N248 SZ RT 007 Iso2 PDF

Bakhtar Petrochemical Company
Lorestan Petrochemical Company (LPC)

Lorestan Petrochemical Company
NEC IDENTIFICATION CODE TCM IDENTIFICATION CODE TITLE OWNER DOCUMENT Nr.
N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

PLANT LOCATION OWNER SHEET Nr. REV. Nr.
300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
KHORAMABAD (IRAN) LORESTAN PETROCHEMICAL COMPANY 1 of 13 02
SIL CLASSIFICATION REPORT FOR OFF-SITE
02 Issued for Approval K. K. F. D. A. M. 22.JUN.2010

01 Issued for Review K. K. F. D. A. M. 30.MAY.2010
REV. DESCRIPTION DRAWN UP CHECKED APPROVED DATE
This document has been produced by Contractor for LORESTAN. It is confidential and cannot be disclosed to or used by any third party for any purpose without prior written consent.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
LIST OF CONTENTS
1. INTRODUCTIN AND SCOPE OF WORK ............................................................................ 3

1.1. INTRODUCTION........................................................................................................... 3
1.2. OBJECTIVES OF STUDY............................................................................................. 4
1.3. SCOPE OF STUDY ...................................................................................................... 4
2. SIL STUDY BASIS AND DEFINITIONS .............................................................................. 4
2.1. STUDY BASIS .............................................................................................................. 4
2.2. DEFINITION OF SIL ..................................................................................................... 5
2.3. BACKGROUND TO RISK BASED APPROACH ADOPTED FOR SIL SELECTION..... 5
3. SIL METHODOLOGY .......................................................................................................... 7
3.1. OVERVIEW................................................................................................................... 7
3.1.1. Identification of SIFs .............................................................................................. 7
3.1.2. Description of Function, Initiators and Final Elements ........................................... 8
3.1.3. Causes of SIF Demand and Consequences of SIF Failure ................................... 8
3.2. FURTHER ELABORATION ON THE APPROACH ADOPTED................................... 10
3.2.1. Multiple Sensors .................................................................................................. 10
3.2.2. Multiple Final Elements ........................................................................................ 10
3.2.3. Consideration of PSV (Safety Valves) ................................................................. 10
3.2.4. Independent Protective Layers ............................................................................ 10
3.3. SIL STUDY GUIDELINES ........................................................................................... 11
3.4. WORKSHEETS........................................................................................................... 12
3.5. ASSUMPTIONS .......................................................................................................... 12

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
1 INTRODUCTIN AND SCOPE OF WORK
1.1 INTRODUCTION
This document covers all units falling under Plant Unit 40 i.e. Utilities and Offsites. For
convenience the units are sub-divided into various plant area codes listed as under.
PLANT AREA CODE 10

Mainly comprising of Sanitary waste collection system and network and other Process and
Plant drainage Waste water collection system and network.
PLANT AREA CODE 20

Mainly comprising of Hydrocarbon storage area for various raw materials and
intermediate/final products. This includes handling of fluids like Propane, Butene-1, Hexane,
Hexene and C6+.
PLANT AREA CODE 30

Mainly comprising of Thermal oxidizer package for treatment/disposal of various solid
wastes generated in HDPE/LLDPE & Butene-1 plants.
PLANT AREA CODE 40

Mainly comprising of Flare package for disposal of various gaseous emissions as well as
blow downs from the HDPE/LLDPE & Butene-1 plants.
PLANT AREA CODE 50

Mainly comprising of Hydrogen generation package to cater to the demand of Hydrogen in
HDPE/LLDPE & Butene-1 plants.
PLANT AREA CODE 70

Mainly comprising of Safety shower water system and associated network.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
1.2 OBJECTIVES OF STUDY
The objective of the Safety Integrity Level (SIL) classification study was to assess the SIL
of the Safety Instrumented Functions (SIF), based on an assessment of the risk of injury to
people (operators or public) and damage to the environment. This involves evaluating the:
Elements forming the SIF;
SIF Design Intent;
SIF demand scenarios and frequency of demand;
Potential consequences if the SIF is not implemented; and
Effectiveness of Impendent Protective Layers (IPL).
The SIL defines the level of the safety integrity (or reliability) required to be implemented
for each specific SIF application, such that the residual risk due to each hazardous event in
the plant is broadly acceptable. The SIL could range from SIL 4 (SIL 3 being the highest level
of safety integrity expected in the process industry). SIL ‘-‘ does not call for any safety
integrity requirements. For SIL 4 a requirement to redesign the system to achieve an
inherently safer design is recommended.
1.3 SCOPE OF STUDY
The SIL Classification was performed for the SIFs as identified from Cause and Effects
Diagrams/ Tables (CED) and the Piping and Instrument Diagrams (P&IDs).
The SIL study was conducted in accordance with:
IEC 61511 Part 3, which incorporates the requirements from ISA S84.01-1996.
2 SIL STUDY BASIS AND DEFINITIONS
2.1 STUDY BASIS
The study was based on:

Casue & Effect Diagrams (hereafter referred as CED);
Piping & Instrumentation Diagrams (P&IDs);
HAZOP Report; and
Input from the SIL study team.
The basis for the SIL study was primarily the P&IDs and CED.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
2.2 DEFINITION OF SIL
The SIF is required to be operated on demand. It will act upon detection of a process upset
leading to a hazardous situation and take corrective action by shutting down the unit/ plant to
bring to a safe status. The SIL defining a minimum level of reliability in terms of Probability of
Failure on Demand (PFD), as shown in Table 2.1 is applied for this project.
Table 2.1 Probability of Failure on Demand for SIL

SIL PFD
1 ≥ 10 -2 to <10-1
2 ≥ 10-3 to <10-2
3 ≥ 10-4 to <10-3
4 ≥ 10-5 to <10-4
SIL 4 is considered extremely rare in the process industry. If a classification leads to SIL 4,
further study should be performed including a review of the design.
The safety functionality that calls for integrity level below SIL 1 shall be retained in the ESD
system as provided now.
The safety functionality that calls for integrity levels SIL 1, 2 and 3 will be implemented in
the ESD system.
2.3 BACKGROUND TO RISK BASED APPROACH ADOPTED FOR SIL SELECTION
Safety instrumented functions (SIF), such as high level trip, high temperature trip, high
pressure trip etc are widely used in the process industry to protect against hazards of
overfilling, design temperature being exceeded or overpressure respectively. These are
safeguards implemented using instrumentation, and comprise one or more sensors, a logic
solver and one or more final elements. However, they do not provided absolute protection as
they may fail to perform its desired function when required due to various reasons including
failure of the various components that make up the system which is designed to implement
the function.
The probability of failure of a SIF depends on the configuration of the system, i.e. the level
of redundancy, testing/ maintenance frequency etc. for example, a system with two
independent level sensors (1oo2 configuration) is less likely to fail as compared to a system
with only one sensor. Similarly, a system with two shut down valves in series (1oo2
configuration) is less likely to fail to perform as compared to a system with only one shutdown
valve. Redundant systems for all applications are however, not cost effective and may not

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
provide any significant additional safety benefit for all cases. Hence, a risk based approach is
adopted to determine the level of reliability required for the particular SIF.
Risk is a function of likelihood and consequence, as follows:
Risk (inherent or unmitigated risk)= Likelihood of a unwanted event x consequence (in
terms of fatality or environmental damages)
A SIF reduces the risk, as follows:
Risk (mitigated risk)= Likelihood of an unwanted event x consequence x probability of
failure of SIF on demand (expressed as SIL)
This study assesses the risk posed by each hazardous event in the plant which is resulted
from SIF failure and determines the level of reliability of the SIF to meet a target risk level or
broadly acceptable risk level. A qualitative (or a semi-quantitative approach) is adopted to
determine the risk using the Risk Graphs.
Probability of failure on demand of SIF (PFD), i.e. the reliability of the SIF is thus derived
as follows
T arg et risk level (ie acceptable risk after mitigation)

PFD=
Likelihood of an unwanted event x consequence
For Example, using safety classification as illustration, and assuming that the target risk
level is 10-4 per year, the likelihood of an unwanted event is 10-1 per year and consequence
is 1 fatality, then.
PFD = 10-4 / (10-1 x 1) = 10-3
The required SIL based on safety classification is therefore 3 for this SIF.
If the likelihood of an unwanted event is 10-1 per year and the Consequence is 0.1 fatality
(i.e. injury), then.
PFD= 10-4/(10-1x0.1)=10-2
The required SIL is 2.

The system configuration is then determined based on the SIL level derived above.
It may be noted that where a SIF is classified as SIL 3 or SIL 2, it means that the inherent
risk is high and hence a higher level of reliability is required for the instrumented function.
Inherent risk may be high due to the system design or the hazard presented by the system.
Similarly, where a SIF is classified as SIL 1, it means that the inherent risk is relatively low.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
The above approach ensures that a consistent basis (i.e. a risk based approach) is
adopted in determining the configuration of the instrumented system, while avoiding over
engineering, where not necessary.
The assessment is however, qualitative and is base on guidelines, experience and
judgment. A more detailed quantitative approach may be adopted put is time consuming. The
above approach is therefore considered reasonable and fit for purpose.
A conservative approach to system design may still be adopted for various reasons, such
as licensors’ past experience or other factors which may not be quantifiable easily. In such
cases, although the SIL derived from above may be lower (say SIL a or SIL) a more
conservative SIL may be assigned, say SIL 1 or SIL 2 respectively. This study seeks to set
the minimum requirements, which however, may be exceeded if required.
3 SIL METHODOLOGY
3.1 OVERVIEW
The methodology defined in the LORESTAN / MAHABAD PETROCHEMICAL COMPANY:

The SIF was first defined with a function description, design intent, one or more initiator(s) (to
detect hazardous situation) and one or more final element(s) (i.e. elements that act to
mitigate the hazardous situation). The study team then described the demand scenario,
consequence(s) of failure on demand (CoFoD) and numerical frequency and consequence
ratings were assigned.
The consequence ratings were based on:
Potential extent of human injury and
Potential extent of environmental damage.
The assessment takes account of the possibility to avert the hazard and the probability of
personnel being in the vicinity of the defined consequence.
A flow chart presenting the steps to assign the SIL classification is shown in Annex B.
Following identification of damage level and likelihood by the team, the SIL of the function
was classified according to Risk Diagrams as shown in Annex C.
3.1.1 Identification of SIFs
The CEDs were first reviewed to identify the SIFs that required SIL classification. These
were also confirmed by reviewing the P&IDs and the HAZOP sheets. Only those functions
within the ESD system and initiated by the process to prevent a specific hazardous situation

