81 / 101
Local Fuel plc - Shoreham Oil Terminal
Safety Instrument System Functional Safety Assessment Stage 5
P & I Design Ltd
DOCUMENT NO: LF364100_RPT
2 Reed Street, Thornaby, UK, TS17 7AF
ISSUE: B DATE: 07.06.2016
Tel: + 44 (0)1642 617444
PAGE 32 OF 51
Fax: + 44 (0)1642 616447
www.pidesign.co.ukThe SIS sensors are all displayed on the HMI, but again this is indication only and cannot
interfere with the SIF.
Maintenance Issues:
No issues have been identified.
Functional Capability:
The functional capability of the SIS has not been affected by this modification. The required
protection remains as defined, in that any high level on Tanks 1, 2,3 & 4 will automatically
close the jetty import pipeline valve XV162.
5.8
Training
As stated previously SIS awareness training has been conducted for all operational staff of
Local Fuel plc.
5.9
Further Safety Assessments
Other than for any FSA 5’s due to modification, which will be conducted as and when, it is
not expected to perform a further FSA 4 for approximately three years when Local Fuel plc
will have approximately five years of Terminal ownership and experience in operation of these
systems.
5.10 Compliance to BS EN 61511
The SIS, in general, is based upon the requirements of the BS EN 61511 lifecycle. Additional
lifecycle documentation has been created and updated as a result of this FSA, to assist in proof
testing and management of functional safety of the SIS. The PFD of the installed system
complies to the requirements of the LOPA and HFT of BS EN 61511, by the utilisation of SIL
certified components.
5.11 Separate Hazards
The FSA discussed if any additional hazards were created by having the SIS. The only
identified hazard is the un-expected closure of the import valve resulting in an increased back
pressure to the ship. This is a know issue and the valve is specified to close slowly, typically
90 seconds, furthermore, a siren is provided at the jetty to inform the ship that the SIS has
activated and the valve is closing.
5.12 Other Protection Layers
Within the LOPA a number of other protection layers, mitigation layers, enabling events and
cross checks were included that were not part of the Safety Instrumented System but need to
be operated and maintained as they are fundamental to the calculated SIL of the SIS. It is
considered important that these non SIS protection layers are monitored to ensure they are
independent, effective and auditable.