Vous êtes sur la page 1sur 43

TANGGUH EXPANSION PROJECT DEFINE

LNG FEED

PRELIMINARY SIL VERIFICATION REPORT

Code Description
A Proceed - No comment
B Proceed - With comment
C Do Not Proceed - Revise & Resubmit
D Cancelled
E Received as information
Signature:

Enza Fiore/ 23-Oct-15 Niccolo Gerrosa/ 23-Oct-15 Marco DAmico 23-Oct-15


A01 Issued for Review
Ganda Himawan Jumriani
Rev Reason for Issue Author Date Checked Date Approver Date

! This document is copyright and shall Document Number Contractor Doc Number
not be reproduced without the
permission of BP
TEP-900-RPT-HS-BP4-0004 870300-PTS-900-LPE-REP-12004

Document Class
BP p.l.c.
Security Classification:
BP Confidential
2
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Table of Contents

1 Introduction ................................................................................................. 5
1.1 Project Overview ..........................................................................................................5
1.2 Scope ...........................................................................................................................5
1.3 Owner and Contractual Standards ..............................................................................22
1.4 International Standards ...............................................................................................22
1.5 Contractor Document .................................................................................................22
1.6 Order of Precedence ..................................................................................................22
2 Symbols, Abbreviations and Definitions ....................................................... 23
3 Methodology.............................................................................................. 24
3.1 General .......................................................................................................................24
3.2 Probability Requirements ............................................................................................24
3.2.1 General .................................................................................................................................24
3.2.2 PFD Formulas .......................................................................................................................25
3.3 Hardware Fault Tolerance ...........................................................................................28
4 Reliability Data ........................................................................................... 31
4.1 General .......................................................................................................................31
4.2 Sensors ......................................................................................................................32
4.3 Logic Solver (SIS) ........................................................................................................32
4.4 Final Elements ............................................................................................................32
4.5 PFD Calculation Chart .................................................................................................32
4.6 Architectural Constraints.............................................................................................32
5 SIL Verification Results ............................................................................... 34
6 Conclusions and Recommendations ............................................................ 36
Appendix A PFD Calculation Sheet .................................................................. 42
Appendix B HFT Compliance Sheet ................................................................. 43

List of Table
Table 1 Allocation Results and SIL Verification Scope of Work ............................................................ 5
Table 2 SIFs to be verified ................................................................................................................ 21
Table 3 Probability of failure on demand for SIL levels (Low Demand Mode)..................................... 24
Table 4 Minimum hardware fault tolerance of sensors and final elements ........................................ 28
Table 5 Minimum hardware fault tolerance of PE logic solvers.......................................................... 29
Table 6 Maximum allowable SIL for a SIF carried out by a type A safety-related element or subsystem
........................................................................................................................................................... 30
Table 7 Maximum allowable SIL for a SIF carried out by a type B safety-related element or subsystem
........................................................................................................................................................... 30
Table 8 Reliability Data for Components ........................................................................................... 31

TEP-900-RPT-HS-BP4-0004 Page 2 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Table 9 SIL satisfied based on SFF and redundancy .......................................................................... 33


Table 10 SIL verification results ........................................................................................................ 34
Table 11 USVE Reliability Data.......................................................................................................... 36
Table 12 Recommendations Table .................................................................................................... 36

List of Figures
Figure 1 Block diagram, voting logic 1oo1 ......................................................................................... 25
Figure 2 Block diagram, voting logic 1oo2 ......................................................................................... 26
Figure 3 Block diagram, voting logic 2oo2 ......................................................................................... 27
Figure 4 Block diagram, voting logic valid for 1oo3, 2oo3 and 3oo3 ................................................... 27

TEP-900-RPT-HS-BP4-0004 Page 3 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Revision History
Amendment Revision Amender Amendment
Date Number Name

OMS references
OMS section OMS section title Relevant section of this
ref document
3.3 Process Safety
5.2 Design and Construction

Related documents
Document number Document name Description of Content

Stakeholders
Name Date Reviewed
A. Muldoon - Engineering Lead
I. Musthafa - Process Safety Lead
A. Daya Wiguna Process Lead
A. Witjaksono I and C Lead

TEP-900-RPT-HS-BP4-0004 Page 4 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

1 Introduction
1.1 Project Overview
BP Berau Ltd., hereafter known as COMPANY, is the operator of Tangguh LNG, a two train natural
gas (NG) liquefaction facility in Bintuni Bay, Papua, Indonesia. The facility includes associated onshore
infrastructure, two offshore platforms, pipelines and twelve wells. These facilities are the Trains 1 and
2 developments at Tangguh.
COMPANY has initiated the Tangguh Expansion Project to commercialize the incremental resource
into high margin gas markets based on a single LNG (liquefied natural gas) train expansion (Train 3).
Tangguh Expansion Project will consist of new offshore facilities, including wellhead platforms and
pipelines, and onshore development on the existing Tangguh brownfield site. The new onshore
facilities will include one additional natural gas liquefaction train of a similar design and capacity to the
existing trains, an onshore receiving facility (ORF), new LNG and condensate loading berth, additional
boil off gas (BOG) recovery, utilities, flares and the infrastructure to support logistics and the
associated increase in the temporary and permanent workforce.
The Tangguh Expansion Project comprises of the following new facilities:
[New] Onshore Receiving Facility (ORF)
[New] LNG Train 3
[New] Condensate Stabilization Train 3
[New/Interconnection] Plant Utility Facilities
[New] LNG Loading System
[New] Condensate Loading System
[Expansion] Integrated Control and Safety System (ICSS)
[Expansion] Telecommunication System
[New] Trestle Jetty Structure
[Expansion] Onshore Infrastructure
Hazardous and Non-hazardous Waste Management System

1.2 Scope
The objective of the SIL verification activity is to confirm that the analyzed automatic protection loops
meet the SIL requirements, assigned by means of LOPA analysis, both from probability of failure on
demand (according to equations described in IEC 61508-6) and architectural constrains.
The LOPA was conducted by a BP-approved Atkins Leader and was attended by a multi-disciplinary
team which included representatives from the Contractor A TEP FEED team, representatives from the
BP embedded team and Tangguh LNG operations team members. The LOPA was held over two
weeks from 3rd August to the 15th August 2015 in Alamanda Tower, Jakarta, Indonesia.
The present document describes methodology and reports the results of the SIL verification process.
SIL verification has been performed for SIF Loops Allocated as reported in the LOPA Report.
The complete list of LOPA scenario and related allocation results is reported in following Table 1,
together with identified SIF, if any, and the relevant SIL requirements. For each SIL rated item of the
table it is indicated if included in SIL Verification process Scope of Work, taking into account if a SIF is
associated to the scenario.
Table 1 Allocation Results and SIL Verification Scope of Work

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
043-E-31002 shell- Not SIL rated, not included in
1 - SIL 0
side high pressure Preliminary SIL Verification

TEP-900-RPT-HS-BP4-0004 Page 5 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Report
Not included in Preliminary SIL
043-E-31003 shell-
2 - SIL 1 Verification Report since < SIL
side high pressure
2

053-C-31001
Included in Preliminary SIL
3 discharge high 053-PAHH-31187 SIL 3
Preliminary Verification Report
pressure

043-T-31001 high Included in Preliminary SIL


4 043-PAHH-31032 SIL 2
pressure Verification Report
Upon close out of
Recommendation #64
043-E-31001 shell from the Critical P&ID Included in Preliminary SIL
5 053-PAHH-31858 SIL 2
side high pressure Review an additional SIF Verification Report
may be considered (e.g.
high pressure trip)

043-E-31001 tube
Not included Preliminary SIL
side high pressure
6 - SIL 1 Verification Report since < SIL
(warm tube bundle -
2 and no SIF defined in LOPA
feed gas)

LPG reinjection high Included in Preliminary SIL


7 043-PAHH-31726 SIL 2
pressure Verification Report

053-D-31007 high Included in Preliminary SIL


8 053-PAHH-31487 SIL 2
pressure Verification Report
Sudden contraction will
not lead to LOPC. LOPC No SIF defined in LOPA,
LNG rundown line is only considered scenario not included in
9 - -
low temperature credible due to a bowing Preliminary SIL Verification
effect (i.e. liquid LNG Report
introduced into line).