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
were selected for classification, thus, the following types of functions listed in the CED were
not classified:
Hand-switch operated functions (operator activated). A default value of SIL 1 may be
assumed;
Control function (FIC, TIC reset etc);
Functions related to normal process control (e.g. auto-start /stop of pumps as a
means of normal level control);
Proposed or indicative machine related protection functions such as those relating to
lube oil systems;
Emergency equipment isolation functions. A default value of SIL 1 may be assumed;
and
Fire & gas systems which are not part of the process/ utility system, such as fire &
gas detectors, deluge systems etc.
DCS interlocks were generally not assessed, except in a few cased they were assessed to
see whether the interlocks need to be upgraded. In all of those cases DCS interlocks were
found to be adequate.
3.1.2 Description of Function, Initiators and Final Elements
The SIFs were defined with a function description, design intent, one or more initiator(s)
(i.e. instrument(s) to detect a hazardous situation) and one or more final element(s) (i.e.
elements that act to mitigate the hazardous situation).
The final element(s) of the SIF were chosen as those which directly meet their design
intent. Thus, only one or two final elements were usually defined for any function, and where
more than one was selected, a success criterion was defined for these final elements. The
other elements acted upon by the initiators were left unclassified (they may however, by
retained for implementation in the ESD system). Some of these unclassified elements may
act as primary final element for another SIF and assigned appropriate SIL classification.
Those final elements not covered under any other SIF as primary final element were
checked, where required, to ensure no separate classification was required.
3.1.3 Causes of SIF Demand and Consequences of SIF Failure
The study team then described the demand scenario and consequence(s) of failure on
demand (CoFoD) and the numerical frequency and consequence ratings were then assigned
according to Risk Diagrams as shown in Annex C.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
A demand on a SIF may be caused by instrument malfunction, operator error, or

equipment failure to operate such as pump or compressor trip. The frequency of demand is
then assessed, i.e. how often the SIF is likely to be activated (Frequency of Demand, W
classification).
The following aspects were investigated for the consequence of SIF failure.
Potential extent of human injury (S classification); and
Potential extent of environmental damage (E classification).
Different categories of W, S and E are defined and presented in Annex C.
Consequence for personnel safety was assessed assuming operator present in the vicinity,
and exposed to a loss of containment scenario leading to fire and/or explosion.
hazard and the probability of personnel being in the vicinity of the defined ‘consequence’.
All consequences were classified and the most stringent SIL was selected for that function.
If the demand has different causes, the consequences of failure on demand were usually
different as well requiring a classification for all causes and consequences.
It is noted that the potential consequences may not result in each demand case. The
procedure adopted In the SIL study takes some credit for the intermediate probabilities such
as loss of containment or ignition and explosion probability. For example, if design
temperature is exceeded, metallurgy may fail leading to loss of containment, and potential
ignition and fire/explosion. It is likely that the potential consequences (i.e. fatality) may result
in less that one in ten demand cases, due to the intermediate event probabilities and hence
this may be reflected, where applicable, by a one order of magnitude reduction in the
demand rate for the SIL. Such assumptions are included in the relevant worksheets. For
overpressure scenarios, however, no reduction factor may be considered due to the likely
speed of the event occurrence.
As part of the frequency of demand analysis or following the consequence assessment, the
provision of other safeguards for the specific demand/ consequence scenario was also
reviewed.
For each such safeguard identified, also called ‘Independent Protection Layer (IPL)’, risk
reduction factor was determined. This risk reduction factor may be applied to the “originally
identified frequency of demand”. The study takes credit for the independent protection layers
(IPL) that mitigate the likelihood or consequence. A reduction factor of 10 will reduce SIL by
one level while a reduction factor of 100 will reduce SIL by two levels.
The term ‘independent protection layer’ has been applied to a safeguard which is capable
of preventing a scenario from proceeding to its undesired consequence independent of the
initiating event or the action of any other layer of protection associated with the scenario.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
3.2 FURTHER ELABORATION ON THE APPROACH ADOPTED
3.2.1 Multiple Sensors
Where multiple sensors are provided, success criterion is defined if they detect the same
hazard. This approach for defining the sensor success criteria was taken for all SIF with
multiple sensors.
3.2.2 Multiple Final Elements
For some SIFs several final elements are acted upon simultaneously to put the system to a
safe state. Where more than one action is require4d to be successful in order to put the
system of a safer state, success criteria (eg 1oo2 or 2oo2 etc.) may be selected for the final
elements. Not all of the actions in one particular SIF, however, may be required or important
enough to protect against the particular hazard, some may be secondary in nature, i.e. to
prevent collateral hazards or may be for operator assistance in restarting the unit quickly.
3.2.3 Consideration of PSV (Safety Valves)
Where a SIF is provided in addition to a PSV, PSV will in most cases operate to mitigate
an overpressure hazard. External conditions (send, dust, corrosion), internal vessel
conditions (dirty service, clogging), manufacturing defects, potential inadequate preventive
maintenance, or induced vibrations or ice formation during a release (which may lead to
blockage of line and subsequent line rupture/ leakage) could potentially lead to the PSV
being ineffective. For this study, most PSVs has been considered as an IPL with a risk
reduction factor of 100, except for selected cases where a lower credit (i.e. 10 instead of 100)
has been given as a conservative measure to meet the requirements of risk graph.
3.2.4 Independent Protective Layers
Credit was given to an independent protective layer (IPL). Only if it could be demonstrated
that the IPL could be independent from the SIF studied and independent from the cause of
the hazard studied. However, before taking credit for IPLs, due consideration was made to
the effectiveness of the IPLs, the time required for successful intervention and the level of
independence with the SIF classified and the event causing a demand on the SIF.

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
3.3 SIL STUDY GUIDELINES
In order to ensure consistency in the assessment, rule sets for assessing independent
protection layer, frequency of demand, presence in danger area and possibility to avert
hazard in Table 3.1 to Table 3.4, these rule sets serve as an aid for assigning the levels for
the various parameters shown in the Risk Graphs in Annex C.
Table 3.1 Rule Set for Independent Protective Layer
Independent Protection Layer Risk Reduction Factor
Pressure Relief Device (mechanical safety trip) 100
SIS- SIL 1 10
SIS – SIL 2 100
BPCS, when independent of initiating event 10
Internal mechanical safety trips that are independent of 10 to 1000 (Base on actual operating
the SIS or BPCS experience with similar device)
Operator response under high stress, average training 0
Operator response to Alarms with procedures, low stress,
10
recognized event and least 5 minutes to respond
Double check valves designed for the hazardous scenario 10
Single check valve 0
Dikes when capable of mitigating the initiating event. This
100
is an IPL only for environmental events
Notes: where more than one protective measure exists, the highest IPL value assumed, without taking credit for all, as a conservative
measure.
Table 3.2 Rule Set for Frequency of Demand
Initiating Event
Frequency of Demand
Scenario Frequency (per
(W)
year)
Control loop failure >1.E-01 W2
Analyzer failure >1.E-00 W3
Pump Failure loss of flow (conservatively W3) 7.9E-01 W3
Positive Displacement pump trip 1.1E-00 W3
Reciprocating compressor trip 2.1E-00 W3
Single mechanical pump seal leak 1.0E-01 W2
Double mechanical pump seal leak with announcement 1.0E-02 W1
Canned/ magnetic drive pump leak 1.0E-02 W1
Loss of electrical power 1.0E-01 W2
General utility failure 1.0E-01 W2
Heat exch. Tube leak 1.0E-02 W1(<100 TUBES)
W2 (>100 TUBES)
Operator failure (if considered in the analysis):
Under stress, emergency, action performed more than once a W3

quarter
Unstressed, action performed more than once a quarter W2
Under stress, emergency, action performed once/ Qtr. Or less

W2
Unstressed, action performed once/ Qtr. Or less
W1

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
Table 3.3 Rule Set for Enabling event Factors

Ordinary Hydrocarbons Easily Ignitable*
Release (kg) Probability of Risk Reduction Probability of Risk Reduction
Ignition Factor Ignition Factor
Minor leak/
Seal leak (<1 1.0E-02 100 1.0E-01 10
tone)
Major leak (1 to
1.0E-01 10 10 0
10 tones)
Large leak
10 0 10 0
(>10 tone)
*Notes: Hydrogen, Acetylene, Ethylene, Ethylene Oxide, Propylene Oxide (above BP), Butadiene
Probability of vessel or pipeline failure due to overpressure will be determined as follows:
1.5 to 2 times man allowable working pressure: flange gasket leaking will be assumed
>2 times working pressure: rupture will be assumed
Probability of vessel or pipeline failure due to significant design temperature exceedance: 0.1
Table 3.4 Rule Set for Exposure Parameter Avoidance parameter

Presence in Danger Zone at the Time of Demand Possibility of Advert Hazard
Assumed when hazard
A1 Default G1 results from manual
operations
Assumed when hazard results from manual
A2 G2 Default
operations
3.4 WORKSHEETS
The session proceedings were recorded using PHA-Pro 7. The records were projected on
a screen for comment and agreement by the team members during the sessions.
Preparation for the study was conducted prior to the commencement of the classification
sessions. This comprised input of the study SIF into the PHA software, based on the
information in CED.
3.5 ASSUMPTIONS
Several assumptions were made regarding the basis of the design during the course of the
SIL study. The main items are:
In case of multiple equipments (with duty a standby/ spare equipment) inside a unit, the study
was conducted for one set of equipment. The recommendations from this study will therefore
apply for such similar systems as well. The study has however, considered the impact of
simultaneous operation of systems in parallel or series including the control requirements

