Capstone: hazard review and relief design for the ethyl acetate tank farm

The ethyl acetate line at Kingfisher Bioenergy is ready for its pre-startup safety review. Over the course, Theo has worked on its hazards piece by piece: exposure at the drum filling station, release and dispersion from the tank farm dike, flammable headspaces and nitrogen blanketing, explosion overpressure at the control room, static control at the filling station, relief of the rundown drum V-410, the HAZOP of the column and the risk of overfilling tank T-402. In this capstone he pulls the results together into the process safety package that the startup team will review, with Nadia Brandt as the checker and Malik Osei as the manager who must sign off. The lesson also shows how the engineering work fits into the plant's process safety management system, which in Ontario follows CSA Z767, the Canadian standard for process safety management, applied alongside Ontario's Occupational Health and Safety Act and the Technical Standards and Safety Authority's rules for pressure equipment.

The process safety management framework

Process safety management, PSM, is the system that keeps the engineering in this course alive over the life of a plant. In the US, OSHA's standard 29 CFR 1910.119 sets out fourteen elements for covered processes, including employee participation, process safety information, process hazard analysis, operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work, management of change, incident investigation, emergency planning and response, compliance audits and trade secrets. EPA's Risk Management Program rule, 40 CFR Part 68, applies similar requirements to facilities holding listed toxic or flammable substances above threshold quantities, with an emphasis on off-site consequences; EPA revised the rule in 2024 and proposed further changes in early 2026. In Canada, CSA Z767 sets out a process safety management standard that companies adopt and that regulators and insurers reference, and Canada's Environmental Emergency Regulations under the Canadian Environmental Protection Act require environmental emergency plans for listed substances above threshold quantities. HSE-311 covers these frameworks in depth. For the capstone, the key elements are process safety information, PHA, management of change, pre-startup safety review and mechanical integrity.

Step 1: confirm the hazards and the inventory

The first section of the package summarizes the hazards of the materials. Ethyl acetate is a flammable liquid with a flash point near −4 °C, flammable limits of about 2 to 11.5 %, a minimum ignition energy of about half a millijoule and an 8-hour exposure limit of 400 ppm. Ethanol is similar but slightly less volatile. The inventory is the three 1,000 m³ tanks, the column and its drums, and the transfer lines. The HAZOP recommendation to replace the planned intermediate tank with a smaller one has been implemented, reducing the inventory in the rundown system by about a third: an inherently safer step that reduces every consequence downstream.

Step 2: consequences and siting

The consequence section collects the screening results. A 25 mm hole in T-402 releases about 2.4 kg/s of liquid; a spill filling the dike evaporates about 0.26 kg/s at 25 °C. On a calm night the flammable cloud from that pool could reach about 50 m, beyond the dike wall and toward the drum filling station; on a windy day only about 10 m. A cloud of 2,000 kg igniting among the column structures would produce roughly 10 kPa at 100 m. The new control room was therefore sited about 150 m from the tank farm and built blast resistant, and the laboratory's occupancy during transfers was reduced. A pool fire in the dike would give about 3 kW/m² at 25 m, which sets the safe approach routes for firefighters. Nadia's review note states that these are screening values and that the siting decision was confirmed with the company's consequence software and the multi-energy method.

Step 3: the overfill LOPA

The HAZOP and the fault tree of lesson 11 identified overfill of T-402 as the scenario with the largest risk contribution at the east fence. The LOPA starts with the level control loop failing at 0.1 per year. The independent high-level alarm, with a written operator response and fifteen minutes available, is credited with a PFD of 0.1. The probability of ignition is 0.1, and the probability that someone is in the dike area is 0.2. The mitigated frequency is \(2 \times 10^{-4}\) per year, against the company's tolerable frequency of \(10^{-5}\) per year for a large pool fire with a possible fatality.

# Capstone: LOPA for tank T-402 overfill, relief check and the action-tracking summary
target = 1e-5           # tolerable frequency for a large pool fire with possible fatality (company criterion, illustrative)
init = 0.1              # tank level control loop failure, per year
layers = (("independent high-level alarm with 15 min operator response", 0.1),)
cond = (("probability of ignition", 0.1), ("probability of a person in the dike area", 0.2))
f = init
for _, p in layers + cond: f *= p
print(f"mitigated frequency with existing layers: {f:.1e} per year")
need = target / f
print(f"required PFD of a new layer: {need:.2f} -> {'SIL 1' if need < 0.1 else 'non-SIL layer adequate'}")
pfd_sif = (5e-7 + 1e-7 + 1.5e-6) * 8760 / 2
print(f"proposed high-high level SIF closing the inlet valve: PFDavg {pfd_sif:.4f} -> residual {f * pfd_sif:.1e} per year")
# Relief: governing fire case vapour 9.4 t/h needs ~1,465 mm2; installed valve on rundown drum V-410 is a 'K' orifice
need_A, installed = 1465, 1186
print(f"relief on V-410: required {need_A} mm2, installed {installed} mm2 -> {'adequate' if installed >= need_A else 'UNDERSIZED: replace with L orifice (1841 mm2)'}")
# Recommendations tracked to closure
recs = (("add high-high level SIF on T-402", "high", 90), ("replace V-410 relief valve with L orifice", "high", 60),
        ("bond and ground drum filling station", "medium", 30), ("re-rate inlet line velocity limit for filling", "medium", 120),
        ("update area classification drawing", "low", 180))
for r, pri, d in recs: print(f"{pri:6s} {d:3d} days  {r}")