Not SIL rated, not included in


LNG rundown line
10 - SIL 0 Preliminary SIL Verification
high temperature
Report

Upon close out of


Recommendation #19 No SIF defined in LOPA,
043-E-31004 tube
from the Critical P&ID scenario not included in
11 side low - SIL 3
Review an additional IPL Preliminary SIL Verification
temperature
may be considered for Report
Causes 1 to 4.
043-T-31001 low Included in Preliminary SIL
12 043-LAHH-31044 SIL 2
level Verification Report

Not included in Preliminary SIL


043-E-31004 tube
13 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
071-TK-1001/2 high need to consider causes phase. SIF not included in
14 043-TAHH-31258 -
pressure in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.
15 LNG rundown line - SIL 0 Not SIL rated, not included in

TEP-900-RPT-HS-BP4-0004 Page 6 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
bowing. Preliminary SIL Verification
Report
043-E-31001 tube
side high pressure Not included in Preliminary SIL
16 (middle and cold - SIL 1 Verification Report since < SIL
tube bundles - LNG 2 and no SIF defined in LOPA
product)
Upon close out of
No SIF defined in LOPA,
Recommendation #21
043-T-31002 high scenario not included in
17 - SIL 4+ from the Critical P&ID
level Preliminary SIL Verification
Review an additional SIF
Report
may be considered.
Upon close out of No SIL Verification required
043-T-31003 feed Recommendation #150 since hazard has been
18 line high 043-PAHH-31273 SIL 4+ from the Critical P&ID removed following Company
temperature Review this hazard may approval of Recommendation
be removed. #150 implementation
MP steam Not included in Preliminary SIL
19 condensate flash - SIL 1 Verification Report since < SIL
drum high pressure 2 and no SIF defined in LOPA

043-T-31002 low Included in Preliminary SIL


20 043-LALL-31285 SIL 2
level Verification Report

043-T-31002 high Included in Preliminary SIL


21 043-PAHH-31273 SIL 2
pressure Verification Report

053-C-31002
Included in Preliminary SIL
22 discharge high 053-PAHH-31487 SIL 2
Verification Report
pressure

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
074-TK-1001 high need to consider causes phase. SIF not included in
23 - -
level in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Upon close out of No SIL Verification required


Recommendation #39 since hazard has been
C2 transfer line high
24 - SIL 4+ from the Critical P&ID removed following Company
temperature
Review this hazard may approval of Recommendation
be removed. #39 implementation

Not included in Preliminary SIL


043-E-31006 shell
25 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA

Upon close out of


Recommendation #24
043-T-31003 high Included in SIL Verification
26 043-LAHH-31434 SIL 3 from the Critical P&ID
level Report
Review an additional SIF
may be considered.

043-T-31003 high Included in SIL Verification


27 043-PAHH-31423 SIL 3
pressure Report
043-T-31004 feed Upon close out of Hazard has been removed
28 line high - SIL 4+ Recommendation #26 following Company approval of
temperature from the Critical P&ID Recommendation #26

TEP-900-RPT-HS-BP4-0004 Page 7 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Review this hazard may implementation
be removed.
043-T-31003 low Included in SIL Verification
29 043-LALL-31434 SIL 2
level Report

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations
SIL to be defined in EPC
074-TK-1002A/B need to consider causes
30 - - phase. SIF not included in SIL
high level in existing facilities which
Verification Report
were not included in the
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Not included in Preliminary SIL


C3 transfer line high
31 053-PAHH-31359 SIL 1 Verification Report since < SIL
pressure
2 and no SIF defined in LOPA

No SIF defined in LOPA,


043-T-31004 high scenario not included in
32 - SIL 3
leve Preliminary SIL Verification
Report
043-T-31004 high
33 043-PAHH-31573 SIL 4+ SIF considered outstanding
pressure

Due to close out of Hazard has been removed


C2 liquid for LPG
Recommendation #48 following Company approval of
34 reinjection pipework - -
this consequence has Recommendation #48
high pressure
been removed. implementation

Due to close out of Hazard has been removed


C2 vapour for LPG
Recommendation #48 following Company approval of
35 reinjection pipework - -
this consequence has Recommendation #48
high pressure
been removed. implementation
Due to close out of Hazard has been removed
C3 liquid for LPG
Recommendation #48 following Company approval of
36 reinjection pipework - -
this consequence has Recommendation #48
high pressure
been removed. implementation

Due to close out of Hazard has been removed


Dilution gas line Recommendation #52 following Company approval of
37 - -
high pressure this consequence has Recommendation #52
been removed. implementation
Upon close out of
Hazard has been removed
Recommendation #93
043-E-31012 shell following Company approval of
38 - SIL 1 from the Critical P&ID
side high pressure Recommendation #93
Review an additional IPL
implementation
may be considered.
043-E-31001 tube
side high pressure Not included in Preliminary SIL
39 (warm, middle and - SIL 1 Verification Report since < SIL
cold tube bundles - 2 and no SIF defined in LOPA
LPG reinjection)
N2 system high Included in SIL Verification
40 053-PDALL-31469 SIL 2
pressure Report

Due to close out of Hazard has been removed


053-C-31003
Recommendation #67 following Company approval of
41 suction low - -
this consequence has Recommendation #67
pressure
been removed. implementation

TEP-900-RPT-HS-BP4-0004 Page 8 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Upon close out of
Hazard has been removed
053-C-31002 Recommendation #93
following Company approval of
42 discharge low - SIL 3 from the Critical P&ID
Recommendation #93
temperature Review this hazard may
implementation
be removed.

053-C-31003
43 discharge high 053-TAHH-31578 SIL 4+ SIF considered outstanding
temperature
053-C-31002 Not SIL rated, not included in
44 excess nitrogen - SIL 0 Preliminary SIL Verification
flow Report

053-C-31003 Not SIL rated, not included in


45 excess nitrogen 053-TAHH-31578 SIL 0 Preliminary SIL Verification
flow Report

053-C-31004 Not SIL rated, not included in


46 excess nitrogen 053-TAHH-31638 SIL 0 Preliminary SIL Verification
flow Report
053-C-31004
47 discharge high 053-TAHH-31638 SIL 4+ SIF considered outstanding
temperature

053-C-31002
Included in Preliminary SIL
48 discharge high 053-TAHH-31489 SIL 2
Verification Report
temperature
053-C-31003
Included in Preliminary SIL
49 discharge high 053-PAHH-31576 SIL 2
Verification Report
pressure

Due to close out of Hazard has been removed


053-C-31004
Recommendation #67 following Company approval of
50 suction low - -
this consequence has Recommendation #67
pressure
been removed. implementation
Upon close out of
Hazard has been removed
053-C-31003 Recommendation #71
following Company approval of
51 discharge low - SIL 3 from the Critical P&ID
Recommendation #71
temperature Review this hazard may
implementation
be removed.

053-C-31004
Included in Preliminary SIL
52 discharge high 053-PAHH-31636 SIL 2
Verification Report
pressure
Upon close out of
Hazard has been removed
053-C-31004 Recommendation #71
following Company approval of
53 discharge low - SIL 3 from the Critical P&ID
Recommendation #71
temperature Review this hazard may
implementation
be removed.

No SIF defined in LOPA,


053-E-31007 shell scenario not included in
54 - SIL 2
side high pressure Preliminary SIL Verification
Report

Not included in Preliminary SIL


053-E-31008 shell
55 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA
Not included in Preliminary SIL
053-E-31009 shell
56 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA
Not included in Preliminary SIL
053-E-31010 shell
57 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA

TEP-900-RPT-HS-BP4-0004 Page 9 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Upon close out of
Hazard has been removed
053-E-31009 shell Recommendation #75
following Company approval of
58 side low - SIL 3 from the Critical P&ID
Recommendation #75
temperature Review this hazard may
implementation
be removed.

Upon close out of


Hazard has been removed
053-E-31010 shell Recommendation #75
following Company approval of
59 side low - SIL 3 from the Critical P&ID
Recommendation #75
temperature Review this hazard may
implementation
be removed.

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
074-TK-1001 high need to consider causes phase. SIF not included in
60 - -
pressure in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

043-E-31001 tube
side high pressure Not included in Preliminary SIL
61 (warm and middle - SIL 1 Verification Report since < SIL
tube bundles - MR 2 and no SIF defined in LOPA
liquid)

043-E-31001 tube
side high pressure Not included in Preliminary SIL
62 (middle and cold - SIL 1 Verification Report since < SIL
tube bundles - MR 2 and no SIF defined in LOPA
lquid)

Upon close out of


Recommendation #86
from the Critical P&ID No SIF defined in LOPA,
053-C-31001
Review 053-PSV- 31151 scenario not included in
63 suction high - SIL 4+
on the HP C3 Compressor Preliminary SIL Verification
pressure
Suction Drum may be Report
considered as an
additional IPL.
053-C-31001
Included in Preliminary SIL
64 discharge high 053-TAHH-31189 SIL 3
Verification Report
temperature
053-C-31001 Not SIL rated, not included in
65 excess nitrogen - SIL 0 Preliminary SIL Verification
flow Report
No SIF defined in LOPA,
053-D-31004 high scenario not included in
66 - SIL 3
pressure Preliminary SIL Verification
Report

Upon close out of


No SIF defined in LOPA,
Recommendation #97
053-D-31006 low scenario not included in
67 - SIL 3 from the Critical P&ID
pressure Preliminary SIL Verification
Review additional IPLs
Report
may be considered.

