pr-1001c - temporary override of safeguarding system procedure

Petroleum Development Oman L.L.C.

Temporary Overriding of Safeguarding Systems

Document ID PR-1001c

Document Type Procedure

Security Unrestricted

Discipline Engineering and Operations

Owner Functional Production Manager - UOP

Issue Date October 2014

Revision 6.2

Copyright: This document is the property of Petroleum Development Oman, LLC. Neither the whole nor any part of this document may be disclosed to others or reproduced, stored in a retrieval system, or transmitted in any form by any means (electronic, mechanical, reprographic recording or otherwise) without prior written consent of the owner.

Petroleum Development Oman LLC Revision: 6.2Effective: Oct-14

This page was intentionally left blank

PR-1001c - Temporary Overriding of Safeguarding Systems

Printed 04/05/23

The controlled version of this CMF Document resides online in Livelink®. Printed copies are UNCONTROLLED.


i Document AuthorisationAuthorised For Issue – July 2014


Printed 04/05/23



ii Revision HistoryThe following is a brief summary of the 4 most recent revisions to this document. Details of all revisions prior to these are held on file by the issuing department.

Revision No.

Date Author Scope / Remarks

6.2 Oct-14 Philip Hatherton UOP61 Revisions to incorporate Minor Amendments

6.1 Aug-14 Philip Hatherton UOP61 Revisions to incorporate Minor Amendments

6.0 Jul-14 Philip Hatherton UOP61 Revisions to incorporate Audit findings

5.0 Apr-13 Robin Norman UOP61 Reviewed and updated to address the MoC Application and Web based forms

iii Related Business Processes

Code Business Process (EPBM 4.0)

EP.71 Produce Hydrocarbons

EP.72 Maintain and Assure Facilities Integrity

iv Related Corporate Management Frame Work (CMF) Documents

The related CMF Documents can be retrieved from the CMF Business Control Portal.

See also Appendix 4


Printed 04/05/23



TABLE OF CONTENTS

i Document Authorisation..................................................................................................3

ii Revision History...............................................................................................................4

iii Related Business Processes...........................................................................................4

iv Related Corporate Management Frame Work (CMF) Documents...................................4

1 Introduction...................................................................................................................... 6

1.1 Background 6

1.2 Purpose 6

1.3 Scope 6

1.4 Distribution / Target Audience 6

1.5 Changes to the Document 6

1.6 Variance Approval 6

2 Roles and Responsibilities..............................................................................................7

3 Temporary Override of Safeguarding Systems..............................................................10

3.1 Authorisation for Temporary Override Risk Assessment 10

3.2 Process Overrides Request Form 11

3.3 Validity of Temporary Process Override 14

3.4 Temporary Process Override Auditing 15

3.5 Retention of Completed Process Override Requests 15

Appendix 1 – Worked Example of the Process Override Request.............................................16

Appendix 2 – Approved Override Type......................................................................................28

Appendix 3 – Abbreviations........................................................................................................29

Appendix 4 – Reference Material...............................................................................................30

Appendix 5 – Temporary Overrides of Safeguarding and E-MoC audit......................................31

Appendix 6 – User Feedback Page............................................................................................33


Printed 04/05/23



1 Introduction

1.1BackgroundIMPORTANT: OVERRIDING OF SAFETY CRITICAL SYSTEMS IS ONE OF THE LIFE SAVING RULESDefinition: An override can be considered as a device which when initiated will defeat the safeguarding action. The device will be returned to normal condition at the original set point(s) once the override is removed.

NOTE: An override can also be considered as any method where a protective function is defeated either temporarily or permanently

During the Operations Phase it sometimes becomes necessary to apply overrides on Safeguarding Systems. This operation requires to be strictly controlled and monitored. In addition the action of applying overrides requires to be risk Assessed to ensure that all necessary controls are in place to reduce any induced risks to As low As Reasonably Practicable (ALARP).

1.2PurposeThe purpose of the procedure shall be to ensure that Safeguarding System Temporary Overrides are authorised, applied, monitored and removed in a correct and controlled manner

1.3ScopeThe scope of this procedure will be the management of Safeguarding System Temporary Overrides.

NOTE: The procedure does not apply to devices are specifically provided for start-up.

