IChemE SYMPOSIUM SERIES NO. 153 # 2007 Clive Timms

HAZARDS AND RELATED ISSUES IN THE WHISKY DISTILLATION INDUSTRY†

Clive Timms

Strathayr, Rhu-Na-Haven Road, Aboyne, Aberdeenshire, AB34 5JB; e-mail: clive.timms@assetintegrity.co.uk

The very traditional methods used in the whisky distillation process are fascinating to members of

the public as they do their tours around the delightful settings and sample the end products.

However, some recent incidents have highlighted that significant major accident hazard issues

exist within this process sector.

The traditional methods of using directly fired copper distillation vessels, venting of ethanol spirit

into unsafe areas, regular pipe and filter blockages and problems with securing the supply of cooling

water from Scottish burns, open up a whole raft of non conformance with respect to safety manage-

ment. Add to this the fact that many distilleries are open top the public, with as many as 60,000

people passing through every year, there are also significant societal risk implications.

Many distilleries have undergone process automation upgrades to improve productivity and

manpower efficiency, but they have failed to recognise their hazards and the need for risk reduction

using automated safeguarding. The focus has all too often been on control without any regard or

understanding about incorporating safety instrumented systems (SIS) into their upgrades.

This paper will draw upon the findings from Safety Integrity Level (SIL) determination

case studies to highlight some of the most significant issues and discuss the steps that have been

found necessary to overcome the major accident hazard issues that have been revealed. In many

cases simple basic and inexpensive modifications are all that has been required.

KEYWORDS: whisky, distillation, hazards, SIL

INTRODUCTIONThe traditional process of turning water into whisky or the‘amber nectar’ has changed little over hundreds of years,and whisky distilleries are a common feature of the Scottishlandscape. Often set in delightful glens in areas such asSpeyside they are an absolute delight to the hundreds ofthousands of visitors that tour them each year. There arearound 53 registered members of the Scotch WhiskyAssociation representing around 500 different brands, andfor anyone that does not like a ‘wee dram’ some of thedistilleries also make very fine gins.

Although the traditions of whisky making give a quaintand nostalgic first impression, a closer examination of theprocess reveals that some of the traditional methods used rep-resent a process with multiple hazards. For example, the useof directly fired copper distillation vessels, venting of spiritvapour into unsafe areas, regular pipe and filter blockagesand problems with securing the supply of cooling waterfrom Scottish burns (streams), open up a whole raft ofissues with respect to safety management. Add to this thefact that many distilleries are open top the public with tensof thousands of people passing through them every year,there are also significant societal risk implications.

Although many distilleries have undergone processautomation upgrades to improve productivity and man-power efficiency, the upgrades have often failed to recognisethe hazards and the possible need for risk reduction usingsafety instrumented functions (SIF). The focus has all toooften been on control without any regard or understandingabout SIF requirements and how they should be incorpor-

†# 2007 Clive Timms.

1

ated in safety instrumented systems (SIS) that are segregatedfrom basic control.

This paper will draw upon the findings from SafetyIntegrity Level (SIL) determination case studies in compli-ance with BS EN IEC 61511 (BSI, 2004) to highlight someof the most significant issues and indicate the steps that havebeen found necessary to overcome the major accidenthazard issues that have been revealed. In many cases onlysimple, basic and inexpensive modifications are requiredto resolve these problems.

HAZARDS IN THE PROCESSDistilleries are usually classed as top tier COMAH (HMSO,1999) sites due to the quantity of flammable spirit that isstored on site, but there are also a considerable number ofhazards in the actual whisky production process. Figure 1shows an overview of a SIL determination case study fora typical Still House. The unusually high SIL outcomes inthe Figure 1 distribution indicate an absence of fundamentalrisk reduction measures, but these can often be resolved bythe implementation of some very simple and cost effectivesolutions. The primary considerations are discussed at theend of the paper. The best way to identify the relatedhazards of whisky distillation is to take a step-by-stepwalk through the process which is shown in Figure 2.

