POS (Start-Up Over-ride Switch) & MOS (Maintenance Over-ride Switch)

Mojtaba HabibiProcess Engineer at Wood Group

Dears,
At this topic I would like to discuss about importance and design aspects of SOS (Start-Up Over-ride Switch) & MOS (Maintenance
Over-ride Switch).
As you know SOS is defined for some shutdown loops such as very low liquid level of storage tank/separator and very low pressure
to prevent spurious shutdown of the plant and minimize start-up difficulties. MOS has the same function with focus on
maintenance.
Could you please share your idea and experiences on below queries:
1. For SOS and MOS a time period should be specified and once this time period is elapsed the shutdown loops will be activated.
How do you specify SOS and MOS required time? any typical value or lessons learnt in this regard?
2. Which shutdown loops should be included as part of SOS and MOS?
3. How to arrange the SOS time period with respect to several shutdown loops for a lage plant start-up?
4. How to specify/sectionalise the process for MOS? should it be equipment wise, train wise or plant wide? on other hand how much
flexibility should be considered for MOS?
5. Any other technical point that should be considered?
Many thanks for your time and help.
All The Best,
Mojtaba

Comments
Emil Modoran, loreto jr saldana and 6 others like this
16 comments Jump to most recent comment

YOUSEF
YOUSEF RASHIDINEJAD
Process Engineer, Sulfur Technologist at Agip KCO
Dear Mojtaba
About your Q1: SOS time period is depend how long does it take until unit getting stabel, for example for a pump flow rate it will take about maximum 30
sec. but in order to stablized the copressors suction, or discharge pressure it may take about 5 to 10 mini or more but not more than 30 min.
but for MOS we do not need any time preriod and timing is depend to how important that element is and how long does it take to repair, so for that the
Supervisor or SUPT. of the plant will deside.
Q2: As I explain in part one for start up of some equipment we need to put SOS, but MOS has been put for any Trip signal from instruments in order alow
instrumnetation to check and calibrate, do PM and CM on that. but should be carefull about Voting system. because some of voting system assume the
inhibit as a fault and 2nd inhibit my cause trip. for prevent to have such problem should force the trip comand.
Q3: It is explain in Q1, depend how long take time for normalize.
Q4: for MOS need just put the inhibit or force for the instrument which need to be fix. this could have effect on equipment, Train or overal plant. depend
how iportant is it and where is the location. For example if it is located on hipps will effect all plant, if located on one non essentila equipment will trip only
that equipment.
o
Like (4)
o
Flag as inappropriate
o
July 2, 2013
mourad B., Mojtaba Habibi and 2 others like this
Mojtaba
Mojtaba Habibi
Process Engineer at Wood Group
Dear Mr.RASHIDINEJAD,
Thanks a lot for your time and help.
1. If MOS specified time is elapsed while we have not finished with your works, should we expect any difficulty, problem or hazard?
2. How to specify MOS for specific equipment?
3. What do you mean by PM and CM?
4. Could you please explain more about "should be carefull about Voting system. because some of voting system assume the inhibit as a fault and 2nd
inhibit my cause trip. for prevent to have such problem should force the trip comand."?
Many thanks.
Best,
Mojtaba
o
o
o

Like
Flag as inappropriate
July 2, 2013
Richard

Richard Hord
Retired Union Carbide/Dow Chemical
Where I worked this violates Procedures. To do this would require some Paperwork and Signatures.
o
Like (2)
o
Flag as inappropriate
o
July 2, 2013
mourad B., Philippe N. like this
Jonter
Jonter Siregar

