sis safety requirements specification specific part · damage the line from pig receiver to slug...

D:\Daten\Safety Training\Schulung Prozess\SRS_Detail.doc

PAGE 1 OF 38

Prepared

Checked

Approved

Statoil Rev. Code

Linde Version

Status

Date

Description

ORIGINATOR

COMPANY

TITLE

SIS Safety Requirements Specification Specific Part

DOCUMENT NUMBER

System/ Area 11/0000

DFO

E066-AB-S-SD-0009.011 B

Project No.

Orig Code

Area System

Disc Code

Doc. Type

Seq. No.

Statoil Rev.Code

´

of 38 SIS Safety Requirement Specification Specific Part

Rev.date :


11-PT-1100 A/B/C (high presure)....................................................................................4

11-PT-1100 (pressure low)..............................................................................................5

11PDT1168 (previous 1095) ...........................................................................................6

11PT1026 A/B/C .............................................................................................................7

11PT1053 A/B/C .............................................................................................................8

11PDT1116 .....................................................................................................................9

11PDT1080 ...................................................................................................................10

11PDT1153 (previous 1081) .........................................................................................11

11PDT1057 ...................................................................................................................12

11PDT1056 ...................................................................................................................13

11LT1068 A/B/C............................................................................................................14

11LT1069 A/B/C............................................................................................................15

11LT1081D (previous 11LT1085 ) ................................................................................16

11LT1082D (previous 11LT1086 ) ................................................................................17

11LT1083 (previous 11LDT1087) .................................................................................18

11LT1083 ......................................................................................................................19

11LT1084 (previous 11LDT1088) .................................................................................20

11LT1084 ......................................................................................................................21

11LT1083 (previous 11LDT1089) .................................................................................22

11LT1084 (previous 11LDT1090) .................................................................................23

11LT1083 (previous 1091) ............................................................................................24

11LT1084 (previous 1092) ............................................................................................25

11PDT1109 ...................................................................................................................26

11PDT1023 ...................................................................................................................27

11PDT1121 ...................................................................................................................28

11PDT1151 ...................................................................................................................29

11PDT1055 ...................................................................................................................30

11PDT1024 ...................................................................................................................31

11PDT1037 ...................................................................................................................32


Rev.date :


11PDT1038 ...................................................................................................................33

11PT1138 A/B ...............................................................................................................34

11PT1139 A/B ...............................................................................................................35

11TT1181......................................................................................................................36

11PDT1014 ...................................................................................................................37

11ZSL1007....................................................................................................................38


Rev.date :


Tag 11-PT-1100 A/B/C (high pressure) voting 2 out of 3

Process Unit: 11 inlet facilities P+ID no.: 11-PE-1001-001

Equipment under control pipeline Safe state of the process no packing of pipeline Protected system environment (flaring) and operation Description of the SIS function prevent pipeline packing and subsequent flaring Description of mode of operation of the plant for which the SIS is required

Setpoint Description of SIS Output Action (including force manual close signal to ensure safe state of process unit)

Response time of final element

H HH 120 barg closing the subsea wing valve L LL

SIL allocation (Reason for Selection of Each Risk Parameter) based on "Risk Matrix for HSE and Assets" E066-AB-S-SG-0002 Consequence to (without SIF)

Description / Reason

Personnel 1 no impact Exposure Time Risk

-

Environment 2 Flaring for more less than 1 week including depressuring the pipeline and start-up of the plant. Assets: Equipment / Production Downtime

2 packing the pipeline, when the inlet to the LNG onshore plant is closed. production downtime of main product is less than 1 week

Averting of hazard

yes Operator interaction is possible because packing of pipeline is a slow process. There is sufficient indication that the inlet is closed. ESD has position alarm, 11-PSHH-1026 and 11-PSHH-1053 gives alarm. All gives 1 IPL

Frequency/ Demand Rate

3 Closing the ESD beach valve, ESD inlet at slugcatcher and/or the HIPPS valves

Remarks:

Safety Integrity Level (SIL) 0 Asset Integrity Level (AIL) 0 Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS

if not otherwise stated, refer to Safety Requirements Specification General Part

Bypass requirements Mean Time to Repair MTTR Additional safety instrumented functions to support special operational cases (e.g. start-up, stand-by, shutdown etc.).

revealed failure (spurious trip) : Review date : 29/01/2003


Rev.date :


Tag 11-PT-1100 (pressure low) voting 1 out of 1

Process Unit: main feed gas pipeline P+ID no.: 11-PE-1001-001

Equipment under control pipeline Safe state of the process shut-down all Xmas tree valves subsea and depressurize the pipeline (via process and later via flare) Protected system environment sea and atm. Description of the SIS function leak detection

prevent major leaks of gas/liquid entering the sea in case of a rupture Description of mode of operation of the plant for which the SIS is required

rupture of main feed gas pipeline



HH L LL 50 barg

(35 barg) 1) a) automatic action: close sub sea wells b) operator action as follows: depressurize the pipeline (via process and later via flare e.g. close the main feed gas control valve unit 12 or the ESD outlet valves at the slugcatcher and finally open the BDV at the slugcatcher by remote manual interaction)



