Maintaining boiler safety

Short-term errors or long-term practices can cause boiler failures. Low-water trip switches should be checked regularly and never bypassed. Poor feedwater quality can cause corrosion and contamination. HVAC/SafetyRegard for personnel safety is an item that is first and foremost in the design, construction, operation, and maintenance of industrial manufacturing facilities.

By William L. Reeves, PE, ESI Inc. of Tennessee, Kennesaw, GA November 2, 2018

Key Concepts

  • Short-term errors or long-term practices can cause boiler failures
  • Low-water trip switches should be checked regularly and never bypassed
  • Poor feedwater quality can cause corrosion and contamination.


Regard for personnel safety is an item that is first and foremost in the design, construction, operation, and maintenance of industrial manufacturing facilities. Sometimes serious and fatal injuries are caused by catastrophic equipment failure that stems from years of seemingly innocent neglect or poor operation and maintenance.

When it comes to potential catastrophic failure caused by poor operating and maintenance practices, there is probably no more potentially dangerous equipment operating in an industrial manufacturing facility than steam and power generating equipment. The boiler is often the largest, most expensive, and potentially most dangerous piece of equipment, if not operated and maintained properly.

Even the most sophisticated high-temperature and pressure watertube boiler can be simply described as pressure parts (drums, headers, and steel tubes) which contain high-pressure steam and water. The tube surface transfers heat to the water from a fuel being combusted in a controlled manner outside of the tube surface. A firetube boiler is simply the opposite with the fuel combustion on the inside of the tube surface.

Boiler failures

Catastrophic boiler failures can threaten the safety of operating personnel. Fuel explosions, low water, or poor feedwater quality generally causes them.

Fuel explosions

One of the most dangerous situations in the operation of a boiler is that of a fuel explosion in the furnace (Fig. 1). The inherent cause of fuel explosions can generally be traced back to an operations or maintenance problem. If a steam boiler is properly operated and maintained, including performance of all the necessary routine preventive maintenance, the likelihood of a fuel explosion is virtually eliminated.

Low-water incidence

The potential for severe and even catastrophic damage to a boiler as a result of low-water conditions is easy to imagine, considering that furnace temperatures exceed 1800 F, yet the physical properties of carbon steel change dramatically at temperatures above 850 F.

The only reason a boiler can withstand these furnace temperatures is the presence of water in all tubes of the furnace at all times when a fire is present. In a very short period of time, continued firing during a low water condition literally melts steel boiler tubes (Fig. 2).

Typical industrial boilers are natural circulation and do not utilize pumps to move water through the tubes. Instead, these units rely on the differential density between steam and water to provide the necessary water circulation. The water level is critical to ensure a flooded supply of water to downcomer tubes (Fig. 3).

Because sufficient water level is critical, modern boilers are equipped with automatic low-water trip switches. Some older boilers may not have these relatively inexpensive devices.

If a boiler does not have low-water trips, have these devices installed. Low-water trips protect boiler pressure parts by shutting down the fuel combustion process, eliminating high temperatures in the furnace when the natural circulation cooling process is interrupted.

Control of the boiler drum level is sophisticated, and even the best-tuned control systems cannot always prevent a low-water condition. The water level in a steam drum is actually a fairly unstable compressible mixture of water and steam bubbles that shrink and swell with pressure changes, firing rate changes, and when colder feedwater is added.

All properly designed installations — both gas/oil and solid fuel units — should be installed with redundant and dissimilar low-water trips, conductive and float-actuated types. Unfortunately, an alarming number of boilers equipped with low-water trips are destroyed each year.

There are several common reasons for low-water trip failures.

  • Disabled trip circuits. A typical scenario involves bypassing the switches to eliminate nuisance trips due to improperly tuned controls, safety device failure, etc. This approach is a Band-Aid to cover the real problem and should never be allowed.
  • Inoperative trip switches. Trip switches should be blown down regularly to exercise the trip devices and remove potential sludge buildup. A properly designed installation allows the trip devices to be blown down each shift without the boiler tripping offline. This blowdown keeps them clean and verifies proper operation of the low-water protection and alarm circuitry.