Not included in Preliminary SIL


053-P-31006 high
68 053-PAHH-31359 SIL 1 Verification Report since < SIL
pressure
2 and no SIF defined in LOPA

TEP-900-RPT-HS-BP4-0004 Page 10 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
No SIF defined in LOPA,
053-D-31006 high scenario not included in
69 - SIL 3
level Preliminary SIL Verification
Report

Not included in Preliminary SIL


023-D-31004 low
70 - SIL 1 Verification Report since < SIL
level
2 and no SIF defined in LOPA
Not included in Preliminary SIL
023-D-31008 low
71 023-LALL-31057 SIL 1 Verification Report since < SIL
water level
2

Not included in Preliminary SIL


023-D-31008 low
72 023-LALL-31056 SIL 1 Verification Report since < SIL
condensate level
2

Not included in Preliminary SIL


023-E-31005 shell
73 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA

Not included in Preliminary SIL


033-E-31001 shell
74 - SIL 1 Verification Report since < SIL
side high pressure
2 and no SIF defined in LOPA

Not included in Preliminary SIL


033-D-31001 low
75 033-LALL-31054 SIL 1 Verification Report since < SIL
condensate level
2

Not included in Preliminary SIL


033-D-31001 low
76 033-LALL-31055 SIL 1 Verification Report since < SIL
water level
2
Upon close out of
Recommendation #103 No SIF defined in LOPA,
033 Regeneration
from the Critical P&ID scenario not included in
77 gas circuit high - SIL 3
Review Cause 8 may be Preliminary SIL Verification
pressure (Fire/VCE)
changed to PV fails Report
closed during start-up.
OG compressor is not
part of the critical P&ID
review and hence not
considered in LOPA as
the LOPA calculations
071 BOG SIL to be defined in EPC
need to consider causes
compressor phase. SIF not included in
78 - - in existing facilities and
discharge high Preliminary SIL Verification
other parts of the project
pressure Report
facilities not included in
the Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Upon close out of


Hazard has been removed
033-E-31006 shell Recommendation #101
following Company approval of
79 side high - SIL 3 from the Critical P&ID
Recommendation #101
temperature Review this hazard may
implementation
be removed.

Not SIL rated, not included in


053-D-31103 high
80 - SIL 0 Preliminary SIL Verification
pressure
Report

No further Not SIL rated, not included in


033-E-31005 shell
81 - risk reduction Preliminary SIL Verification
side high pressure
required. Report
033-E-31006 shell No further Not SIL rated, not included in
82 -
side high pressure risk reduction Preliminary SIL Verification

TEP-900-RPT-HS-BP4-0004 Page 11 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
(Jet Fire) required. Report
No SIF defined in LOPA,
033-E-31006 shell
scenario not included in
83 side high pressure - SIL 3
Preliminary SIL Verification
(Fire/VCE)
Report

Fuel gas system is not


part of the critical P&ID
review and hence not
considered in LOPA as
the LOPA calculations SIL to be defined in EPC
HP fuel gas turbines need to consider causes phase. SIF not included in
84 033-TAHH-31454 -
high temperature in other parts of the Preliminary SIL Verification
project facilities not Report
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

Not SIL rated, not included in


033-D-31003 low
85 033-LALL-31502 SIL 0 Preliminary SIL Verification
water level
Report
No further Not SIL rated, not included in
033-D-31003 low
86 - risk reduction Preliminary SIL Verification
condensate level
required. Report
023-T-31001 low Included in Preliminary SIL
87 023-LALL-31084 SIL 2
amine level Verification Report

No SIF defined in LOPA,


023-T-31001 low scenario not included in
88 - SIL 2
condensate level Preliminary SIL Verification
Report

No further Not SIL rated, not included in


023-D-31001 high
89 023-PAHH-31128 risk reduction Preliminary SIL Verification
pressure
required Report

Not SIL rated, not included in


023-D-31001 low
90 023-LALL-31139 SIL 0 Preliminary SIL Verification
amine level
Report

Upon close out of


Recommendation #101 No SIF defined in LOPA,
023-D-31009 high
91 - SIL 1 from the Critical P&ID scenario not included in SIL
pressure
Review an additional IPL Verification Report
may be considered.

Not SIL rated, not included in


023-D-31001 low
92 - SIL 0 Preliminary SIL Verification
condensate level
Report

023-P-
31001A/B/C/D
93 023-FALL-31099 SIL 4+ SIF considered outstanding
suction high
pressure

023-T-31002 high SIF considered outstanding


94 023-FALL-31099 SIL 4+
pressure /Same as SIF 93

Not included in Preliminary SIL


023-D-31002 high
95 023-PAHH-31215 SIL 1 Verification Report since < SIL
pressure
2

No further Not SIL rated, not included in


017-D-31004 inlet
96 - risk reduction Preliminary SIL Verification
piping high pressure
required Report

97 017-D-31004 high 017-PAHH-31258 No further Not SIL rated, not included in

TEP-900-RPT-HS-BP4-0004 Page 12 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
pressure risk reduction Preliminary SIL Verification
required Report
Not included in Preliminary SIL
017-D-31004 high
98 017-LAHH-31252 SIL 1 Verification Report since < SIL
level
2

Fuel gas system is not


part of the critical P&ID
review and hence not
considered in LOPA as
the LOPA calculations SIL to be defined in EPC
LP fuel gas circuit need to consider causes phase. SIF not included in
99 - -
high pressure in other parts of the Preliminary SIL Verification
project facilities not Report
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

No further Not SIL rated, not included in


017-D-31004 low
100 017-LAHH-31252 risk reduction Preliminary SIL Verification
condensate level
required Report
Produced water system is
not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations
SIL to be defined in EPC
Produced water need to consider causes
101 - - phase. SIF not included in SIL
tank high pressure in other parts of the
Verification Report
project facilities not
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

Recovered oil system is


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations
SIL to be defined in EPC
Recovered oil tank need to consider causes
102 - - phase. SIF not included in SIL
high pressure in other parts of the
Verification Report
project facilities not
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

No further Not SIL rated, not included in


011-T-31001 inlet
103 011-PAHH-31013 risk reduction Preliminary SIL Verification
piping high pressure
required Report

Upon close out of


Recommendation #117
Not included in Preliminary SIL
011-T-31001 high from the Critical P&ID
104 011-PAHH-31013 SIL 1 Verification Report since < SIL
pressure Review an additional IPL
2
may be considered for
Cause 3.
Not included in Preliminary SIL
011-T-31001 high
105 - SIL 1 Verification Report since < SIL
level
2 and no SIF defined in LOPA

Not SIL rated, not included in


011-T-1001A/B inlet
106 011-PAHH-31013 SIL 0 Preliminary SIL Verification
piping high pressure
Report

TEP-900-RPT-HS-BP4-0004 Page 13 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Existing systems were
not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations
SIL to be defined in EPC
011-T-1001A/B high need to consider causes
107 - phase. SIF not included in SIL
level in existing facilities which
Verification Report
were not included in the
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

No further Not SIL rated, not included in


011-E-31001 shell
108 - risk reduction Preliminary SIL Verification
side high pressure
required. Report

Not SIL rated, not included in


017-D-31008 high
109 - SIL 0 Preliminary SIL Verification
pressure
Report
011-P-31001A/B No further Not SIL rated, not included in
110 suction low - risk reduction Preliminary SIL Verification
pressure required. Report

Upon close out of


Recommendation #152
017-D-31001A low Included in Preliminary SIL
111 017-LALL-31057 SIL 3 from the Critical P&ID
condensate level Verification Report
Review additional IPLs
may be considered.
Upon close out of
Recommendation #152
017-D-31001A low Included in Preliminary SIL
112 017-LALL-31060 SIL 3 from the Critical P&ID
water level Verification Report
Review additional IPLs
may be considered.
Upon close out of
Recommendation #152
017-D-31001B low Included in Preliminary SIL
113 017-LALL-31107 SIL 3 from the Critical P&ID
condensate level Verification Report
Review additional IPLs
may be considered.

Upon close out of


Recommendation #152
017-D-31001B low Included in Preliminary SIL
114 017-LALL-31110 SIL 3 from the Critical P&ID
water level Verification Report
Review additional IPLs
may be considered.
This system is not part of
the critical P&ID review
and hence not considered
in LOPA as the LOPA
calculations need to SIL to be defined in EPC
017-V-31305 high consider causes in other phase. SIF not included in
115 - -
pressure parts of the project Preliminary SIL Verification
facilities not included in Report
the Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.
Existing systems were
not part of the critical
SIL to be defined in EPC
P&ID review and hence
016-D-1006 high 016-PAHH-XXXX phase. SIF not included in
116 - not considered in LOPA
pressure (HIPPS) (2oo3) Preliminary SIL Verification
as the LOPA calculations
Report
need to consider causes
in existing facilities which

TEP-900-RPT-HS-BP4-0004 Page 14 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
were not included in the
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
016-D-1006 high
need to consider causes phase. SIF not included in
117 pressure (PSV + 016-PAHH-XXXX -
in existing facilities which Preliminary SIL Verification
Trip)
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Not included in Preliminary SIL


017-D-31006 low
118 017-LALL-31203 SIL 1 Verification Report since < SIL
level
2

Not SIL rated, not included in


017-D-31005 high
119 017-PAHH-31308 SIL 0 Preliminary SIL Verification
pressure
Report
Not SIL rated, not included in
017-D-31005 high
120 017-LALL-31302 SIL 0 Preliminary SIL Verification
level
Report
The coalescer is not part
of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
017-D-31009 low need to consider causes phase. SIF not included in
121 017-LALL-31357 -
level in other parts of the Preliminary SIL Verification
project facilities not Report
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete
017-D-31005 low Not SIL rated, not included in
122 017-LALL-31305 SIL 0 Open Recommendation
level SIL Verification Report