300 kt/y LLDPE/HDPE
30 kt/y BUTENE-1
and the effect of trip of one system on the other. In spite of this, the mentioned functions
report has been presented in the worksheet.
The CEDs were reviewed to identify the SIFs that required SIL classification. Only those
functions within the ESD system and initiated by the process to prevent a specific hazardous
situation were chosen for classification, thus, the following types of functions listed in the
CED were not classified:
Hand-switch operated functions (operator activated). A default value of SIL 1 may be
assumed;
Control function (FIC, TIC reset etc);
Functions related to normal process control (e.g. auto start/stop of pumps as a means of
normal level control); and Proposed or indicative machine related protection functions.
The final element(s) of the SIF were chosen as those which directly meet their design intent.
Thus, only one or two final elements were usually defined for any function. The other
elements acted upon by the initiators were left unclassified (they may however, be retained
for implementation). However, these unclassified elements may act as a primary final
element for another SIF and assigned appropriate SIL classification. Those final elements
not covered under any other SIF as primary final element were checked, where required, to
ensure no separate classification was required.
Annex A
Attendance List
Team Members
First Name Last Name Title Company Department
ALi Mirfakhraie Senior Engineer Nargan HSE
Farian Daiepour Engineering Nargan HSE
Kianoosh Karimpour Engineering Nargan HSE
Annex B
SIL Classification Flow Chart

CAUSE & EFFECT
START ANALYSIS
INITIATOR AND
FINAL ELEMENT
IDENTIFICATION
SCENARIO
CAUSES OF SIF CONSEQUENCE OF

DEMAND SIF FAILURE
FREQUENCY OF EVALUATION OF
-Personnel Safety
-Environmental Damage
NEXT SIF
ASSESSMENT OF INDEPENDENT PROTECTION LAYER
SIL FOR SIF
Consider if SIL in necessary for all final
ALL SIF CLASSIFIED

NO
YES
STOP ANALYSIS
Annex C
Risk Diagrams
1 PERSONAL SAFETY
(W) Frequency of Demand
W1= Low (A very slight probability that the unwanted occurrence will occur and
only a few unwanted occurrences are likely (>once per 10 years))
W2= Moderate (A slight probability that the unwanted occurrence will occur and a
few unwanted occurrences are likely (>once per 1 year & > once per 10 years))
W3= High (A relatively high probability that he unwanted occurrence sill come to
pass and frequent unwanted occurrences are likely (>once per 1 year))
(S) Potential extent of human injury per demand if ESD system fails on
demand
S0= No injury
S1= Slight injury, non-permanent
S2= Severe injury, death of 1 person
S3= Death of several persons
S4= Catastrophe, many casualties
(A) Presence in danger zone at time of demand

A1= Rare to more often exposure in the hazardous zone
A2= Frequent to permanent exposure in the hazardous zone
(G) Possibility to avert hazard

G1= Possible under certain conditions
G2= Almost impossible
2 ENVIRONMENTAL DAMAGE
(W) Frequency of demand
W1= Low (Avery slight probability that the unwanted occurrences will occur and
only a few unwanted occurrences are likely (>once per 10 years))
W2= Moderate (A slight probability that he unwanted occurrence will occur and a
few unwanted occurrences are likely (<once per 1 year & > once per 10 years))
W3= High (A relatively high probability that the unwanted occurrence will come to
pass and frequent unwanted occurrences are likely (>once per 1 year))
(E) Environmental damage per demand if ESD system fails on demand
E0= No release or release with negligible damage to the environment
E1= Release with minor damage to the environment that should be reported (e.g.,
moderate leak from a flange or a valve, small scale liquid spill)
E2= Release within fence with significant damage to the environment (e.g., a
could of obnoxious vapor travelling beyond the unit following flange gasket blow-
out or compressor seal failure)
E3= Release outside fence with temporary major damage to the environment
(e.g., a vapor or aerosol release with or without liquid fallout that cases
temporary damage to plants or fauna)
E4= Release outside fence with permanent major damage to the environment
(e.g., liquid spill into a river or sea, a vapor or aerosol release with or without
liquid fallout that causes lasting damage to plants or fauna, solids fallout, liquid
release that could affect groundwater)
(G) Possibility to avert hazard
G1= Possible under certain conditions
G2= Almost Impossible

Annex D
Drawings
Drawing File Path Place(s) Used Comment
3454-XZ-DM-40_007-ISO4
3454-XZ-DM-40_008-ISO4 Nodes: 43
3454-XZ-DM-40_009-ISO4
3454-XZ-DM-40_010-ISO4 Nodes: 36, 37
3454-XZ-DM-40_012-ISO4
3454-XZ-DM-40_013-ISO4
3454-XZ-DM-40_014-ISO4 Nodes: 7, 8, 9, 10, 11,
22, 23
3454-XZ-DM-40_015-ISO4 Nodes: 7, 8, 12, 13, 15,
16, 17, 19, 20, 21, 22,
23
3454-XZ-DM-40_016-ISO4 Nodes: 1, 2, 3
3454-XZ-DM-40_017-ISO4 Nodes: 1, 2, 4, 5, 6
3454-XZ-DM-40_018-ISO4 Nodes: 30, 31, 32, 33,
34
3454-XZ-DM-40_019-ISO4 Nodes: 34, 35
3454-XZ-DM-40_020-ISO4 Nodes: 24, 25, 26, 27,
29
3454-XZ-DM-40_021-ISO4 Nodes: 27, 28
3454-XZ-DM-40_023-ISO3 Nodes: 38, 39
3454-XZ-DM-40_024-ISO3 Nodes: 39, 40, 41, 42
3454-XZ-DM-40_076-ISO5
3454-XZ-DM-40-015 Nodes: 14
1. List "FUNCTIONS"
Area Interlock ID Drawings Initiator Final Element
Off-Site 40ESD-1601 3454-XZ-DM-40_016-ISO4 40LT-1601 40HV-1601
3454-XZ-DM-40_017-ISO4 40P-2002 A/B
40UAE-1601
Off-Site 40ESD-1602 3454-XZ-DM-40_016-ISO4 40LT-1601 40P-2001 A/B
3454-XZ-DM-40_017-ISO4 40HV-1602
Off-Site 40ESD-1603 3454-XZ-DM-40_016-ISO4 40P-1601 A OR B 40P-2001 A OR B
40HSH-1601 A OR B
Off-Site 40ESD-1701 3454-XZ-DM-40_017-ISO4 40XS-1703 40XL-1710
40XS-1702 40UAE-1710
40XS-17013
40ZE-1701
40ZE-1702
40LSHH-1701
40HZLL-1702
40HZLL-1703
Off-Site 40ESD-1702 3454-XZ-DM-40_017-ISO4 40ESD-1701 40HV-1702
40HS-1710 40HV-1703
40HV-1601
40HL-1710
Off-Site 40ESD-1703 3454-XZ-DM-40_017-ISO4 40ESD-1701 40P-2002 AOR B
40ESD-1702 40HV-1702
40AAHH1704, 1705, 40HV-1703
1706, 1707, 1708
40HS-1708 40FV-1703
40LSHH-1701 40UAE-1703
40YA-1701 A OR B
40FQAH-1703
3454-XZ-DM-40_015-ISO4 40P-2004 A/B
40UAE-1401
3454-XZ-DM-40_015-ISO4 40HV-1402 40P-2004 A/B/C
Off-Site 40ESD-1403 3454-XZ-DM-40_014-ISO4 40P-2003 A OR B 40P-2003 A/B
40HSH-1401 AOR B
Off-Site 40ESD-1404 3454-XZ-DM-40_014-ISO4 40PT-1413 40PV-1413
Off-Site 40ESD-1405 3454-XZ-DM-40_014-ISO4 40PT-1411 40P-2009 A/B
40SX-1513 40UAE-1501
40XS-1512
40ZE-1503
40ZE-1504
40LSHH-1502
40HV-1504
40HV-1502
40XS-1510 40UAE-1502
40XS-1515
40ZE-1501
40ZE-1502
40LSHH-1501
40HV-1501
40HV-1503
Off-Site 40ESD-1503 3454-XZ-DM-40-015 40ESD-1501 40HV-1502
40HS-1514 40HV-1504
40HL-1514
40HS-1514 40HV-1504
40HL-1514
40HS-1514 40HV-1504
40HL-1514
Off-Site 40ESD-1507 3454-XZ-DM-40_015-ISO4 40ESD-1501 40P-2004 A OR C
40ESD-1503 40HV-1504
40AAHH-1501, 1502, 40HV-1502
1503, 1504, 1505, 1506,
1507, 1508, 1509
40HS-1516 40UAE-1506
40LSHH-1502
40YA-1501 A/B/C
40HZLH-1402
40FQAH-1502
Off-Site 40ESD-1508 3454-XZ-DM-40_015-ISO4 40ESD-1501, 40ESD- 40P-2004A/C
1503, 40V-1502
40UAE-1508
Off-Site 40ESD-1509 3454-XZ-DM-40_015-ISO4 40ESD-1502 40P-2004 B OR C
40ESD-1504 40HV-1503
40AAHH-1501, 1502, 40HV-1501
1503, 1504, 1505, 1506,
1507, 1508, 1509
40HS-1512 40UAE-1507
40LSHH-1501
40YA-1501 A/B/C
40HZLH-1402
40FQAH-1501
Off-Site 40ESD-1510 3454-XZ-DM-40_015-ISO4 40ESD-1501 40P-2004 A OR C
40ESD-1503 40UAE-1508
40V-1502
Off-Site 40ESD-1512 3454-XZ-DM-40_015-ISO4 40ESD-1502 40P-2004 B OR C
40ESD-1504 40UAE-1509
40V-1501
3454-XZ-DM-40_015-ISO4 40HS-1515 40HV-1504
40HV-1401
40HL-1516