Personnel 5 if major vapor cloud occurs, personnel on the sea may be exposed Exposure Time Risk

0.1 low exposure time risk

Environment 5 major leak in the flow line and /or connectors into the sea Assets: Equipment / Production Downtime

5 loss of reputation loss of main production

Averting of hazard

yes

yes yes

1. deviation of several pressure indicators (this well and other wells) and flow indication subsea control system (PCDA) is dual (deviation alarms are available) leak detection possible via the offshore flow measurement including back-up, onshore flow measurement,. finally operator interaction (e.g. ESD closing all valves) is possible. (1 IPL) 2. there is sufficient experience in operating and maintenance of pipelines, proper material selection and the endangered part of pipeline is trenched. (1 IPL) subsea 18-UT 1125 B (pressure low) (1IPL)


1 major leak is expected to happen less than once in 20 to 100 years, which is very conservative consideration

Remarks: Team agreed on an alarm only and have operator interaction. Verification by Statoil will be done. Comparison with other plant needs to be done.

Safety Integrity Level (SIL) 0 Asset Integrity Level (AIL) - Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part Manual shutdown possibility operator interaction to activate the ESD system is required. Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS



1) During initial start-up of pipeline the set point needs to be lowered to 35 barg. (comment from HAZOP team recommendation 720.)

revealed failure (spurious trip) : Review date : 29/01/2003


Rev.date :


Tag 11PDT1168 (previous 1095) voting 1 out of 1

Process Unit: 11 Slugcatcher and Pigtrap P+ID no.: 11-PE-1001-001

Equipment under control ESD-Valve 11ESV1001 Safe state of the process ensure low pressure difference before ESD-Valve is opened. Protected system Pig receiver and slug catcher and connected piping Description of the SIS function avoid pressure shock and connected piping Description of mode of operation of the plant for which the SIS is required

all cases defined in E066-AB-P-LE-0001 "Operational Design Scenarios of Snøhvit Feed for Hammerfest LNG Plant", as well as start-up, shutdown, off-spec. case.



H 1 barg 1) inhibit to open ESD-Valve HH L LL

SIL allocation (Reason for Selection of Each Risk Parameter) based on "Risk Matrix for HSE and Assets" E066-AB-S-SG-0002 Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS.

Consequence to (without SIF)


Personnel (4)

Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Release at Flanges

Exposure Time Risk

(0.1)

Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Operator is present at the ESD valve, but leakage further and thus not exposed

Environment Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Assets: Equipment / Production Downtime

(4)

Damage the line from pig receiver to slug catcher due to pressure shock, resulting into leakage Damage to both slug catchers at the same time

Averting of hazard

(Yes

)

Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. prior to opening of ESD valve after a pipeline shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency by one step. Closing the ESD valve is not seen as an option, because only limiting the consequences.


(1) (2)

Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Pig receiver open and high pressure upstream the valve Operator failure at restart of pipeline at high pressure

Remarks: The ranking is done to compare the fault tree analysis of the HIPPS. The same range of PFD is reached.




Revealed failure : at high differential pressure trip shall not open the valve, if it is closed at high differential pressure trip shall not close the valve, if it is open, Thus no high availability is necessary Review date : 26/09/2002


Rev.date :


Tag 11PT1026 A/B/C voting 2 out of 3


Equipment under control Transfer Line from ESD Beach Valve to Slug catcher Safe state of the process Pressure Control Protected system Slug catcher Description of the SIS function Prevent overpressure of the slug catcher Description of mode of operation of the plant for which the SIS is required




H HH 120 barg close ESD-Valve upstream Pig receiver L LL




Personnel Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Exposure Time Risk

Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS.


Overpressurise slug catcher ; above the burst pressure and finally damage to slug catcher . This is covered by the safety criteria used in the HIPPS study.

Averting of hazard




Remarks: According to HIPPS study, SIL 1 was sufficient, a SIL 2 can be reached without additional cost and team agreed for AIL2 , because there is no impact

Safety Integrity Level (SIL) 2 Asset Integrity Level (AIL) 2 Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part

stroke test is sufficient, no leak test Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS


Bypass requirements Repressurazation Bypass required at ESD-Valve, which is LC Mean Time to Repair MTTR Additional safety instrumented functions to support special operational cases (e.g. start-up, stand-by, shutdown etc.).

revealed failure (spurious trip) : trip of plant and pipeline and stop of main production thus high availability is required Review date : 26/9/2002


Rev.date :


Tag 11PT1053 A/B/C voting 2 out of 3


Equipment under control Transfer Line from ESD Beach Valve to Slug catcher Safe state of the process Pressure Control Protected system Slug catcher Description of the SIS function Prevent overpressure of the slug catcher Description of mode of operation of the plant for which the SIS is required




H HH 125 barg close HIPPS valve downstream Pig receiver L LL




Personnel Refer to E066-AB-S-RE-0018 SIL Allocation for HIPPS and PSV, as SIF is part of HIPPS. Exposure Time Risk



Overpressurise slug catcher ; above the burst pressure and finally damage to slug catcher . This is covered by the safety criteria used in the HIPPS study.

