startup and recovery operations, capturing extra hours of on-target production. Since the base-layer controls handle stability, this custom WABT algorithm is similar to, and no more complex than, a traditional heater pass balancing control.
- Conversion control involves moving the WABT setpoints based on fractionation section product spreads. MPC is a good choice for handling the long response times involved, although a rudimentary custom algorithm can also be used. A limitation is that feed quality changes are the primary disturbance, and they are often much bigger than the handles, since WABTs can only be moved gradually and within limits. Another key consideration is a smart-conversion calculation and scheduler, so that fractionator disturbances are not back-propagated to the reactor section.
Excursions are commonly quantified as the difference between real-time reactor bed temperatures and recent (heavily filtered) values. The excursion value reflects any short-term temperature rise; i.e., the severity of an excursion. At steady-state, this value will be zero, and at operating conditions (if procedures are carefully followed and no excursions occur), it will always be less than the prescribed maximum hourly rate of change; e.g., less than around 5°F.
Since modern hydrocracker reactors may have a dozen or more thermocouples per bed, a common practice is to calculate the highest temperature of each bed for monitoring and alarming, for ease of operation, and to avoid alarm floods when excursions occur. Fig. 4 is an example of the long-term trend of the highest excursion temperatures for each bed of a two-stage reactor. The vertical axis shows excursion severity (for example, increments of 5°F).
Fig. 4. Improvement in excursion control.
Excursions below a severity of 1 reflect routine daily operation. Excursions with a severity between 1 and 2 may occur daily, weekly or monthly, depending on the quality of operation. Excursion controls should take effect at this level. Excursions greater than a severity of 2 are increasingly serious and, in many cases, warrant near-miss investigations to prevent recurrence. These investigations often lead to the types of control improvements described here.
Fig. 4 provides a meaningful metric of progress and of ongoing quality of operation. As controls are upgraded, the frequency and severity of excursions decreases. As with any safety metric, frequent, minor excursions indicate the increased likelihood of a full-blown excursion and potential depressure event. A graph like that shown in Fig. 4 is a good candidate for visibility on a large control-room screen, as a means of sustaining improvement and awareness.
A guiding tenet in the evolution of these controls was to utilize quench, heater and other controls as advantageously as possible under all circumstances, to contain excursions and avoid reaching auto-depressure conditions. This led to many creative and sensible ideas. The main challenge was not in the difficulty of designing new controls reflecting these ideas, but in overcoming entrenched paradigms about the old controls, even though they were outdated or not sensibly configured in many cases, such as the conflict between the Bed 1 quench and heater controls, and the lack of reliable bed outlet control.
Control layers 2 through 4 were implemented with standard DCS functionality, bringing cost and engineering advantages. Another practical benefit is operability, since these controls present to the DCS console operator and behave as conventional cascaded controls, requiring minimal new concepts and training.
MPC is often considered a comprehensive solution for the types of control concerns raised here; however, none of the critical excursion control, depressure prevention or auto-quench functions are of the type provided by MPC. For design or hazard and operability study (HAZOP) purposes, it is usually better to view MPC as a gradual constraint pusher, rather than as a reliable disturbance handler. This distinction is important on any process, but especially for hydrocrackers, where a robust response can make the difference between an online reactor and a depressured reactor, in a matter of minutes.
Process control could benefit by borrowing from safety system practice and convening a multidisciplinary team to review critical process upset scenarios and arrive at the most appropriate and advantageous automatic control response. While many processes do not have the rapid downside potential of HC reactors, the general principles of maximizing on-target production and avoiding safety function thresholds under upset conditions make this approach a good practice for any refinery unit.
The traditional practice of operating high-pressure, high-temperature, exothermic reactors without reliable, nonlinear bed outlet temperature control is a paradigm that industry should proactively remedy. The auto-quench, excursion control and bed outlet layers should join auto-depressure as industry best practice for all hydrocrackers. HP
1 EPA Chemical Accident Investigation Report, Tosco Avon Refinery, Martinez, California, November 1998.
Allan Kern has over 35 years of process control experience and has authored dozens of papers on multivariable control, inferential control, safety systems and distillation control, with a focus on practical process control solutions and effectiveness. He is a professional control systems and chemical engineer, a senior member of ISA and a graduate of the University of Wyoming. Mr. Kern is a consultant, and he can be contacted at Allan.Kern@APCperformance.com.