SIL = Safety Integrity Level •Safety systems are becoming increasingly instrumented •Depending less on human intervention and operator’s ability to respond correctly in a given situation •Depending more on instrumentation and programmable systems •SIL requirements are intended to ensure the reliability of such safety instrumented systems

1. Working together
for a safer world
Functional Safety (SIL) in the Subsea and Drilling Industry
June 3rd, 2015
Lloyd’s Register Energy

2. ©Lloyd’s Register Consulting
SIL – Background
• SIL = Safety Integrity Level
• Safety systems are becoming increasingly
instrumented
• Depending less on human intervention and
operator’s ability to respond correctly in a given
situation
• Depending more on instrumentation and
programmable systems
• SIL requirements are intended to ensure the
reliability of such safety instrumented systems

3. ©Lloyd’s Register Consulting
Principles for risk reduction

4. ©Lloyd’s Register Consulting
What is a safety instrumented function ?
Sensor Brain Protective unit
Input Output
Initiator Logic solver Final element
Examples:
- Transmitters
- Detectors
- Push buttons
Integrity Level X
Examples:
- Process shutdown (PSD)
- Fire & Gas (F&G)
- Emergency shutdown (ESD)
Examples:
- Valves
- Firewater
- Dampers

5. ©Lloyd’s Register Consulting
4 main requirements
Quantitative
Requirements
Qualitative
Requirements
Software
Requirements
Semi-Quantitative
Requirements
Probability of Failure on
Demand (PFD)
Avoidance and Control of
Systematic Failures
· Design and integration
process
· Competency and training
· QA, follow-up, change
control etc.
Software Safety Functions
· V-model
· Certified SW clocksArchitectural Constraints
· Safe Failure Fraction
(SFF)
· Hardware Fault
Tolerance (HFT)
SIL

6. ©Lloyd’s Register Consulting
Integrity Levels (IL)
SIL = Safety Integrity Level
EIL = Environmental Integrity Level
AIL = Asset Integrity Level

7. ©Lloyd’s Register Consulting
Regional standards and regulations
• USA/ Canada
• No government regulations or specific standards for SIL
• Companies use the IEC functional safety standards or a company specific variation of
the IEC standards
• Brazil
• Petrobras standard N-2595 Rev.C.
• Based on IEC 61508/61511
• Norway
• NOG Guideline 070 – Guideline on how to use IEC 61508/61511
• Provides minimum SIL levels for various common SIFs
• UK
• Risk based approach (Safety case and performance standards)
• Often achieved by showing compliance with IEC 61508/61511

8. ©Lloyd’s Register Consulting
Advantages of using SIL
• Calculate and document the required performance
for a safety instrumented function
• Measure of safety unavailability - Probability of
failure on demand (PFD)
• Provide justification for chosen test intervals based on
required SIL
• Documentation of safety system lifecycle to ensure
that the system meets the required reliability
• Reduced cost due to lower safety system
unavailability

9. ©Lloyd’s Register Consulting
Typical SIFs for a BOP stack
• NOG guideline 070, defines the following
functions for a BOP:
1. Seal around drill pipe
2. Seal an open hole
3. Shear drill pipe and seal off well
• The guideline differentiates between two main
functionalities and sets SIL levels for:
• The annular preventer/pipe ram function
(function 1) – SIL 2
• The shear ram function (function 2 & 3
combined) – SIL 2

10. ©Lloyd’s Register Consulting
Typical SIL Requirements for Workover Systems
• Emergency shutdown (ESD) – SIL 2
• Emergency quick disconnect – SIL 2
• Process shutdown (PSD) – SIL 2

11. ©Lloyd’s Register Consulting
X-mas Tree/ Subsea Production System
Typical SIL requirements
• Isolate one well from manifold/ flowline by
activation through topside ESD logic solver and
closure of well valves (relevant XT-valves
including DHSV)
• ESD
• SIL3
• Shut down one well (PWV or PMV) on topside
PSD, by electrical power cut
• PSD
• SIL 2

12. ©Lloyd’s Register Consulting
Subsea Isolation Valve (SSIV)
• Creates a safety barrier in case a part of a
flowline needs to be shut down
• Main purpose is to protect the platform
and its personnel from unintended release
of hydrocarbons.
• Designed to be fail safe, and to close on
loss of active signal from the ESD system
• The SSIV is typically SIL 2 rated.

13. ©Lloyd’s Register Consulting
High Integrity Pressure Protection System (HIPPS)
• A system that closes the source of over-pressure
quickly (within 2 seconds) with a determined
reliability
• A subsea HIPPS consists of
• The initiators that detect the high pressure
• A logic solver
• The final elements that perform the
corrective action in the field
• Normally SIL 2 or SIL 3

14. ©Lloyd’s Register Consulting
Total overview –
Services and products from LR Energy
- QRA
- PSA
- Risk analysis in
transport,
energy &
industry
- Environmental
risk
assessments
- HAZOP and
process safety
- CFD
- Structural
analysis
- Empirical
tools
- Probabilistic
tools
- Flow
assurance
- Nuclear
consequences
- Technical
safety
Risk based
management
Risk analysis
Technical safety
and
consequence
modelling
Engineering
dynamics
Human factors
and
working
environment
Reliability and
asset
performance
- Human
factors
integration &
working
environment
- Physical
ergonomics
- Cognitive
ergonomics
- Socio-
technical
systems
- Reliability and
SIL
- RAM and
Asset
performance
- FMECA
- Data and
Uncertainty
analysis
- Fluid dynamics
- Machinery
dynamics
- Structural
dynamics
- Noise and
vibration
control
- Field measure-
ment, testing
and signal
analysis
-RiskSpectrum
- Other LR
Consulting
made software
Risk
management
software
• HSE&Q
management
• Asset and
RAMS
management
• Emergency
preparedness
• Safety
licensing