mitigated frequency with existing layers: 2.0e-04 per year
required PFD of a new layer: 0.05 -> SIL 1
proposed high-high level SIF closing the inlet valve: PFDavg 0.0092 -> residual 1.8e-06 per year
relief on V-410: required 1465 mm2, installed 1186 mm2 -> UNDERSIZED: replace with L orifice (1841 mm2)
high    90 days  add high-high level SIF on T-402
high    60 days  replace V-410 relief valve with L orifice
medium  30 days  bond and ground drum filling station
medium 120 days  re-rate inlet line velocity limit for filling
low    180 days  update area classification drawing

A new layer with a PFD no greater than 0.05 is needed, a risk reduction of 20, which is SIL 1. The proposed safety instrumented function uses an independent radar level transmitter, the safety logic solver and a dedicated valve on the tank inlet. With a yearly proof test its PFDavg is about 0.009, and the residual frequency falls to about \(1.8 \times 10^{-6}\) per year, comfortably below the target. The function is specified under the plant's CSA C22.2 No. 61511-1 procedures, with its trip point set so that the inlet valve closes before the liquid reaches the overflow, allowing for the valve's closing time and the pump's flow.

Step 4: relief and the disposal system

The relief section reports the correction to V-410. The fire case governs, needing about 1,465 mm² of effective area; the K orifice on the old data sheet, 1,186 mm², is undersized. An L orifice, 1,841 mm², is specified. The inlet piping is checked for the 3 % loss rule with the larger valve, and the outlet and the flare header are checked for the higher flow, as Nadia required. The atmospheric tanks T-401 to T-403 have pressure-vacuum vents and emergency vents sized to API Standard 2000, confirmed against the tank data. The pre-reactor's runaway relief, a rupture disc to a catch tank designed with DIERS methods by the company's specialists, is reviewed and found consistent with the latest calorimeter data. The management of change record for V-410 documents why the original data sheet was wrong: it had been copied from an older drum without checking the scenarios.

Step 5: ignition control and exposure

The drum filling station is the place where people, vapour and ignition sources come closest together. The package confirms that the station is inside the tank farm's Zone 2 area under the Canadian Electrical Code and that its equipment is rated accordingly; that the drum, lance and supply are bonded and grounded with a monitored clamp interlocked with the pump; that the lance reaches to near the bottom of the drum; and that local exhaust at the drum opening keeps operator exposure well below the 400 ppm limit, with sampling planned in the first month of operation. The nitrogen blanket on the tanks is set at 6 % oxygen with an 8 % alarm, and the oxygen analysers are on the mechanical integrity test schedule.

Step 6: recommendations and closure

The final section lists every recommendation with a priority and a due date. Two are high priority and must be complete before ethyl acetate is introduced: the new high-high level SIF on T-402 and the V-410 relief valve replacement. Two are medium priority: completing the bonding and grounding improvements at the drum station within 30 days, and re-rating the inlet line velocity limit for drum filling. The last, updating the area classification drawing to show the new filling station, is low priority but must be done before the next HAZOP revalidation. The pre-startup safety review verifies the high-priority items in the field: the trip is tested end to end, the new valve's nameplate is checked against the data sheet, and the drawings are compared with the installation.

Looking back

Malik's sign-off note is short. It records that the package rests on screening models with large uncertainties, that the decisions it supports were made with margins, and that the most important findings came from people asking whether the information was right: the copied relief data sheet, the alarm that shared a transmitter with its control loop, and the truck bay used for two products. Theo's own conclusion is that process safety engineering is less about any one equation than about keeping track of assumptions. Each number in the package depends on a hole size, a weather case, an isolation time or a failure rate, and each assumption must be revisited when the plant changes. The incidents of lesson 1 began when assumptions like these quietly stopped being true.

After startup, the line's process safety indicators join the site's monthly review: demands on the new trip, relief valve lifts, loss-of-containment events by tier, overdue tests and open recommendations. The first year passes with two tier 3 events, both alarms that were investigated and fixed, and no tier 1 or 2 events. Malik reminds the team that a quiet year is a reason to keep looking, not to relax.