Professional Documents
Culture Documents
Page
2342 AA00 JSM 202 0 1/19
INDEX
This document covers the procedure for the combined Hazard and Operability study
and the Safety Integrity Level (SIL) determination for the Safety Instrumented
Functions (SIFs) that shall be undertaken by the EPC Contractor (here after referred
as “Contractor”) during the Engineering Procurement Construction (EPC) phase for the
Karbala Refinery Project.
The HAZOP Analysis, developed during the FEED phase, identified a number of
recommendations aimed to increase the safety and operability of the systems. Two
levels of recommendations were considered:
First level: Recommendations closed during the FEED phase of the Project and
relevant actions implemented in the Project FEED Documentation.
Second level: Recommendations to be closed during the EPC phase. It is
responsibility of the Contractor to ensure proper follow-up and closure of all
these Recommendations.
The list of Recommendations assigned to Contractor is given for each unit in the
relevant part of ITB Package. Refer to “FEED HAZOP Review Report” - (Doc. 2234-
unit/section code-ML-210), and “FEED HAZOP Review Recommendation Close Out
Report (Doc. 2234-unit/section code-ML-220).
As part of the Flare Study developed during the FEED Stage of Karbala Project a
number of additional requirements were identified aimed to reduce the relief loads to
the flare. These shall be considered during the Detailed HAZOP / SIL Review during
the EPC phase.
The preliminary design of the Karbala Refinery flare system, as described in the Flare
Study Report from the FEED phase will be reviewed, optimized and modified as
needed by Contractor. As a result of this, Contractor:
- will have to confirm the need for all Safety Instrumented Functions which have
been already foreseen during the FEED phase as preliminary flare mitigation
measures.
- will add new Safety Instrumented Function as required to reduce flare loads further
more, if needed for flare design optimisation.
- will give the appropriate SIL level requirement to each Safety Instrumented
Function.
The Review shall be developed when information on Major Packages and Machineries,
Chemical Injection Systems, Operating/Start-up Procedures are available, but early
enough to be properly implemented during detailed engineering.
The Management of Changes shall cover all P&IDs issues after the Detailed HAZOP
and SIL Review.
2. Study Objectives
The objective of the HAZOP study is to identify hazards and operability problems that
may be encountered during the operation of the facility such that suitable mitigation
measures can be incorporated in the design and/or in the operating procedures.
During the HAZOP review sessions, issues of concern will be defined and party
responsible for resolution will be identified, but no solution will be proposed.
Resolutions for identified issues will be solved after the completion of the HAZOP
review by the responsible parties and reported in a separate document (HAZOP
Follow-up Report).
HAZOP Review cannot be intended as a review of project design bases and operating
philosophies, since these must be defined before the HAZOP Review is carried out.
The objective of the SIL study is to determine the Safety Instrumented System (SIS)
required to prevent and to mitigate hazardous events and the Safety Integrity Level
(SIL) that the SIS has to be designed, to prevent the occurrence of hazardous event or
in some scenarios, to mitigate the consequences from such hazardous event.
The SIL indicates the minimum level of reliability in terms of Probability of Failure on
Demand (PFD) required for a SIF. Such failure probabilities are:
SIL PFD
10 to 10
-2 -1
1
10 to 10
-3 -2
2
10 to 10
-4 -3
3
10 to 10
-5 -4
4
The request of a SIL 4 has to be considered as extremely rare in the process industry.
If a classification leads to SIL 4, further study should be performed, aimed at
rearrangement of the section or installation under analysis (development of process
alternatives to eliminate the need for a SIL 4). Each SIF comprises of an initiating
element (process sensor), a logic solver (PLC/DCS), a final element (shutdown valve,
machinery).
The following documentation shall be available during the Detail HAZOP/SIL Review:
2.2. Acronyms
2.3. Definitions
SIF
Safety function with a specified safety integrity level which is necessary to achieve
functional safety and which can be either safety instrumented protection function.
SIL
Discrete level (one out of four) for specifying the safety integrity requirements of the
safety instrumented functions to be allocated in safety instrumented systems. Safety
integrity level 4 has the highest level of safety integrity; safety integrity level 1 has the
lowest.
SIS
Instrumented system used to implement one or more safety instrumented functions.
IPL
Independent protection layer is applied to a safeguard which is capable of preventing a
scenario from proceeding to its undesired consequence independent of the initiating
event or the action of any other layer of protection associated with the scenario. There
is a slight distinction however, in IEC 61511, between the terms ‘protection layer’ and
‘independent protection layer’. Although both need to meet the criteria mentioned
above, a safeguard may qualify as a ‘Protection layer’, if at least a factor of 10 risk
reduction can be achieved while to qualify as an ‘independent protection layer’, a
higher degree of reliability is required (i.e. reduces the identified risk by a minimum of
100 fold). While this study report has used the term ‘IPL’ for all protection layers, a
100-fold risk reduction is applied only to those protection layers such as PSVs which
meet the criteria of IPL as defined in IEC 61511.