1.4Distribution / Target AudienceThe following personnel shall have knowledge and / or awareness of this procedure and its intent:

Operations Teams (North, South, Gas and Infrastructure)

Production Strategy and Support Teams

Maintenance Strategy and Support Teams

Systems and Operations Field Support Team

Engineering and Maintenance Contractors

1.5Changes to the DocumentResponsibility for the upkeep of the Document shall be with the Functional Production Manager UOP, the Owner. Changes to this document shall only be authorised and approved by the Owner.

Users of the Document who identify inaccuracy or ambiguity can notify the Custodian or his/her delegate and request changes be initiated. The Requests shall be forwarded to the Custodian using the “User Feedback Page” provided in this Document.

The Document Owner and the Document Custodian should ensure review and re-verification of this procedure every 3 years.

1.6Variance ApprovalVariance is not applicable to this procedure.


Printed 04/05/23



2 Roles and ResponsibilitiesThe following table lists the Roles and Responsibilities for the Key Personnel.

All affected personnel shall read this procedure. If they do not understand something within the procedure they shall ask their line supervisor or The Operating Integrity Coordinator (Interior) to explain it. It is the line Supervisor’s Responsibility to ensure that all his subordinates have read and understood this procedure. When the procedure is read and understood they shall sign the Record of Procedure Understanding Form.

Role Responsible for:

Permit Holder / Permit Applicant

Request of the overrides to be applied when necessary. Request override to be removed upon completion of the Job. With guidance from Control Room Operator / Production

Operator (in case dual role) when necessary: Initiates the Form from the Application and completes

the key details. Act as Originator. Completes override related Risk Assessment and

supporting documentation if required and attaches to the form (electronically embedded).

On completion of the request nominates the reviewer. Requests extensions of the Override prior its overdue

Control Room Operator / Production Operator (in case dual role)

Identification of suitable point of application of the override. Initiates the Form from the Application and completes the key

details and act as Originator when required. Completes override related Risk Assessment and supporting

documentation if required and attaches to the form (electronically embedded) when necessary.

On completion of the request nominates the reviewer when necessary.

Application and removal of override Updating and maintaining override register, E-MoC, E-Log,

isolation certificates and/or hard copy MoC form if applicable. Ensuring all overrides are duly logged in the E-log and

discussed at handover Ensuring/confirming application and removal of override as

intended to Permit Holder. Act as Implementer in the E-MoC system. Requests extensions of the Override prior to being overdue

when necessary. Carry out a weekly audit of all system Overrides. See

Appendix 5


Printed 04/05/23


http://sww3.pdo.shell.om/livelink/livelink.exe/open/19845476


Control and Automation (Instrument) Engineer/Technician

Identification of suitable point of application of override when necessary

Application and removal and registration of override under direction of Control Room Operator / Production Operator (in case dual role) when necessary.

As part of IPF testing ensure clear understanding of which override is to be applied for test

Ensure that a SAP notification is raised for the defect causing the need for application.

Production Supervisor / Instrument Supervisor

Adherence to this procedure on shift Review the Originators submission and the Risk Assessment and/or Supporting Documentation Ensuring the right disciplines review the intended use of overrides. Nominates the Risk Assessment Approver, the Technical Approver (if required) and the Final Approver Carry out a monthly audit of all system Overrides using standard form. See Appendix 5 Ensure all technicians under his supervision read and understand the procedures and sign the Record of Procedure Understanding Form

Production Coordinator Responsible for ensuring his / her subordinates are aware of this procedure and compliant to it Approve the implementation of the Temporary Safeguarding Override and authorize extensions forSIL-1 and SIL-a Classification of the Safeguarding device. Act as Final Approver. Review and approve the Risk Assessment if no SIL level available based on a Low Residual Risk if authority to do so has been formally delegated by the DTL using the e-MoC process (see 3.1.1). Carry out a monthly audit of all system Overrides using standard form. See Appendix 5 Act as a Risk Assessment reviewer Ensure that the Record of Procedure Understanding Form is correctly completed and retained in a central location within each area.

Delivery Team Leader Approve the implementation of the Temporary Safeguarding Override and authorize extensions for, SIL-2 Classification of the Safeguarding device. Act as Final Approver.