Averting of hazard




Remarks: According to HIPPS study, SIL 2 was required and team agreed for AIL2 , because there is no impact on cost

Safety Integrity Level (SIL) 2 Asset Integrity Level (AIL) 2 Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval 3 times per year / Leak test shall be done acoustically. Two end flanges at the HIPPS are provided to

be able to remove one HIPPS (which is leaking) and operate on the other HIPPS. To set the end flange, depressuring of the pipe section is required, but quick restart is possible.

Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS


Bypass requirements 3" bypass for pressurisation with locking device full flow testing bypass is equipped with HIPPS

Mean Time to Repair MTTR Additional safety instrumented functions to support special operational cases (e.g. start-up, stand-by, shutdown etc.).

revealed failure (spurious trip) : trip of plant and pipeline and stop of main production thus high availability is required Review date : 26/9/2002


Rev.date :


Tag 11PDT1116 voting 1 out of 1


Equipment under control 11-QSV-1053 A/B Safe state of the process ensure low pressure difference before QSV valves are opened. Protected system slug catcher and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required




H 1 barg 1) inhibit to open QSV-Valves HH L LL



Personnel 4 possible leakage of gaseous HC at flange connections no full rupture is expected Exposure Time Risk

1 no credit is taken for exposure time risk

Environment 2 Flaring for restart Assets: Equipment / Production Downtime

3 3

damage to piping and to two slug catchers due to pressure shock ; leakage at flanges downtime more than one week

Averting of hazard

yes prior to opening of QSV valve after activation the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step


1 high differential pressure is given only after activation of HIPPS

Remarks: 1) pressure A must not be higher than 1 bar than pressure B

Safety Integrity Level (SIL) 1 Asset Integrity Level (AIL) - Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS



Revealed failure : at high differential pressure trip shall not open the valve, if it is closed at high differential pressure trip shall not close the valve, if it is open. Thus no high availability is necessary Review date : 26/09/2002


Rev.date :




Equipment under control 11-ESV-1065 Safe state of the process ensure low pressure difference before ESV valves are opened. Protected system slug catcher and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required




H 1 barg 1) inhibit to open ESV-Valves HH L LL



Personnel 4 Possible leakage of gaseous HC at flange connections no full rupture is expected Exposure Time Risk



3 3

Damage to piping and to two slug catchers due to pressure shock ; leakage at flanges Downtime more than one week

Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step


2 High differential pressure is given only after shutdown







Rev.date :


Tag 11PDT1153 (previous 1081) voting 1 out of 1












3 3

Damage to piping and to two slug catchers due to pressure shock ; leakage at flanges Downtime more than one week

Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step







Revealed failure : at high differential pressure trip shall not open the valve, if it is closed at high differential pressure trip shall not close the valve, if it is open. Thus no high availability is necessary Review date : 26/09/2002 (number changed 15.20.03)


Rev.date :














3 3

Damage to piping and to one slug catcher due to pressure shock ; leakage at flanges Downtime more than one week

Averting of hazard

yes Prior to opening of ESV valve after emergency depressurisation the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step


1 High differential pressure is given only after emergency depressurisation of one section of the slug catcher

Remarks: 1) pressure A must not be higher than 1 bar than pressure B and the opposite way (intermediate valve)






Rev.date :


Tag 11LT1068 A/B/C voting 2 out of 3


Equipment under control 11-VL-101A Safe state of the process Level Control Protected system Downstream feed gas system Description of the SIS function Prevent overfilling of 11-VL-101A and liquid carry-over to LNG process Description of mode of operation of the plant for which the SIS is required




H HH 1) mm Close ESD-valve at the inlet - L LL



Personnel 4 Overfilling of slugcatcher during pigging and releasing the liquid to flare via the safety valves, which are designed for vapour. Risk of serious leaks and risk of damage to flare system

Exposure Time Risk

1 Not taken into account

Environment 2 Flaring at restart Assets: Equipment / Production Downtime

3

Liquid condensate , excluding MEG/H20, carry-over to filter separator 12-CB-101. Resulting in high pressure drop over filter separator with damage of internals. Finally liquid carry-over to C02 wash column, resulting in foaming. Main production out of service, more than 1 week

Averting of hazard

yes Both slugcatchers work in parallel; if one LSHH fails, the other LSHH will still give an alarm and the operator has sufficient time to interact (slow process)


1 2

Personnel : Volume of max. slug is less than volume in slugcatcher, according to pipeline simulations Asset : Liquid carry-over due to operation close to HHlevel

Remarks: 1) Refer Mechanical Data Sheet




The two block valves in the equalisation line must be LO locked open to ensure that the instrument will work.