No further Not SIL rated, not included in


017-D-31005 low
123 017-LALL-31302 risk reduction Preliminary SIL Verification
condensate level
required Report

ORF high pressure 017-PAHH-31152


124 SIL 4+ SIF considered outstanding
(HIPPS) (2oo3)

ORF high pressure 017-PAHH-31152 Included in Preliminary SIL


125 SIL 2
(PSV + Trip) (1oo1) Verification Report

Produced water system is


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
017-TK-31001 high need to consider causes phase. SIF not included in
126 - -
pressure in other parts of the Preliminary SIL Verification
project facilities not Report
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

TEP-900-RPT-HS-BP4-0004 Page 15 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Existing systems were
not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
016-TK-31001 high need to consider causes phase. SIF not included in
127 - -
pressure in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
087-TK-1004 high need to consider causes phase. SIF not included in
128 - -
pressure in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

This scenario is not


considered in LOPA as
the team has insufficient
information to decide on SIL to be defined in EPC
LNG loading arms
its credibility. phase. SIF not included in
129 sudden flow - -
Discuss when detailed Preliminary SIL Verification
increase
drawings and Report
documentation for loading
arm package are available
(during EPC).
This scenario is not
considered in LOPA as
the team has insufficient
information to identify
SIL to be defined in EPC
safeguards on the tankers
LNG tanker high phase. SIF not included in
130 - - at this stage of the
level Preliminary SIL Verification
project.
Report
Discuss when detailed
information for the LNG
tankers are available
(during EPC).

Not included in Preliminary SIL


072-D-31002 high
131 072-LAHH-31204 SIL 1 Verification Report since < SIL
level
2
Upon close out of
LNG loading arms Recommendation #154 No SIF defined in LOPA,
132 bowing / thermal - SIL 2 this hazard may be scenario not included in SIL
shock removed or an additional Verification Report
IPL may be considered.

No further Not SIL rated, not included in


LNG loading line
133 - risk reduction Preliminary SIL Verification
low pressure
required. Report

Upon close out of


Recommendation #124 No SIF defined in LOPA,
LNG loading line
134 - SIL 2 from the Critical P&ID scenario not included in SIL
high pressure
Review, cause 2 may be Verification Report
removed.

TEP-900-RPT-HS-BP4-0004 Page 16 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Upon close out of Hazard has been removed
LNG vapour return Recommendation #123 following Company approval of
135 - SIL 1
line high pressure from the Critical P&ID Recommendation #123
Review. implementation

Upon close out of


No SIF defined in LOPA,
072-P-31008 Recommendation #139
scenario not included in
136 discharge pipework - SIL 2 from the Critical P&ID
Preliminary SIL Verification
high pressure Review, cause 4 may be
Report
removed.

LNG Not SIL rated, not included in


137 loading/circulation - SIL 0 Preliminary SIL Verification
line bowing Report
No SIF defined in LOPA,
Circulation line scenario not included in
138 - SIL 2
surge Preliminary SIL Verification
Report

Not included in Preliminary SIL


LNG loading line
139 - SIL 1 Verification Report since < SIL
surge
2 and no SIF defined in LOPA

Not included in Preliminary SIL


N2 system low
140 - SIL 1 Verification Report since < SIL
temperature
2 and no SIF defined in LOPA

Upon close out of


Recommendation #126 Not included in Preliminary SIL
Jetty 1 circulation
141 - SIL 1 from the Critical P&ID Verification Report since < SIL
line high flow
Review an additional IPL 2 and no SIF defined in LOPA
may be considered.

Not included in Preliminary SIL


Jetty 2 circulation
142 - SIL 1 Verification Report since < SIL
line high flow
2 and no SIF defined in LOPA
No further Not SIL rated, not included in
LNG circulation line
143 - risk reduction Preliminary SIL Verification
low pressure
required. Report
No SIF defined in LOPA,
LNG circulation line scenario not included in
144 - SIL 2
high pressure Preliminary SIL Verification
Report

This scenario is not


considered in LOPA as
the team has insufficient
information to identify
SIL to be defined in EPC
safeguards on the tankers
LNG tanker high phase. SIF not included in
145 - - at this stage of the
pressure Preliminary SIL Verification
project.
Report
Discuss when detailed
information for the LNG
tankers are available
(during EPC).

Existing systems were


not part of the critical
P&ID review and hence
not considered in LOPA SIL to be defined in EPC
LNG storage tank as the LOPA calculations phase. SIF not included in
146 - -
low pressure need to consider causes Preliminary SIL Verification
in existing facilities which Report
were not included in the
Critical P&ID review.
Therefore if a LOPA was

TEP-900-RPT-HS-BP4-0004 Page 17 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
conducted, it would be
incomplete.
Existing systems were
not part of the critical
P&ID review and hence
not considered in LOPA
as the LOPA calculations SIL to be defined in EPC
LNG storage tank need to consider causes phase. SIF not included in
147 - -
high pressure in existing facilities which Preliminary SIL Verification
were not included in the Report
Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Upon close out of


Recommendation #132 Not included in Preliminary SIL
LNG vapour return
148 - SIL 1 from the Critical P&ID Verification Report since < SIL
line bowing
Review, cause 1 may be 2 and no SIF defined in LOPA
removed.

The tankage flare is not


part of the critical P&ID
review and hence not
considered in LOPA as
the LOPA calculations SIL to be defined in EPC
Tankage flare low need to consider causes phase. SIF not included in
149 - -
pressure in other parts of the Preliminary SIL Verification
project facilities not Report
included in the Critical
P&ID review. Therefore if
a LOPA was conducted, it
would be incomplete.

Vapour return No SIF defined in LOPA,


arm/line high scenario not included in
150 - SIL 2
pressure Preliminary SIL Verification
(asphyxiation) Report

No further Not SIL rated, not included in


LNG loading arm
151 - risk reduction Preliminary SIL Verification
high pressure
required. Report
Scenario not considered
072-P-31008 credible as cooldown No SIF defined in LOPA, not
152 uncontrolled - - facilities have not yet included in preliminary SIL
cooldown been provided for 072-P- Verification Report
31008 (design error).
Not SIL rated, not included in
072-D-31002 low
153 - SIL 0 Preliminary SIL Verification
pressure
Report
Not SIL rated, not included in
072-D-31002 high
154 - SIL 0 Preliminary SIL Verification
pressure
Report

Not included in Preliminary SIL


072-D-31002 rapid
155 - SIL 1 Verification Report since < SIL
cooldown
2 and no SIF defined in LOPA

Not included in Preliminary SIL


Condensate loading
156 - SIL 1 Verification Report since < SIL
line surge
2 and no SIF defined in LOPA
This scenario is not SIL to be defined in EPC
Condensate tanker
157 - - considered in LOPA as phase. SIF not included in
high level
the team has insufficient Preliminary SIL Verification

TEP-900-RPT-HS-BP4-0004 Page 18 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
information to identify Report
safeguards on the tankers
at this stage of the
project.
Discuss when detailed
information for the
condensate tankers are
available (during EPC).
This scenario is not
considered in LOPA as
the team has insufficient
information to identify
SIL to be defined in EPC
safeguards on the tankers
Condensate tanker phase. SIF not included in
158 - - at this stage of the
high pressure Preliminary SIL Verification
project.
Report
Discuss when detailed
information for the
condensate tankers are
available (during EPC).

Not SIL rated, not included in


Condensate loading
159 - SIL 0 Preliminary SIL Verification
line low pressure
Report

No further Not SIL rated, not included in


Condensate loading
160 - risk reduction Preliminary SIL Verification
arm low pressure
required. Report

Not SIL rated, not included in


Condensate loading
161 - SIL 0 Preliminary SIL Verification
line high pressure
Report

No further Not SIL rated, not included in


076-P-31004 inlet
162 - risk reduction Preliminary SIL Verification
piping low pressure
required. Report
162-D-31001A high Included in SIL Verification
163 162-LAHH-31682 SIL 2
level Report
162-D-31001B high Included in SIL Verification
164 162-LAHH-31722 SIL 2
level Report

Not included in Preliminary SIL


LP steam header
165 - SIL 1 Verification Report since < SIL
high pressure
2 and no SIF defined in LOPA
Upon close out of
Recommendation #146 No SIF defined in LOPA,
LP steam header
166 - SIL 3 from the Critical P&ID scenario not included in SIL
high temperature
Review an IPL may be Verification Report
considered.
Upon close out of
Recommendation #153
No SIF defined in LOPA,
LP steam header from the Critical P&ID
167 - SIL 3 scenario not included in SIL
hammering Review, this hazard may
Verification Report
be removed or additional
IPLs may be considered.

