30.99.39.1604.1 - FGS Philosophy
30.99.39.1604.1 - FGS Philosophy
30.99.39.1604.1 - FGS Philosophy
4. REFERENCES .................................................................................................................... 7
4.1 CODES AND STANDARDS................................................................................... 7
4.2 REFERENCE DOCUMENT ................................................................................... 9
4.3 ORDER OF PRECEDENCE ................................................................................ 11
Abu Dhabi Company for Onshore Oil Operations (ADCO) intends to proceed with phase III of
the North East Bab (NEB) development as part of ADCO’s program to add an additional 400
MBOPD sustainable capacity. New processing facilities will be required to handle the
additional oil, gas and water production from Al-Dabb’iya and Rumaitha field, located
approximately 50km south west from Abu Dhabi. Water and gas injection facilities will also
be required to provide pressure support and enhanced oil recovery.
The Project scope of CONTRACTOR covers the Engineering, Procurement and Construction
(EPC) of Rumaitha / Shanayel Facilities - Phase III Project to handle an additional production
of 39 MBOPD Rumaitha and Shanayel fields by 2016. The Contract is as below:
EPC for Rumaitha / Shanayel Phase III Development considering the scenario of
Hydrocarbon (HC) Water Alternating Gas (WAG)
DEFINITION
ABBREVIATIONS
This document provides the Fire and Gas System philosophy for the Rumaitha / Shanayel
Facilities - Phase III Fire and Gas Detection Systems, and is based on the basis of design of
Instrumentation & Control Design Basis for the fields. The philosophy incorporates lessons
learned concerning the existing configuration and the specific requirements of the phase III
development.
This document is intended to present the Fire and Gas System philosophy consistent with
industry-accepted practices and / or PROJECT standards and has to be read in conjunction
with the engineering narrative and scope of work for the Rumaitha / Shanayel Facilities -
Phase III ( Gathering GI / CO2/ Gas lift & WI ) Oil export/ Gas Export Pipelines Project for
ADCO Definitions.
This philosophy given in this document gives the broad guidelines for implementation with
ICSS as well as Packages controls. Additional detail requirements for FGS shall be
developed during detail engineering, as required, for fulfilling functional requirements of FGS.
This document shall not be considered as the total requirements of FGS.
The Fire and Gas System design shall comply with the following codes and
standards:
British Standards
BS EN 54-1 Fire detection and fire alarm systems - Introduction
BS EN 54-5 Fire detection and fire alarm systems - Part 5: heat detectors -
point detectors
BS EN 54-7 Fire detection and fire alarm systems - Part 7: smoke detectors -
point detectors using scattered light, transmitted light or ionization
CENELEC Standards
DIN 19234 Measurement and control - electrical distance sensors - dc interface for
distance sensor and signal converter
EEMUA 191 Alarm systems - a guide to design, management and procurement
EN 50014 Electrical Apparatus for Potentially Explosive Atmosphere –
General Requirements
EN 50018 Electrical Apparatus for Potentially Explosive Atmosphere- Flame
Proof Enclosures “EEx(d)”
EN 50019 Electrical Apparatus for Potentially Explosive Atmosphere –
Increased Safety “EEx(e)”
EN 50020 Electrical Apparatus for Potentially Explosive Atmosphere –
Intrinsically safe “EEx(i)”
IEC Regulations
IEC 60079-0 Electrical apparatus for explosive gas atmospheres - Spark test
apparatus for intrinsically-safe circuits
IEC 60079-1 Explosive atmospheres - Part 1: Equipment protection by
flameproof enclosures "d"
IEC 60529 Degrees of protection provided by enclosures (IP code)
IEC 61131-1 Programmable controllers - Part 1: General information
IEC 61508-1 Functional safety of electrical/electronic/programmable electronic
safety-related systems Part 1 general requirements
IEC 61508-2 Functional safety of electrical/electronic/programmable electronic
safety-related systems - Part 2: Requirements for
electrical/electronic/programmable electronic safety-related
systems
IEC 61508-3 Functional safety of electrical/electronic/programmable electronic
safety-related systems - Part 3: Software requirement
All detail design and construction shall be performed in accordance with the
Specifications, Standards, Code, Regulations, Shell DEPs, etc.