GRIST MILLNearly all distilleries obtain dry malted, or germinated barleyfrom malting houses that specialise in this part of the process.

Figure 1. Typical still house SIL determination summary

IChemE SYMPOSIUM SERIES NO. 153 # 2007 Clive Timms

The dry malted barley is delivered to the grist mill where iscrushed by a series of four rollers into a coarse flour like materialcalled ‘Grist’. This helps the next stage of the process which isextraction of sugars from the barley. There are few process

Figure 2. The whisky

2

hazards associated with the grist mill apart from the creationof dust which is akin to flour dust and can be extremely flam-mable. Thus electrical equipment has to comply with DSEARregulations (HMSO, 2002). However, it was not uncommon

distillation process

IChemE SYMPOSIUM SERIES NO. 153 # 2007 Clive Timms

to find a real mishmash of compliant and non compliantelectrical equipment in all hazardous areas.

WASH TUNThe grist is transferred by an auger to mostly wooden WashTuns where it is mixed with hot water to dissolve the sugars,and this forms a sweet mix known as ‘Wort’.

WASHBACKSThe Wort is cooled and pumped into large wooden fermen-tation vessels called ‘Washbacks’. Here yeast is added toconvert the sugars into alcohol and 2–3 days of fermenta-tion produces a liquid called ‘wash’. Fermentation produceslarge quantities of carbon dioxide and the area needs to bewell ventilated to prevent hazardous build up. As part of adistillery tour, the public are often invited to look into thefermentation vessel inspection hatches, with caution, sincethe intoxicating aroma can cause instant dizziness.

POT STILLSOn completion of fermentation, the wash is transferred tothe traditional copper pot stills where it is heated torelease the alcohol as vapour. The use of copper stills isessential to the whisky process and the copper is sacrificiallyreleased gradually to the whisky batches. The Pot Stills forma two stage process with the first distillation of the Washtaking place in the Wash Still and the second distillation,of the condensed Low Wines output from the Wash Stills,in the Spirit Still. The first spirit produced during thesecond distillation at the beginning of a run is known asthe ‘Foreshots’ but this is too strong and pungent forkeeping, and it is during the mid point of the second distilla-tion, when the pure distillate is at 65–70% alcohol byvolume (ABV) content that the spirit is sent to maturation.This is known as the ‘Middle Cut’ and the liquid thatremains at the end of the second distillation is called‘Feints’ which are also very pungent.

There are a number of potential hazards in the distil-lation process and the main issues are as follows:

. Direct and indirect heating. Many of the older and moretraditional stills are direct fired by either peat/coal or gasburners, whilst more modern stills use indirect heatingsteam coils. Direct firing poses a significant hazard inthe event that there is any loss of containment of flam-mable vapour or liquid, and these are both present inmost areas of the whisky production process.

In addition directly fired gas burners introduce burnermanagement issues and the potential for hazardsassociated with gas leaks.

Stills that have steam coils are not exempt fromhazards since loss of control for the main steam valvecan lead to overheating with excessive vibration, andthis can lead to possible rupture and loss of containmentfrom the copper vessel. The worst case would be failureof a Spirit Still where a loss of containment of thousandsof litres at 30–32% ABV at a temperature of 50 deg Ccould result since the flash point is 32 deg C for this

3

ABV. In addition, the steam raising plant has all theusual burner management and steam pressure vesselhazards.

. Still implosion. The outlets from the top of the still arecalled ‘Tail Pipes’ and these gradually taper towardsthe vapour condensers. They have a two way vent mech-anism called a ‘Tail Pipe Vent’ and this is intended toprevent a vacuum implosion or an overpressure. Animplosion can occur if a vacuum is caused by batchcharging a hot still with cold liquid or discharging thestill liquid at the end of a batch run. The most hazardousimplosion is during the fill cycle since the loss of con-tainment from a reasonably large Spirit Still, forexample, could result in approximately 8,600 litres ofspillage at 50 deg C, which is above the flash point of32% ABV at 32 deg C. Implosion on still discharge isnot as hazardous as the majority of spirit vapour hasbeen driven off during the distillation batch process.