Upon close out of


Recommendation #147 No SIF defined in LOPA,
MP steam header from the Critical P&ID scenario not included in
168 - SIL 2
high temperature Review, this hazard may Preliminary SIL Verification
be removed or additional Report
IPLs may be considered.
Not included in Preliminary SIL
MP steam header
169 - SIL 1 Verification Report since < SIL
high pressure
2 and no SIF defined in LOPA

TEP-900-RPT-HS-BP4-0004 Page 19 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

LOPA Report Results


SIL Verification
Hazardous
LOPA Scope of Work
No. Scenario SIF to be verified Notes
Result
Consequences
Upon close out of
Recommendation #153
MP steam header from the Critical P&ID Included in Preliminary SIL
170 162-TALL-31486 SIL 3
hammering Review, this hazard may Verification Report
be removed or additional
IPLs may be considered.

Upon close out of


Recommendation #153 No SIF defined in LOPA,
HP steam header from the Critical P&ID scenario not included in
171 - SIL 3
hammering Review, this hazard may Preliminary SIL Verification
be removed or additional Report
IPLs may be considered.

This tank is not part of the


critical P&ID review and
hence not considered in
LOPA as the LOPA
calculations need to SIL to be defined in EPC
Oxygen scavenger consider causes in other phase. SIF not included in
172 - -
tank high level parts of the project Preliminary SIL Verification
facilities not included in Report
the Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.
This tank is not part of the
critical P&ID review and
hence not considered in
LOPA as the LOPA
calculations need to SIL to be defined in EPC
Neutralization
consider causes in other phase. SIF not included in
173 amine tank high - -
parts of the project Preliminary SIL Verification
level
facilities not included in Report
the Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.
Not SIL rated, not included in
162-D-31001A high
174 - SIL 0 Preliminary SIL Verification
pressure
Report

Not SIL rated, not included in


162-D-31001B high
175 - SIL 0 Preliminary SIL Verification
pressure
Report

This tank is not part of the


critical P&ID review and
hence not considered in
LOPA as the LOPA
calculations need to SIL to be defined in EPC
De-emulsfier
consider causes in other phase. SIF not included in
176 storage drum high - -
parts of the project Preliminary SIL Verification
pressure
facilities not included in Report
the Critical P&ID review.
Therefore if a LOPA was
conducted, it would be
incomplete.

Analysing the above table and excluding all scenario not associated t a specific SIF, a total of 57 SIFs
have been identified, distributed as follows:
7 SIFs rated SIL 4+;

TEP-900-RPT-HS-BP4-0004 Page 20 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

9 SIFs rated SIL 3;


17 SIFs rated SIL 2;
11 SIFs rated SIL 1;
8 SIFs rated SIL 0;
5 SIFs not rated (No further risk reduction required).

The Preliminary SIL verification has been performed for all the loops requiring SIL level 2 or SIL 3.
However outstanding since further investigation is required, for SIL 4+ rated loops it has been
investigated the maximum achievable SIL according to actual SIF design considered during LOPA
analysis.
In Table 2 the list of 33 SIFs to be subjected to FEED SIL Verification process.
SIL 1 loops, not considered critical will not be included in the Preliminary SIL verification report.

Table 2 SIFs to be verified

No. SIF to be verified SIL

3 053-PAHH-31187 SIL 3

4 043-PAHH-31032 SIL 2

5 053-PAHH-31858 SIL 2

7 043-PAHH-31726 SIL 2

8 053-PAHH-31487 SIL 2

12 043-LAHH-31044 SIL 2

20 043-LALL-31285 SIL 2

21 043-PAHH-31273 SIL 2

22 053-PAHH-31487 SIL 2

26 043-LAHH-31434 SIL 3

27 043-PAHH-31423 SIL 3

29 043-LALL-31434 SIL 2

33 043-PAHH-31573 SIL 4+

40 053-PDALL-31469 SIL 2

43 053-TAHH-31578 SIL 4+

47 053-TAHH-31638 SIL 4+

48 053-TAHH-31489 SIL 2

49 053-PAHH-31576 SIL 2

52 053-PAHH-31636 SIL 2

TEP-900-RPT-HS-BP4-0004 Page 21 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

No. SIF to be verified SIL

64 053-TAHH-31189 SIL 3

87 023-LALL-31084 SIL 2

93 023-FALL-31099 SIL 4+

94
023-FALL-31099 SIL 4+
(same as 93)

111 017-LALL-31057 SIL 3

112 017-LALL-31060 SIL 3

113 017-LALL-31107 SIL 3

114 017-LALL-31110 SIL 3

017-PAHH-31152
124 SIL 4+
(2oo3)

017-PAHH-31152
125 SIL 2
(1oo1)

163 162-LAHH-31682 SIL 2

164 162-LAHH-31722 SIL 2

170 162-TALL-31486 SIL 3

1.3 Owner and Contractual Standards


GP 30-75 Safety Instrumented Systems (SIS) - Management of the Safety Lifecycle
GP 30-80 Safety Instrumented Systems (SIS) Specification and Implementation
GP 48-06 Layer of Protection Analysis (LOPA).

1.4 International Standards


IEC 61508 Functional Safety: Safety Related Systems
IEC 61511 Functional Safety: Safety instrumented systems for the process industry sector.

1.5 Contractor Document


TEP-930-RPT-HS-BP4-0019 LOPA WORKSHOP REPORT

1.6 Order of Precedence


1. National or local regulatory standards where the work is being performed and/or where the
facilities are to be installed;
2. Contractual Requirements and Project Specific Requirements or Standards (e.g.
Specifications, Datasheets etc.)
3. BP Group Practice (GP);
4. COMPANY Guidelines, Manuals and Procedures;
International Regulations, Codes and Standards.

TEP-900-RPT-HS-BP4-0004 Page 22 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

2 Symbols, Abbreviations and Definitions

Abbreviations Description
BOG Boil Off Gas.
EPC Engineering, Procurement, and Construction.
FEED Front End Engineering Design
HFT Hardware Fault Tolerance
IEC International Electrotechnical Commission
IPL Independent Protection Layer
PFD Probability of Failure on Demand
LNG Liquefied Natural Gas.
LOPA Layer of Protections Analysis
LPG Liquefied Petroleum Gas.
NFPA National Fire Protection Association.
PFDs Process Flow Diagrams
P&IDs Piping and Instrumentation Diagram
ORF Onshore Receiving Facilities.
SIF Safety Instrumented Function
SIL Safety Integrity Level
SIS Safety Instrumented Function
TMR Triple modular redundancy
TEP Tangguh Expansion Project LNG FEED
1oo1 Voting logic: 1 out of 1
1oo2 Voting logic: 1 out of 2
1oo3 Voting logic: 1 out of 3
2oo3 Voting logic: 2 out of 3
3oo3 Voting logic: 3 out of 3

Definitions Description
COMPANY BP Berau Ltd.

A selected company who has agreed to perform the work on the terms and
CONTRACTOR
conditions contained in the respective FEED and/or EPC contract.
Shall Mandatory

Should/May Discretional, but COMPANY approval to be sought for deviation.

TEP-900-RPT-HS-BP4-0004 Page 23 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

3 Methodology
3.1 General
According to IEC 61508/61511, for each Safety Integrity Level, there is a corresponding probability of
failure on demand that the system must not exceed. For the classification the greater the potential
consequences and the expected frequency of demand are, the more reliable the loop must be. SIL
levels and their associated target probabilities are shown in Table 3. For the target PFD, it has been
considered the upper limit of each SIL requirement (as no margin requirements have been specified
during the SIL Allocation) considering that literature data are conservatively used for the reliability
calculation.

Table 3 Probability of failure on demand for SIL levels (Low Demand Mode)

SIL Probability of Failure on Demand


1 10-110-2

2 10-210-3

3 10-310-4

4 10-410-5

After the SIL required for a SIF has been identified by means of LOPA sessions, the SIF must be
verified in order to check its adequacy both for the maximum required PFD and for architectural
constrains (hardware fault tolerance). As per good engineering practice, loop testing frequency for PFD
calculation has been assumed one year (8760 hours).
The methodology for SIL verification is given by IEC 61508/61511 and is summarized in this document.
Therefore two different requirements are given for each SIF in order to achieve the compliance to the
standard: both probability performance and hardware fault tolerance (HFT) must be satisfied.
No continuous mode of operation SIFs have been identified during the allocation activity.

3.2 Probability Requirements


3.2.1 General
The protection loops (SIF) are considered to be composed by the following items:
The sensing element(s)
The logic solver (SIS)
The final element(s).

The average probability of failure on demand of the safety related system is determined by calculating
and combining the average probability of failure on demand for all the subsystems which provide
protection against a hazardous event. This is expressed by the following relationship:

PFD AVG PFD SE PFD LS PFD FE

where,
PFDAVG is the average probability of failure on demand of the safety-related system
PFDSE is the probability of failure on demand of the sensing element(s)
PFDLS is the probability of failure on demand of the logic system element
PFDFE is the probability of failure on demand of final element(s)

TEP-900-RPT-HS-BP4-0004 Page 24 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

To determine the probability of failure on demand of each of the components (i.e. sensors, logic
system and final elements), the following procedure should be adhered to:
1. Consider the block diagram showing the system input elements, logic solver or system output
elements and represent each set of elements as 1oo1, 1oo2, 2oo2, 2oo3, 1oo3, 3oo3. Only the
final elements that are critical for the protection function shall be considered in the evaluation
of PFDFE, in fact critical is intended the action that protect the system against the deviation
controlled by the SIF loop analyzed. Not all action foreseen by the C&E diagram are to be
considered part of SIF (critical).