In any areas of conflict, detail design and construction shall be performed to the
following Regulations, codes and standards, which are in order of precedence:
In cases of conflict between documents in the same level of the hierarchy, the most
stringent requirement shall apply. In such cases VENDOR/CONTRACTOR shall
provide its interpretation in writing of the most stringent requirement for COMPANY's
Approval.
5. DESIGN REQUIREMENTS
All the Fire and Gas detection system in general shall comply with Shell DEP requirements
and ADCO amendment specification to DEP version 32. All the Instrumentation shall be from
COMPANY approved VENDOR list.
All the FGS Field devices (Detectors, beacons and sounders) (including those
supplied as part of packages), panels, accessories shall be suitable for the specified
hazardous area classification. In general all the field instrumentation shall be
intrinsically safe Eex (i) certified as per CENELEC. In case intrinsically safe devices
are not available, for example solenoids, F&G field devices, explosion proof Eex (d)
or (e) devices certified suitable for hazardous area classification as per CENELEC
shall be considered.
For such electrical apparatus the appropriate certificates and documentation shall be
available. All F & G Devices installed in hazardous area shall be suitable for Zone 1,
Gas group IIB, and Temperature class T3.
For all the F & G devices related to safety functions, as a minimum shall be SIL 1
certified. The Fire and Gas system PLC shall be SIL 3 certified.
The F&G system and Field detectors shall be provided with the following safety
documentations after order;-
SIL certification
The detailed report for certification, which states the operational, environmental,
proof testing frequency required to maintain the SIL level.
Failure data (safe and dangerous) for each instrument.
The classification of the safety loops shall be done according to the DEP 32.80.10.10-
GEN Instrumented Protective Functions (IPF).
The minimum degree of protection of field mounted Fire and Gas devices shall be
IP66. FGS control panels installed in control/equipment rooms shall have minimum
ingress protection to IP42.
All the F&G Field devices shall be suitable for operating in extreme weather
conditions of temperature, humidity and salt laden atmosphere. All F & G devices,
located in direct sun areas shall be designed either for maximum metal surface
temperature conditions of 85°C or shall be covered by a suitable sun shade.
Temperatures
Humidity
The FGS equipment to be mounted indoors (ITRs and Control Room) shall normally
be exposed to the following environment:
Temperature : 24°C ± 3°C Dry Bulb
Relative humidity : 25 to 70% ± 5% RH
However, in the event of air conditioning failure, the FGS equipment shall be able to
operate for 8 hours normally, provided that ambient conditions do not exceed the
following:
Temperature : 51°C
Humidity : 85%RH
The FGS equipment to be mounted inside the Passive cooled shelters shall normally
be exposed to the following environment:
Temperature : 40°C ± 2°C
Humidity : 85% ± 5% RH
EMC shall be in accordance with lEC 61000-3 and Shell DEP 33.64.10.33-GEN. It
shall be marked "CE" according to the corresponding European standard.
6.1 OBJECTIVE
The Fire and Gas Detection System shall be provided as per the Project HSE
Philosophy document reference 30.99.91.1625, Fire and Gas Philosophy document
reference 30.99.91.1627 and Shell DEPs guideline for selection, type, location and
quantity.
The F&G field detectors shall be provided in all new CPP, new buildings, each cluster
area, remote wells, new manifold station, BVS and MP-21, where there is a risk of
fire/gas leakage that requires early detection to minimize the risk to operating
personnel, equipment damage, production loss and reduce the impact on
environment.
Fire & Gas (F&G) Detection System will be provided with the following basic
objectives:
To monitor all areas of the Plant handling flammable/toxic/Asphyxiate materials.
To promptly detect and alert operating personnel.
All F&G system indications and alarms, shall be indicated on the ICSS Operator
consoles MIMIC’s displays. In addition on the LCD displays mounted in the CPP
control room.
Fire and Gas detection of Clusters and Remote wells of Rumaitha/Shanayel Phase-III
will be monitored from the ICSS operator consoles at CPP. In addition the local
operator consoles at each Clusters and remote wells will be provided for local
monitoring.