Figure – Water level is critical for boiler-feedwater circulation in downcomer tubes.

Poor feedwater quality

Feedwater is treated to protect the boiler from two basic problems: buildup of solid deposits on the waterside of the tubes and corrosion.

Water that enters the boiler is vaporized to steam, leaving solids behind in the form of scale or buildup in the areas of highest heat transfer rate.

A buildup of scale deposits inside boiler tubes produces an insulating layer which inhibits the ability of the water to remove heat from the tube surface. If this condition becomes severe enough and allowed to continue, the result is localized overheating of the tube and eventual failure.

Whether caused by low water or poor boiler water quality, potentially dangerous steam explosions can occur when overheated pressure parts suddenly fail under high pressure. A steam explosion in a boiler house can, in seconds, produce ambient conditions of intolerable heat and reduced oxygen levels below survivable limits.

To prevent deposits on tubes, the level of solids in the boiler feedwater must be maintained at acceptable limits. The higher the operating pressure and temperature of the boiler, the more stringent the requirements for proper feedwater treatment.

Unless a power generation turbine is involved, or the raw water quality is particularly bad, most industrial boilers operate at sufficiently low pressures to enable the use of simple sodium zeolite water softeners for feedwater treatment (Fig. 4) .

At higher pressures and when turbines and superheaters are involved, more complex feedwater treatment systems, such as reverse osmosis and demineralizer systems, are required.

Waterside tube corrosion is generally caused by the existence of contaminants in the boiler feedwater, which is a combination of makeup water and condensate returns.

Feedwater contaminants include oxygen, excessive water treatment chemicals, oils, miscellaneous metals and chemical compounds, and resin.

Dissolved oxygen is a common and constant threat to boiler tube integrity. The use of modern, sophisticated chelant water treatment programs has dramatically improved the cleanliness of boiler heat transfer surfaces to such an extent that essentially bare-metal conditions exist.

Since only a thin magnetic oxide film remains on boiler metal surfaces, oxygen control is extremely important. The typical boiler facility is equipped with a deaerating feedwater heater to remove the majority of oxygen. In boilers operating below 1000 psig, the oxygen scavenger — sodium sulfite — is continuously fed to the storage tank of the deaerator to ensure the absence of free oxygen.

One of the most serious types of oxygen corrosion is oxygen pitting, which is concentrated on a very small area. Pressure part failures can occur, even though a relatively small amount of corrosion and loss of metal has been experienced.

A chelant boiler water treatment program that is not properly maintained to ensure proper dosages of chelating chemicals can create problems with consequences these chemicals are injected to prevent.

Chelant corrosion or attack develops only when excess concentrations of sodium salt are maintained substantially above the control level for an extended period of time. The resultant attack is a dissolving or thinning of metal, unlike oxygen pitting. The attack concentrates on areas of stress within the boiler, such as: rolled tube ends, baffle edges, tube welds, threaded members, and other nonstress-relieved areas.

The inadvertent introduction of acid and caustic can cause the most devastating immediate damage to a boiler. The presence of either of these chemicals can cause many different types of corrosion and destruction of metal integrity.

These chemicals are commonly introduced into a boiler for several reasons.

  • Equipment failure or malfunction. A typical problem might be leaking regenerant isolation valves or failure of an automatic controller, resulting in an inadequate rinse cycle.
  • Poor water treatment system design. Double block and bleed valve systems should be used wherever any regenerant chemicals are introduced into the water system to protect against damage due to valve failure.
  • Poor water treatment system training and operation. If operators are not properly trained and cognizant of the importance of operating these often-sophisticated systems, they might be responsible for pumping concentrated acid and caustic into the boiler. A less likely problem might be improperly carrying out the regeneration of water treatment equipment, such as improper rinsing of residual acid and caustic.

