HAZARDS AND RELATED ISSUES IN THE WHISKY DISTILLATION INDUSTRY

HAZARDS AND RELATED ISSUES IN THE WHISKY DISTILLATION INDUSTRY Clive Timms Strathayr, Rhu-Na-Haven Road, Aboyne, Aberdeenshire, AB34 5JB; e-mail: clive.timms@assetintegrity.co.uk The very traditional methods used in the whisky distillation process are fascinating to members of the public as they do their tours around the delightful settings and sample the end products. However, some recent incidents have highlighted that significant major accident hazard issues exist within this process sector. The traditional methods of using directly fired copper distillation vessels, venting of ethanol spirit into unsafe areas, regular pipe and filter blockages and problems with securing the supply of cooling water from Scottish burns, open up a whole raft of non conformance with respect to safety management. Add to this the fact that many distilleries are open top the public, with as many as 60,000 people passing through every year, there are also significant societal risk implications. Many distilleries have undergone process automation upgrades to improve productivity and manpower efficiency, but they have failed to recognise their hazards and the need for risk reduction using automated safeguarding. The focus has all too often been on control without any regard or understanding about incorporating safety instrumented systems (SIS) into their upgrades. This paper will draw upon the findings from Safety Integrity Level (SIL) determination case studies to highlight some of the most significant issues and discuss the steps that have been found necessary to overcome the major accident hazard issues that have been revealed. In many cases simple basic and inexpensive modifications are all that has been required. KEYWORDS: whisky, distillation, hazards, SIL INTRODUCTION The traditional process of turning water into whisky or the amber nectar has changed little over hundreds of years, and whisky distilleries are a common feature of the Scottish landscape. Often set in delightful glens in areas such as Speyside they are an absolute delight to the hundreds of thousands of visitors that tour them each year. There are around 53 registered members of the Scotch Whisky Association representing around 500 different brands, and for anyone that does not like a wee dram some of the distilleries also make very fine gins. Although the traditions of whisky making give a quaint and nostalgic first impression, a closer examination of the process reveals that some of the traditional methods used represent a process with multiple hazards. For example, the use of directly fired copper distillation vessels, venting of spirit vapour into unsafe areas, regular pipe and filter blockages and problems with securing the supply of cooling water from Scottish burns (streams), open up a whole raft of issues with respect to safety management. Add to this the fact that many distilleries are open top the public with tens of thousands of people passing through them every year, there are also significant societal risk implications. Although many distilleries have undergone process automation upgrades to improve productivity and manpower efficiency, the upgrades have often failed to recognise the hazards and the possible need for risk reduction using safety instrumented functions (SIF). The focus has all too often been on control without any regard or understanding about SIF requirements and how they should be incorporated in safety instrumented systems (SIS) that are segregated from basic control. This paper will draw upon the findings from Safety Integrity Level (SIL) determination case studies in compliance with BS EN IEC 61511 (BSI, 2004) to highlight some of the most significant issues and indicate the steps that have been found necessary to overcome the major accident hazard issues that have been revealed. In many cases only simple, basic and inexpensive modifications are required to resolve these problems. HAZARDS IN THE PROCESS Distilleries are usually classed as top tier COMAH (HMSO, 1999) sites due to the quantity of flammable spirit that is stored on site, but there are also a considerable number of hazards in the actual whisky production process. Figure 1 shows an overview of a SIL determination case study for a typical Still House. The unusually high SIL outcomes in the Figure 1 distribution indicate an absence of fundamental risk reduction measures, but these can often be resolved by the implementation of some very simple and cost effective solutions. The primary considerations are discussed at the end of the paper. The best way to identify the related hazards of whisky distillation is to take a step-by-step walk through the process which is shown in Figure 2. GRIST MILL Nearly all distilleries obtain dry malted, or germinated barley from malting houses that specialise in this part of the process.. 1

IChemE SYMPOSIUM SERIES NO. 153 Figure 1. Typical still house SIL determination summary The dry malted barley is delivered to the grist mill where is crushed by a series of four rollers into a coarse flour like material called Grist. This helps the next stage of the process which is extraction of sugars from the barley. There are few process hazards associated with the grist mill apart from the creation of dust which is akin to flour dust and can be extremely flammable. Thus electrical equipment has to comply with DSEAR regulations (HMSO, 2002). However, it was not uncommon Figure 2. The whisky distillation process 2

