19 / 64
Local Fuel – Shoreham Oil Terminal
Gasoline Ship Import – Layers of Protection Analysis
P & I Design Ltd
DOCUMENT NO: LF364002_RPT
2 Reed Street, Thornaby, UK, TS17 7AF
ISSUE: E DATE: 30.07.15
Tel: + 44 (0)1642 617444
PAGE 19 OF 38
Fax: + 44 (0)1642 616447
www.pidesign.co.uk5
GASOLINE IMPORT REVIEW
5.1
Storage Facility
The process involves the importation of Gasoline by pipeline to one of two gasoline
storage tanks. Import is from ship via a dedicated pipeline system. The receiving tank is
selected by the operator and only 1 tank will be selected for import.
The terminal controls the manifold route selection. The manifold has remotely operated
valves. There are two jetty loading arms with valve splits.
The complete pipeline system
runs through the confines of the terminal.
The Gasoline tanks are fitted with an automatic tank gauge (ATG), which measures the
level in the tank, by liquid height. There are prior batch fill level alerts which warn the
operator that the predicted end of transfer is approaching, these are at 5 minute intervals
from 15 minutes before the predicted transfer completion. There is a normal fill level alert
and there are high and high high alarms, these are audible alarms within the control room
and are repeated at the jetty (on an alarm panel).
There is an independent high high level alarm, from separate high high level switches, hard
wired to the dual redundancy alarm PLC in the control room and fed to the UCOS system
as well as the mimic panel. This alarm is repeated through the PLC out to the jetty alarm
panel. The independent high high jetty alarm is continually active. There is no link
between the dual redundancy alarm PLC and the valve control system and the ATG
system. No extra credit has been applied for this high alarm within the LOPA. There is also
an independent high integrity Safety Instrument System that operates by closing a common
gasoline import valve in the event of a high level in any of the gasoline storage tanks.
In the event of a power failure, the terminal operator will contact the jetty to stop transfer.
The SCADA/UCOS system and mimic panel are on a UPS system however the alarm PLC
is currently not powered through the PLC so the high high level alarms will not operate.
The level monitoring on the tanks will fail. The common gasoline import valve will fail
closed stopping any receipt of gasoline.
All tank independent alarms will be generated on the SCADA.
A local loss of power to the alarm PLC would result in a failure of the independent high
high alarms and this would not be readily apparent to the operator although all tank
independent alarms will be generated on the SCADA.