revealed failure (spurious trip) : closure of the inlet of one slug-catcher, which is designed for 100%, but more risk of carry-over to downstream system. High availability is required. Review date : 02/04/2003


Rev.date :


Tag 11LT1069 A/B/C voting 2 out of 3


Equipment under control 11-VL-101B Safe state of the process Level Control Protected system Downstream feed gas system Description of the SIS function Prevent overfilling of 11-VL-101B and liquid carry-over to LNG process Description of mode of operation of the plant for which the SIS is required




H HH 1) mm Close ESD-valve at the inlet - L LL



Personnel 4 Overfilling of slugcatcher during pigging and releasing the liquid to flare via the safety valves, which are designed for vapour. Risk of serious leaks and risk of damage to flare system

Exposure Time Risk

1 Not taken into account


3


Averting of hazard

yes Both slugcatchers work in parallel; if one LSHH fails, the other LSHH will still give an alarm and the operator has sufficient time to interact (slow process)


1 2

Personnel : Volume of max. slug is less than volume in slugcatcher, according to pipeline simulations Asset : Liquid carry-over due to operation close to HHlevel





The two block valves in the equalisation line must be LO locked open to ensure that the instrument will work.

revealed failure (spurious trip) : closure of the inlet of one slug-catcher, which is designed for 100%, but more risk of carry-over to downstream system. High availability is required. Review date : 02/04/2003


Rev.date :


Tag 11LT1081D (previous 11LT1085 ) voting 1 out of 1


Equipment under control 11-VL-101A Safe state of the process Level Control Protected system Downstream condensate system Description of the SIS function Prevent gas breakthrough into condensate system Description of mode of operation of the plant for which the SIS is required




H HH - LL 1) mm Close HV valves in upper condensate draw off line (4 valves) LLL 1) mm Close ESD valves in the common line



Personnel 5 Gas breakthrough results in overpressurisation of 12-VA-101; exceeding burst pressure Exposure Time Risk

NA

Environment 2 Flaring more > 1 day (start-up) Assets: Equipment / Production Downtime

5 3 2

Gas breakthrough into condensate separator 12-VA-101 downtime of side product >1 week and downtime of main product >1week

damage of internals of condensate separator and of filter 11-CA-101 (but spare is provided) Averting of hazard

yes Asset damage of interals: PSHH in the 12-VA-101, acting on 11-ESV-1072 (1 IPL) Personnel: Safety valves are designed for the scenario ( 3 IPL’s, reducing the consequence)


2 control loop failure or operator failure (selector failure)





revealed failure (spurious trip) : Unwanted closure of the flow to the condensate system. Storage in slugcatcher is possible. No high availability is necessary. Review date : 02.04.2003


Rev.date :


Tag 11LT1082D (previous 11LT1086 ) voting 1 out of 1


Equipment under control 11-VL-101B Safe state of the process Level Control Protected system Downstream condensate system Description of the SIS function Prevent gas breakthrough into condensate system Description of mode of operation of the plant for which the SIS is required




H HH - LL 1) mm Close HV valves in upper condensate draw off line (4 valves) LLL 1) mm Close ESD valves in the common line




NA


5 3 2

Gas breakthrough into condensate separator 12-VA-101 downtime of side product >1 week and downtime of main product >1week

damage of internals of condensate separator and of filter 11-CA-101 (but spare is provided) Averting of hazard

yes Asset damage of interals: PSHH in the 12-VA-101, acting on 11-ESV-1073 (1 IPL) Personnel: Safety valves are designed for the scenario ( 3 IPL’s, reducing the consequence)









Rev.date :


Tag 11LT1083 (previous 11LDT1087) voting 1 out of 1


Equipment under control 11-VL-101A Safe state of the process Level Control Protected system Downstream condensate system Description of the SIS function Prevent MEG/H20 into condensate system Description of mode of operation of the plant for which the SIS is required




HHH 1100 mm Close inlet ESD valve to slugcatcher HH 1) mm Alarm if condensate valve is not closed H 1) mm Close HV valves in condensate draw off line (4 valves) - LL



Personnel 1 No impact, Exposure Time Risk

NA


2 2

MEG/H20 into condensate separator 12-VA-101, which can then be sent to the MEG system; operational upset fouling of 20-HA-101, which needs cleaning : Downtime of side product >1 day, less than 1 week and downtime of main product > 1 day, as condensate can be stored in slugcatcher, but storage capacity is limited

Averting of hazard

yes Asset : 12-LDT-1084 and 12-LDT-1058 give alarm



Remarks: 1) Refer to PID 11-PE-1002-007 and Mechanical Data Sheet 2) 11LT1083 B or A can be used as control. When one is selected as control the other must be used as trip signal.

Control and trip signal must be independent.