Undetected contamination of condensate returns is another common problem, which leads to boiler feedwater contamination. Contaminants can vary from metals such as copper and iron, to oils and process chemicals.

Heavy metal contamination is usually a function of the materials of construction of the process equipment and the condensate system.

Oils and process chemicals are generally introduced into the condensate system due to process equipment failures or corrosion-caused leaks in equipment, such as heat exchangers, pump and gland seals, etc.

The biggest risk associated with condensate system contamination is a catastrophic failure of a piece of process equipment, which results in the introduction of significant quantities of undesirable chemicals or compounds into the boiler. For this reason, prudent boiler operations should include continuous monitoring of the quality of condensate being returned from the process with automatic dump capability in case of contamination.

Another problem that sometimes causes severe boiler fouling is the introduction of ion exchange resin into the boiler feedwater system. This situation is frequently caused by the failure of the ion exchange vessel internal piping or lateral screens.

Depending upon the operating pressure of the boiler and type of resin, this problem can result in a severe coating of resin material on boiler surfaces. An inexpensive and very worthwhile method to alleviate the chance of this type of contamination is to install a resin trap on the outlet of any ion exchange vessel. Resin traps not only protect the boiler from contamination, but also prevent the loss of very expensive resin.

Boiler feedwater contamination and resultant corrosion can be a slow, degenerative process, or an instantaneous, catastrophic event. Routine and efficient maintenance procedures greatly mitigate the chances of both types of occurrences. Consistent boiler water and feedwater quality monitoring and testing provides operating personnel not only with historical data, but also with a timely warning anytime feedwater quality changes dramatically.

Improper blowdown

When boiler feedwater is high quality, it is maintained by following proper blowdown practices. The concentration of undesirable solids in boiler water is reduced through the proper operation of a continuous purge or blowdown system and by performing intermittent bottom blowdowns on a regular basis.

The sodium zeolite water softening process is an ion exchange operation that exchanges harmful scale-producing calcium and magnesium ions for sodium ions.

The main purpose of blowdown is to maintain the solids concentration of the boiler water within certain acceptable limits. The blowdown rate can be determined by any one of several factors, which include total dissolved solids, suspended solids, silica, and alkalinity (see table).

The continuous blowdown rate is set to control the boiler water within ABMA-recommended acceptable limits. A well-designed continuous blowdown system constantly monitors boiler water conductivity (solids concentrations) and adjusts the blowdown rate to maintain the control range.

If the boiler water exceeds the recommended limits, potential problems can occur, including scale and sludge formation, corrosion, and moisture carryover due to foaming, and poor steam drum separation equipment performance. This foaming phenomenon associated with high conductivity can also cause drum level instability leading to nuisance water level alarms and potential boiler trips.

Sometimes, it is necessary to perform intermittent bottom blowdowns to dramatically reduce solids concentrations in the boiler water. Also, intermittent bottom blowdowns of water wall headers and the mud drum are critical to remove potential sludge buildup to keep all water circuitry clear. Generally, the only bottom blowdown that can be performed while the unit is being fired is from the mud drum.

Blowdown of lower water wall headers, particularly the furnace wall headers, should not be performed while the unit is being fired. This action could potentially result in water wall tube overheat damage due to the interruption of the boiler natural circulation.

Lower water wall headers should be routinely blown down every time the unit is brought out of service after fuel firing has been halted and the unit is still under pressure. Care should be taken to perform a blowdown of a limited duration to maintain visibility of the boiler water level in the sight glass. Additional bottom blows can be performed once feedwater is added to raise the level back up in the sight glass.

The single biggest problem caused by poor blowdown practices is the failure to periodically blow down the boiler water columns to ensure that the low-water trip devices are kept operational.