Project Manager at PT. MKK under VME Process

Hi Mojtaba,
Please specify the type of plant, is it Oil & Gas or another process ? and is it treatment gathering or refinery. a different plant process will different SOS &
MOS procedure that will affected to time required that you need. Thanks
o
Like
o
Flag as inappropriate
o
July 3, 2013
Richard
Richard Hord
Retired Union Carbide/Dow Chemical
Union Carbide/Dow Chemical all plants.
o
Like
o
Flag as inappropriate
o
July 3, 2013
YOUSEF
YOUSEF RASHIDINEJAD
Process Engineer, Sulfur Technologist at Agip KCO
Dear Mojtaba:
As I mention for MOS we could not put a timer to removed automatically otherwise Plant or equipmnet would be tripped if Repair job is not complet.
for any Trip signal from any instrumentation and F&G system you can have MOS because they need to be maintained and could not stop production or any
equipment for checking one instrument, so for any Trip signal from any instrument or F&G you should have possibility for MOS in order to do your
maintenace job.
PM means Preventive MNT
and CM means corrective MNT
About Voting system, Let I explain it with an example.:
there is a voting system in the letdown station of one plant and the important parameter is pressure, so there is 3 PT all connected to the voting system of
2 out of 3 so that means if 2 detect any unormality will send trip signal in S/D system. so if there is any MNT action for thouse PTs need to inhibit them in
order do not send fault signal for S/D, if put the normal inhibition it think that this PT is faulty so already lose one of 3 so if any othere has got fault plant
will trip. also if put 2 inhibit for 2 PTs plant will trip because of 2 fault detected.
in order to avoid of any trip for MNT activity for such system Alarm signal must be forecd and always show correct to S/D.
Hope explnation is enough
o
Like (2)
o
Flag as inappropriate
o
July 3, 2013
Saeed N., mourad B. like this
Nigel
Nigel Sooklal
Plant Superintendent at Incitec Pivot
I work in the Ammonia industry. When we developed the coding for the logics, the SOS
were built in as dictated by the condition of the plant. eg, toggling a switch to "start up mode" would automatically overide certain transmitters linked to
the trip system. Also built into the logic was the automatic removal of the SOS as the plant conditions met the permissives for the overides to be removed.
eg, flow rate greater than XXXX or HS XXXX toggled to NORMAL MODE.
On the MOS, as mentioned by Richard Hord, we have to seek authority to apply a MOS. This authority is in the form of a safety systems bypass register
which has to be accompanied by a risk assessment and required approvals. Based on the time frame for the MOS to be active, a different level of
authorisation is required. eg 0-3 hrs - Supervisor, 3-24 hrs - Plant manager, > 24 hrs - Site manager.
The MOS is applied to trip transmitters by use of secured environment (supervisor login) AND a key switch to toggle the MOS on the transmitter. Once
applied, the system is handed over to maintenence. The removal of the MOS has to also seek the authorisation from the supervisor before removal to
ensure the transmitters are in fact reading correctly.
We also have a rigid system of auditing the active bypasses and actioning close out ASAP.
Hope this helps and have a safe and productive day.
o
Like (3)
o
Flag as inappropriate
o
July 3, 2013
vinod S., mourad B. and 1 other like this
John
John Lewicki
CONSULTANT at n/a-freelance
You never over ride a trip switch, you can only energise one , when a MAINT function is planned with all of the goodies signed off.
No over ride switch should be left on over a long period, which simply means that the repairs were not carried out correctly.
I have seen an override switch being left on a CGC, with devistating results.
o
Like (1)
o
Flag as inappropriate
o
July 5, 2013
Richard H. likes this

ehab abd elaziz

ehab abd elaziz ghanem
commissioning&operations Superintendent at Saipem
sos is very important for avoid any shoutdown but should be care of hazard and to avoid any damage of equipments by example if we have level low low
and it is comming gas with high pressure to the pump so the pump will be make HAZARD so it should be looking to the level Gage and be aware from the
level (like compressors KO ) otherwise in pumps discharge we have flow and no premmition to start before the flow occur so we need to put override
switch to flow but need timer not forever and the time depend to the pressure discharge so it is much more dependent
overall if you put override you must mention to all your supervisor but before instrumentation should be work on it and give green light that the signal
from the transmitters are right not need to be adjusted
it should be all opertional peopel now about that and it should be written
Regards
Ehab
o
Like (1)
o
Flag as inappropriate
o
July 5, 2013
mourad B. likes this
Greg

Greg Dunnells
Senior Petrochemicals Staff Consultant
There are several ways to do this. If it is truly a startup function, then you can do something like a mode switch, which allows you to start up the process.
For maintenance, typically you would turn off the interlock - but only with proper procedures and authorizations in place.
The proper way to do these things is during a hazards evaluation (hazop, etc) where you look at the hazards that the interlock is mitigating, and decide
whether or not it is truly a safety issue.... or not.
The tendency of late, is to make everything a "safety interlock" which may or may not be true. It is truly safety only if, there is a danger of someone
getting injured or a major environmental problem. There are other types of interlocks, such as process, which are intended to avoid a non-safety problem.
The ISA standards have all of the details on how to do these sorts of things.
o
Like (2)
o
Flag as inappropriate
o
July 5, 2013
Mike E., mourad B. like this