Rev.date :


Tag 11LT1083 voting 1 out of 1


Equipment under control 11-VL-101A Safe state of the process Level Control Protected system slugcatcher Description of the SIS function Prevent overfilling of stand-pipe for level measurement with MEG while slugcatcher is filled with

condensate. Prevent wrong level measurement. Description of mode of operation of the plant for which the SIS is required




HHH 1100 mm Close inlet ESD valve to slugcatcher time delay H 1) mm Close HV valves in condensate draw off line (4 valves) - L LL



Personnel 3 Overfilling of slugcatcher, no risk for personnel, as liquid will enter the process first. Exposure Time Risk

0.1 operator not present


3


Averting of hazard

yes Both slugcatchers work in parallel; if one LSHH fails, the other LSHH will still give an alarm and the operator has sufficient time to interact (slow process) There are sufficient alarms.


2 failure of level high control causes wrong measurement for 11LSHH1068, (trip will be too late)

Remarks: 1. Refer to PID 11-PE-1002-007 and Mechanical Data Sheet






Rev.date :




Equipment under control 11-VL-101B Safe state of the process Level Control Protected system Downstream condensate system Description of the SIS function Prevent MEG/H20 into condensate system Description of mode of operation of the plant for which the SIS is required




HHH 1100 mm Close inlet ESD valve to slugcatcher H 1) mm Close HV valves in condensate draw off line (4 valves) - L LL



Personnel 1 No impact, Exposure Time Risk

NA


2 2

MEG/H20 into condensate separator 12-VA-101, which can then be sent to the MEG system; operational upset fouling of 20-HA-101, which needs cleaning : Downtime of side product >1 day, less than 1 week and downtime of main product > 1 day, as condensate can be stored in slugcatcher, but storage capacity is limited

Averting of hazard

yes Asset : 12-LDT-1084 and 12-LDT-1058 give alarm



Remarks: 1) Refer to PID 11-PE-1002-007 and Mechanical Data Sheet 2) 11LT1084 B or A can be used as control. When one is selected as control the other must be used as trip signal.

Control and trip signal must be independent.






Rev.date :


Tag 11LT1084 voting 1 out of 1


Equipment under control 11-VL-101B Safe state of the process Level Control Protected system slugcatcher Description of the SIS function Prevent overfilling of stand-pipe for level measurement with MEG while slugcatcher is filled with

condensate. Prevent wrong level measurement. Description of mode of operation of the plant for which the SIS is required




HHH 1100 mm Close inlet ESD valve to slugcatcher time delay H 1) mm Close HV valves in condensate draw off line (4 valves) - L LL



Personnel 3 Overfilling of slugcatcher, no risk for personnel, as liquid will enter the process first. Exposure Time Risk

0.1 operator not present


3


Averting of hazard

yes Both slugcatchers work in parallel; if one LSHH fails, the other LSHH will still give an alarm and the operator has sufficient time to interact (slow process) There are sufficient alarms.


2 failure of level high control causes wrong measurement for 11LSHH1069, (trip will be too late)

Remarks: 1) Refer to PID 11-PE-1002-007 and Mechanical Data Sheet






Rev.date :




Equipment under control 11-VL-101A Safe state of the process Level Control Protected system Downstream MEG/H20 system Description of the SIS function Prevent condensate breakthrough into MEG/H20 system Description of mode of operation of the plant for which the SIS is required




H L 1) mm Switch condensate draw off valve - LL 1) mm Alarm MEG/H2O level low LLL 1) mm Close MEG/H20 draw off line



Personnel 1 No impact Exposure Time Risk

NA

Environment 1 No impact Assets: Equipment / Production Downtime

3

Condensate breakthrough into MEG/H20 system into MEG storage tank, from where finally condensate is used as MEG to pipeline downtime of main product >1 week

Averting of hazard

yes Asset : 13-VA-101, where separation is done, with Level indication and alarms; collection in the bottom of 13-TA-101, where it can be removed (1AIL) Lean MEG is buffered in the tank 13-TA-102, so pipeline does not need to be stopped (1 AIL)




Safety Integrity Level (SIL) - Asset Integrity Level (AIL) - Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS



revealed failure (spurious trip) : Unwanted closure of the flow to the MEG/H20 system; operator has time to react. No high availability is necessary. Review date : 02.04.2003


Rev.date :




Equipment under control 11-VL-101B Safe state of the process Level Control Protected system Downstream MEG/H20 system Description of the SIS function Prevent condensate breakthrough into MEG/H20 system Description of mode of operation of the plant for which the SIS is required







Personnel 1 No impact Exposure Time Risk

NA

Environment 1 No impact Assets: Equipment / Production Downtime

3

Condensate breakthrough into MEG/H20 system into MEG storage tank, from where finally condensate is used as MEG to pipeline downtime of main product >1 week

Averting of hazard

yes Asset : 13-VA-101, where separation is done, with Level indication and alarms; collection in the bottom of 13-TA-101, where it can be removed (1AIL) Lean MEG is buffered in the tank 13-TA-102, so pipeline does not need to be stopped (1 AIL)