2. For each sub-system element, select the parameters relevant to:


probability of failure per hour, , for the element;
diagnostic coverage (DC);
the common cause -factor;
proof test interval.

3. Obtain the probability of failure on demand.

The complete verification tables summarizing calculation reports for each analysed function are
reported in Appendix A.

3.2.2 PFD Formulas


In this paragraph the equations used for the SIL verification (i.e. for calculating the probability of failure
on demand) are described per each architecture.
Only reliability block diagrams present in actual design have been considered and used in the
calculation reported in Appendix A.

Voting logic 1oo1


This architecture consists of a single element, where any dangerous failure will prevent a valid alarm
signal from being correctly processed.

Figure 1 Block diagram, voting logic 1oo1

Probability of failure can be calculated using the following formulas:

D DU DD (REF. IEC 61508-6 B.3.2.2.1)

: D (REF. IEC 61508-6 B.3.2.2.1)

DU D 1 DC (REF. IEC 61508-6 B.3.2.2.1)

DD D DC (REF. IEC 61508-6 B.3.2.2.1)

TEP-900-RPT-HS-BP4-0004 Page 25 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

The value of device equivalent mean down time can be obtained as follows:

DU T1
t CE MTTR DD MTTR (REF. IEC 61508-6 B.3.2.2.1)
D 2 D

Average probability of failure on demand can then be evaluated:

PFD AVG DU DD t CE (REF. IEC 61508-6 B.3.2.2.1).

Voting logic 1oo2


This architecture consists of two elements connected in parallel, such that either element can
command a shutdown output. Thus, there would have to be a dangerous failure in both elements in
order for a valid alarm signal not to be correctly processed. It is assumed that any diagnostic testing
would only report the faults and would not change any output states or the output voting.

Figure 2 Block diagram, voting logic 1oo2

To evaluate average probability of failure on demand, system equivalent mean down time (tGE) shall be
defined, using the following formula:

DU T1
t GE MTTR DD MTTR (REF. IEC 61508-6 B.3.2.2.2).
D 3 D

Average probability of failure on demand can then be evaluated:

T
PFD AVG 2 1 D DD 1 DU t CE t GE D DD MTTR DU 1 MTTR
2

(REF. IEC 61508-6 B.3.2.2.2)

D.

TEP-900-RPT-HS-BP4-0004 Page 26 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Voting logic 2oo2


This architecture has two channels connected in parallel so that both channels need to demand the
safety function before it can take place. It is assumed that any diagnostic testing would only report the
faults and would not change any output states or the output voting.

Figure 3 Block diagram, voting logic 2oo2

Average probability of failure on demand can then be evaluated:

PFD AVG 2D t CE (REF. IEC 61508-6 B.3.2.2.3)

Voting logic 2oo3


This architecture consists of three elements connected in parallel with a majority voting arrangement
for the output signals, such that the output state is not changed if only one channel demands the
safety function to intervene.
It is assumed that any diagnostic testing would only report the faults and would not change any output
states or the output voting.

Figure 4 Block diagram, voting logic valid for 1oo3, 2oo3 and 3oo3

Average probability of failure on demand can then be evaluated:

T
PFD AVG 6 1 D DD 1 DU t CE t GE D DD MTTR DU 1 MTTR
2

2
(REF. IEC 61508-6 B.3.2.2.5).

TEP-900-RPT-HS-BP4-0004 Page 27 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Voting logic 1oo3


This architecture consists of three channels connected in parallel with a voting arrangement for the
output signals, such that the output state follows 1oo3 voting.
It is assumed that any diagnostic testing would only report the faults found and would not change any
output states or change the output voting.
The average probability of failure on demand for the architecture is:

T
PFD AVG 61 D DD 1 DU t CE t GE t G 2 E D DD MTTR DU 1 MTTR
3

2
T
t G 2 E DU 1 MTTR DD MTTR
D 4 D
(REF. IEC 61508-6 B.3.2.2.6).

Voting logic 3oo3


This architecture has three channels connected in parallel so that all the three channels need to
demand the safety function before it can take place. It is assumed that any diagnostic testing would
only report the faults and would not change any output states or the output voting.
Average probability of failure on demand has been evaluated considering the structure of 2oo2
equation:

PFD AVG 3D t CE

3.3 Hardware Fault Tolerance


Safety instrumented functions, may need to have a minimum Hardware Fault Tolerance (HFT)
requirements based on the SIL level allocated.
It is important to note that the Hardware Fault Tolerance represents the minimum component or
subsystem redundancy requirements.
In particular, hardware fault tolerance is the capability of a component or subsystem to continue to be
able to function with one or more dangerous faults in the hardware. A Hardware Fault Tolerance equal
to 1 means that there are for example two devices and the architecture is such that the dangerous
failure of one of the two components or subsystems does not prevent the safety action from occurring
on demand.
A Hardware Fault Tolerance equal to 2 means that there are for example three devices and the
architecture is such that the dangerous failure of two of the three components or subsystems does not
prevent the safety action from occurring on demand.
Requirements related to HFT foreseen by IEC 61511 are shown in the following Table 4 for each level.

Table 4 Minimum hardware fault tolerance of sensors and final elements

SIL Minimum Hardware Fault Tolerance

1 0

2 1

3 2

4 Special requirements apply - see IEC-61508

TEP-900-RPT-HS-BP4-0004 Page 28 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

If elements are not fail safe, above requirements have to be increased by 1 order.
Vice versa, HFT can be reduced by 1 order if the following requirements are satisfied:
the hardware of the device is selected on the basis of prior use;
the device allows adjustment of process-related parameters only, e.g., measuring range,
upscale or downscale failure direction;
the adjustment of the process-related parameters of the device is protected, e.g., jumper,
password;
the function has a SIL requirement less than 4.
Above approach applies to sensors and final elements only.
Logic solver HTF follows only the requirements given in IEC-61511 part 1 clauses 11.4.2 to 11.4.4,
based on SFF, as reported in Table 5.

Table 5 Minimum hardware fault tolerance of PE logic solvers

Minimum Hardware Fault Tolerance


SIL SFF 60 % to 90
SFF < 60 % SFF > 90 %
%
1 1 0 0

2 2 1 0

3 3 2 1

4 Special requirements apply - see IEC 61508

According to IEC-61508, redundancies can be evaluated following the SFF approach, if vendors
certifications are available.
Elements and subsystems are divided in two categories, type A and type B, as defined:
An element can be regarded as type A if, for the components required to achieve the safety function:
a. the failure modes of all constituent components are well defined; and
b. the behaviour of the element under fault conditions can be completely determined; and
c. there is sufficient dependable failure data to show that the claimed rates of failure for detected
and undetected dangerous failures are met.
Instead an element shall be regarded as type B if, for the components required to achieve the safety
function:
a. the failure mode of at least one constituent component is not well defined; or
b. the behaviour of the element under fault conditions cannot be completely determined; or
c. there is insufficient dependable failure data to support claims for rates of failure for detected
and undetected dangerous failures.
For each type of elements and subsystems IEC-61508 lists the architectural requirements as per
following tables (Table 6 and Table 7).

TEP-900-RPT-HS-BP4-0004 Page 29 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Table 6 Maximum allowable SIL for a SIF carried out by a type A safety-related element or subsystem

Safe failure fraction Hardware fault tolerance


of an element
0 1 2
< 60 % SIL 1 SIL 2 SIL 3

60 % < 90 % SIL 2 SIL 3 SIL 4

90 % < 99 % SIL 3 SIL 4 SIL 4

99 % SIL 3 SIL 4 SIL 4

Table 7 Maximum allowable SIL for a SIF carried out by a type B safety-related element or subsystem

Safe failure fraction Hardware fault tolerance


of an element
0 1 2
< 60 % Not SIL 1 SIL 2
Allowed

60 % < 90 % SIL 1 SIL 2 SIL 3

90 % < 99 % SIL 2 SIL 3 SIL 4

99 % SIL 3 SIL 4 SIL 4

TEP-900-RPT-HS-BP4-0004 Page 30 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

4 Reliability Data
4.1 General
Reliability data used during the verification activity, relating to each component of the SIF, are
presented in the following Table 8.
The following information are shown per single subsystem:
instrument code as per SIL verification sheet;
reliability data;
subsystem Type, as per IEC 61508;
factor;
MTTR as per contractual requirements;
references.
According to project phase, barriers, QEV, aut similia are not considered in this report.
A general factor of 5% has been considered in PFD calculation.
As per contractual requirement, a minimum of SFF=60% is consider for all subsystems, even though
differently reported in relevant databank reference.