. Still overpressure due to blockages. The copper stills arenot designed to be pressure vessels but there are risks ofblockages in the still Tail Pipes due to build up of verde-gree (copper oxide) or sediment carry-over from thestill. Experience indicates that this build up is agradual process over a number of years but there isoften no routine cleaning of the pipe work. In someinstances the stillman was known to compound theproblem by banging the soft piping with a spanner to dis-lodge blockages, with the consequence that the piping isthen dented making for a more rapid build up sediment.

The Tail Pipe Vent can relieve pressure in the event ofblockages occurring. However, many of these Tail PipeVents have been traditionally installed so that they actu-ally vent into the still house. The purpose of this tra-ditional design was for the stillman to regularly checkfor vapour venting as an indication of blockage byplacing his hand underneath the vent.

Venting flammable vapour into the still house givesrise to considerable risk of ignition and explosionwhich is compounded when the stills are directly fired.The risk to on site personnel is not the only considerationfor distilleries that are open to the public since tens ofthousands of visitors pass through the still houses onthe Whisky Trail in any year.

Tail Pipe venting has been the cause of some fire inci-dents and many distilleries are changing the ventlocation to a high elevation outside of the Still House,and this is a basic, fairly inexpensive and very effectivesolution to a significant hazard potential.

CONDENSERSThe vapours released from the stills are condensed back toliquid by water cooled condensers which can be locatedinside and outside of the still house. Cooling water is criticalfor maintaining stability in the whisky distillation process,as with many other industries in the process sector, andyet the source of this utility is so often taken directly froma local burn (stream) that flows through the glen. Watercapacity of Scottish burns can fluctuate dramatically

IChemE SYMPOSIUM SERIES NO. 153 # 2007 Clive Timms

throughout the year and loss of cooling water is one of themost regular problems in whisky distillation. The waterlevel of a burn has a tendency to go low quite quicklyin the dryer summer months whilst fallen leaves canregularly cause blockages in the extraction pipe filters inthe autumn.

Loss of cooling water to the condensers can, and oftendoes, occur very rapidly resulting in the formation of vapourin the spirit safe which could cause failure of the glasswindow, and/or a build up of vapour pressure and ventingfrom the tail pipe vent. Either consequence can lead to a sig-nificant loss and build up of flammable vapour with a highchance of ignition. Even if the distillation heat can beremoved quickly, and this is not possible with coal firedstills, there will be sufficient residual heat to cause aproblem.

Stills operating with directly fired heaters also pose anadditional risk of ignition for any loss of containment.

SPIRIT SAFEAll the condensed spirit passes through the Spirit Safe whereit can be manually directed to appropriate run-down vesselsby the stillman. The Low Wines from the first distillation arerun into the Low Wines Vessel, the first part of the seconddistillation known as the ‘Foreshots’ and the final part ofthe second distillation known as the ‘Feints’ are run-downinto respective vessels. The specific gravity and purity ofthe spirit are closely monitored by the stillman during thesecond distillation and only when the spirit has reachedthe appropriate specific gravity and purity is it run downinto the wooden or steel Spirit Receivers.

There are three main hazard potentials associatedwith the Spirit Safes:

. Formation of vapour in the Spirit Safe due to loss ofcooling in the Condensers. This has been discussed inthe Condenser section above.

. Build up of verdegree (copper oxide) in the rundownlines. Experience shows that a build up of verdegree(copper oxide) in the rundown lines from the safe tothe receiving vessels is a gradual process over anumber of years, but there is often no routine in placefor cleaning of the pipe work. The worst affected linesare those for the Low Wines and Feints since theMiddle Cut spirit is much cleaner.