Safety Integrity Level (SIL) - Asset Integrity Level (AIL) - Special requirement for the SIS, if not covered by the General part of the Safety Requirements Specification: Requirement for proof test interval if not otherwise stated, refer to Safety Requirements Specification General Part Manual shutdown possibility if not otherwise stated, refer to Safety Requirements Specification General Part Energise or deenergise to trip if not otherwise stated, refer to Safety Requirements Specification General Part Special requirement for reset of SIS if not otherwise stated, refer to Safety Requirements Specification General Part specific requirements for starting or restarting the SIS



revealed failure (spurious trip) : Unwanted closure of the flow to the MEG/H20 system; operator has time to react. No high availability is necessary. Review date : 02.04.2003


Rev.date :


Tag 11LT1083 (previous 1091) voting 1 out of 1


Equipment under control 11-VL-101A Safe state of the process Level Control Protected system Downstream MEG/H20 system Description of the SIS function Prevent gas breakthrough into 13-VA-101 MEG/H20 system Description of mode of operation of the plant for which the SIS is required








NA Not taken into account

Environment 2 Short Flaring from safety valve relief, > 1 day Assets: Equipment / Production Downtime

5 Gas breakthrough results in overpressurisation of 13-VA-101, exceeding burst pressure, damage to vessel

Averting of hazard

yes Safety valves are designed for the scenario ( 3 IPL’s, reducing the consequence)







revealed failure (spurious trip) : Unwanted closure of the flow to the MEG/H20 system; operator has time to react. No high availability is necessary. Review date : 27/9/2002


Rev.date :


Tag 11LT1084 (previous 1092) voting 1 out of 1


Equipment under control 11-VL-101B Safe state of the process Level Control Protected system Downstream MEG/H20 system Description of the SIS function Prevent gas breakthrough into 13-VA-101 MEG/H20 system Description of mode of operation of the plant for which the SIS is required








NA Not taken into account

Environment 2 Short Flaring from safety valve relief, > 1 day Assets: Equipment / Production Downtime

5 Gas breakthrough results in overpressurisation of 13-VA-101, exceeding burst pressure, damage to vessel

Averting of hazard

yes Safety valves are designed for the scenario ( 3 IPL’s, reducing the consequence)







revealed failure (spurious trip) : Unwanted closure of the flow to the MEG/H20 system; operator has time to react. No high availability is necessary. Review date : 10/10/2002


Rev.date :




Equipment under control 11-ESV-1074 Safe state of the process ensure low pressure difference before ESV valve is opened. Protected system 11-CA-102 A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required




H 1 barg 1) inhibit to open ESV-Valve HH L LL



Personnel 4 Full rupture of 4” piping; liquid MEH/H20 leakage Exposure Time Risk

0.1 Rare to more often exposure in the endangered zone (~ 10% of the time), e.g. only during supervision rounds or maintenance. Operator may be present at the ESD-Valve but not in the endangered area thus frequency is reduced by one step (area is outside the barge and at large distance). Exposure time risk needs not to be taken into account

Environment 2 Flaring for restart and spill of liquid MEG/H20 in not curbed area : risk of soil contamination Assets: Equipment / Production Downtime

4 3

Liquid hammering : Damage to common piping and to 11-CA-102 A or B Downtime for main and by-product more than one week

Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak the ESV valve can be closed again (stopping already the flow of water in MEG) (1 SIL)









Rev.date :




Equipment under control 11-ESV-1075 Safe state of the process ensure low pressure difference before ESV valve is opened. Protected system 11-CA-102 A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required







Personnel 4 Full rupture of 4” piping; liquid MEH/H20 leakage Exposure Time Risk


Environment 2 Flaring for restart and spill of liquid MEG/H20 in not curbed area : risk of soil contamination Assets: Equipment / Production Downtime

4 3


Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak the ESV valve can be closed again (stopping already the flow of water in MEG) (1 SIL)









Rev.date :




Equipment under control 11-HV-1093/1094/1098/1099 Safe state of the process ensure low pressure difference before group of HV valve is opened. Protected system 11-CA-101A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required




H 1 barg 1) inhibit to open group of HV-Valves HH L LL



Personnel 4 Full rupture of 8” piping; condensate leakage Exposure Time Risk


Environment 2 Flaring for restart and spill of condensate in not curbed area : risk of soil contamination Assets: Equipment / Production Downtime

4 3


Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak, the ESV valve, could be closed again, which limits gas leakage at 115 barg and also 11-ESV-1072 can be closed again, which limits the consequences (1 SIL)









Rev.date :




Equipment under control 11-HV-1070/1071/1095/1096 Safe state of the process ensure low pressure difference before group of HV valve is opened. Protected system 11-CA-101A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required




H 1 barg 1) inhibit to open group of HV-Valves HH L LL






4 3


Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak, the ESV valve, could be closed again, which limits gas leakage at 115 barg and also 11-ESV-1073 can be closed again, which limits the consequences (1 SIL)









Rev.date :




Equipment under control 11-ESV-1072 Safe state of the process ensure low pressure difference before ESV valve is opened. Protected system 11-CA-101A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required