John
John Lewicki
CONSULTANT at n/a-freelance
Please don,t forget the
o
o
o

liability insurance, if you screw up, they won,t pay, so it comes down to need , planning and execution.
Like
Flag as inappropriate
July 6, 2013
WASIM
WASIM YASIN, ASP, BE Chem
Operations| Pre-commissioning| Commissioning| Process Safety Managment Professional
Q1: No such timer to be provided as you never know that whether job would have been completedor not by the time it resets the logic. Yes, indication
(Panel Bulb) to be provided so that boardmen should not forget the bypassed securities.
Q.2: Normally, these are provided for Lower Limit of securities such Low level, low flow, low pressure, low ratio, low speed etc as in startup phase these
securities would be below their lower limits & would not let the plant startup. Once the plant has crossed these lower limits by a significant pre-defined
value these should be taken in service ASAP.
o
Like
o
Flag as inappropriate
o
September 9, 2013
WASIM
WASIM YASIN, ASP, BE Chem
Operations| Pre-commissioning| Commissioning| Process Safety Managment Professional
Q1: No such timer to be provided as you never know that whether job would have been completedor not by the time it resets the logic. Yes, indication
(Panel Bulb) to be provided so that boardmen should not forget the bypassed securities.
Q.2: Normally, these are provided for Lower Limit of securities such Low level, low flow, low pressure, low ratio, low speed etc as in startup phase these
securities would be below their lower limits & would not let the plant startup. Once the plant has crossed these lower limits by a significant pre-defined
value these should be taken in service ASAP.
Greg
Greg Dunnells
Senior Petrochemicals Staff Consultant
I agree with Wasim. This is an operations management decision. Typically a bypass authorization expires when the shift changes, and has to be reauthorized.
Mojtaba
Mojtaba Habibi
Process Engineer at Wood Group
Dear Mr.RASHIDINEJAD,
Regarding to 2OO3 voting instrumentation MOS:
I think if there is any need for maintenace of any of these 3 transmitters this mean for that particular transmitter something is wrong and from MOS
viewpoint this means fault. So for this case the 2OO3 logic should automically be changed to 1OO2 logic once MOS is enabled for one of the faulty
transmitters. Also I think simultaneous MOS for more than one transmitters should be prohibited. Correct me if I am wrong.
Best,
Mojtaba
Jan
Jan Dauwerse
process stop coordinator / shift supervisor at SABIC
Hello Mojtaba.
there are different levels of switches. It depends on the effect of the damage when the switch doesn't work. Do you have only financial damage or is it
possible that people get hurt or even die. Is it a problem for the envirement or reputation. The highes level has the biggest impact. The level of importance
is analized by engeneers, manager operations and production. We yuse a foult tree for this analise. Normally we are allowed to overide these switches for
less than 24 hours a year. Only the manager operations is allowed to approve to overide. The middle level has lessel impact and we are allowed to overid
for a period of a week a year. The manager operations or his assistant are allowed to approve this overid. The lowest level doesn't have much impact.
There is no time limit to overid and the shift supervisor can approve this overid.
A SOS is a part of the design of the plant and doesn't have a time limit. When a system is not working, like during a turn around, there is no level of
importance. A switch must work during the time a potential danger is coming out of the process.
During running a plant you have to test the switches on time base. It can be possible that you have to overide a switch during this test. There is also a
difference inside the process. When you run a reactor the high temperature switches must have an other high limit than if you do a regeneration of this
reactor.
The only way of keeping the plant save is to keep a good administration of all the overrides. The shift supervisor will check this list every day.
Jan
Jan Dauwerse
process stop coordinator / shift supervisor at SABIC
Hello Mojtaba.
there are different levels of switches. It depends on the effect of the damage when the switch doesn't work. Do you have only financial damage or is it
possible that people get hurt or even die. Is it a problem for the envirement or reputation. The highes level has the biggest impact. The level of importance
is analized by engeneers, manager operations and production. We yuse a foult tree for this analise. Normally we are allowed to overide these switches for
less than 24 hours a year. Only the manager operations is allowed to approve to overide. The middle level has lessel impact and we are allowed to overid
for a period of a week a year. The manager operations or his assistant are allowed to approve this overid. The lowest level doesn't have much impact.
There is no time limit to overid and the shift supervisor can approve this overid.
A SOS is a part of the design of the plant and doesn't have a time limit. When a system is not working, like during a turn around, there is no level of

importance. A switch must work during the time a potential danger is coming out of the process.
During running a plant you have to test the switches on time base. It can be possible that you have to overide a switch during this test. There is also a
difference inside the process. When you run a reactor the high temperature switches must have an other high limit than if you do a regeneration of this
reactor.
The only way of keeping the plant save is to keep a good administration of all the overrides. The shift supervisor will check this list every day.