3. TEAM ORGANIZATION
The HAZOP and SIL Review shall be lead by a Third Party independent from the
Project.
The HAZOP and SIL Review shall cover all the P&IDs. The Team Leader shall ensure
that the technique is systematically applied to all parts of a system such that safety and
operability problems on the complete system are identified.
A detailed list of guide words to be used for the various HAZOP reviews of the EPC
phase is attached in Appendix B.
4.1.1. Consequences
The potential consequences of each deviation will be discussed and assessed within
the limits of the information available and the expertise of the team. The potential
consequence threats will be assessed without considering operator or instrument
intervention or any mitigation or safeguards. Consequences will focus on possible
major effects in terms of personal safety, environment and production/equipment loss.
4.1.2. Safeguards
The team will identify safeguards that are effective in preventing or controlling the
hazards. The safeguards can be classified as Independent Protection Layers (IPLs)
and non-IPLs. An IPL is a device, system or action that is capable of preventing a
scenario from proceeding to its undesired consequence independent of the initiating
event or the action of any other layer of protection associated with the scenario. An IPL
may also include a Safety Instrumented System (SIS). Appendix A shows the rule
sets for IPLs.
The team will provide recommendations if the existing protective measures are found
to be inadequate. Actions will be recommended to eliminate or mitigate any residual
hazard that is considered significant.
The recommendation may take the form of design changes (e.g. addition of an alarm
or increase the design temperature) or request for further clarification on design basis.
A SIF consists of one or more initiators, the logic solver and the final elements. The
initiators are the sensors that detect one or more initiating events or the hazardous
situation. The final elements are all the actuators that are required to bring the process
to a safe state to avert the hazardous event.
The final element(s) of the SIF will be chosen as those which directly meet their design
intent. Thus, only one or two final elements will be usually defined for any function, and
where more than one is selected, a success criterion will be defined for these final
elements. The other elements acted upon by the initiators will be left unclassified (they
will however, be retained for implementation in the ESD system).
SIL Classification will assign a discrete level (SIL 1, SIL 2, etc.) to every SIF identified.
All consequences shall be classified and the most stringent SIL shall be selected for
that function. If the demand has different causes, the consequences of failure on
demand will usually be different as well, requiring a classification for all causes and
consequences.
For each aspect, the following will be considered for the analysis:
Severity Levels
Frequency of Demand
Safeguards
Severity Levels
Severity Levels will be selected in accordance to the consequence identified in the review
and categorised in personal safety (S), environmental (E) and production/equipment loss
(P). An example of severity categorization is shown in Table 3.1.
Table 4.1 Hazard severity level in terms of personal safety, environment and
production/equipment loss
Hazard Severity Levels
Level Severity
4 - Catastrophic S4: Several deaths or very many seriously injured.
Severity for safety impacts will be determined based on the nature of fluid handled,
e.g., sweet gas, sour gas, flashing liquids, liquids handled above boiling point, hot
liquids, liquids near auto ignition temperature etc. The size of release and inventory
may also be considered. This may be further expanded during the course of the study
to ensure consistency in assigning severity levels.
Also the presence of personnel and escape possibility may be considered for safety
severity levels determination according to guidelines of IEC-61511.
Production loss estimates will be determined based on expected downtime and impact
on production. Approximate monetary impacts due to production loss will be provided
by COMPANY for each unit and for the plant as a whole. Impact on production will then
be determined by the team based on cascading effect on other units, availability of
standby equipment/ trains, availability of storage capacity etc.
For equipment damage costs, equipment costs will be assumed based on the team’s
experience on approximate costs for similar size equipment. Where standby
equipment is provided, no production loss may apply but damage costs will be
considered.
In any case the main severity criteria to be considered are relative to safety or/and
environment. Production losses or cost criteria should only be used as complementary
information only.
Frequency of Demand
Safeguards
During the frequency of demand analysis, the provision of other safeguards for the
specific scenario will be reviewed. For each safeguard identified (IPL), a risk reduction
factor will be determined. Guidelines for IPL determination are given in Appendix A.
APPENDIX A
For control failure involving a control valve whose failure position is opposite to that
which leads to a hazard, the likelihood may be assigned lower than suggested above,
based on the study team’s experience.
APPENDIX B
APPENDIX C
2) Attachments
DRAWING LIST
NODE LIST
ATTENDANCE LIST
HAZOP/SIL WORKSHEETS
HAZOP/SIL RECOMMENDATION CLOSE OUT FORM
SIL CLASSIFICATION LIST
HAZOP MASTER P&IDS