to find a real mishmash of compliant and non compliant electrical equipment in all hazardous areas. WASH TUN The grist is transferred by an auger to mostly wooden Wash Tuns where it is mixed with hot water to dissolve the sugars, and this forms a sweet mix known as Wort. WASHBACKS The Wort is cooled and pumped into large wooden fermentation vessels called Washbacks. Here yeast is added to convert the sugars into alcohol and 2 3 days of fermentation produces a liquid called wash. Fermentation produces large quantities of carbon dioxide and the area needs to be well ventilated to prevent hazardous build up. As part of a distillery tour, the public are often invited to look into the fermentation vessel inspection hatches, with caution, since the intoxicating aroma can cause instant dizziness. POT STILLS On completion of fermentation, the wash is transferred to the traditional copper pot stills where it is heated to release the alcohol as vapour. The use of copper stills is essential to the whisky process and the copper is sacrificially released gradually to the whisky batches. The Pot Stills form a two stage process with the first distillation of the Wash taking place in the Wash Still and the second distillation, of the condensed Low Wines output from the Wash Stills, in the Spirit Still. The first spirit produced during the second distillation at the beginning of a run is known as the Foreshots but this is too strong and pungent for keeping, and it is during the mid point of the second distillation, when the pure distillate is at 65 70% alcohol by volume (ABV) content that the spirit is sent to maturation. This is known as the Middle Cut and the liquid that remains at the end of the second distillation is called Feints which are also very pungent. There are a number of potential hazards in the distillation process and the main issues are as follows:. Direct and indirect heating. Many of the older and more traditional stills are direct fired by either peat/coal or gas burners, whilst more modern stills use indirect heating steam coils. Direct firing poses a significant hazard in the event that there is any loss of containment of flammable vapour or liquid, and these are both present in most areas of the whisky production process. In addition directly fired gas burners introduce burner management issues and the potential for hazards associated with gas leaks. Stills that have steam coils are not exempt from hazards since loss of control for the main steam valve can lead to overheating with excessive vibration, and this can lead to possible rupture and loss of containment from the copper vessel. The worst case would be failure of a Spirit Still where a loss of containment of thousands of litres at 30 32% ABV at a temperature of 50 deg C could result since the flash point is 32 deg C for this ABV. In addition, the steam raising plant has all the usual burner management and steam pressure vessel hazards.. Still implosion. The outlets from the top of the still are called Tail Pipes and these gradually taper towards the vapour condensers. They have a two way vent mechanism called a Tail Pipe Vent and this is intended to prevent a vacuum implosion or an overpressure. An implosion can occur if a vacuum is caused by batch charging a hot still with cold liquid or discharging the still liquid at the end of a batch run. The most hazardous implosion is during the fill cycle since the loss of containment from a reasonably large Spirit Still, for example, could result in approximately 8,600 litres of spillage at 50 deg C, which is above the flash point of 32% ABV at 32 deg C. Implosion on still discharge is not as hazardous as the majority of spirit vapour has been driven off during the distillation batch process.. Still overpressure due to blockages. The copper stills are not designed to be pressure vessels but there are risks of blockages in the still Tail Pipes due to build up of verdegree (copper oxide) or sediment carry-over from the still. Experience indicates that this build up is a gradual process over a number of years but there is often no routine cleaning of the pipe work. In some instances the stillman was known to compound the problem by banging the soft piping with a spanner to dislodge blockages, with the consequence that the piping is then dented making for a more rapid build up sediment. The Tail Pipe Vent can relieve pressure in the event of blockages occurring. However, many of these Tail Pipe Vents have been traditionally installed so that they actually vent into the still house. The purpose of this traditional design was for the stillman to regularly check for vapour venting as an indication of blockage by placing his hand underneath the vent. Venting flammable vapour into the still house gives rise to considerable risk of ignition and explosion which is compounded when the stills are directly fired. The risk to on site personnel is not the only consideration for distilleries that are open to the public since tens of thousands of visitors pass through the still houses on the Whisky Trail in any year. Tail Pipe venting has been the cause of some fire incidents and many distilleries are changing the vent location to a high elevation outside of the Still House, and this is a basic, fairly inexpensive and very effective solution to a significant hazard potential. CONDENSERS The vapours released from the stills are condensed back to liquid by water cooled condensers which can be located inside and outside of the still house. Cooling water is critical for maintaining stability in the whisky distillation process, as with many other industries in the process sector, and yet the source of this utility is so often taken directly from a local burn (stream) that flows through the glen. Water capacity of Scottish burns can fluctuate dramatically 3