As per section 4.1 of Shell Dep 32.30.20.11, the number, type and location of
detectors shall be determined by an assessment of selection criteria, including:
Regulatory requirements;
Hazardous area zoning, Safety Study results;
Limits of equipment congestion;
Potential leak sources and areas where accumulation of gas may be likely or
particularly hazardous;
Type of detection approach to be provided – perimeter, area, or equipment
specific;
Detector voting logic to be deployed;
Properties of process fluids (composition, volatility, phase, temperature, pressure,
toxicity);
Characteristics of potential releases (jet or flashing liquid, plume, buoyancy);
Forced or natural draft ventilation patterns, wind speed and wind direction.
Based on the above parameters the Fire & Gas detectors, as applicable, shall be
provided as part of EPC for Rumaitha/Shanayel Phase-III Project.
Fire and Gas mapping study shall be performed during the EPC stage in order to
verify the provided number of detectors during FEED stage is adequate.
At the CPP a dedicated FSCs are installed for FGS functionality, with redundant
safety bus links to the IPS system FSCs, and redundant linkage to the Experion
system.
At the Cluster locations the FSCs carry out ESD, F&G and control functionality. In
case of reduced I/O, ESD, F&G and control functionality have been implemented in a
single redundant FSC system, however at larger clusters separate FSC systems are
installed to perform control and safety functions independently.
Communications between the CPP systems and remote sites (i.e. clusters
and isolated wells) is via SDH multiplexer systems and fibre-optic cabling
configured in a ring formation. Spur fibre connections are also provided to
isolated wells not on a fibre ring route, these are interfaced to the cluster
SDH multiplexer, which communicates with the CPP. The SDH multiplexer
system also carries telephone, CCTV, PA/GA and access control signaling.
The Fire and Gas Detection and Protection system shall provide an effective early warning of
a fire or gas event in plant area, building, and also automatically to trip HVAC System/close
fire dampers/trip battery banks initiate fire protection system (as applicable) to mitigate the
hazard.
Independent F&G systems shall be provided for CPP Process, Utilities and Clusters and
Remote wells. The F&G systems shall be SIL 3 rated safety PLC, designed in compliance
with IEC-61511 and IEC-61508 part-2. The system architecture shall meet the HFT
(Hardware Fault Tolerance) requirement based on the SFF (Safe Failure Fraction) values of
the designed system, as specified in IEC-61508, Table-3.
There shall be a dedicated FGS for the CPP process, CPP Compressor and CPP utilities.
For the Clusters and remote wells, the F&G logic shall be combined with the IPS Systems.
The I/O rack for the F&G systems shall be separated in the IPS system and shall be
according to the F&G Cause & Effect diagram.
At Crude and Gas export pipeline sectionalizing block valve stations, the F&G devices shall
be connected to the RTU system.
FGS for CPP shall be directly interfaced with the DCS through a safety link.
F&G Inputs/outputs shall be non-failsafe type i.e. normally de-energized, and energized to
activate. All such I/Os shall be designed with line-monitored circuits to detect short or open
circuit conditions.
The FGS shall incorporate extensive self-testing, fault monitoring and fault diagnostics
facilities which shall be available for continuous and periodic, automatic and operator initiated
testing purposes.
The gas detectors shall be smart HART type with 4-20mA output.
All the F & G systems shall communicate with each other over a redundant network and a
common PC with printer shall be provided at Control Room for SOE and programming
functions. In addition a laptop shall also be provided for the same functions.
A plant emergency audible alarm system shall be provided to give a warning to the plant
personnel in the CPP and Cluster areas. The siren and visual alarm shall be as defined in
the HSE philosophy.
F & G system will be interfaced with IPS system for shutdowns related to plant / building Fire
& Gas detection. Such interface shall be through hardwired digital signals between the two
systems.
The following types of testing and fault monitoring shall be provided as a minimum;
F&G detectors and alarm output circuit line monitoring
Fire protection system output circuit line monitoring
Logic system and I/O module self-testing, including loopback monitoring
Power supply distribution monitoring
Data storage availability and integrity test.
Any malfunction in the test and monitoring facilities shall not degrade the FGS Operation.
The FGS executive action signals from the FGS to the IPS and the PAGA shall be hardwired.
The FGS shall initiate deluge/ extinguishant systems directly by energizing associated
solenoid valves, which latch open on energization, requiring a local manual reset.
The power supply to the FGS shall be from the UPS system via dual redundant feeder, each
sized for full load.
Fire and Gas device inputs which initiate executive actions, and are not part of a 2 of N
voting system, for example, the fusible loop pressure transmitter, shall have redundant input
module.