Table 8 Reliability Data for Components

D
Failure DC MTTR SFF
Component Code Dangerous Type Reference
rate failure rate [-] [-] [hr] [-]
[oc/hr] [oc/hr]

Level Exida FMEDA


transmitter LT 1,60E-06 1,60E-06 86% 5% 8 91% B Report No.: Rosemount
(radar) 08/02-17 R005

Item 5.1.3 "Reliability Data


Generic for Safety Instrumented
Pressure PT 1,30E-06 8,00E-07 60% 5% 8 75% B Systems", SINTEF PDS
Transmitter Data Handbook, 2010
Edition

Item 5.1.5 "Reliability Data


Generic for Safety Instrumented
Temperature TT 2,00E-06 7,00E-07 60% 5% 8 86% B Systems", SINTEF PDS
Transmitter Data Handbook, 2010
Edition

SIS Logic >99 PFD=1.0E-04 (Average


SIS -- -- -- -- -- B
Solver % data from Vendors)

Item 5.3.4 "Reliability Data


for Safety Instrumented
Solenoid Valve SY 3,00E-06 1,10E-06 30% 5% 72 74% A Systems", SINTEF PDS
Data Handbook, 2010
Edition

SIS/XV Item 5.3.1 "Reliability Data


including for Safety Instrumented
actuator XV 5,30E-06 3,00E-06 0% 5% 72 43% A Systems", SINTEF PDS
(excluding Data Handbook, 2010
pilot) Edition

TEP-900-RPT-HS-BP4-0004 Page 31 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

D
Failure DC MTTR SFF
Component Code Dangerous Type Reference
rate failure rate [-] [-] [hr] [-]
[oc/hr] [oc/hr]
Combined value from
USVE valve USVE 8,30E-06 4,10E-06 0% 5% 72 51% A solenoid valve and XV
valve.

As specific reliability data provided from vendors are not available, generic figures, referenced in
international hand books has been used to perform the reliability assessment. When available, the
reliability data of Vendor will be verified and used for the next Verification calculations.
According to the equations described in IEC 61508, factor listed in Table 8 doesnt have any effect if
not redundant NooN architecture are used (e.g. 1oo1, 2oo2); if redundant NooM (N<M) voting logic are
used (e.g. 1oo2, 2oo3) beta factor shown in the reliability data table is used accordingly. It is assumed
redundant architectures are composed by identical components.

4.2 Sensors
Probability of failure on demand for sensors has been calculated on the basis of an initial proof test
period of 8760 hours and of the equations described in relevant paragraph.
Typically level is monitored through DP cells, therefore, if not otherwise indicated, used figure for level
transmittal is PT.

4.3 Logic Solver (SIS)


The SIS logic solver is selected to be certified for use in SIL 3 rated loops, therefore, as PFD value is
not available (this value is typically determined after FAT), a PFDLS=1.0E-04 has been assumed.
The system is considered in TMR architecture, type B, with SFF>99%.

4.4 Final Elements


Final elements are mainly represented by valve closure/opening and machine trips actions and are
generally considered the weak part of the SIF. In order to calculate the PFD related to the final
elements the analysis has been focused only on the final elements considered critical for the evaluated
function, i.e. those final elements that actually provide a protection for the concerned process deviation
as defined during the allocation meetings. Moreover these critical end modules are shown in the
calculation summaries enclosed in the report.
The probabilities of failure on demand have been obtained on the basis of the failure rates values, DC
and factor shown in Table 8.
Probability of failure on demand for final elements has been calculated on the basis of an initial proof
test period of 8760 hours and of the equations described in relevant paragraph.

4.5 PFD Calculation Chart


Considering the abovementioned assumptions, methodology and reliability data, for each subsystem
the following PFD values apply, according to relevant architecture.

4.6 Architectural Constraints


Based on component reliability (i.e. SFF), it is possible to identify which safety integrity level can be
achieved based on the loop architecture provided; for each type of component, according to its SFF,
maximum SIL level for each redundancy (HFT) is shown in the following Table 9.

TEP-900-RPT-HS-BP4-0004 Page 32 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Table 9 SIL satisfied based on SFF and redundancy

Component Code SFF [%] Type HFT=0 HFT=1 HFT=2

Flow transmitter FT 84% B SIL 1 SIL 2 SIL 3

Level transmitter LT 81% B SIL 1 SIL 2 SIL 3

Generic Pressure Transmitter PT 75% B SIL 1 SIL 2 SIL 3

Generic Temperature Transmitter TT 86% B SIL 1 SIL 2 SIL 3

SIS Logic Solver SIS >99% B SIL 3 SIL 4 SIL 4

Motor failure to trip/start MT 60% A SIL 3 SIL 4 SIL 4

Blowdown valve (excluding pilot) USVD 33% A SIL 2 SIL 3 SIL 4

X-tree valve (excluding pilot) ESV 45% A SIL 1 SIL 2 SIL 3

SIS/XV including actuator


XV 43% A SIL 1 SIL 2 SIL 3
(excluding pilot)

Solenoid Valve SY 74% A SIL 2 SIL 3 SIL 4

Control valve CV 68% A SIL 2 SIL 3 SIL 4

UZV valve USVE 60% A SIL 2 SIL 3 SIL 4

(*) Outside BIDDER Scope of Work

TEP-900-RPT-HS-BP4-0004 Page 33 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

5 SIL Verification Results


The SIL verification has been performed for all the loops requiring SIL level 2 or higher, as specified in
par. 1.2..
For all safety functions classified as SIL 2 and SIL 3, it has been verified if the specific reliability
requirement is satisfied in terms of both probability of failure on demand (PFD) and architectural
constraints (HFT).
For SIL 4+ rated loops, considered outstanding since further investigation is required, it has been
indicated in Notes column the maximum achievable SIL according to SIF design considered during
LOPA analysis.
SIL Verification has been performed considering actual SIF arrangement, as modified incorporating
recommendations from Critical P&ID Review.
The summary of the results of the SIL verification for all SIL rated functions are reported in Table 10,
together with relevant remarks indicating the necessary improving actions in order to fulfil SIL
requirements, both in terms of PFD and HFT, for all SIFs not positively verified.
Test interval used during verification study is equal to 8760 h (1 year).
Detailed calculations for each SIF is given in following attachments:
A PFD SIL Verification Sheets
B HFT SIL Verification Sheets

Table 10 SIL verification results

SIL Compliance
N. SIF Notes
target PFD HFT SIL
3 053-PIT-31187-HH 3 NO NO NO Refer to Table 12

4 043-PIT-31032-HH 2 NO NO NO Refer to Table 12

5 053-PIT-31858-HH 2 NO NO NO Refer to Table 12

7 043-PIT-31726-HH 2 NO NO NO Refer to Table 12

8 053-PIT-31487-HH 2 NO NO NO Refer to Table 12

12 043-LIT-31044-LL 2 NO NO NO Refer to Table 12

20 043-LIT-31285-LL 2 NO NO NO Refer to Table 12

21 043-PIT-31273-HH 2 NO NO NO Refer to Table 12

22 053-PIT-31487-HH 2 NO NO NO Refer to Table 12

26 043-LIT-31434-HH 3 NO NO NO Refer to Table 12

27 043-PIT-31423-HH 3 NO NO NO Refer to Table 12

29 043-LIT-31434-LL 2 NO NO NO Refer to Table 12

33 043-PIT-31573-HH 4+ -- -- -- Refer to Table 12

40 053-PDIT-31469-LL 2 NO NO NO Refer to Table 12

43 053-TIT-31578-HH 4+ -- -- -- Refer to Table 12

47 053-TIT-31638-HH 4+ -- -- -- Refer to Table 12

48 053-TIT-31489-HH 2 NO NO NO Refer to Table 12

TEP-900-RPT-HS-BP4-0004 Page 34 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL Compliance
N. SIF Notes
target PFD HFT SIL
49 053-PIT-31576-HH 2 NO NO NO Refer to Table 12

52 053-PIT-31636-HH 2 NO NO NO Refer to Table 12

64 053-TIT-31189-HH 3 NO NO NO Refer to Table 12

87 023-LIT-31084-LL 2 NO NO NO Refer to Table 12

93 023-FIT-31099-LL 4+ -- -- -- Refer to Table 12

Same Same as Same as Same as Same as 93


94 Same as 93
as 93 93 93 93

111 017-LIT-31057-LL 3 NO NO NO Refer to Table 12

112 017-LIT-31060-LL 3 NO NO NO Refer to Table 12

113 017-LIT-31107-LL 3 NO NO NO Refer to Table 12

114 017-LIT-31110-LL 3 NO NO NO Refer to Table 12

124 017-PIT-31152A/B/C-HH 4+ -- -- -- Refer to Table 12

125 017-PIT-31152 2 NO NO NO Refer to Table 12

163 162-LI-31682-HH 2 NO NO NO Refer to Table 12

164 162-LI-31722-HH 2 NO NO NO Refer to Table 12

170 162-TI-31486-LL 3 NO NO NO Refer to Table 12

NOTES:
YES: SIL achieved
NO: SIL not achieved

TEP-900-RPT-HS-BP4-0004 Page 35 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

6 Conclusions and Recommendations


In this section conclusions/recommendations arisen after verification step for each SIF are presented;
when a SIF doesnt satisfy SIL requirements (refer to Table 10), a specific recommendation applicable
to the mention subsystem has been issued and listed in Table 12.

