78 / 101
Local Fuel plc - Shoreham Oil Terminal
Safety Instrument System Functional Safety Assessment Stage 5
P & I Design Ltd
DOCUMENT NO: LF364100_RPT
2 Reed Street, Thornaby, UK, TS17 7AF
ISSUE: B DATE: 07.06.2016
Tel: + 44 (0)1642 617444
PAGE 29 OF 51
Fax: + 44 (0)1642 616447
www.pidesign.co.ukFollowing the SAT a proof test was conducted on the SIS on 11
th
February 2016. The proof
test utilised the following documentation:
LF364001_HDR Handover certificate
LF364011_RPT SIS LFS-SIS1 Documentation Verification
LF364012_RPT SIS LFS-SIS1 Shutdown Conditions Proof Testing
The following were noted from the testing:
A coms cable showing SWA was removed as it was no longer used.
Closing time not in specified limits, this was reviewed and revised in the
appropriate documentation and safety plan.
LF364013_RPT SIS LFS-SIS1 Operation, Maintenance and Modification Lifecycle
LF364002_SCH controlled copy Instrument Schedule
LF364003_SCH controlled copy Cause & Affect Matrix
5.6
Operating, maintenance and emergency procedures
During the installation phase, operators are to be made familiar of the changes to the SIS. It
is not envisaged that any additional training, other than on the job familiarisation will be
required.
Action 2 details that Local Fuel have revised and created new procedures utilising an
external consultant.
5.7
Suitability and Performance of the SIS
5.7.1 Description of Operation
Existing Gasoline Tanks
The SIS is a combination of four (prior to Marine Gas Oil modification) SIF’s albeit they are
interactive with each other in that operation of any sensor results in the final element going to
its safe state. In addition there are eleven other tanks which are fitted with a similar type of
SIL rated sensor and utilise the same logic solver albeit just to provide an alarm. The
description below just relates to the SIF’s on the gasoline tanks, the other tanks utilise the
same technique, however, there is no automatic final element, the operator is warned of
operation of a high high level by annunciation and on the SCADA system, he is then required
to take manual intervention. Annunciation and SCADA repeats are also provided for Tanks
1, 2, 3 & 4.
Each of the four gasoline Tank sensors is connected to a trip amplifier which detects for a
change in mA signal from the sensor, although the device is in effect a switch it provides an
analog output equating to 8mA = Alarm, 16mA = Normal, 22mA = Fault, the trip amplifier is
fitted with two relay output setpoints one at 17mA rising and the other at 15mA falling. Hence,
if the sensor output is not above 15mA and below 17mA then the corresponding relay will
open circuit. A 24Vdc feed is fed into the trip amplifier and through both relay contacts, the
output from the trip amplifier is wired to the coil of a further safety relay via a safety relay
contacts which are operated by the site ESD system. The sensor is fitted with an external test
facility to simulate high level.