The Plant facilities shall be divided into a number of fire zones as per the Fire Hazard
Zone Layout reference document number 44.99.88.06.08, for the purpose of Fire and
Gas detection and protection.
Fire zones are areas within the installation where equipment are grouped by nature
and/ or homogeneous level of risk attached to them. The partition into fire zones in
such that the consequences of a fire, a flammable gas leak or an explosion likely to
occur in the concerned fire zone shall not impact other fire zones to an extent where
their integrity could be put at risk. A fire zone is defined physically by its limits and
hydrocarbon inventory inside the zone.
The purpose of the fire zone definition is mainly to calculate the fire water demand
and then to size the fire water network. It is also considered for the design of the flare
system pressure safety valves (PSV) and Blowdown valves.
Separate fire zones are created in order to separate risks and limit the probability of
escalation. Simultaneous independent hazardous events in two separate fire zones
are not considered (Single jeopardy concept).
It shall be possible to completely isolate the hydrocarbon inventory within a single fire
zone by emergency shutdown valves and depressurize the isolated hydrocarbon
Each protection place has to be monitored with a minimum of two F & G sensors.
F&G detectors shall ensure personnel warning and allow immediate response to
minimize damage from any emergency situation.
The F&G System will acquire signals from the following type of devices distributed
throughout the fire zones:
Flame detector (Multi spectrum IR type);
Toxic gas detector (Semiconductor type);
Hydrocarbon Gas detectors (Point IR type);
Hydrocarbon Gas detectors (Open path type);
Carbon Dioxide (CO2) Gas Detectors(IR type)
Manual call points (MAC)
Smoke detectors
Heat detectors
Fusible Plug Heat Detectors
High Sensitivity Smoke Detection
Beacons
Sounders (Part of PAGA)
Linear heat wire loop or Linear heat detectors
Deluge valves
Alarm lights (flashing beacons) and audible alarms shall be provided in the plant
areas and inside/outside buildings for personnel warning. The audible alarm shall be
routed through PA system, the PA speakers shall be line monitoring and
redundancies will be considered in the design.
The Automatic Water Spray Systems provided to protect identified equipment in the
plant and utility areas shall be activated by the F&G System, including activation of
deluge valves and starting of the firewater pumps.
The following F&G Device for major package items and substation shall be provided:
Hydrocarbon(HC) gas detector (Point type) for LP / MP / HP gas compression
area, Vapor recovery unit area and
Hydrocarbon(HC) sulphide (H2S) gas detector for Crude oil separation area,
Crude oil dehydration and desalting area, Crude oil stabilization area, LP / MP /
HP Gas compression area and Vapor recovery unit area, Gas dehydration area,
CO2 separation area
Carbon dioxide(CO2) gas detector for CO2 separation area and CO2 LP & HP
compression areas
Triple IR flame detector for Crude oil separation area, Crude oil dehydration and
Each Phase-III building and passive cooled shelter shall be equipped with
a stand-alone Addressable Fire Alarm Control Panel (FACP).
This panel will acquire all local building detectors, Beacons, and Manual
Alarm Call Points and it will provide the confirmed Fire detected signal to
Main FGS, which will activate the executive actions within the building,
including alarms, shutdown of power to non EExd equipment and trigger fire
extinguishing systems when applicable, etc.
These Fire Alarm Control Panels will provide signals: “Common Fire”,
“Common Fault” and a separate “Fire Alarm” for each sub-zone, to the main
F & G system.
For each zone, single detection, confirmed detection and fault signals
shall be provided as outputs from the Building Fire Alarm Panel for interface
to the plant Fire & Gas system. The fire detection logic (voting) shall be
carried out in the plant F & G system
The Addressable Fire Alarm panel shall provide information of all
addressable type devices viz. Detectors, MAC’s and zone status (under
normal / alarm condition) continuously. All the loops shall be supervised and
faults in any detectors shall be displayed.
All Analog addressable Field detectors, MAC’s and Heat detectors shall
be connected to the FACP Central Monitoring Unit (CMU) on pair loops (2C
X1sq.mm, Mineral Insulated Copper Conductor cable) in a ring network, to
be confirmed during detaiedl engineering.