Review and approve the Risk Assessment if no SIL level available based a Low Residual Risk

Accountable for compliance to this Procedure within his / her area of Authority

Operations Manager Approve the implementation of the Temporary Safeguarding Override and authorize extensions for SIL-3 Classification of the Safeguarding device. Act as Final Approver. Review and approve the Risk Assessment based on the Medium Residual Risk

Technical Director Review and approve the Risk Assessment based on the High/Serious Residual Risk

Technical Approver(Process Engineer / Integrity Engineer /

If nominated shall review the Override at a technical level to ensure that it has no implications regarding the operating envelope of the system/equipment or process in general


Printed 04/05/23






Process Safety Engineer)

Operating Integrity Co-ordinator (interior)

Carry out a monthly audit of all system Overrides using standard form. See Appendix 5

Maintenance Staff Comply with this procedure

Ensure the procedures are read and understood and they sign the Record of Procedure Understanding Form


Printed 04/05/23




3 Temporary Override of Safeguarding SystemsTemporary Overrides of Safeguarding Systems (including Fire and Gas) are / or may be provided to facilitate repairs, function testing and calibration whilst the facility / plant is operational.

WARNING: THE USE OR PROVISION OF TEMPORARY OVERRIDES CAN BE POTENTIALLY HAZARDOUS AND MUST BE STRICTLY CONTROLLED AND DOCUMENTED. IMPORTANT: In accordance with Matrix of Permitted Operations (MOPO) overrides on safeguarding systems are permitted for short durations only, are subject to risk assessment and only to be used when the facility / station is manned. Additionally all other safeguarding instrumentation on equipment shall be functional. High priority shall be given to any repairs required to normalise the system.

PDO uses the following Temporary Override devices in their operations:

Maintenance Override Switch (MOS) : Installed by design for the purpose of testing and maintenance

Start up bypass override: Installed by design for purpose of operational Start up.

Force : An imposed healthy signal within an Instrumented Protective System (e.g., Prosafe) – software, or use of “CAL” or “SCAN OFF” function within the DCS

Mechanical (Hardware force) : A physical override, e.g., wire bridge, pneumatic bypass, physical removal of protective device (e.g. Minimum Stop)

Wire jumper

More detail is provided on each of the above in Appendix 2 and Appendix 3.

3.1Authorisation for Temporary Override Risk AssessmentAuthorisation for the use of overrides on safeguarding systems shall be in accordance with Table 1.

The table is considered the most appropriate method to simplify authorisation levels for use of overrides on safeguarding systems. The SIL / IPF classification process will have ensured the safeguarding system has been fully risk assessed.

Table 1 – Guide to Authorisation Levels

SIL Classification

IPF Classification

Required Authorisation Level

3VI Ops Manager or Delegate

V Ops Manager or Delegate

2 IV DTL or Delegate

1 III Prod. Coordinator or Delegate

aII Prod. Coordinator or Delegate

I Prod. Coordinator or Delegate

Table 1 was adapted from EP200607206661

Table 1 above provides the Authorisation Level for the proposed Temporary Override. Where a SIL/IPF classification is not in place the authorisation level required will be decided from the Residual Risk of the supporting RAM.


Printed 04/05/23



The use of the override will require being Risk Assessed using the PDO RAM. The RAM will be attached to the Web based override request and sent with the request for review and authorisation. The Risk Assessment Approver will be determined by the residual risk i.e. Low = DTL or Delegate; Medium = Operations Manager; High/Serious = Technical Director.

3.1.1 DTL Delegation of Signing AuthorityTo allow for periods when the DTL is not available due to leave, illness etc. and to facilitate the application of overrides following an unplanned event there may be a requirement for him to delegate his signing authority to the Production Coordinator. The delegation of such authority shall be given using the E-MoC process for Organizational Change with a validity period not exceeding 1 month The authority shall not be delegated for planned events outwith this period

IMPORTANT: Routine work that is covered by an approved procedure and has already been risk assessed, via IPF or SIL Classification, can use the original risk assessment provided that the risks assessed have not changed and no changes have been made to the way the work is conducted. All other types of safeguarding override i.e. multiple, long term, process startup and stabilisation and non-routine activities shall require the risks to be assessed using the standard RAM.

3.2Process Overrides Request FormThe Process Overrides Request Form is accessed from the Applications/Management of Change (MOC).

Accessing Management of Change (MOC) will open up the Home Page


Printed 04/05/23



From the management of Change list in green select Process Overrides. This will open the access screen.

The access screen contains information on all process overrides that have been raised and the status of each. To open a new request use ‘Add new item’ at the foot of the screen.

The basic form that is opened will be completed by the requester. It is important to remember that all items on the form that have a * or which are highlighted I red are required and must be completed for the form to be processed.


