Safety: HAZOP, relief, LOPA and siting

The ATJ plant handles three of the most hazardous materials in the process industries: ethylene, a highly reactive flammable gas, at 30 bar; hydrogen, which ignites easily and burns with an almost invisible flame; and a strongly exothermic reaction that can run away. It also stores tens of thousands of litres of flammable liquid. The brief requires a hazard review of the reaction section, and the panel at the final presentation will judge the design first on whether it is safe. Liam leads the review, with Nadia Brandt, Kingfisher's process safety engineer, as facilitator, and the methods of CHE-380. This lesson follows the review from inherent safety through HAZOP, relief design and layer of protection analysis to the layout of the plant.

Inherent safety first

Before any hazard review, the team asks the inherent safety questions: can the hazard be removed, reduced, replaced with something milder, or simplified? Several design choices already made answer them. The oligomerization feed is diluted to about 15 % ethylene, which limits the heat that a runaway can release in any tube. The reactors use narrow tubes with boiling-water cooling, which is self-regulating: the coolant cannot rise above the boiling temperature at the drum pressure. The hydrogen is bought as needed rather than stored in bulk, and the hydrogen inventory is limited to the piping and one small buffer vessel. The team also looks for further gains. Riya reduces the liquid hold-up of the stabilizer by using a smaller bottom sump and a separate surge drum that can be isolated, and Jonah sizes the high-pressure separator for three minutes of liquid residence instead of the five in his first draft, cutting its flammable inventory by 40 %.

Hazard and operability study

The HAZOP is carried out on the preliminary P&IDs of Lesson 9, node by node, by a team that includes people who did not design the plant: Nadia as facilitator, Theo, a senior panel operator from the dehydration unit, Professor Marchetti, and the four students. For each node, guidewords such as no, more, less, reverse and other than are combined with parameters such as flow, temperature, pressure and level to generate deviations. For each deviation, the team records causes, consequences, existing safeguards and recommended actions. The review of the reaction section takes four sessions of three hours.

Several actions change the design. The most important is the first: loss of cooling is the deviation that can lead to the worst consequence, a runaway that ruptures tubes and releases hot ethylene at 30 bar, which could ignite and, in a congested area, explode. The safeguards listed are an alarm and the operator's response, which on its own does not seem enough. The HAZOP does not decide how much more protection is needed; it records the scenario for a layer of protection analysis.

Layer of protection analysis

Layer of protection analysis (LOPA) takes one scenario from the HAZOP and estimates its frequency, step by step, with order-of-magnitude numbers. It starts with the initiating event frequency, multiplies by the probability of failure on demand (PFD) of each independent protection layer, multiplies by conditional modifiers such as the probability of ignition and of someone being present, and compares the result with a tolerable frequency. If the result is too high, the gap is the reliability a new safety instrumented function must provide.

For loss of cooling on R-301, the initiating events are a failure of the drum level loop or the drum pressure loop, each taken at the conventional 0.1 per year for a basic control system failure, so 0.2 per year combined. The only independent protection layer is the hot-spot alarm with operator response, credited at a PFD of 0.1 because its thermocouple is separate from the control loops. The drum relief valve is not credited: it limits pressure, but at its set point the coolant would still be hot enough for the hot spot to exceed its limit. Probability of ignition is taken as 0.3 and of fatality if someone is exposed as 0.5. The tolerable frequency, from Kingfisher's corporate criteria, is 10⁻⁵ per year for a single fatality.

# Layer of protection analysis for oligomerization runaway, and fire-case relief for the high-pressure separator
import math
# --- 1. LOPA: loss of cooling on R-301 (drum level or pressure control failure) leading to tube rupture and fire
IEF = 0.2                         # per year: two BPCS failures (level loop, pressure loop) at 0.1 per year each
ipl = {'hot-spot high alarm and operator response (independent sensor)': 0.1}
cond = {'ignition': 0.3, 'fatality if exposed': 0.5}
target = 1e-5                     # Kingfisher's tolerable frequency for a single fatality, per year
for site, occ in (('workshop beside the unit', 0.5), ('workshop moved 100 m away', 0.1)):
    f = IEF
    for p in ipl.values(): f *= p
    f *= cond['ignition'] * cond['fatality if exposed'] * occ
    pfd = target / f
    sil = 'none needed' if pfd >= 1 else ('SIL 1' if pfd >= 0.01 else ('SIL 2' if pfd >= 0.001 else 'SIL 3'))
    print(f"{site:<27} occupancy {occ:.1f}: frequency without SIF {f:.1e}/yr; SIF PFD needed {pfd:.4f} -> {sil}")
# --- 2. Fire case on the high-pressure separator (API 521, adequate drainage and firefighting)
D, L, F_env = 2.0, 6.0, 1.0       # m, m, environment factor (bare vessel)
wet = 0.5 * (math.pi * D * L + 2 * math.pi * D**2 / 4)      # half full, all within 7.6 m of grade
Q = 43.2 * F_env * wet**0.82      # kW
lam = 250.0                       # kJ/kg latent heat of the light oligomer at relief conditions (illustrative)
W = Q / lam * 3600                # kg/h
print(f"wetted area {wet:.1f} m2; fire heat input {Q:.0f} kW; relief load {W:.0f} kg/h")
# --- 3. Required orifice area for gas relief (API 520), set 35 bar(g), 21 % fire overpressure
k, M, T, Z = 1.10, 70.0, 523.0, 0.85
P1 = (35.0 * 1.21 + 1.013) * 100  # kPa absolute
C = 0.03948 * math.sqrt(k * (2 / (k + 1)) ** ((k + 1) / (k - 1)))
A = W / (C * 0.975 * P1 * 1.0 * 1.0) * math.sqrt(T * Z / M)    # mm2
letters = [('D', 71), ('E', 126), ('F', 198), ('G', 325), ('H', 506), ('J', 830)]
pick = next(l for l, a in letters if a >= A)
print(f"relieving pressure {P1:.0f} kPa(a); required area {A:.0f} mm2 -> API orifice {pick}")