Upon detection of fire by one or more of the field devices an alarm shall
be raised at the FACP CMU in addition to initiation of all Alarms connected in
the respective Building FACP.
Operation of any MAC within any zone will activate all the audible
Alarms/ in that building.
It shall be possible to configure the FACP Central Monitoring Unit to
differentiate between single and coincident detection within the given fire
loop.
Any failure of the Analog addressable field device shall not affect the
performance of Fire Alarm Panel. In addition, no single fault on the analog
addressable loop shall cause a loss of detector coverage.
The system shall be provided with extensive self-testing facilities and
annunciate all system faults. Test, Reset and Acknowledge functions shall be
provided in the FACP.
Self-diagnostics features shall be provided in the CMU to identify any
faults during a system breakdown.
System features shall include detector condition monitoring and shall
The following interface shall be considered for the design of Fire Alarm
System:
The new fire alarm panel at Al Rumaitha Industrial building will have a
repeater panel located at Al Rumaitha existing MCR.
Gas detectors, at buildings’ air intake / air locks including ITR building, shall
be hardwired, directly, to the main FGS. This means that the interface to the
HVAC system shall be from the FGS.
High Sensitive Smoke Detection (HSSD) System shall be able to detect fire
in its incipient stage i.e. long before visible smoke and flames are present
and give an early warning.
The High Sensitivity Smoke Detection (HSSD) System shall provide an early
smoke detection and alarm facility for smoke release within the buildings
such as ITR’s and Substations.
Each detector unit shall be suitable for detecting smoke levels during
early stages of fire from the zone which consists of different areas
(Areas inside buildings comprises cabinets, racks, floor void, false
ceiling voids, false floor voids) and zone display for the same shall be
available on the display unit.
The Detector unit shall be designed in such a way that opening of the
panel during normal operation shall not lead to system fault or spurious
alarm.
The interface of each detector / display unit with the main Fire and Gas
System shall include,
zone Pre-Alarm (Alert)
zone Confirmed Alarm (Fire)
HSSD System Fault Alarm
A FGS Engineering Workstation with printer will be provided for the system at
Engineering Room of MCR for SOE and programming function. FGS engineering
workstation will be connected to the FGS nodes via safety network. In addition a
laptop shall also be provided for the same functions. This workstation shall be
provided with the relevant software for on-line monitoring and configuration allowing
engineering changes and maintenance access to the FGS program according to a
security level access.
Fire and gas executive actions for shutdown and alarm shall be based on Fire and
Gas Philosophy document reference 30.99.91.1627.
The following general rules are applicable to the interlocks described hereafter:
All the logics shall be configured for “Non-fail safe”, “energise to trip”.
There shall be no time lag between the causes and effects, unless otherwise
specified.
Maintenance override for each initiator.
Maintenance Override Enable Switches give permissive for the individual
override of the relevant group.
Evaluate mitigation of existing problem of operator forgetting override switch after
maintenance, i.e. MOS time.
Further details such as the alarm and Hi Hi alarm settings and logics refer to F&G
cause and effect matrices.
The Fire and Gas detectors voting logic shall be implemented in the systems
as per the following philosophy for Detector faults.
a) 2oo3 Voting:
I. First Fault : The logic will operate in 2oo2 mode when MOS is
activated. Once the MOS is inactivated, the logic will operate in
2oo3 mode.
II. Second Fault: The Logic will operate in 1oo2 mode.
c) 2oo2 Voting:
One Fault: The logic will operate in 1oo2
Level 2 – Maintenance
This level shall be used by the maintenance personnel, for diagnostics and viewing
the system & input/output point configuration. This level shall only provide a limited
access, such that either application program or trip setting modification shall be
prohibited.
Level 3 – Engineering
On this level all configuration and input/output trip setting can be accessed and
modified. The application program can also be accessed and modified in this level of
access.
Maintenance override functions are required to bypass any predefined field F&G
devices in the FGS loop for carrying out some maintenance activities on the by-
passed field device (calibration, repair or replacement).
The DCS soft Maintenance Override Switches (MOS) shall be latched type, which can
be cleared by the Operator either by this switch itself or by the Override Enable
Switch. When the maintenance override is initiated from the DCS, the FGS shall
bypass the respective trip signal for a duration of 4 hours and alert the operator after
3.5 hours, if the override is not removed.