These copper oxide deposits can lead to lineblockages and backup of liquid into the Safe resultingin failure of the glass window and loss of containmentof liquid. The severity of the hazard depends on the per-centage alcohol by volume and temperature. Althoughthe Low Wines will be around 20–22% ABV at approxi-mately 20 deg C, which is below its flash point of 38 degC, the Feints is around 30% ABV with a 32 deg C flashpoint, and the Middle Cut spirit would be around 65%ABV with a flash point of around 20 deg C. Althoughany loss of containment could be contained within aStill House bund, a large volume of liquid may sub-merge the transfer pumps adding to the hazard potential.

4

. Still overfill. Overfilling the stills can lead to liquid carryover in to the Spirit Safe, failure of the glass window andloss of containment. The most significant hazard wouldbe the overfilling of a Spirit Still. Low Wines, Foreshotsand Feints are used to charge these stills and the worstcase scenario would be to overfill by the volume of theLow Wines Tank (typically 30,000 litres). There isalso the additional possibility that liquid could carryover and also overfill the Foreshots Vessel, FeintsVessel and/or the Spirits Receiver. The Still Housemay well have a bundied area to contain a spill andeven though the Low Wines liquid has a low alcoholcontent of 20–22% ABV, it is pre-heated to 45–50deg C before filling. This is well above the flash pointof 38 deg C (20% ABV) for ethanol vapour. If overfill-ing the Spirit Still resulted in a carry over through thesafe to the Feints and Foreshots Vessels and/or SpiritReceiver this could result in a loss of containmentwith an even lower flash point temperature.

HIGH LEVELS IN THE RUNDOWN VESSELSAs described earlier, condensate from distillation is rundown into different manually selected vessels dependingon the actual stage of the distillation batch process. Thesevessels include Low Wines, Spirits, Foreshots and Feintsand they are usually located in the Still House. Thus ahigh level can lead to overfilling and loss of containmentif the distillation process fails to be shut down.

Overfilling the Low Wines Vessel can result in apotential for loss of containment from a man door or dippoint into the Still House. The Low Wines Vessel containsaround 20–22% ABV and at around 20 deg C temperatureit is well below its 38 deg C flash point which would bevery hard to reach on the hottest Scottish summer day; solittle safety risk. But, depending on whether there is abund or one of sufficient capacity, there have been incidentswhere the volume of liquid exceeded the containmentcapacity to find its way into ordinary storm drains to causesignificant pollution of the site burn. This environmentalissue has been experienced by a number of distilleries.

Overfilling the Spirit Receiver could also result in lossof containment through a man door or dip point into the StillHouse. Depending on how well the process is monitored,many tens of thousands of litres at 65% ABV and a flashpoint of 25 deg C could be discharged between operatorvisits. There is also the same environmental risk as thedescribed for the Low Wines above.

Overfilling the Feints vessel could also result in lossof containment of many thousands of litres into the StillHouse hours at an average of 30% ABV and with a 32deg C flash point. There is also the same environmentalrisk as the described for the Low Wines and Spirits above.

FILLING AND MATURATION STORAGESpirit is pumped to the Filling Store from the Spirit Recei-ver. The colourless spirit is filled into oak casks to beginthe maturation process and it is from the oak that the

IChemE SYMPOSIUM SERIES NO. 153 # 2007 Clive Timms

whisky draws its colour. Cask filling is usually a manualprocess and there is a risk of small spillages of spirit at65% ABV.

By law Scotch Whisky must be matured for aminimum of 3 years, so the oak barrels are stacked inlarge warehouses to undergo this natural process duringwhich a certain amount spirit vapour known as ‘theangel’s share’ is lost to the atmosphere. Lighting and electri-cal equipment in these warehouses must therefore complywith DSEAR regulations. However, distilleries that opento the public have many tens of thousands of visitorspassing through some of their storage warehouses andthese often have visual display equipment for the touristsand this has no DSEAR compliance.