throughout the year and loss of cooling water is one of the most regular problems in whisky distillation. The water level of a burn has a tendency to go low quite quickly in the dryer summer months whilst fallen leaves can regularly cause blockages in the extraction pipe filters in the autumn. Loss of cooling water to the condensers can, and often does, occur very rapidly resulting in the formation of vapour in the spirit safe which could cause failure of the glass window, and/or a build up of vapour pressure and venting from the tail pipe vent. Either consequence can lead to a significant loss and build up of flammable vapour with a high chance of ignition. Even if the distillation heat can be removed quickly, and this is not possible with coal fired stills, there will be sufficient residual heat to cause a problem. Stills operating with directly fired heaters also pose an additional risk of ignition for any loss of containment. SPIRIT SAFE All the condensed spirit passes through the Spirit Safe where it can be manually directed to appropriate run-down vessels by the stillman. The Low Wines from the first distillation are run into the Low Wines Vessel, the first part of the second distillation known as the Foreshots and the final part of the second distillation known as the Feints are run-down into respective vessels. The specific gravity and purity of the spirit are closely monitored by the stillman during the second distillation and only when the spirit has reached the appropriate specific gravity and purity is it run down into the wooden or steel Spirit Receivers. There are three main hazard potentials associated with the Spirit Safes:. Formation of vapour in the Spirit Safe due to loss of cooling in the Condensers. This has been discussed in the Condenser section above.. Build up of verdegree (copper oxide) in the rundown lines. Experience shows that a build up of verdegree (copper oxide) in the rundown lines from the safe to the receiving vessels is a gradual process over a number of years, but there is often no routine in place for cleaning of the pipe work. The worst affected lines are those for the Low Wines and Feints since the Middle Cut spirit is much cleaner. These copper oxide deposits can lead to line blockages and backup of liquid into the Safe resulting in failure of the glass window and loss of containment of liquid. The severity of the hazard depends on the percentage alcohol by volume and temperature. Although the Low Wines will be around 20 22% ABV at approximately 20 deg C, which is below its flash point of 38 deg C, the Feints is around 30% ABV with a 32 deg C flash point, and the Middle Cut spirit would be around 65% ABV with a flash point of around 20 deg C. Although any loss of containment could be contained within a Still House bund, a large volume of liquid may submerge the transfer pumps adding to the hazard potential.. Still overfill. Overfilling the stills can lead to liquid carry over in to the Spirit Safe, failure of the glass window and loss of containment. The most significant hazard would be the overfilling of a Spirit Still. Low Wines, Foreshots and Feints are used to charge these stills and the worst case scenario would be to overfill by the volume of the Low Wines Tank (typically 30,000 litres). There is also the additional possibility that liquid could carry over and also overfill the Foreshots Vessel, Feints Vessel and/or the Spirits Receiver. The Still House may well have a bundied area to contain a spill and even though the Low Wines liquid has a low alcohol content of 20 22% ABV, it is pre-heated to 45 50 deg C before filling. This is well above the flash point of 38 deg C (20% ABV) for ethanol vapour. If overfilling the Spirit Still resulted in a carry over through the safe to the Feints and Foreshots Vessels and/or Spirit Receiver this could result in a loss of containment with an even lower flash point temperature. HIGH LEVELS IN THE RUNDOWN VESSELS As described earlier, condensate from distillation is run down into different manually selected vessels depending on the actual stage of the distillation batch process. These vessels include Low Wines, Spirits, Foreshots and Feints and they are usually located in the Still House. Thus a high level can lead to overfilling and loss of containment if the distillation process fails to be shut down. Overfilling the Low Wines Vessel can result in a potential for loss of containment from a man door or dip point into the Still House. The Low Wines Vessel contains around 20 22% ABV and at around 20 deg C temperature it is well below its 38 deg C flash point which would be very hard to reach on the hottest Scottish summer day; so little safety risk. But, depending on whether there is a bund or one of sufficient capacity, there have been incidents where the volume of liquid exceeded the containment capacity to find its way into ordinary storm drains to cause significant pollution of the site burn. This environmental issue has been experienced by a number of distilleries. Overfilling the Spirit Receiver could also result in loss of containment through a man door or dip point into the Still House. Depending on how well the process is monitored, many tens of thousands of litres at 65% ABV and a flash point of 25 deg C could be discharged between operator visits. There is also the same environmental risk as the described for the Low Wines above. Overfilling the Feints vessel could also result in loss of containment of many thousands of litres into the Still House hours at an average of 30% ABV and with a 32 deg C flash point. There is also the same environmental risk as the described for the Low Wines and Spirits above. FILLING AND MATURATION STORAGE Spirit is pumped to the Filling Store from the Spirit Receiver. The colourless spirit is filled into oak casks to begin the maturation process and it is from the oak that the 4