4 3


Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak, the ESV valve, could be closed again, which limits gas leakage at 115 barg and also the group 11-HV-1093/1094/1098/1099 valves can be closed again, which limits the consequences (1 SIL)









Rev.date :




Equipment under control 11-ESV-1073 Safe state of the process ensure low pressure difference before ESV valve is opened. Protected system 11-CA-101A/B and connected piping Description of the SIS function avoid pressure shock Description of mode of operation of the plant for which the SIS is required










4 3


Averting of hazard

yes Prior to opening of ESV valve after shutdown the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step Personnel : In case of leak, the ESV valve, could be closed again, which limits gas leakage at 115 barg and also the group 11-HV-1070/1071/1095/1096 valves can be closed again, which limits the consequences (1 SIL)









Rev.date :




Equipment under control ESD-Valve 11ESV1066 Safe state of the process ensure low pressure difference before ESD-Valve is opened. Protected system 12-HA-102 and connected piping Description of the SIS function avoid pressure shock to 12-HA-102 and connected piping Description of mode of operation of the plant for which the SIS is required








1 no credit taken

Environment 2 minor effects because non environmental hazardous products are released Assets: Equipment / Production Downtime

4 3

damage to piping and equipment due to pressure shock and explosion or fire, > 1% plant value downtime not more than one week

Averting of hazard

yes prior to opening of ESD valve after a depressurisation the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step ( 1 IPL) Personnel : ESD valve can be closed again, limiting the consequences; no credit is taken


1 high differential pressure is given after shutdown and an operator failure at the same time

Remarks: 1) pressure A must not be higher than 1 bar than pressure B, and the opposite way




revealed failure (spurious trip) : at high differential pressure trip shall not open the valve, if it is closed at high differential pressure trip shall not close the valve, if it is open. Thus no high availability is necessary Review date : 27/9/2002


Rev.date :




Equipment under control ESD-Valve 11ESV1067 Safe state of the process ensure low pressure difference before ESD-Valve is opened. Protected system 12-HA-102 and connected piping Description of the SIS function avoid pressure shock to 12-HA-102 and connected piping Description of mode of operation of the plant for which the SIS is required








1 no credit taken

Environment 2 minor effects because non environmental hazardous products are released Assets: Equipment / Production Downtime

4 3

damage to piping and equipment due to pressure shock and explosion or fire, > 1% plant value downtime not more than one week

Averting of hazard

yes prior to opening of ESD valve after a depressurisation the operator is warned to repressurise the equipment in the field ( limit switch and operating procedure is provided ) that reduces the frequency with one step ( 1 IPL) Personnel : ESD valve can be closed again, limiting the consequences; no credit is taken


1 high differential pressure is given after shutdown and an operator failure at the same time

Remarks: 1) pressure A must not be higher than 1 bar than pressure B, and the opposite way




revealed failure (spurious trip) : at high differential pressure trip shall not open the valve, if it is closed at high differential pressure trip shall not close the valve, if it is open. Thus no high availability is necessary Review date : 27/9/2002


Rev.date :


Tag 11PT1138 A/B voting 1 out of 2


Equipment under control 11-VL-101B Safe state of the process pressure control Protected system flare system and slugcatcher Description of the SIS function prevent overloading of flare by keeping the second valve closed until the pressure is below 55 barg

and the third valve until the pressure is below 15 barg Description of mode of operation of the plant for which the SIS is required

only in case of emergency depressurisation all cases defined in E066-AB-P-LE-0001 "Operational Design Scenarios of Snøhvit Feed for Hammerfest LNG Plant", as well as start-up, shutdown, off-spec. case.



H 48 barg inhibits to open 11-BDV-1135 HH 70 barg inhibits to open 11-BDV-1134 L LL



Personnel 4 overload of flare system and possible damage to flare header system and risk of hydrocarbon release to atm. Exposure Time Risk

0.1 rare to more often exposure in the endangered zone (~ 10% of the time), e.g. only during supervision rounds or maintenance and the removal of the dangerous situation does not require the presence of staff on the scene of action

Environment 1 overload of the flare (less than 8 hrs) Assets: Equipment / Production Downtime

3 back pressure in the flare system for half hour, no potential reaching the test pressure in the flare system, risk off damage to the flare system at the tie in point of subheaders, release of HC possible. Production downtime main product, > 1 week. Risk for the BD drum damage. Risk of short fire

Averting of hazard

no


2 in case of emergency depressurisation, which may occur once every 5 years

Remarks: 1st valve may open to blow-down without any risk




only in case of emergency depressurisation

revealed failure (spurious trip) : trip of valve does not effect main production and thus no high availability is required Review date : 27/9/2002


Rev.date :


Tag 11PT1139 A/B voting 1 out of 2


Equipment under control 11-VL-101A Safe state of the process pressure control Protected system flare system and slugcatcher Description of the SIS function prevent overloading of flare by keeping the second valve closed until the pressure is below 55 barg

and the third valve until the pressure is below 15 barg Description of mode of operation of the plant for which the SIS is required