3454-XZ-DM-40_015-ISO4 40HS-1513 40HV-1503
40HV-1401
40HL-1513
40P-2008 A/B
Off-Site 40ESD-2101 3454-XZ-DM-40_020-ISO4 4LT-2002 40P-2007
40HV-2001
3454-XZ-DM-40_021-ISO4 40XS-1902 40UAE-2101
40XS-1901
40ZE-2101
40ZE-2102
40LSHH-2101
40HV-2102
40HV-2101
40HS-2111 40HV-2101
40HV-2002
40HL-2111
Off-Site 40ESD-1802 3454-XZ-DM-40_020-ISO4 40ESD-2101 40P-2008 A OR B
40ESD-2102 40HV-2101
40AAHH-2101, 2102, 40HV-2102
2103, 2104, 2105
40HS-2110
40LSHH-2110
40YA-2101
40FQAH-2101
40PT-2155
40P-2006 A/B
40HV-1801
40XS-1902 40UAE-1901
40XS-1901
40ZE-1901
40ZE-1902
40LT-1901
40HV-1901
40HV-1902
Off-Site 40FCS-1001 3454-XZ-DM-40_018-ISO4 40ESD-1901 40HV-1902
3454-XZ-DM-40_019-ISO4 40HS-1911 40HV-1901
40HV-1802
40HL-1911
Off-Site 40FCS-1002 3454-XZ-DM-40_019-ISO4 40ESD-1901 40P-2006 A OR B
40ESD-1902 40HV-1901
40AAHH-1911, 1912, 40HV-1902
1913, 1914, 1915
40HS-1910
40LSHH-1901
40P-2006 A OR B
40FQAH-1901
Off-Site 40ESD-2302 3454-XZ-DM-40_010-ISO4 40LT-1001 40P-7001 A OR B
3454-XZ-DM-40_024-ISO3 40HV-2301
Off-Site 40ESD-2403 3454-XZ-DM-40_024-ISO3 40XS-2303 40UAE-2401

