Safety, environment and permitting in design

Safety and environmental protection are not added to a design at the end. The cheapest and most effective time to make a plant safe is when the flowsheet and the layout are still being drawn, because that is when the hazards themselves can be removed or reduced, rather than guarded against. By the time the plant is being built, the only options left are added protection: alarms, trips, relief valves, fire protection, procedures. These work, but they cost money every year, they can fail, and they depend on people maintaining them. This lesson follows how the ester line's design changed during FEL-3 as the team looked at it through safety, environmental and permitting eyes.

Inherent safety

Trevor Kletz, who led safety work at ICI for many years, put the idea simply: what you do not have cannot leak. His principles of inherently safer design are usually grouped under four words. Minimize: use smaller quantities of hazardous material. Substitute: use a less hazardous material or process. Moderate: use hazardous materials in a less hazardous form or at less severe conditions. Simplify: design out opportunities for error, so that the plant is forgiving when something goes wrong. Each principle is applied by asking, at each stage of design, whether a hazard could be removed rather than controlled.

The ester line handles three flammable liquids. Ethyl acetate has a flash point of about minus 4 °C and ethanol about 13 °C, so both can form flammable mixtures with air at ordinary temperatures. Acetic acid has a flash point of about 39 °C and is also corrosive. The largest inventories are in the storage tanks, not the process, and that is where the team looks first.

Reducing the inventory

Lesson 6 left a question from Carla: does the line really need 14 days of product storage? Malik looks at the shipping pattern. Most product goes by truck, several loads a week, and the larger customers take railcars. With a weekly rail loading slot agreed with the railway and the larger customers, about a week of storage is enough. The first draft allowed two 1,000 m³ product tanks, so that one can receive product while the other is tested and shipped; the revised design uses two 600 m³ tanks instead.

# Inherent safety and permitting in design for the ester line (illustrative)
# 1. Inventory: metric tons of flammable liquid on site in two storage strategies
opts = {"two 1,000 m3 product tanks (14 days)": 2 * 1000 * 0.85 * 0.90,
        "two 600 m3 product tanks + rail loading weekly": 2 * 600 * 0.85 * 0.90}
for k, v in opts.items(): print(f"{k:50s} {v:6.0f} t ester")
cut = 1 - list(opts.values())[1] / list(opts.values())[0]
print(f"inventory reduction {cut*100:.0f} %")
# 2. Wastewater organic load from losses (lesson 3), as chemical oxygen demand
cod = {"acetic acid": (0.21 * 60.05, 1.07), "ethanol": (0.11 * 46.07, 2.09), "ethyl acetate": (0.079 * 88.11, 1.82)}
tot = 0
for k, (kg_h, f) in cod.items():
    tot += kg_h * f; print(f"  COD from {k:14s} {kg_h*f:6.1f} kg/h")
flow = 0.60                                   # m3/h of process water
print(f"total COD {tot:.1f} kg/h = {tot*24:.0f} kg/d, about {tot/flow*1000:,.0f} mg/L in {flow} m3/h of process water")
# 3. Permit and approval schedule: critical path in months from FEL-3 start (illustrative durations)
tasks = [("FEL-3 design and estimate", 0, 8), ("air and wastewater applications prepared", 3, 4),
         ("regulator review and decision", 7, 9), ("pressure equipment registration", 9, 6),
         ("detailed engineering", 8, 10), ("procurement of long-lead columns", 10, 9),
         ("construction", 16, 12), ("commissioning and start-up", 28, 3)]
end = 0
print("\ntask                                         start   end (month)")
for n, s, d in tasks:
    end = max(end, s + d); print(f"  {n:42s} {s:5d}   {s+d:5d}")
print(f"start-up about month {end}")

two 1,000 m3 product tanks (14 days)                 1530 t ester
two 600 m3 product tanks + rail loading weekly        918 t ester
inventory reduction 40 %
  COD from acetic acid      13.5 kg/h
  COD from ethanol          10.6 kg/h
  COD from ethyl acetate    12.7 kg/h
total COD 36.8 kg/h = 882 kg/d, about 61,255 mg/L in 0.6 m3/h of process water

task                                         start   end (month)
  FEL-3 design and estimate                      0       8
  air and wastewater applications prepared       3       7
  regulator review and decision                  7      16
  pressure equipment registration                9      15
  detailed engineering                           8      18
  procurement of long-lead columns              10      19
  construction                                  16      28
  commissioning and start-up                    28      31
start-up about month 31

The change cuts the maximum product inventory by about 40 %, from about 1,530 t to about 920 t. Smaller tanks mean a smaller dike, a smaller fire to plan for, and smaller separation distances from the site boundary and from other equipment. They also cost less: Lucia estimates a saving of about 0.6 million in tanks, foundations and fire protection, and less working capital tied up in product. Theo notes that in this case the safer design is also the cheaper one, which is often true when the change is made early and rarely true when it is made late.