Regarding USVE valves, consisting of a system including solenoid and XV valve body, in order to
support valves vendors selection in Table 11 it has been indicated reliability data to fulfil SIL 2
requirement, without redundancy. This value shall be considered as a the maximum reliability
requirement to be considered in EPC phase, in case redundancy for sensors in SIL 2 loop will be not
applied.

Table 11 USVE Reliability Data

D
Failure DC MTTR SFF
Component Code Dangerous Type Reference
rate failure rate [-] [-] [hr] [-]
[oc/hr] [oc/hr]
USVE valve USVE 1,00E-06 4,00E-07 0% 5% 72 60% A

According to GP 30-80, par. 9.5, bullet m., for SIL 3 a minimum of 2 final element shall be utilized,
consequently final element should have a redundancy.

Table 12 Recommendations Table

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
For sensor a redundancy (i.e. voting 1oo2 or
2oo3) shall be applied unless on market
053-PAHH-31187
transmitter certified for SIL 3 application is
available
3 053-PAHH-31187 3
For valve and its components (e.g. solenoid,
053-USVE-31222 (Trip HP actuator, body, et other applicable) a
FG to 053-CG-31001) redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

Sensor to be certified suitable to SIL 2


043-PIT-31032-HH application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2 or 2oo3) shall be applied

Valve and its components (e.g. solenoid,


4 043-PIT-31032-HH 2
actuator, body, et other applicable) to be
provided with minimum reliability data as per
043-USVE-31062
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
5 053-PIT-31858-HH 2 053-PIT-31858-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

TEP-900-RPT-HS-BP4-0004 Page 36 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
Valve and its components (e.g. solenoid,
actuator, body, other applicable) to be
053-USVE-31990/31951 provided with minimum reliability data as per
31989/31988 Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
043-PIT-31726-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

7 043-PIT-31726-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
043-USVE-
provided with minimum reliability data as per
31085/31725/31866/3186
Table 11 and certified suitable to SIL 2
7/31868
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
053-PIT-31487-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

8 053-PIT-31487-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
053-USVE-31464
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
043-LIT-31044-LL
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

12 043-LIT-31044-LL 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
043-USVE-31047
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
043-LIT-31285-LL
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

20 043-LIT-31285-LL 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
043-USVE-31288
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
043-PIT-31273-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

21 043-PIT-31273-HH 2 Valve and its components (e.g. solenoid,


043-USVE- actuator, body, et other applicable) to be
31293/31277/31047 provided with minimum reliability data as per
Table 11 and certified suitable to SIL 2
053-USVE-31885 application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

TEP-900-RPT-HS-BP4-0004 Page 37 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
Sensor to be provided certified suitable to
SIL 2 application (HFT=0), otherwise a
053-PIT-31487-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

22 053-PIT-31487-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
053-USVE-31522 (Trip HP provided with minimum reliability data as per
FG to 053-CG-31002) Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
043-LIT-31434-HH
transmitter certified for SIL 3 application is
available
26 043-LIT-31434-HH 3
For valve and its components (e.g. solenoid,
actuator, body, et other applicable) a
043-USVE-31441/31288
redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
043-PIT-31423-HH
transmitter certified for SIL 3 application is
available
27 043-PIT-31423-HH 3
For valves and its components (e.g.
043-USVE- solenoid, actuator, body, et other applicable)
31452/31441/31288 a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
043-LIT-31434-LL
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

29 043-LIT-31434-LL 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
043-USVE-31437
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

043-PIT-31573-HH SIF to be further investigated.


Maximum achievable SIL: 2 according to SIF
33 043-PIT-31573-HH 4+ design analyzed during LOPA. In this case
043-USVE-31602/31437 the recommendation are the same as for
other SIL 2 rated SIFs

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
053-PDIT-31469-LL
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

40 053-PDIT-31469-LL 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
053-USVE-31466
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

053-TIT-31578-HH SIF to be further investigated.


Maximum achievable SIL: 2 according to SIF
43 053-TIT-31578-HH 4+ design analyzed during LOPA. In this case
053-USVE-31522 (Trip HP
FG to 053-CG-31002) the recommendation are the same as for
other SIL 2 rated SIFs

TEP-900-RPT-HS-BP4-0004 Page 38 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
053-TIT-31638-HH SIF to be further investigated.
Maximum achievable SIL: 2 according to SIF
47 053-TIT-31638-HH 4+ design analyzed during LOPA. In this case
053-USVE-31222 (Trip HP
FG to 053-CG-31001) the recommendation are the same as for
other SIL 2 rated SIFs

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
053-TIT-31489-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

48 053-TIT-31489-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
053-USVE-31522 (Trip HP provided with minimum reliability data as per
FG to 053-CG-31002) Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
053-PIT-31576-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

49 053-PIT-31576-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
053-USVE-31522 (Trip HP provided with minimum reliability data as per
FG to 053-CG-31002) Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
053-PIT-31636-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

52 053-PIT-31636-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
053-USVE-31222 (Trip HP provided with minimum reliability data as per
FG to 053-CG-31001) Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
053-TIT-31189-HH
transmitter certified for SIL 3 application is
available
64 053-TIT-31189-HH 3
For valves and its components (e.g.
053-USVE-31222 (Trip HP solenoid, actuator, body, et other applicable)
FG to 053-CG-31001) a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
023-LIT-31084-LL
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

87 023-LIT-31084-LL 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
023-USVE-31103
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

93 023-FIT-31099-LL 4+ 023-FIT-31099-LL SIF to be further investigated.

TEP-900-RPT-HS-BP4-0004 Page 39 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
Maximum achievable SIL: 2 according to SIF
design analyzed during LOPA. In this case
023-USVE-31101 the recommendation are the same as for
other SIL 2 rated SIFs

Same as
94 Same as 93 Same as 93 Same as 93
93

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
017-LIT-31057-LL
transmitter certified for SIL 3 application is
available
111 017-LIT-31057-LL 3
For valves and its components (e.g.
solenoid, actuator, body, et other applicable)
017-USVE-31064
a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
017-LIT-31060-LL
transmitter certified for SIL 3 application is
available
112 017-LIT-31060-LL 3
For valves and its components (e.g.
solenoid, actuator, body, et other applicable)
017-USVE-31065
a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
017-LIT-31107-LL
transmitter certified for SIL 3 application is
available
113 017-LIT-31107-LL 3
For valves and its components (e.g.
solenoid, actuator, body, et other applicable)
017-USVE-31114
a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
017-LIT-31110-LL
transmitter certified for SIL 3 application is
available
114 017-LIT-31110-LL 3
For valves and its components (e.g.
solenoid, actuator, body, et other applicable)
017-USVE-31115
a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

017-PIT-31152A/B/C-HH SIF to be further investigated.


Maximum achievable SIL: 2 according to SIF
124 017-PIT-31152A/B/C-HH 4+ design analyzed during LOPA. In this case
017-USVE-31156 the recommendation are the same as for
other SIL 2 rated SIFs

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
017-PIT-31152-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

125 017-PIT-31152-HH 2 Valve and its components (e.g. solenoid,


actuator, body, et other applicable) to be
provided with minimum reliability data as per
017-USVE-31156
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

TEP-900-RPT-HS-BP4-0004 Page 40 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

SIL
N. SIF Involved Subsystems Proposed Recommendation
Target
Sensor to be provided certified suitable to
SIL 2 application (HFT=0), otherwise a
162-LI-31682-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

Currently under BPCS. It shall be moved to


163 162-LI-31682-HH 2 SIS
Valve and its components (e.g. solenoid,
162-XV-31690 actuator, body, et other applicable) to be
provided with minimum reliability data as per
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

Sensor to be provided certified suitable to


SIL 2 application (HFT=0), otherwise a
162-LI-31722-HH
redundancy (i.e. voting 1oo2 or 2oo3) shall
be applied

Currently under BPCS. It shall be moved to


164 162-LI-31722-HH 2 SIS
Valve and its components (e.g. solenoid,
162-XV-31722 actuator, body, et other applicable) to be
provided with minimum reliability data as per
Table 11 and certified suitable to SIL 2
application (HFT=0), otherwise a redundancy
(i.e. voting 1oo2) shall be applied

For sensor a redundancy (i.e. voting 1oo2 or


2oo3) shall be applied unless on market
162-TI-31486-LL
transmitter certified for SIL 3 application is
available
170 162-TI-31486-LL 3
For valves and its components (e.g.
solenoid, actuator, body, et other applicable)
162-USVE-31845
a redundancy (i.e. voting 1oo2) shall be
applied (ref. BP 30-80)

TEP-900-RPT-HS-BP4-0004 Page 41 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Appendix A PFD Calculation Sheet

SIL Verification
Report_Att. 1.pdf

TEP-900-RPT-HS-BP4-0004 Page 42 of 43 Rev: A01


BP p.l.c. BP Confidential
Tangguh Expansion Project LNG FEED
Preliminary SIL Verification Report

Appendix B HFT Compliance Sheet

SIL Verification
Report_Att. 2.pdf

TEP-900-RPT-HS-BP4-0004 Page 43 of 43 Rev: A01


BP p.l.c. BP Confidential