40XS-2402 40XL-2404
40XS-2401
40ZE-2401
40ZE-2402
40LSHH-2401
40HV-2401
40HV-2402
Off-Site 40FCS-0801 3454-XZ-DM-40_024-ISO3 40ESD-2401 40HV-2402
40HS-2411 40HV-2401
40HV-2302
Off-Site 40FCS-0802 3454-XZ-DM-40_024-ISO3 40ESD-2401 40P-2006 A OR B
40ESD-2402 40HV-2401
40AAHH-2411, 2412, 40HV-2402
2413, 2414, 2415
40HS-2410
40LSHH-2401
40P-2006 A OR B
40FQAH-2402
Off-Site 40FCS-0803 3454-XZ-DM-40_008-ISO4 40LSLL-0801 40P-1002 A OR B
40LSHL-0804
2. Function List
Other Final
Function Name Initiators Final Element Unit Interlock ID P&ID
Element
1. On high high level on 40TK-2001, propane 40LT-1601 40HV-1601, 40P-2002 A/B, 40UAE-1601 None Off-Site 40ESD-1601 1) 3454-XZ-DM-40-016
sphere to close 40HV-1601, propane inlet 2) 3454-XZ-DM-40-017
valve, trip 40P-2002 A/B and hexane truck
unloading pump.
2. On low low level on 40TK-2001, propane 40LT-1601, 40HV- 40P-2001 A/B None Off-Site 40ESD-1602 1) 3454-XZ-DM-40-016
bullet discharge, malfunction to stop 40P-2001 1602 2) 3454-XZ-DM-40-017
A/B, propane feed pumps.
3. On 40P-2001 A or B to start spare pump 40P-2001 A or B 40-P-2001A/B None Off-Site 40ESD-1603 1) 3454-XZ-DM-40-016
automatically due to not activation of 40YLH- (40YLH-1601) 40HSH-1601A/B
1601 A or B.
To automatic start of spare pump, local
selector shall be placed in AUTO (remote)
position.
4. On truck connection on loading bay, to 40XS-1703, 40XS- 40UAE-1701 None Off-Site 40ESD-1701 1) 3454-XZ-DM-40-017
check 40XS-1703, truck earthing connection on 1702, 40XS=1701, 40XL-1710
40ZE-1701, 40ZE-
and 40XS-1702, truck front barrier and 40XS- 1702, 40LSHH-
1701 truck parking position and 40ZE-1701, 1701, 40HZLL-
vapor loading arm connection and 40ZE-1702, 1702, 40HZLL-
liquid loading arm connection and 40LSHH- 1703
1701 truck overfilling system detection
connection and 40HZLL-1702, emergency
valve on vapor connection time closing and
40HZLL-1703, emergency valve on liquid line
closed, to active 40UAE-1701, board signaling
at FCS and 40XL-1710, local boarding "ready
to align propane truck".
5. On propane truck unloading valve to check 40ESD-1701, 40HV-1702 None Off-Site 40ESD-1702 1) 3454-XZ-DM-40-017
40ESD-1701 permissive verified, and press 40HS-1710 40HV-1703
local push button 40HS-1710 to open 40HV-1601
emergency valve on vapor return line 40HV- 40HL-1710
1702, emergency valve on liquid line 40HV-
1703, emergency valve on propane tank 40HV-
1601, and activation of 40HL-1710, local
boarding "alignment for propane truck
unloading OK"
Other Final
Element
6. To trip the truck unloading operation due to 40ESD-1701, 40P-2002A/B None Off-Site 40ESD-1703 1) 3454-XZ-DM-40-017
gas detector intervention, any emergency 40ESD-1702, 40HV-1702
40AAHH-
condition, and permissive unverification. These 1704,1705,1706,17 40HV-1703
items will be checked by disturbance in 07,1708, 40HS- 40FV-1703
40ESD-1701, permissive not verified, not 1708 40UAE-1703
activation of 40ESD-1702 lead to truck loading 40LSHH-1701,
40YA-1701A/B,
valve not align, activation of 40AAHH-1704, or 40FQAH-1703
1705 or 1706 or 1707 or 1708, emergency
local push button 40HS-1708, truck overfilling
signal by 40LSHH-1701, fault pumps 40P-2002
A/B (40YA-1701A/B), and reset valve reached
(40FQAH-1703) to trip propane truck unloading
pump (40P-2002A/B) and close 40HV-1702
emergency valve on vapor line and close
40HV-1703, emergency valve on liquid return
line, and 40FV-1703 forced to close.
7. On high high level on 40-TK-2002, Butene-1 40LT-1401 40HV-1401 None Off-Site 40ESD-1401 1) 3454-XZ-DM-40-014
storage sphere, to close 40HV_1401, butene-1 40P-2004 A/B 1) 3454-XZ-DM-40-015
inlet valve, trip 40P-2004A/B, butene truck 40UAE-1401
loading/unloading pumps.
8. On low low level on 40TK-2002, butene-1 40LT-1402, 40HV- 40P-2003A/B None Off-Site 40ESD-1402 1) 3454-XZ-DM-40-014
sphere and 40HV-1402, valve on bottom of 1402 40P-2004 A/B/C 1) 3454-XZ-DM-40-015
sphere malfunction, to stop 40-P-2003A/B,
butene-1 feed pumps, 40P-2004A/B/C butene
truck loading/unloading pumps.
9. On 40P-2003A/B, butene-1 feed pumps, to 40P-2003 A/B 40P-2003A/B None Off-Site 40ESD-1403 1) 3454-XZ-DM-40-014
start spare pump automatically due to not (40YLH-1401A/B) 40HSH-1401A/B
activation of 40YLH-1401A/B.
To start spare pump automatically local
selector has to be placed in AUTO (remote)
position.
10. On High high pressure in 40PT-1413, on 40PT-1413 40PV-1413 None Off-Site 40ESD-1404 1) 3454-XZ-DM-40-014
cooling water side of butane-1 cooler (40E-
2003) to close 40PV-1413, cooling water side
of heat exchanger.
11. On 40PT-1411, to trip 40P-2003A/B due to 40PT-1411 40P-2003 A/B None Off-Site 40ESD-1405 1) 3454-xz-dm-40-014
low low pressure in butene-1 storage sphere.
Other Final
Element
12. On butene-1 truck loading bay 1 to give the 40XS-1514, 40XS- 40UAE-1501 None Off-Site 40ESD-1501 1) 3454-XZ-DM-40-015
permissive to the operators for loading. To 1513 40XL-1502
40XS-1512, 40ZE-
have this permission the following items shall 1503
be checked: truck earthing connection, 40XS- 40ZE-1504,
1514, truck front barrier, 40XS-1513, truck 40LSHH-1502,
parking position, 40XS-1512, vapor loading 40HV-1504, 40HV-
1502
arm connection, 40ZE-1503, liquid loading arm
connection, 40ZE-1504, truck overfilling system
detection connection, 40LSHH-1502,
emergency valve on liquid line to be closed and
40HZLL-1502 activation emergency valve on
vapor return line to be closed and 40HZLL-
1504 activation after checking these items
board signaling at FCS and 40XL-1502 local
boarding "ready to align truck 1" will be
activated
13. On butene-1 truck loading bay 1 to give the 40XS-1511, 40XS- 40UAE-1502 None Off-Site 40ESD-1502 1) 3454-XZ-DM-40-015
permissive to the operators for loading. To 1510, 40XS-1515, 40XL-1501
40ZE-1501, 40ZE-
have this permission the following items shall 1502, 40LSHH-
be checked: truck earthing connection, 40XS- 1501, 40HV-1501,
1511, truck front barrier, 40XS-1510, truck 40HV-1503
parking position, 40XS-1515, vapor loading
arm connection, 40ZE-1501, liquid loading arm
connection, 40ZE-1502, truck overfilling system
detection connection, 40LSHH-1501,
emergency valve on liquid line to be closed and
40HZLL-1501 activation emergency valve on
vapor return line to be closed and 40HZLL-
1503 activation after checking these items
board signaling at FCS and 40XL-1502 local
boarding "ready to align truck 1" will be
activated
14. On butene-1 truck loading bay-1 to give 40ESD-1501, 40HV-1502 None Off-Site 40ESD-1503 1) 3454-XZ-DM-40-015
permission by checking ESD-1501and pressing 40HS-1514 40HV-1504
40HS-1514 (local push button), then the 40HL-1514
following items shall be checked emergency
valve on vapor return line 40HV-1502 condition
(it shall be open), emergency valve on liquid
line (40HV-1504) (it shall be open) and local
boarding 40HL-1514 "alignment leading bay 1
OK"
Other Final
Element
15. On butene-1 truck loading bay-1 to give 40ESD-1502, 40HV-1501 None Off-Site 40ESD-1504 1) 3454-XZ-DM-40-015
permission by checking ESD-1502 and 40HS-1511 40HV-1503
pressing 40HS-1511 (local push button), then 40HL-1511
the following items shall be checked
emergency valve on vapor return line 40HV-
1501 condition (it shall be open), emergency
valve on liquid line (40HV-1503) (it shall be
open) and local boarding 40HL-1511
"alignment leading bay 1 OK"
16. To trip the truck unloading due to gas 40ESD-1501, 40P-2004A/C None Off-Site 40ESD-1506 1) 3454-XZ-DM-40-015
detector intervention, any emergency condition 40ESD-1503, 40HV-1504
40AAHH-
and permission no more verified. These items 1501,1502,1503,15 40HV-1502
will be checked by disturbance in 40ESD-1501, 04,1505,1506,1507 40UAE-1506
permissive not verified, not activation of ,1508,1509, 40HS-
40ESD-1503 lead to truck loading valve not 1516, 40LSHH-
1502, 40YA-
aligned, activation of 40AAHH-1501or 1502 or 1501A/B/C,
1503 or 1504 or 1505 or 1506 or 1507or 1508 40HZLH-1402,
or 1509, emergency local push button 40HS- 40FQAH-1502
1516, truck overfilling signal by 40LSHH-1502,
fault pumps 40P-2004A/B/C (40YA-
1501A/B/C), valve on sphere bottom (40HZLH-
1402), and reset valve reached (40FQAH-
1502), to trip butene-1 truck loading pump
(40P-2004AorC) close emergency valve on
liquid line (40HV-1504), close emergency valve
vapor line 40HV-1502.
17. To trip the truck unloading due to gas 40ESD-1502, 40P-2004B/C None Off-Site 40ESD-1507 1) 3454-XZ-DM-40-015
40AAHH-
and permission no more verified. These items 1501,1502,1503,15 40HV-1501
will be checked by disturbance in 40ESD-1502, 04,1505,1506,1507 40UAE-1507
permissive not verified, not activation of ,1508,1509, 40HS-
40ESD-1504 lead to truck loading valve not 1512, 40LSHH-
1501, 40YA-
aligned, activation of 40AAHH-1501or 1502 or 1501A/B/C,
1503 or 1504 or 1505 or 1506 or 1507or 1508 40HZLH-1402,
or 1509, emergency local push button 40HS- 40FQAH-1501
1512, truck overfilling signal by 40LSHH-1501,
fault pumps 40P-2004A/B/C (40YA-
1501A/B/C), valve on sphere bottom (40HZLH-
1402), and reset valve reached (40FQAH-
1501), to trip butene-1 truck loading pump
(40P-2004B or C) close emergency valve on
liquid line (40HV-1503), close emergency valve
vapor line 40HV-1507.
Other Final
Element
18. On off-spec butene-1 truck loading bay 1 to 40ESD-1501, 40P-2004A/C None Off-Site 40ESD-1508 1) 3454-XZ-DM-40-015
give the permissive to the operator to align the 40ESD-1503, 40V- 40UAE-1508
1502
valves for loading operation. To give this
permission 40ESD-1501 and 40ESD-1503
shall be activated and 40V-1502 shall be fully
opened. Due to activation of this interlock 40P-
2004 A/C will be stopped and 20P-5002 will be
ready to align.
19. On off-spec butene-1 truck loading bay 1 to 40ESD-1502, 40P-2004B/C None Off-Site 40ESD-1509 1) 3454-XZ-DM-40-015
give the permissive to the operator to align the 40ESD-1504, 40V- 40UAE-1509
1501
valves for loading operation. To give this
permission 40ESD-1502 and 40ESD-1504
shall be activated and 40V-1501 shall be fully
opened. Due to activation of this interlock 40P-
2004 B/C will be stopped and 20P-5002 will be
ready to align.
20. On butene-1 truck unloading bay-1 to align 40ESD-1501, 40HV-1502 None Off-Site 40ESD-1510 1) 3454-XZ-DM-40-015
all the valves by activation of 40ESD-1501, 40HS-1515 40HV-1504 1) 3454-XZ-DM-40-014
permissive verified, and pushing 40HS-1515 to 40HV-1401
open 40HV-1502, emergency valve on vapor 40HL-1516
return line, 40HV-1504, emergency valve on
liquid line, 40HV-1401, emergency valve on
butene-1 sphere and sending signal to 40HL-
1516 local boarding "alignment for truck
unloading bay1 OK"
21. On butene-1 truck unloading bay-1 to align 40ESD-1503, 40HV-1501 None Off-Site 40ESD-1512 1) 3454-XZ-DM-40-014
all the valves by activation of 40ESD-1503, 40HS-1513 40HV-1503 1) 3454-XZ-DM-40-015
permissive verified, and pushing 40HS-1513 to 40HV-1401
open 40HV-1501, emergency valve on vapor 40HL-1513
return line, 40HV-1503, emergency valve on
liquid line, 40HV-1401, emergency valve on
butene-1 sphere and sending signal to 40HL-
1513 local boarding "alignment for truck
unloading bay1 OK"
22. on 40LT-2002, high high level in 40TK- 40LT-2002 40HV-2002 None Off-Site 40ESD-2001 1) 3454-XZ-DM-40-020
2004, hexene tank, to protect overfilling by 40P-2008A/B
closing 40HV-2002 and stopping 40P-2008
A/B.
23. On low low level in 40LT-2002 and not 40LT-2002, 40HV- 40P-2007 None Off-Site 40ESD-2002 1) 3454-XZ-DM-40-020
activation of 40HZSH-2001 in hexene tank to 2001
protect feeding pumps by stopping them
24. On hexene feeding pumps to start stand by 40P-2007A/B, 40P-2007A/B None Off-Site 40ESD-2003 1) 3454-XZ-DM-40-020
pump in case of stop of the duty pump 40YLH-2001A/B 40HSH-2001A/B
Other Final
Element
25. On truck connection on hexene loading bay 40XS-1903, 40XS- 40UAE-2101 None Off-Site 40ESD-2101 1) 3454-XZ-DM-40-020
to check 40XS-1903, truck earthing operation, 1902, 40XS-1901, 40XL-2101 1) 3454-XZ-DM-40-021
40ZE-2101, 40ZE-
on and 40SX-1902, truck front barrier, 40XS- 2102, 40LSHH-
1901, truck parking position, 40ZE-2101, vapor 2101, 40HV-2102,
loading arm, connected, 40ZE-2102, liquid 40HV-2101
loading arm, connected, 40LSHH-2101, truck
overfilling system detection, connected, 40HV-
2102, emergency valve on nitrogen connection
line, closed, 40HV-2101, emergency valve on
liquid line closed, to board signaling 40VAE-
2101 and local boarding "ready to align truck1"
40XL-2101 be activated
26. On truck unloading valve to align all the 40ESD-2101, 40HV-2102 None Off-Site 40ESD-2102 1) 3454-XZ-DM-40-21
valves before running the pumps and start 40HS-2111 40HV-2101
unloading session by checking the activation of 40HV-2002
40ESD-2101 and local push button truck 40HL-2111
unloading, 40HS-2111 pressed to open 40HV-
2102, emergency valve on Nitrogen, 40HV-
2002 emergency valve on hexene tank, 40HV-
2101, emergency valve on liquid line and
activation of 40HL-2111, local boarding
"alignment for truck unloading OK"
27. To trip the truck unloading due to gas 40ESD-2101, 40P-2008A/B None Off-Site 40ESD-2103 1) 3454-XZ-DM-40-020
40AAHH-
and permissive no more verified. These items 2101,2102,2103,21 40HV-2102
will be checked by disturbance in 40ESD-2101, 04,2105, 40HS-
permissive not verified, not activation of 2110, 40LSHH-
40ESD-2102, truck loading valve not aligned, 2110, 40YA-2101,
40FQAH-2101,
activation of 40AAHH-2101, or 2102 or 2103 or 40PT-2155
2104 or 2105, emergency local push button
40HS-2110, truck overfilling signal, 40LSHH-
2110, fault pumps 40P-2008A/B, rest valve
reached in 40FQAH-2101 and low pressure on
N2 connection to truck 40PT-2155 to trip
hexene truck unloading pump 40P-2008A/B,
close emergency valve on liquid line 40HV-
2101 and emergency valve on Nitrogen line.
28. On hexane storage high high level in 40LT- 40LT-1802 40HV-1802 None Off-Site 40ESD-1801 1) 3454-XZ-DM-40-018
1802 to close 40HV-1802, and stopping 40P- 40P-2006A/B
2006A/B
29. On low low level of hexane tank in 40LT- 40LT-1802, 40HV- 40P-2005A/B None Off-Site 40ESD-1802 1) 3454-XZ-DM-40-018
1802 and not activation of 40HZLH-1801, to 1801
stop 40P-2005A/B hexane feeding pumps.
30. On hexane feeding pumps 40P-2005A/B to 40-P-2005A/B 40P-2005A/B None Off-Site 40ESD-1803 1) 3454-XZ-DM-40-018
start the standby pump in case of stop of the
duty pump
Other Final
Element
31. On hexane truck unloading to give the 40XS-1903, 40XS- 40UAE-1901 None Off-Site 40ESD-1901 1) 3454-XZ-DM-40-018
permission to the operator to align the valves 1902, 40XS-1901, 40XL-1904
40ZE-1901, 40ZE-
for truck, these items will be checked by 40XS- 1902, 40LT-1901,
1903, truck earthing connection on, 40XS-1902 40HV-1901, 40HV-
truck front barrier, 40XS-1901, truck parking 1902
position, 40ZE-1901, vapor loading arm
connection, 40ZE-1902 liquid loading arm
connection, 40LSHH-1901, truck overfilling
system detection connection, 40HV-1901,
emergency valve on liquid line to be closed,
40HV-1902, emergency valve on vapor
connection to be closed to activate 40UAE-
1901 and 40XL-1904
32. On hexane truck unloading valve to check 40ESD-1901, 40HV-1902 None Off-Site 40ESD-1902 1) 3454-XZ-DM-40-018
valve alignment before starting operation by 40HS-1911 40HV-1901 1) 3454-XZ-DM-40-019
checking 40ESD-1901 activation, and local 40HV-1802
push button truck unloading press to open 40HL-1911
40HV-1902, emergency valve on vapor return
line, 40HV-1901, emergency valve on liquid
line, 40HV-1802, emergency valve on hexane
tank and local loading 40HL-1911.
33. To trip the truck unloading due to gas 40ESD-1901, 40P-2006A/B None Off-Site 40ESD-1903 1) 3454-XZ-DM-40-019
40AAHH-
and permissive no more verified. These items 1911,1912,1913,19 40HV-1902
will be checked by disturbance in 40ESD-1901, 14,1915, 40HS-
permission not verified not activation of 1910, 40LSHH-
40ESD-1902, truck loading valve not aligned, 1901, 40P-
2006A/B, 40FQAH-
activation of 40AAHH- 1901
1911/1912/1913/1914/1915, emergency local
push button, 40HS-1910, 40LSHH-1901, truck
overfilling signal, fault pumps 40P-2006A/B,
reset valve reached in 40FQAH-1901 to trip
Hexane truck unloading pump, 40P-2006A/B,
close emergency valve on liquid line 40HV-
1901, emergency valve on nitrogen line 40HV-
1902.
34. On safety shower water pump 40P- 40P-7001A/B 40P-7001A/B None Off-Site 40FCS-1001 1) 3454-XZ-DM-40-010
7001A/B to start the standby pump in case of
stop of the duty pump.
35. On low low level of 40LT-1001 in 40D- 40LT-1001 40P-7001A/B None Off-Site 40FCS-1002 1) 3454-XZ-DM-40-010
7001, safety shower buffer drum, to stop safety
shower water pumps, 40P-7001A/B.
36. On high high level of 40LT-2302 in C6+ 40LT-2302 40HV-2302 None Off-Site 40ESD-2301 1) 3454-XZ-DM-40-023
storage tank (40TK-2005) to close 40HV-2302
and board signaling
Other Final
Element
37. On low low level of 40LT-2302 in 40TK- 40LT-2302, 40HV- 40P-2009A/B None Off-Site 40ESD-2302 1) 3454-XZ-DM-40-023
2005 or not opening of 40HV-2301, valve on 2301 1) 3454-XZ-DM-40-024
hexane tank, to stop 40P-2009A/B, C6+
loading pumps
38. On C6+ truck unloading to give permission 40XS-2303, 40XS- 40UAE-2401 None Off-Site 40ESD-2401 1) 3454-XZ-DM-40-024
to the operator to start loading operation by 2402, 40XS-2401, 40XL-2404
40ZE-2401, 40ZE-
checking procedure. This procedure includes, 2402, 40LSHH-
40XS-2303, truck earthing connection on, 2401
40XS-2402 truck front barrier, 40XS-2401, 40HV-2401, 40HV-
truck parking position, 40ZE-2401, vapor 2402
loading arm connection, 40ZE-2402, liquid
loading arm connection, 40LSHH-2401 truck
overfilling system detection connection, 40HV-
2401, emergency valve on liquid line to be
closed, 40HV-2402, emergency valve on N2
connection line to be closed to board signaling
at FCS and local boarding 40XL-2404
39. On C6+ truck loading valve to check 40ESD-2401, 40HV-2402 None Off-Site 40ESD-2402 1) 3454-XZ-DM-40-024
permissive verifications, 40ESD-2401, and 40HS-2411 40HV-2401
press 40HS-2411 local push button to open 40HV-2302
40HV-2402, emergeny valve on vapor return
line, 40HV-2401 emergency valve on liquid
line, 40HV-2302, emergency valve on C6+ tank
40. on C6+ truck loading to trip the operation 40ESD-2401, 40P-2006A/B None Off-Site 40ESD-2403 1) 3454-XZ-DM-40-024
due to gas detection, emergency contingencies 40ESD-2402, 40HV-2401
40AAHH-
and no verification in permissive procedure to 2411,2412,2413,24 40HV-2402
trip C6+ truck unloading pump 40P-2006A/B 14,2415, 40HS-
closing 40HV-2401 emergency valve on liquid 2410, 40LSHH-
line and 40HV-2402, emergency valve on 2401, 40P-
2006A/B, 40FQAH-
nitrogen due to not activation of 40ESD-2401, 2402
40ESD-2402, truck loading valve not aligned,
gas detection by 40AAHH-2411,
2412,2413,2414,2415, press emergency local
push button (40HS-2410), truck overfilling
signal by 40LSHH-2401, fault pumps 40P-
2006A/B and rest value reached 40FQAH-2402
41. On waste water collection basin, to control 40LSLL-0801, 40P-1002 A/B None Off-Site 40FCS-0801 1) 3454-XZ-DM-40-008
level high/low by start/stop pumps 40P- 40LSHL-0804
1002A/B.
On low low level of 40LSLL-0801, selected
main pump 40P-1002A/B will be stopped.
On high high level in 40LSHL-0804 or not
running of 40P-1002A/B to start stand by pump
40P-1002A/B.
Other Final
Element
42. On low level alarm in 40LSHL-0803 to stop 40LSHL-0803, 40P-1003 A/B None Off-Site 40FCS-0802 1) 3454-XZ-DM-40-008
selected main pump 40P-1003A/B. 40P-1003A/B
On 40P-1003A/B to automatic start of stand by
pump when duty pumps is stopped.
On high level alarm in 40LSHL-0803 to start
duty pump 40P-1003.
43. On low level alarm in 40LSHL-0802 to stop 40LSHL-0802, 40P-1004 A/B None Off-Site 40FCS-0803 1) 3454-XZ-DM-40-008
selected main pump 40P-1004A/B. 40P-1004
On 40P-1004 A/B to automatic start of stand by
pump when duty pump is stopped.
On high level alarm in 40LSHL-0802 to start
duty pump 40P-1004.
3. SIL STUDY - RISK GRAPH
Node: 1.
Area: Off-Site
Interlock ID: 40ESD-1601
Drawings: 3454-XZ-DM-40_016-ISO4; 3454-XZ-DM-40_017-ISO4
Initiators: 40LT-1601
Final Element: 40HV-1601; 40P-2002 A/B; 40UAE-1601
SIL determination
Risk Graph (Semi-qualitative