whisky draws its colour. Cask filling is usually a manual process and there is a risk of small spillages of spirit at 65% ABV. By law Scotch Whisky must be matured for a minimum of 3 years, so the oak barrels are stacked in large warehouses to undergo this natural process during which a certain amount spirit vapour known as the angel s share is lost to the atmosphere. Lighting and electrical equipment in these warehouses must therefore comply with DSEAR regulations. However, distilleries that open to the public have many tens of thousands of visitors passing through some of their storage warehouses and these often have visual display equipment for the tourists and this has no DSEAR compliance. PROCESS CONTROL The method of process control depends on the size and age of a distillery. There are still many small and/or older distilleries that are entirely manual, but the industry has seen considerable automation with the introduction of process control systems (PCS) to reduce manning, increase efficiency and maintain consistent quality of spirit production. The introduction of PCS have brought their own issues since they tend to remove the continuous presence of the stillman from the Still House floor by placing him in a more isolated control and monitoring environment. Thus much of the continuous manual monitoring and adjustment is now superseded by automation, and this is fine providing there is sufficient regard to the ergonomics of the human/machine interface and a good understanding of the difference between control and safety functionality. Logical sequences for batching distillation such as still charge and discharging have also regularly been implemented in the basic control system without regard to the safety critical functionality of the elements involved. Unfortunately, from observations and studies made at four different distilleries it is apparent that PCS have often been installed with little understanding of basic control/ safety functionality segregation. Many operators have made a great deal of investment in automation to modernise their Still Houses but the unfortunate reality is that safety functionality has so regularly been implemented within the basic control system. There has been little appreciation that this compromises the safety integrity level (SIL) capability to,sil 1. On one site visited during 2006 the response of the PCS was found to be so slow that the control functionality was poor. But there was also a significant amount of safety functionality configured within the basic control that was firstly compromised by the PCS capability of, SIL 1, and secondly rendered totally ineffective by the slow response should there have ever been any demand. It is understandable that operators wish to bring the whisky industry into the 21 st century to maintain a competitive and cost effective approach to manufacturing, but the author strongly advises all operators of distilleries to review their hazards and undertake risk assessments in line with IEC 61511. SIMPLE REMEDIAL ACTIONS All operators need to identify the hazards and take necessary measures to reduce risk to as low as reasonably practicable (ALARP), but there are often simple solutions to reduce the risks associated with most of the major hazards and a few of these are outlined below. Process modification from direct heating by naked flame using gas burners or peat/coal to indirect heating using steam coils removes many hazards. Ensuring a secure and reliable source of cooling water would make major contributions to risk reduction. Where Tail Pipe venting is within the Still House, the simple plumbing of these to a high elevation externally will also make a very cost effective solution for reducing undesirable flammable vapour hazards. The introduction of simple maintenance routines to regularly check for the build up of copper oxide and other sediment carryover into still/condenser and safe/receiver run down lines would significantly reduce the risk of blockages and consequential loss of containment. High level alarms and trips on the various run down vessels to shut off distillation heat and reduce the risk of overfilling and loss of containment, and consideration of removing the vessels with the highest alcohol by volume percentages from inside the Still House would be even better. An introduction of cause and effect matrices for all automated shut down requirements would considerably help the understanding of the logic requirements. A review of the functionality configured into the basic process control systems, including sequence processing, to ensure appropriate segregation, and SIL determination of all trip and alarm related functions to ensure they can meet the criticality requirements. None of the above measures represent technical complexity but they do represent significant process integrity improvement. REFERENCES BSI: BS EN IEC 61511 1-3, 2004: Functional Safety Safety Instrumented Systems for the Process Industry Sector, 2004. HMSO Statutory Instruments 1999 No. 743. The Control of Major Accident Hazards Regulations 1999 (COMAH) - ISBN 0 11 082192 0. HMSO Statutory Instruments 2002: 2776: Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR) ISBN 011 042957 5. 5