The setting of the Plant layout, the production of the General Plot Plan discussed in the Guide was related to On-Shore (land) facilities.
The layout of Off-shore facilities differs in a number ways, which derive from the specificities of these facilities, mainly their location in the sea and the limited space available.
The overall layout of an On-Shore facility, depicted on the General Plot Plan, sets that Plant with respect to its surroundings, such as local topography and natural elements, access and exit roads, inlet feedstock and product rundown pipelines, connection to external utilities etc.
That of an Off-Shore facility, depicted on the Overall Field Layout, shows the field architecture, i.e., the number and layout of the field facilities. These facilities will include wellhead platforms, production flowlines, gas and water injection lines, production facilities, gas treatment and compression, utilities, living quarters, helideck, flare, export/off-loading lines etc.
Considerations coming into field architecture will first of all entail safety: location of living quarters and control room, which are permanently manned, as far as practicable from high risk process units, usually by locating utility units in between, location of evacuation area and life boats as shielded as possible from the hazards, location of the flare upwind of all facilities to prevent ignition of gas cloud resulting from a leak etc.
The means that will be used to install the individual facilities, including the type of installation (float-over, lift) and the capacity of the installation barge/crane, will determine their maximum size/weight.
Provision will be made for access of rigs to wellhead platforms for work-over. Access ways and landing areas, that will allow an approach against the current, will be provided for supply boats. This will include boats supplying consumables, such as catering, fuel, water, production chemicals etc. as well as boats ferrying equipment parts sent out for repair, spare parts etc. The landing area of the later will be coordinated with the position of the cranes on the facilities themselves.
Finally, provision for future field developments, such as addition of risers, gas injection facilities etc. will be made in the layout.
Recent development of industry standard related to Safety Instrumented Systems (SIS) in the Process Industry, ISA 84.00.00 in particular, have placed many new requirements on the design, selection, installation, operation and maintenance of instrumented safety systems.
These standards have prompted Safety Integrity Level (SIL) review to be systematically done on projects.
The objective is to ensure that each safety automation has the reliability required given its criticality.
It is done in two steps:
• First review of the criticality and assignment of a required reliability level for the automation
• Second check that the automation has indeed the required reliability
In the following text we will use the dedicated vocabulary. Safety Automation will therefore be called “Safety Instrumented Function (SIF)” and “reliability” will be called “Safety Integrity Level (SIL)”.
First step of the SIL study: SIL determination/assignment workshop
All SIF, i.e., instrumented interlocks, appearing on the project P&IDs are reviewed. For each one, the team evaluate qualitatively the consequence if the SIF fails. Consequences are evaluated in the field of impact of personnel (Safety), economical loss, environmental.
The consequence rating is done using categories, e.g. category 1 in case of fatalities on the public, category 2 in case of serious injury on public, category 3 if impact on personnel only etc.
The team then evaluates the likelihood of the SIF failure using a qualitative approach as well and categories: category A for 20 or more failure during the facility life, up to category D, once every 100 facility lives.
The product of the consequence severity and likelihood is the risk level. A matrix is defined, such as the one shown here, that indicates the tolerable risk area (low consequence, low probability), where no action is required, and the area were the risk is not tolerable.
In the non-tolerable risk area, one of the two following actions must be done:
• Either assign the SIF the SIL target shown in the matrix
• or, in case this protection is considered undesirable, due to the high SIL level required, such a SIL 3, additional safeguards or other risk reduction measures besides the SIF can be considered by the review team. The revised case shall then be subject to the same assessment as above to determine the new SIL target.
Once the required SIL level for each SIF is determined, comes the second step of the SIL Study.
Second step of the SIL study: the SIS performance verification.
This second step, which is done after outside the above step 1 workshop, consists of calculations of the actual Safety Integrity Level of each SIF. Such calculation takes into account the hardware used (component failure rates), architecture (redundancy, voting), test intervals etc.
In case were the calculated SIL is below the target set in the assignment workshop, improvements are required, such as increase of testing interval, change of SIF component types and adding components for redundancy.
The deliverable of this second step is the documented calculations and recommendations “SIS performance verification results and recommendations”.
Most safety automations are the first of two barriers. A high pressure safety switch (PSHH) that shuts the fuel supply to a turbine driving a compressor, for instance, is the first barrier to stop the turbine in case of too high compressor discharge pressure.
If it fails to operate, a pressure safety relief valve (PSV) on the compressor discharge line will open, providing the second level of protection.
In most cases, 2 such safeguards are provided in the design: the safety automation is backed by a hard device. In these cases, the reliability of the automation is not thoroughly investigated as it is backed up.
The SIL review will focus on the few cases were the SIF is the only barrier. That would be the case if, for some reason, no PSV is installed on the compressor discharge line for the above case. In this case the SIF will be thoroughly examined, a SIL target set and the performance duly verified.