Risk method)
Design Intent Demand Scenario CoFoD IPLs Red Required Actions
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent to overfilling of propane High high level alarm in 40LT- 1.1. Overpressure in sphere 1.1. 40PSV-1601A/B, high level 100 S A G W SIL 2
sphere that may lead to overpressure 1601 caused by block outlet or may lead to breaking lines, alarm provided in 40LT-1601A. 4 1 1 2
and liquid carry over to BDM line by 40FV-1703 malfunction or any explosion and ball fire.
closing raw propane bullet valve other circumstances.
(40HV-1601) and stopping 40P-
2002A/B.
Node: 2.
Area: Off-Site
Initiators: 40LT-1601, 40HV-1602

Final Element: 40P-2001 A/B
SIL determination

Risk method)
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent raw propane feed pumps Low low level alarm in 40LT- 1.1. Damage to pump may 1.1. Operator intervention 10 S A G W SIL--- Note 1
40P-2001A/B, damage due to low low 1601, propane bullet discharge lead to leakage and possible considered to be possible 2 1 1 2
level in sphere or inlet line blockage by not open or any other case jet fire
stopping pumps. which may lead to input cut off.
It is recommended to study on providing pressure alarm in inlet line pressure indicators 40PL-1604, 40PI-1605, 40PI-1607
Node: 3.
Area: Off-Site
Drawings: 3454-XZ-DM-40_016-ISO4
Initiators: 40P-2001 A or B (40YLH-1601)

Final Element: 40P-2001 A OR B; 40HSH-1601 A OR B
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To start spare pump automatically in 40YLH-1601A/B not active 1.1. Loss of propane feed may 1.1. operator intervention considered 10 S A G W SIL---
case of duty pump not active to prevent lead to process upset. to be possible 0 1 1 2
to loss of propane feed due to

stoppage of pumps.
Node: 4.
Area: Off-Site
Initiators: 40XS-1703, 40XS-1702, 40XS=1701, 40ZE-1701, 40ZE-1702, 40LSHH-1701, 40HZLL-1702, 40HZLL-1703

Final Element: 40XL-1710; 40UAE-1710
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To give permissive to the operator to in loading and unloading time 1.1. Possible leakage, jet fire, 1.1. Parallel independent systems 100 S A G W SIL---
align the valves for truck loading this ESD shall be used explosion have been considered mentioned in 2 1 1 2
operation to prevent leakage or initiator column to prevent any
improper filling incident, operator intervention
considered to be possible
Node: 5.
Area: Off-Site
Initiators: 40ESD-1701, 40HS-1710

Final Element: 40HV-1702; 40HV-1703; 40HV-1601; 40HL-1710
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To check unloading valve alignment Any unloading procedure needs 1.1. possible leakage, and jet 1.1. independent parallel systems 100 S A G W SIL---
and prevent to damage to truck due to to activate of this interlock fire have been considered (mentioned in 2 1 1 2
improper unloading. initiator column) to prevent any

incident, operator intervention
Node: 6.
Area: Off-Site
Initiators: 40ESD-1701, 40ESD-1702, 40AAHH-1704,1705,1706,1707,1708, 40HS-1708

40LSHH-1701, 40YA-1701A/B, 40FQAH-1703
Final Element: 40P-2002 AOR B; 40HV-1702; 40HV-1703; 40FV-1703; 40UAE-1703
SIL determination

Risk method)
Factor Risk
Estim
S A G W E
ation
SIL
1. To have safe unloading and prevent During all unloading operation 1.1. Possible jet fire 1.1. Independent parallel systems 100 S A G W SIL---
to any emergency condition due to this ESD shall be activated have been considered (mentioned in 2 1 1 1
operator error by automatic check up of initiator column) to prevent any

unloading facilities. incident, operator intervention
considered to be possible.
Node: 7.
Area: Off-Site
Final Element: 40HV-1401; 40P-2004 A/B; 40UAE-1401
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent to overfilling of butene High high level alarm in 40LT- 1.1. over pressure in sphere 1.1. 40PSV-1401A/B, high level 100 S A G W SIL2
sphere that may lead to overpressure 1401, cause by block outlet or may lead to breaking lines, alarm provided in 40LT-1401 4 1 1 2
and liquid carryover to BDM line by 40FV-1501, 1502 malfunction or leakage, explosion and ball
closing butene-1 inlet valve (40HV- any other circumstances. fire
1401) and stopping 40P-2004 A/B.
Node: 8.
Area: Off-Site