Printed 04/05/23



The Requested by box is automatically generated and will be the same as the logged on person using the computer. Appendix 1 displays an actual Form that has been completed and implemented and shall serve as a guidance template to completing the request Form fully.

Displayed above is the portion of the form that is completed by the requester. There are

a number of multi choice ‘dropdown’ boxes indicated by the selection is made by highlighting the choice and clicking the mouse.


Printed 04/05/23



To select the reviewer enter the persons company number and click on the man/tick icon or the browse icon and select using the person’s name, highlight and then OK

Attachments shall be a Risk Assessment to support the use of the override (refer to Section 3.1) and any other document i.e. Method Statement, that is considered relevant to assisting the reviewers and approvers in understanding the Request. The attachments are selected from the computer and automatically embedded in the form. They accompany the Form throughout its life cycle.

Once the Request is completed it is electronically processed and sent to the Reviewer. This action is accomplished by clicking

The process is described in detailed using a worked example in Appendix 1.

3.3Validity of Temporary Process OverrideWhere the Temporary Process Override is linked with a PTW it shall be removed at the end of the working day when the PTW is suspended unless it is required to remain in


Printed 04/05/23



place for operational reasons. When the PTW is validated the next day the necessary Temporary Process Override shall be re-applied. Application and removal of the Overrides should be recorded by “ON” / “OFF” E-MoC function to provide evidence and reflect real status of the Overrides in the Register (E-MoC)

The PTW has a validity of 14 days after which it is closed out or extended. In conjunction with the PTW the Temporary Process Override can be extended. A total of three extensions, normally authorised by the production Coordinator are allowed after which the Process Override request shall be closed out. If after this period the override is still required, an example being if waiting for spares, a new E-MoC shall be raised with the PTW number being ‘Operations’. The justification for the override will be updated with the expected return to service as will the risk assessment.

If the override is expected to be in place for over 12 months then a FCP (Facilities Change Proposal) should be made to engineer out the requirement for the override.

NOTE: If the Temporary Override is required to be maintained when, in the case of an unmanned station, the station is vacated then approval shall be obtained from the Production Coordinator. When leaving Temporary Overrides in place a Risk Assessment shall be required to ensure all risks are mitigated to ALARP and it can be demonstrated the area control room is able to monitor the process effectively and initiate any remote actions required. Failure to satisfy this requirement shall mean manning or shutting down the station during the night hours.

See PR-1172 – Permit to Work Section 7 for details on PTW validity and isolations.

3.4Temporary Process Override AuditingThe temporary process override is recorded in the Operational Override Log. Each facility shall demonstrate a methodology whereby the temporary overrides can be audited on a monthly basis. Overrides that have a Risk Assessment conducted during authorisation shall require having that Risk Assessment checked to ensure that there are no changes in the hazards and residual risk.

Temporary Process Overrides that are not required shall be removed and the Process Override Request Closed Out. The status of all Process Overrides Requests can be checked on-line from the reports Section of the Management of Change – Process Overrides. To be carried out as per the Roles and Responsibilities Matrix at the front of this document

As a minimum a monthly physical audit of the status shall be conductedMinimum requirements are:

All fields in register, E-MoC filled in correctly Risk assessments adequate Mitigations adequate and in place if override is current Authority levels / Approvals correct Override use within expiry date Current overrides logged in end of shift reports and E-Log.

3.5Retention of Completed Process Override RequestsThe completed (implemented) Process Override Request form can be printed from the web and attached to the PTW. The hard copy form will then be filed with the PTW on completion of the work. The completed PTW is retained for a period of 6 months.

The Safeguarding System Temporary Overriding Request Form will be attached to and filed. The focal points for the retention of the PTW are the permit Coordinator in the North and the Permit to Work Focal Point in the South and Gas.

The web based requests shall be closed out and will be retained (archived) indefinitely.


Printed 04/05/23


http://sww3.pdo.shell.om/getdoc?dataid=95856&objAction=download


Appendix 1 – Worked Example of the Process Override RequestA completed Process Overrides Request with explanatory text and covering the full process is detailed on the following pages.


Printed 04/05/23




Printed 04/05/23



Appendix 2 – Approved Override Type

Maintenance Override Switch (MOS)Maintenance override switches are used to override safeguarding initiators to enable maintenance or on-line functional testing. It shall be considered during the basis of design (BfD) phase whether MOS's are required in those cases where spare process units or equipment are available.