The same thinking applies elsewhere. The acid tank stays at 21 days, because the acid comes by rail from a single supplier and running out would stop the line, but the acid is moderated: it is stored warm enough to stay liquid but well below its flash point. The ethanol day tank is small because the ethanol comes by pipe from the existing plant, which is itself a minimization: no ethanol trucks, no unloading hoses. In the process, the reactive column combines reaction and separation in one vessel, which cuts the number of vessels holding hot flammable liquid, and the decision in lesson 2 to use a solid catalyst rather than sulfuric acid removed a corrosive, hazardous liquid from the plant entirely.

Hazard reviews during design

Inherent safety removes some hazards; the rest need protection, and a design team uses formal reviews to find them. In FEL-3, Nadia leads a hazard identification workshop on the PFD and a preliminary HAZOP, a hazard and operability study, on the first P&IDs. A HAZOP takes each section of the plant and applies guide words such as no flow, more pressure, less level or reverse flow to each design intention, asking what could cause the deviation, what would follow, what protects against it and whether more is needed. The full HAZOP is held during detailed engineering, when the P&IDs are complete, but holding a first pass in FEL-3 catches the issues that would change the cost.

Two findings change the estimate. The first concerns the reactive column. If cooling water to the condenser fails while steam to the reboiler continues, the column pressure rises; the relief valve and its line to the site flare must be sized for that case, and the flare header must have room for it. The second concerns tank overfill. Filling a product tank from the column with the outlet closed could overflow it into the dike. The team adds an independent high-high level trip that stops the product pump and closes the inlet valve, assessed with a layer of protection analysis and designed as a safety instrumented function under ANSI/ISA-61511-1-2018, the US adoption of IEC 61511.

The project also falls under OSHA's Process Safety Management standard, 29 CFR 1910.119, together with EPA's Risk Management Program rule where a listed chemical exceeds its threshold quantity. The team reviews the threshold quantities and confirms which parts of the new line are covered, so that the process safety information, the hazard analysis, the operating procedures, the training and the management of change are planned from the start rather than added at handover. Electrical equipment in the areas where flammable vapor may be present is classified under Articles 500 and 505 of the National Electrical Code, which offer both the Class and Division system and the Zone system, which also affects cost: motors and instruments for classified areas cost more.

Environmental design

The main environmental questions for the ester line are air emissions and wastewater. Air emissions are mostly volatile organic compounds from tank breathing and from truck and railcar loading. The design uses nitrogen blanketing on all flammable tanks, vapor balancing during loading so that the vapor displaced from the railcar returns to the tank rather than to the air, and a vent condenser on the columns. The remaining vents go to the ethanol plant's existing thermal oxidizer, which has spare capacity. Dispersion modeling of the remaining emissions forms part of the air application, which Wren prepares. Priya points out that vapor balancing helps the loading crew as much as the air: without it, the operator at the top of a railcar stands in the displaced vapor, and her exposure estimate for the loading rack drops well below the OSHA limit once it is in place.

Wastewater is the more interesting problem. The water stripper from lesson 3 sends about 0.6 m³/h of process water to treatment, carrying small amounts of acid, ethanol and ester. The code converts those losses into chemical oxygen demand, COD, the standard measure of the organic load in water. The total is about 37 kg/h, or nearly 900 kg a day, and the concentration is high, about 61,000 mg/L, because the volume is so small. Sent to the site's wastewater treatment, this would be a significant new load.

The ethanol plant's fermentation team agrees to a trial, with Dev running laboratory fermentations on spiked cook water first, and the design includes a line to the cook water tank with a connection to the treatment plant as a backup. This is a small example of the integration that makes the project work: the ester line uses the ethanol plant's ethanol, steam, nitrogen, thermal oxidizer, control room and wastewater system, and gives back water that the ethanol plant can use.

Permits and approvals

The line needs several approvals before construction can start or the plant can operate. In Iowa, these are an air construction permit from the Iowa Department of Natural Resources followed by an update to the site's Title V operating permit, registration and inspection of the pressure vessels under the Iowa boiler and pressure vessel program, a local building permit, and a check of whether the new inventories bring any substance under EPA's Risk Management Program. Each has its own timeline, and some cannot be applied for until the design is far enough advanced to describe the emissions and equipment. The site's emergency planning must also be reviewed against EPA's Risk Management Program rule, 40 CFR Part 68, and the new tanks against land-use guidance from guidance from the Center for Chemical Process Safety, since there are no federal numerical risk criteria in the US.

The schedule shows why permitting is part of design. The air application is prepared during FEL-3 from the emission estimates and goes in around month 7. The regulator's review may take most of a year, and construction cannot start on the emission sources until it is complete. Meanwhile, detailed engineering and procurement of the long-lead columns go ahead at risk after sanction. On this schedule, construction starts around month 16 and the line starts up around month 31. A delay of six months in the approvals would push start-up back by about the same amount.

A six-month delay would cost about half a year of margin, around 3 million US dollars before tax, which is why Wren wants the applications submitted on time even if it means fixing some design details early.