Final Element: 40P-2003 A/B; 40P-2004 A/B/C
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent butene feed pumps 40P- Low low level alarm in 40LT- 1.1. Damage to pump may 1.1. Operator intervention 100 S A G W SIL---
2003 A/B and 40P-2004 A/B/C damage 1401, blockage in inlet line to lead to leakage and possible considered to be possible, low low 1 1 1 2
due to low low level in sphere or inlet pumps, or any case in which jet fire. pressure alarm provided in 40PT-
line blockage by stopping pumps. valve on the outlet line on sphere 1411, moreover 40ESD-1405
bottom, loose the opened status. provided to stop pumps during low
low pressure
Node: 9.
Area: Off-Site
Initiators: 40P-2003 A/B (40YLH-1401A/B)

Final Element: 40P-2003 A/B; 40HSH-1401 AOR B
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To start spare pump automatically in 40YLH-1401A/B not active 1.1. loss of propane feed may 1.1. operator intervention considerd 10 S A G W SIL---
case of duty pump not active to prevent lead to process upset. to be possible. 0 1 1 2
loss of butene-1 feed due to stoppage

of pumps.
Node: 10.
Area: Off-Site
Initiators: 40PT-1413
Final Element: 40PV-1413
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To avoid any contamination of Tube rupture in 40E-2003 which 1.1. Contamination of cooling 1.1. high pressure alarm provided in 10 S A G W SIL---
cooling water by HC (butene-1) in case may lead to overpressure in water may lead to process 40PT-1413 0 1 1 2
of tube rupture by closing 40PV-1413. cooling water line. upset, environmental effects,
overpressure in CW line and
breakage.
1.2. Environmental effects 1.2. 10 G W E SIL---

such as HC release in to 1 2 1
undesirable location.
Node: 11.
Area: Off-Site
Initiators: 40PT-1411
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. to prevent damage to pump due to low low pressure in butene-1 1.1. Possible damage to pump 1.1. Low low level alarm provided in 100 S A G W SIL---
low low pressure in 40TK-2002 butene- storage sphere may lead to cavitations 40LT-1402, and ESD-1402 provided 1 1 1 2
1 storage sphere. leakage and jet fire. to trip pump due to low low level in
tank, operator intervention
Node: 12.
Area: Off-Site
Initiators: 40XS-1514, 40XS-1513

40XS-1512, 40ZE-1503
40ZE-1504, 40LSHH-1502, 40HV-1504, 40HV-1502
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent to any emergency Any loading procedure needs to 1.1. Possible leakage, jet fire. 1.1. Operator intervention 10 S A G W SIL---
condition due to improper loading by check the mentioned items. considered to be possible. 1 1 1 2
checking 40XL-1502 and 40UAE-1501
Node: 13.
Area: Off-Site
Initiators: 40XS-1511, 40XS-1510, 40XS-1515, 40ZE-1501, 40ZE-1502, 40LSHH-1501, 40HV-1501, 40HV-1503

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent to any emergency Any loading procedure needs to 1.1. Possible leakage, jet fire. 1.1. Operator intervention 10 S A G W SIL---
condition due to improper loading in check the mentioned items. considered to be possible. 1 1 1 2
bay 2, by checking 40VAE-1502, and

40XL-1501.
Node: 14.
Area: Off-Site
Drawings: 3454-XZ-DM-40-015

Final Element: 40HV-1502; 40HV-1504; 40HL-1514
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To align all the valves before running Any loading scenario needs to 1.1. Possible leakage and 1.1. Operator intervention 10 S A G W SIL---
the pumps and start with the truck check alignments. improper loading may lead to considered to be possible. 1 1 1 2
loading session in bay 1. jet fire.
Node: 15.
Area: Off-Site

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To align all the valves before running Any loading scenario needs to 1.1. Possible leakage and 1.1. Operator intervention 10 S A G W SIL---
the pumps and start with the truck check alignments. improper loading may lead to considered to be possible. 1 1 1 2
loading session in bay 2. jet fire.
Node: 16.
Area: Off-Site
Initiators: 40ESD-1501, 40ESD-1503, 40AAHH-1501,1502,1503,1504,1505,1506,1507,1508,1509, 40HS-1516, 40LSHH-1502, 40YA-1501A/B/C, 40HZLH-1402, 40FQAH-1502

SIL determination

Risk method)
Factor Risk
Estim
S A G W E
ation
SIL
1. To have safe loading and prevent to During all loading operation this 1.1. Possible leakage and jet 1.1. Independent parallel systems 100 S A G W SIL---
any emergency condition due to ESD shall be activated. fire. have been considered (mentioned in 2 1 1 2
operator error by automatic checkup of initiator column) to prevent any
loading facilities incident, operator intervention
Node: 17.
Area: Off-Site
Initiators: 40ESD-1502, 40ESD-1504, 40AAHH-1501,1502,1503,1504,1505,1506,1507,1508,1509, 40HS-1512, 40LSHH-1501, 40YA-1501A/B/C, 40HZLH-1402, 40FQAH-1501

Final Element: 40P-2004 A OR C; 40HV-1504; 40HV-1502; 40UAE-1506
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To have safe loading and prevent to During all loading operation this 1.1. Possible leakage and jet 1.1. Independent parallel systems 100 S A G W SIL---
any emergency condition due to ESD shall be activated. fire. have been considered (mentioned in 2 1 1 2
operator error by automatic checkup of initiator column) to prevent any

loading facilities incident, operator intervention
Node: 18.
Area:
Initiators: 40ESD-1501, 40ESD-1503, 40V-1502

Final Element:: 40P-2004A/C, 40UAE-1508
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent manual error during off- Any off spec butene-1 truck 1.1. Possible human error may 1.1. Operator intervention 10 S A G W SIL---
spec butene-1 truck loading in bay-1 loading in bay-1 needs to lead to improper loading, considered to be possible. 2 1 1 2
activate this ESD. leakage and jet fire.

Node: 19.
Area: Off-Site
Initiators: 40ESD-1502, 40ESD-1504, 40V-1501

Final Element: 40P-2004 B OR C; 40HV-1503; 40HV-1501; 40UAE-1507
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent manual error during off- Any off spec butene-1 truck 1.1. Possible human error may 1.1. Operator intervention 10 S A G W SIL---
spec butene-1 truck loading in bay-1 loading in bay-1 needs to lead to improper loading, considered to be possible. 2 1 1 2
activate this ESD. leakage and jet fire.
Node: 20.
Area: Off-Site

Final Element: 40P-2004 A OR C; 40UAE-1508
SIL determination

Risk method)
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent any emergency condition Any butene-1 unloading 1.1. Possible leakage, jet fire. 1.1. Operator intervention 10 S A G W SIL---
and incident during unloading of procedure needs to activate this considered to be possible, the 2 1 1 2
butene-1 truck by checking verifications interlock operation is manually and follows an
and local push button truck unloading operating procedure.
pressed.
Node: 21.
Area: Off-Site

Final Element: 40P-2004 B OR C; 40UAE-1509
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent any emergency condition Any butene-1 unloading 1.1. Possible leakage, jet fire. 1.1. Operator intervention 10 S A G W SIL---
and incident during unloading of procedure needs to activate this considered to be possible, the 2 1 1 2
butene-1 truck by checking verifications interlock operation is manually and follows an

and local push button truck unloading operating procedure.
pressed.
Node: 22.
Area: Off-Site
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent hexene tank overfilling by Blockage in tank outlet, any 1.1. Possible overfilling may 1.1. Operator intervention 10 S A G W SIL---
closing inlet valve and temporary stop disturbance in feed pumps, lead to pool formation and in considered to be possible, high level 2 1 1 2
the unloading pump. normal unloading. the worst case pool fire. alarm provided in 40LT-2001.
Node: 23.
Area: Off-Site

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To protect feeding pumps from low Low low level alarm in 40LT- 1.1. Damage to pump due to 1.1. Low level alarm proivded in 10 S A G W SIL---
low level in hexene tank or hexene tank 2002 or inlet valve malfunction. cavitation, leakage, jet fire 40LT-2001, operator intervention 2 1 1 2
discharge valve malfunciton by considered to be possible

stopping pumps.
Node: 24.
Area: Off-Site
Initiators: 40P-2007A/B, 40YLH-2001A/B

Final Element: 40HV-2002; 40P-2008 A/B
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent loss of hexene feeding stoppage of the duty pump due 1.1. Loss of feed may lead to 1.1. Operator intervention 0 S A G W SIL---
due to pump stoppage by automatic to any case. process upstream. considered to be possible 0 1 1 2
starting of stand by pump.
Node: 25.
Area: Off-Site
Initiators: 40XS-1903, 40XS-1902, 40XS-1901, 40ZE-2101, 40ZE-2102, 40LSHH-2101, 40HV-2102, 40HV-2101

Final Element: 40P-2007
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To give the permissive to the In loading and unloading time 1.1. possible leakage, jet fire 1.1. parallel independent systems 100 S A G W SIL---
operator to align the valves for truck this ESD shall be activated and pool fire have been considered (mentioned in 0 1 1 2
unloading operation to prevent leakage initiator column) to prevent any

or improper filling incident, operator intervention
Node: 26.
Area: Off-Site

Final Element: 40P-2007 A OR B
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent improper unloading due Any unloading operation needs 1.1. possible leakage, pool 1.1. operator intervention considered 10 S A G W SIL---
to incorrect alignment of valves by to follow this procedure formation possible pool fire jet to be possible 2 1 1 2
checking permissive verifications fire
Node: 27.
Area: Off-Site
Initiators: 40ESD-2101, 40ESD-2102, 40AAHH-2101,2102,2103,2104,2105, 40HS-2110, 40LSHH-2110, 40YA-2101, 40FQAH-2101, 40PT-2155