PLANT ENGINEERING magazine extends its appreciation to QPF, LLC, for its cooperation in making the cover photo possible. — Edited by Joseph L. Foszcz, Senior Editor,630-320-7135,

  1. Investigate and identify the cause of any trip before attempting to relight.
  2. Before lighting a boiler, always purge the furnace thoroughly.
  3. Perform routine maintenance, calibration, and testing of the burner management system and combustion controls, especially safety devices and transmitters.
  4. Verify that the water treatment system is operating properly, producing boiler feedwater of sufficiently high quality for the operating temperatures and pressures involved. Although zero hardness is always an absolute criteria, other water quality standards based on operating pressures and temperatures as recommended by ABMA should be followed. Never use untreated water in a boiler.
  5. Blow down all the dead legs of the low water trips, water column, etc., on a regular basis to prevent sludge buildup in these areas, which leads to device malfunction. Never, under any circumstance, disable a low-water trip.
  6. Verify that water leaving the deaerator is free of oxygen, that the deaerator is operated at the proper pressure, and that the storage tank water is at saturation temperature. A continuous vent from the deaerator is necessary to allow the discharge of noncondensable gases.
  7. Continuously monitor the quality of condensate coming back from the process to enable the diversion of condensate in the event of a catastrophic process equipment failure.
  8. Adjust continuous blowdown to maintain conductivity of the boiler water within required operating limits and operate the mud drum blowdown on a regular basis. Never blow down a furnace wall header while the boiler is operating.
  9. The boiler waterside should be inspected on a regular basis. If there are any signs of scaling or buildup of solids on the tubes, water treatment adjustments should be made. The boiler might require either a mechanical or chemical cleaning.


The deaerator vessel and internals should be inspected on a regular basis for signs of corrosion. This check is an important safety issue because a deaerator can rupture from oxygen corrosion damage. The catastrophic failure of an operating deaerator is the most common source of a fatal steam explosion inside a boiler house.

More info

The author is available to answer questions about boiler safety. He can be reached at 800-654-2512 or via e-mail at Additional information is available on the web site: For more information on boilers, visit the “Process and space heating” channel at

ABMA maximum recommended concentration limits in water of an operating boiler

Drum operating pressure, psig Total dissolved solids, ppm Total alkalinity, ppm Silica, ppm SiO2 Total suspended solids, ppm
0300 3500 700 150 15
301450 3000 600 90 10
451600 2500 500 40 8
601750 1000 200 30 3
751900 750 150 20 2
9011000 625 125 8 1

Steam boiler failures

There are two common reasons for boiler failure:

  • Short-term operator or maintenance errors that have a dramatic, immediate effect toward causing a catastrophic failure or incident
  • Long-term operating or maintenance practices that, over time, cause or allow a condition to develop that results in a catastrophic failure or incident.

Common causes of fuel explosions

Fuel-rich mixtures can occur any time that insufficient air is supplied for the amount of fuel being burned. Never add air to a dark, smoky furnace. First, trip the unit to remove the ignition source, purge thoroughly, and then correct the problem. A lean mixture, which results in more air than necessary, while not efficient, is not dangerous.

Poor atomization of oil can cause an accumulation in the furnace and create a localized volatile mixture of unburned fuel, which can result in an explosion. To prevent this situation, the oil gun sprayer assembly must be free of debris and the atomizing steam or air and fuel oil pressures must be properly adjusted.

Improper purge can leave a combustible mixture in a boiler.Many explosions occur during attempts to relight a burner after it has tripped because of another problem. The pilot then ignites the large inventory of unburned combustible gases in the furnace, which produces the explosion.

This scenario can be avoided by investigating the cause of the trip and allowing the furnace to purge thoroughly before any attempt to relight. Before relighting, purge, purge, purge!

Common causes of low water conditions

Feedwater pump failure

Control valve failure

Loss of water to the deaerator or makeup water system

Drum level controller failure

Drum level controller inadvertently left in “manual” position

Loss of plant air pressure to the control valve actuator

Safety valve lifting and then reseating

Large and sudden change in steam load and/or firing rate

Boiler safety operation and maintenance practices

Frequently observe the burner flame, especially when firing oil, to identify plugged sprayer tips and other combustion problems. This approach provides an early warning.