H 48 barg inhibits to open 11-BDV-1137 HH 70 barg inhibits to open 11-BDV-1136 L LL



Personnel 4 overload of flare system and possible damage to flare header system and risk of hydrocarbon release to atm. Exposure Time Risk


Environment 1 overload of the flare (less than 8 hrs) Assets: Equipment / Production Downtime

3 back pressure in the flare system for half hour, no potential reaching the test pressure in the flare system, risk off damage to the flare system at the tie in point of subheaders, release of HC possible. Production downtime main product, > 1 week. Risk for the BD drum damage. Risk of short fire

Averting of hazard

no


2 in case of emergency depressurisation, which may occur once every 5 years

Remarks: 1st valve may open to blow-down without any risk




only in case of emergency depressurisation

revealed failure (spurious trip) : trip of valve does not effect main production and thus no high availability is required Review date : 27/9/2002


Rev.date :


Tag 11TT1181 voting 1 out of 1


Equipment under control 11-HA-101 Safe state of the process temperature control Protected system slugcatcher line from 11-HA-101 to slugcatcher Description of the SIS function prevent low temperatures during pipeline depressurisation when no heating in 11-HA-101 Description of mode of operation of the plant for which the SIS is required




H HH L - 3 °C alarm (to prevent hydrate formation) LL - 5 °C alarm (close the ESD valve to stop the flow) operator action



Personnel 4 low temp. will occur at high delta P, risk of brittle fracture may be given, depending on the ratio of temperature and pressure . there is no risk of brittle fracture if depressurisation is done from 230 bar to 70 bar. (delta T is -25°C) , design temp. is -45°C

Exposure Time Risk


Environment NA Assets: Equipment / Production Downtime

4 damage of piping and main equipment due to low temp.

Averting of hazard

yes special operating procedure will be available and needs to be followed strictly. (1 IPL) hydrates may occur in the valve 11HV1002 and will restrict the flow.


0 pipeline depressurisation with very high delta p (230 bar down to 1 bar), which may occur once every 10 years and failure of a control loop.

Remarks: Team agreed during HAZOP that an alarm is sufficient, as a trip function may cause problems during cold slugs and may cause unwanted trips when liquids are vaporised.




only in case of pipeline depressurisation

revealed failure (spurious trip) Review date : 01.04.03 final HAZOP


Rev.date :




Equipment under control Pig receiver Safe state of the process prevent opening of shut-off valves at the pig receiver when personnel are working at open door Protected system personnel working on Pig receiver Description of the SIS function inhibit to open / prevent opening of shut-off valves at the pig receiver when personnel are working at

open door and prevent gas flow to atm. Description of mode of operation of the plant for which the SIS is required




H HH 1 barg 1) inhibit to open Shut-off -Valve L LL



Personnel 4 Large gas release to atm. when opening of shut-off valves at the pig receiver. Personnel are working at open door. Risk of fire and explosion. One to three fatalities possible.

Exposure Time Risk

1 operator is present when opening the valves

Environment 3 large gas release Assets: Equipment / Production Downtime

1 no impact, as gas jet will not be directed to the plant equipment

Averting of hazard

yes 11ZSLL1007 prevents also that the second shut-off valves are open when the pig receiver door is open. ( 1 IPL) no impact, as gas jet will not be directed to the plant equipment highly established operating procedure is available / supervised action (1 IPL)


2 operator mistake during a highly supervised action, removing a pig is only once per year.

Remarks: 1) as long as there is a differential pressure the valves must not be opened




Revealed failure : on impact on production thus low availability Review date : 15.10.03


Rev.date :


Tag 11ZSL1007 voting 1 out of 1


Equipment under control Pig receiver Safe state of the process prevent opening of shut-off valves at the pig receiver when personnel are working at open door Protected system personnel working on Pig receiver Description of the SIS function inhibit to open / prevent opening of shut-off valves at the pig receiver when personnel are working at

open door and prevent gas flow to atm. Description of mode of operation of the plant for which the SIS is required




H HH L LL open door inhibit to open Shut-off -Valves



Personnel 4 Large gas release to atm. when opening of shut-off valves at the pig receiver. Personnel are working at open door. Risk of fire and explosion. One to three fatalities possible.

Exposure Time Risk

1 operator is present when opening the valves

Environment 3 large gas release Assets: Equipment / Production Downtime

1 no impact, as gas jet will not be directed to the plant equipment

Averting of hazard

yes 11PDSHH1014 prevents also that the shut-off valves are open when the pig receiver door is open. ( 1 IPL) no impact, as gas jet will not be directed to the plant equipment highly established operating procedure is available / supervised action (1 IPL)


2 operator mistake during a highly supervised action, removing a pig is only once per year.

Remarks:




Revealed failure : on impact on production thus low availability Review date : 15.10.03

sis safety requirements specification specific part · damage the line from pig receiver to slug...

Documents