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To have safe loading and prevent to during all loading operation this 1.1. possible leakage, jet fire 1.1. Independent parallel system 100 S A G W SIL---
any emergency condition due to ESD shall be activated and pool fire have been considered operator 2 1 1 2
operator error by automatic check up of intervention considered to be

loading facilities possible
Node: 28.
Area: Off-Site
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent overfilling of hexane tank Block outlet or 40HV-1801 1.1. Possible pool formation 1.1. High level alarm provided in 100 S A G W SIL---
by closing inlet valve and temporary malfunction may lead to pool fire 40LT-1801 operator intervention 2 1 1 2
stop the unloading pump considered to be possible
Node: 29.
Area: Off-Site

Final Element: 40P-2008 A OR B; 40HV-2101; 40HV-2102
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent damage to hexane Low low level alarm in 40LT- 1.1. Possible damage to 1.1. Low level alarm provided in 10 S A G W SIL---
feeding pump by stopping them due to 1802 malfunction in 40HV-1801 pump, leakage and jet fire 40LI-1801, operator intervention 2 1 1 2
low low level on tank considered to be possible.
Node: 30.
Area: Off-Site
Initiators: 40-P-2005A/B
Final Element: 40HV-1802; 40P-2006 A/B
SIL determination

Risk method)
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent hexane feeding pump Stoppage of one of in operation 1.1. Possible loss of hexane 1.1. Operator intervention 10 S A G W SIL---
stoppage by automatic starting of hexane feeding pumps. may lead to process upset. considered to be possible. 0 1 1 2
starting by hexane feeding pumps in
case of stop of the duty pump.
Node: 31.
Area: Off-Site
Initiators: 40XS-1903, 40XS-1902, 40XS-1901, 40ZE-1901, 40ZE-1902, 40LT-1901, 40HV-1901, 40HV-1902

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent any incident during Any loading/unloading operation 1.1. Improper unloading 1.1. Parallel independent safeguards 10 S A G W SIL---
hexane truck unloading by checking needs to follow this procedure. operation may lead to pool have been considered, operator 2 1 1 2
verifications and give permission to formation and pool fire. intervention considered to be
start truck loading/unloading operation. possible
Node: 32.
Area: Off-Site

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent any emergency Any loading / unloading 1.1. possible pool formation 1.1. parallel independent safeguards 10 S A G W SIL---
circumstances by checking valve operation needs to check this and pool fire have been considered, operator 2 1 1 2
alignment before running pumps and procedure intervention considered to be
start with unloading session possible
Node: 33.
Area: Off-Site
Initiators: 40ESD-1901, 40ESD-1902, 40AAHH-1911,1912,1913,1914,1915, 40HS-1910, 40LSHH-1901, 40P-2006A/B, 40FQAH-1901

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To have safe loading and prevent to During all unloading operation 1.1. Possible leakage jet fire 1.1. Independent parallel systems 100 S A G W SIL---
any emergency condition due to this ESD shall be activated and pool fire have been considered, operator 2 1 1 2
operator error by automatic check up of intervention considered to be

unloading facilities. possible
Node: 34.
Area: Off-Site
Interlock ID: 40FCS-1001
Initiators: 40P-7001A/B
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent loss of safety shower stoppage of duty pumps will lead 1.1. No safety issues 1.1. Operator intervention 10 S A G W SIL---
water by automatic starting of the stand to activate this interlock considered to be possible. 0 1 1 2
by pump in case of stop of the duty
pump
Node: 35.
Area: Off-Site
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent damage to pump due to Malfunction in 40LV-101, 1.1. Possible damage to 1.1. Low level alarm provided in 10 S A G W SIL---
low low level in upstream drum and blockage in inlet line pump, no safety issues 40LT-1001 0 1 1 2
consequently possible loss of inlet

stream by stopping pumps.
Node: 36.
Area: Off-Site
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent overfilling of C6+ storage Block outlet malfunction in 40HV- 1.1. possible pool formation 1.1. Operator intervention 10 S A G W SIL---
tank by closing 40HV-2302. 2301 and pool fire considered to be possible, high level 2 1 1 2
alarm provided in 40LT-2301
Node: 37.
Area: Off-Site

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent to pump damage due to Low low level alarm in 40LT- 1.1. Possible damage to 1.1. Low level alarm provided in 10 S A G W SIL---
loss of upstream flow by stopping pump 2302 pump, leakage and jet fire 40LT-2301, operator intervention 2 1 1 2
Node: 38.
Area: Off-Site
Initiators: 40XS-2303, 40XS-2402, 40XS-2401, 40ZE-2401, 40ZE-2402, 40LSHH-2401

40HV-2401, 40HV-2402
Final Element: 40HV-2302
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To give the permissive to the All loading operation needs to 1.1. Possible leakage, pool 1.1. Parallel independent safeguards 10 S A G W SIL---
operator to align the values for truck follow this procedure formation and pool fire have been considered, operator 2 1 1 2
loading operation intervention considered to be

possible.
Node: 39.
Area: Off-Site

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To align all the valves before running All loading operation needs to 1.1. improper loading may 1.1. operator intervention considered 10 S A G W SIL---
the pumps and start C6+ loading activate this interlock. lead to leakage pool formation to be possible. 2 1 1 2
procedure by checking verifications and and jet fire

press local push button to open
emergency valves on vapor return
liquid and C6+ line.
Node: 40.
Area: Off-Site
Initiators: 40ESD-2401, 40ESD-2402, 40AAHH-2411,2412,2413,2414,2415, 40HS-2410, 40LSHH-2401, 40P-2006A/B, 40FQAH-2402

Final Element: 40UAE-2401; 40XL-2404
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To trip truck unloading operation Any emergency condition, gas 1.1. possible leakage jet fire or 1.1. Operator intervention 10 S A G W SIL---
whenever one of the emergency detection, unverficiation pool fire considered to be possible. 2 1 1 2
conditions occurred
Node: 41.
Area: Off-Site
Initiators: 40LSLL-0801, 40LSHL-0804

Final Element: 40HV-2402; 40HV-2401; 40HV-2302
SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To prevent pump damage due to low Low low level or high high level 1.1. Possible damage to 1.1. Low level alarm provided in 10 S A G W SIL---
low level in basin and overfilling due to in waste water basin. pump, overfilling, pool 40LSHL-0804, operator intervention 0 1 1 2
loss of in duty pump (control of level in formation, no safety issues. considered to be possible.
waste water basin)
Node: 42.
Area: Off-Site
Initiators: 40LSHL-0803, 40P-1003A/B

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To control level in the LPG monomer Low level and high level alarm in 1.1. Possible damage to 1.1. Operator intervention 10 S A G W SIL---
storage area collection basin, 40Z- 40Z-1004 pump, overfilling and pool considered to be possible. 0 1 1 2
1003, by start / stop 40P-1004 formation
Node: 43.
Area: Off-Site
Initiators: 40LSHL-0802, 40P-1004

SIL determination

method)
Risk
Factor Risk
Estim
S A G W E
ation
SIL
1. To control level in the LPG monomer Low level and high level alarm in 1.1. Possible damage to 1.1. Operator intervention 10 S A G W SIL---
storage area collection basin, by basin. pump, overfilling and pool considered to be possible. 0 1 1 2
automatic start / stop of 40P-1003. formation

N248 SZ RT 007 Iso2 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

N248 SZ RT 007 Iso2 PDF

Uploaded by

Copyright:

Available Formats

Bakhtar Petrochemical Company

Lorestan Petrochemical Company (LPC)

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

SIL CLASSIFICATION REPORT FOR OFF-SITE

02 Issued for Approval K. K. F. D. A. M. 22.JUN.2010

REV. DESCRIPTION DRAWN UP CHECKED APPROVED DATE

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

1. INTRODUCTIN AND SCOPE OF WORK ............................................................................ 3

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

1 INTRODUCTIN AND SCOPE OF WORK

PLANT AREA CODE 10

PLANT AREA CODE 20

PLANT AREA CODE 30

PLANT AREA CODE 40

PLANT AREA CODE 50

PLANT AREA CODE 70

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

1.2 OBJECTIVES OF STUDY

1.3 SCOPE OF STUDY

2 SIL STUDY BASIS AND DEFINITIONS

2.1 STUDY BASIS

The study was based on:

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

2.2 DEFINITION OF SIL

Table 2.1 Probability of Failure on Demand for SIL

2.3 BACKGROUND TO RISK BASED APPROACH ADOPTED FOR SIL SELECTION

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

T arg et risk level (ie acceptable risk after mitigation)

PFD = 10-4 / (10-1 x 1) = 10-3

The required SIL is 2.

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

The methodology defined in the LORESTAN / MAHABAD PETROCHEMICAL COMPANY:

3.1.1 Identification of SIFs

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

3.1.2 Description of Function, Initiators and Final Elements

3.1.3 Causes of SIF Demand and Consequences of SIF Failure

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

A demand on a SIF may be caused by instrument malfunction, operator error, or

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

3.2 FURTHER ELABORATION ON THE APPROACH ADOPTED

3.2.1 Multiple Sensors

3.2.2 Multiple Final Elements

3.2.3 Consideration of PSV (Safety Valves)

3.2.4 Independent Protective Layers

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

3.3 SIL STUDY GUIDELINES

Under stress, emergency, action performed more than once a W3

Unstressed, action performed more than once a quarter W2

Under stress, emergency, action performed once/ Qtr. Or less

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

Table 3.3 Rule Set for Enabling event Factors

Table 3.4 Rule Set for Exposure Parameter Avoidance parameter

N248-SZ-RT-007 --------- SIL CLASSIFICATION REPORT FOR OFF-SITE 1500-SZ-RT-007

SIL Classification Flow Chart

CAUSES OF SIF CONSEQUENCE OF

ASSESSMENT OF INDEPENDENT PROTECTION LAYER

SIL FOR SIF

Consider if SIL in necessary for all final

ALL SIF CLASSIFIED

(W) Frequency of Demand

(A) Presence in danger zone at time of demand

(G) Possibility to avert hazard

(W) Frequency of demand