workshop beside the unit    occupancy 0.5: frequency without SIF 1.5e-03/yr; SIF PFD needed 0.0067 -> SIL 2
workshop moved 100 m away   occupancy 0.1: frequency without SIF 3.0e-04/yr; SIF PFD needed 0.0333 -> SIL 1
wetted area 22.0 m2; fire heat input 545 kW; relief load 7843 kg/h
relieving pressure 4336 kPa(a); required area 188 mm2 -> API orifice F

The result depends on where people are. In Ana's first layout, the maintenance workshop sits beside the reaction section, and someone is there half the time. The frequency without a safety function is then 1.5 × 10⁻³ per year, and the safety instrumented function must have a PFD of no more than about 0.007: safety integrity level 2, which needs redundant sensors and valves and frequent proof testing. Moving the workshop 100 m away, so that the occupancy near the reactors falls to about 0.1, brings the frequency to 3 × 10⁻⁴ per year and the requirement to a PFD of 0.03, SIL 1. The team moves the workshop. This is the point of LOPA: it shows where risk can be reduced by layout or design instead of by ever more reliable instrumentation.

LOPA numbers are rough, and Nadia reminds the team that their value lies in comparison and consistency, not precision. Each credited layer must be independent of the initiating event and of the other layers, specific to the scenario, auditable, and actually able to prevent the consequence. The team's first draft credited both the drum low-level alarm and the hot-spot alarm, until Nadia pointed out that both rely on the same operator responding to the same upset, so only one can be credited.

Relief systems

Every vessel that can be overpressured needs relief, sized for the worst credible scenario. Riya lists the scenarios for each item: blocked outlet, control valve failure, loss of cooling, exchanger tube rupture, thermal expansion of blocked-in liquid, and external fire, following API Standard 521. For the high-pressure separator, a horizontal drum 2.0 m in diameter and 6 m long, half full of light oligomer, external fire is the governing case. API 521 gives the heat input to a wetted vessel with adequate drainage and firefighting as

The wetted area is about 22 m², so the fire heat input is about 545 kW and, with a latent heat of about 250 kJ/kg, the vapour generated is about 7,800 kg/h. At the fire-case relieving pressure, 21 % above the 35 bar(g) set pressure, the API 520 equation for gas relief gives a required effective area of about 190 mm², which an API letter F orifice provides. Riya notes the separator also has a blocked-outlet case from the reactors, which she sizes the same way, and that the larger of the two governs. The relief discharges to the site flare through a new subheader; the flare's capacity for the ATJ plant's largest simultaneous relief, a general power failure, must be checked against the existing flare's design, an item the team lists for Kingfisher.

Two relief cases need more than a valve. A runaway in a tubular reactor cannot be relieved through a valve fast enough to protect the tubes, which is why the protection is by safety instrumented function and depressuring rather than relief. And the jet column, under vacuum, needs protection against both overpressure and collapse: a relief valve to the flare and a vacuum breaker that admits nitrogen.

Facility siting and layout

Where equipment and buildings are placed decides who is exposed if something goes wrong. Kingfisher uses the approach of API RP 752 for permanent buildings and API RP 753 for portable ones: a building near process units must either be far enough from credible explosion and fire scenarios or be designed to withstand them. Liam estimates the largest credible vapour cloud explosion from a release in the oligomerization section and finds that the existing ethanol plant control room, 220 m away, is outside the overpressure contour of concern. The new satellite rack room for the ATJ plant's instrumentation is placed 60 m from the reactors and specified as blast-resistant. The team also lays the plant out so that the reactors are on the open edge of the unit, where a release would disperse rather than collect in congestion, which raises explosion severity.

Spacing tables from insurance guidance set minimum distances between the fired heater, which is a permanent ignition source, and equipment containing flammable gas or liquid. The fired heater is placed upwind of the process area in the prevailing wind, with a steam curtain on its process side, and the hydrogen and ethylene compressors in an open-sided shelter rather than a closed building, so that any leak disperses. Electrical equipment in areas where flammable gas may be present is classified under Section 18 of the Canadian Electrical Code (zones).

Regulatory framework

The plant will be covered by CSA Z767 Process Safety Management, applied under Ontario's Occupational Health and Safety Act, with the Technical Standards and Safety Authority (TSSA) for pressure equipment and fuel systems. That framework requires the elements the team has begun: process safety information, process hazard analysis, operating procedures, training, mechanical integrity, management of change and pre-startup safety review. Because the plant will store and process ethylene and hydrogen above the threshold quantities, it will also need emergency planning under the Environmental Emergency Regulations under CEPA. The team's report lists these obligations for Kingfisher and notes that its HAZOP is a preliminary review that would be repeated on the detailed design.