Maintenance override facilities may be provided only for those safeguarding initiators where a second or back-up indication and an associated means to stop the process are available to the operator. Furthermore, the process dynamics shall be such that the operator has time to act.

All maintenance override keys shall be removed from their locks when not in service and be kept in a separate key box controlled by the Production Supervisor, or his / her delegate.

IPS-PLC Software Overrides (Forces in PLC systems)Software overrides can be provided on input and output channels of IPS-PLCS to override trip commands for repairs, equipment calibration and functional testing.

Wherever possible the override shall be provided on the input channels as these are inherently less hazardous than overrides on the outlet channel. The implementation shall be enabled and disabled by means of a key lock and / or password facility.

NOTE: The method of implementation shall be discussed with and approved by the Instrument Supervisor and the Production supervisor prior to use.

All 'forced enable/disable' keys shall be removed from their locks when not in service and kept in a separate key box controlled by the Production Supervisor, or his / her delegate.

JumpersJumpers shall be used only when MOS or IPS-PLC Software Overrides are not available. Their use shall be strictly controlled, logged and monitored as they entail the physical bridging (frigging) of trip contacts.

The use of ‘Jumpers’ must be approved by the Production Coordinator and the location and method of implementation agreed prior to their use. The use of jumpers must be entered on the Operational Override Log Sheet.

Mechanical OverridesUsually associated with automatic valves these are temporary mechanical means to prevent valve travel for repair and tests purposes. Use of this type of override should be avoided, as they are overrides on IPF final (output) elements and by nature more hazardous than overrides on IPF initiators (inputs).

The use of ‘mechanical overrides’ must approved by the Instrument and Production Supervisor and the location and method of implementation agreed prior to their use.


Printed 04/05/23



Appendix 3 – AbbreviationsThe following abbreviations have been used in this procedure:

ALARP As Low As Reasonably Practicable

CAL (Yokogawa), calibration, can be used to freeze a process variable in the DCS and disable alarming to allow maintenance and testing. This overrides the function, including alarms, of associated control and/or calculation. If the function has executive action then CAL is classed as an override.

EORD Engineering and Operations Reference Document

EPI Extended Period Isolation

FCP Field Change Proposal

IPF Instrumented Protection Function

IPS Instrumented Protection System

MoC Management of Change

MOPO Matrix of Permitted Operations

MOS Maintenance Override Switch

PLC Programmable Logic Controller

PTW Permit to Work

RAM Risk Assessment Matrix

SAP Systems, Applications and Products

Scan off (Honeywell), the technique used to stop an Experion server reading data from controller/point parameters, such as PV, SP and OP. This overrides the function, including alarms, calculation, and associated control. If the function has executive action then scan off is classed as and override.

SIL Safety Integrity Level

TA Technical Authority


Printed 04/05/23



Appendix 4 – Reference MaterialPDO Related Documents

The following PDO procedures have interface with this specification.

CP-114 – Maintenance and integrity Management Code of Practice

CP-115 - Operate Surface Product Flow Assets - CoP

PR-1001a – Field Change Proposal

PR-1001x - Operations Variance and Change Management

PR-1073 - Gas Freeing, Purging & Leak Testing of Process Equipment (Excluding Tanks)

PR-1076 - Isolation of Process Equipment Procedure

PR-1077 - Preparation of Static Equipment for Internal Maintenance and Inspection

PR-1079 - Gas Freeing and Purging of Tanks Procedure

PR-1094 - Instrumented Protective Functions Test Procedure

PR-1100 – Operator Routine Functions

PR-1148 - Entry into a Confined Space Procedure

PR-1172 – Permit to Work

GU-437 - Guideline on SIL Assessments and Implementation Guideline


Printed 04/05/23
















Appendix 5 – Temporary Overrides of Safeguarding and E-MoC auditLINK TO AUDIT FORM


Printed 04/05/23





Printed 04/05/23



Appendix 6 – User Feedback Page

PR-1001c - Temporary Overriding of Safeguarding Systems User Feedback Page

Any user who identifies an inaccuracy, error or ambiguity is requested to notify the custodian so that appropriate action can be taken. The user is requested to return this page fully completed, indicating precisely the amendment(s) recommended.

Name:

Ref ID Date:

Page Ref: Brief Description of Change Required and Reasons

Surface Operations and Integrity Team Leader (UOP6):

Date:


Printed 04/05/23