PROCESS CONTROLThe method of process control depends on the size and ageof a distillery. There are still many small and/or older dis-tilleries that are entirely manual, but the industry has seenconsiderable automation with the introduction of processcontrol systems (PCS) to reduce manning, increase effi-ciency and maintain consistent quality of spirit production.

The introduction of PCS have brought their ownissues since they tend to remove the continuous presenceof the stillman from the Still House floor by placing himin a more isolated control and monitoring environment.Thus much of the continuous manual monitoring and adjust-ment is now superseded by automation, and this is fineproviding there is sufficient regard to the ergonomics ofthe human/machine interface and a good understanding ofthe difference between control and safety functionality.

Logical sequences for batching distillation such asstill charge and discharging have also regularly beenimplemented in the basic control system without regard tothe safety critical functionality of the elements involved.

Unfortunately, from observations and studies made atfour different distilleries it is apparent that PCS have oftenbeen installed with little understanding of basic control/safety functionality segregation. Many operators havemade a great deal of investment in automation to modernisetheir Still Houses but the unfortunate reality is that safetyfunctionality has so regularly been implemented withinthe basic control system. There has been little appreciationthat this compromises the safety integrity level (SIL)capability to ,SIL 1. On one site visited during 2006 theresponse of the PCS was found to be so slow that thecontrol functionality was poor. But there was also a signifi-cant amount of safety functionality configured within thebasic control that was firstly compromised by the PCS capa-bility of ,SIL 1, and secondly rendered totally ineffectiveby the slow response should there have ever been anydemand.

It is understandable that operators wish to bringthe whisky industry into the 21st century to maintain a

5

competitive and cost effective approach to manufacturing,but the author strongly advises all operators of distilleriesto review their hazards and undertake risk assessments inline with IEC 61511.

SIMPLE REMEDIAL ACTIONSAll operators need to identify the hazards and take necessarymeasures to reduce risk to as low as reasonably practicable(ALARP), but there are often simple solutions to reduce therisks associated with most of the major hazards and a few ofthese are outlined below.

Process modification from direct heating by nakedflame using gas burners or peat/coal to indirect heatingusing steam coils removes many hazards. Ensuring asecure and reliable source of cooling water would makemajor contributions to risk reduction. Where Tail Pipeventing is within the Still House, the simple plumbing ofthese to a high elevation externally will also make a verycost effective solution for reducing undesirable flammablevapour hazards.

The introduction of simple maintenance routines toregularly check for the build up of copper oxide and othersediment carryover into still/condenser and safe/receiverrun down lines would significantly reduce the risk ofblockages and consequential loss of containment.

High level alarms and trips on the various run downvessels to shut off distillation heat and reduce the risk ofoverfilling and loss of containment, and consideration ofremoving the vessels with the highest alcohol by volumepercentages from inside the Still House would be evenbetter.

An introduction of cause and effect matrices for allautomated shut down requirements would considerablyhelp the understanding of the logic requirements.

A review of the functionality configured into the basicprocess control systems, including sequence processing, toensure appropriate segregation, and SIL determination ofall trip and alarm related functions to ensure they canmeet the criticality requirements.

None of the above measures represent technical com-plexity but they do represent significant process integrityimprovement.

REFERENCESBSI: BS EN IEC 61511 1-3, 2004: ‘Functional Safety – Safety

Instrumented Systems for the Process Industry Sector’, 2004.

HMSO Statutory Instruments 1999 No. 743. ‘The Control of

Major Accident Hazards Regulations 1999 (COMAH)’ -

ISBN 0 11 082192 0.

HMSO Statutory Instruments 2002: 2776: ‘Dangerous

Substances and Explosive Atmospheres Regulations 2002

(DSEAR)’ – ISBN 011 042957 5.