27 / 443
Local Fuel – Shoreham Oil Terminal
Safety Requirement Specification
P & I Design Ltd
DOCUMENT NO: LF364005_RPT
2 Reed Street, Thornaby, UK, TS17 7AF
ISSUE:C DATE: 14.08.15
Tel: + 44 (0)1642 617444
PAGE 11 OF 19
Fax: + 44 (0)1642 616447
www.pidesign.co.uk3
GENERAL REQUIREMENTS
The following are general requirements specific to this SIS for prevention of tank overfill.
Information regarding this SIS, i.e. valve closing against a third party must be communicated
to the third party.
All Safety Instrument Functions shall be designed as follows:
De-energise to trip.
Shall operate as a low demand mode system with demands placed on the system from
operations no more frequently than once every ten years.
In accordance with all the requirements laid down in the standard BS EN 61511.
The response time shall be determined for each storage tank with consideration given to
pipeline surge and tank ullage capacity.
There shall be no conceivable individually safe process states which, when occurring
concurrently, can create a separate hazard.
There shall be no dangerous combinations of output states of the SIS.
Auto Reset of the final element shall not be possible.
On all tanks, the high level sensors shall have fault detection and diagnostics.
Dominant failure modes of any device shall be to the safe state. The safe state for tanks 1,
& 3 is with the common, gasoline pipeline import valve closed and no flow into the gasoline
tanks.
To carry out its design function on loss of electric power.
Mean time to restore shall be 24 hours or less. The normal mode of operation is batch filling
from a pipeline. Maintenance of the SIS can be carried out when import is not in operation
and no additional safety instrumented functions are envisaged. The gasoline operations are
on a batch basis and in the event of failure, operations will cease until the Safety
Instrumented System is operationally restored. There are no specific start up and shutdown
requirement for the SIF.
The proof testing philosophy will be an annual end to end test with a simulated high level
derived from the level switch. The switch cannot be fixed in the override position. Each
level switch probe will be wet tested at a maximum interval of 5 years.
There are no additional SIFs to support abnormal modes of operation (Start-up,
maintenance, testing etc.)
Maximum Spurious Trip rate shall be less than 1 in 10 years.