All the FGS initiating alarm and FGS confirmed alarm shall be indicated in graphics.
F & G Activation Push buttons located on the hardwired console shall be Pulsed type.
Initiation of Push Buttons can be cleared by the operator through DCS soft reset
switches.
The Alarm assessment shall be a qualitative assessment of the Fire and Gas
coverage in the process facilities and define the alarm priority for the Fire
and Gas alarms and rationalization of all alarms.
The FGS shall generally acquire data from field F & G devices, check with
the respective alarm setting and generates the ‘Normal/Alarm’ conditions. It
shall also acquire digital data like MAC signals from field etc.
When an alarm is detected as the first-up alarm within a subsystem, the bit
indicating its first-up state shall be set to 1 and the logic shall block the first-
up bit of any other alarm initiating the same executive actions.
For each alarm initiating the shutdown of several subsystems, there shall be
only one first-up alarm and consequently the logic shall lock the first-up bit of
all other alarms in the subsystems for which the shutdown has been initiated.
All the inputs shall be time stamped on the trip value for both analog and
digital signals. The time stamping shall be based on actual input acquisition
time and shall be independent of the controller scan time.
All the input and output from/to the FGS shall be alarmed at the DCS with
Alarm priority.
The data transfer between the FGS and the DCS shall be based on positive
logic, that is, normal condition shall be ‘0’ state and abnormal condition shall
be ‘1’. This is because the failure of communication link shall not create a
burst of alarms in the DCS.
On the alarm condition communicated to the DCS, the alarm at the DCS
shall be initiated. The respective alarm indication shall be blinking until it is
acknowledged. It shall be acknowledged through any one of the various
means provided in the DCS.
Upon acknowledgement the indication shall stop blinking and remains steady
until the alarm returns to normal. When alarm condition is reset, the
respective indication shall also be reset automatically. No manual reset is
required at the DCS.
The FGS and sub-system components shall be supported for a period of minimum 15
years from the date of system commissioning. Any hardware or software upgrade or
version change within this period shall be informed to COMPANY.
The FGS VENDOR shall continue to support the spare parts for all system hardware
and software for a period of 10 years from the date of product discontinue. An
advance notification shall be sent to COMPANY prior to the product discontinue or
obsolescence.
The reliability and availability of the system is critical to the safety and continued
production of the Phase-3 CPP facilities.
System spare shall be as per the specification for ICSS Document No 30.99.39.1629.
Cabinets shall not be overcrowded in the design and layout of internal components. A
30% spare space is to be provided. The cabinet spare philosophy is applicable only
for new cabinets and cables.
In each multi-core cable 25% spare cores shall be provided. All spare wires/cores
including shields in cables shall be terminated and numbered in junction boxes and
panels in substation.
25% spare capacity shall be available in the ducting when all wiring is complete
including wiring for 25% built-in spare I/O points, terminal blocks, and termination
assemblies.
Any FGS function in a FGS shall be independent of the DCS, i.e. any writing
signal from DCS to a FGS either hardwired or soft shall not be part of a FGS
function.
DCS writing signals will include the following non-safety signals by soft: DCS
operator commands, start, reset conditions and MOS.
All signals from FGS to DCS shall be available via Process Control Network.
Cluster FGS nodes will be connected to all CPP FGS through the safety
network.
Inter-trip signals between safety systems will be through the safety related
bus, TUV certified for SIL-3.
When both FGS and IPS Systems have a safety action on a final device,
F&G trip signal will be sent to the IPS through the safety related bus and the
IPS signal will carry the combined trip signal to the final device.
Indication and commands on the FGS Auxiliary panel in MCR shall be driven
from the FGS access to ITR-03, ITR-04, ITR-05, Substation-03, Substation-
04 and Substation-05. Refer to ICSS specification for details.
8. UTILITIES AVAILABLE
At the Main Control Room (MCR), Instrument Technical Rooms (ITRs), sub-stations
and Telecoms Equipment Rooms (TERs), the following utilities shall be available for
instrument and control requirements:
Remote isolated wells farther than 2km from another well and with a load requirement
of less than 1 kW shall be equipped with solar panels, to provide power at 24Vdc for
the electrical users. This is in line with the current philosophy for remote isolated wells.
Separate UPS power will not be required as the solar power systems will be battery
backed.