The function of safety systems is to take control and prevent an undesirable event when the process and the facility are no longer operating within normal operating conditions. Functional safety is the part of the overall safety of a system that depends on the correct response of the safety system response to its inputs, including safe handling of operator errors, hardware failures and environmental changes (fires, lightning, etc.).

The definition of safety is "freedom from unacceptable risk" of physical injury or of damage to the health of people, either directly or indirectly. It requires a definition of what is acceptable risk, and who should define acceptable risk levels. This involves several concepts, including:

1. Identifying what the required safety functions are, meaning that hazards and safety functions have to be known. A process of function reviews, formal hazard identification studies (HAZID), hazard and operability (HAZOP) studies and accident reviews are applied to identify the risks and failure modes.
2. Assessment of the risk-reduction required by the safety function. This will involve a safety integrity level (SIL) assessment. A SIL applies to an end-to-end safety function of the safety-related system, not just to a component or part of the system.
3. Ensuring the safety function performs to the design intent, including under conditions of incorrect operator input and failure modes. Functional safety management defines all technical and management activities during the lifecycle of the safety system. The safety lifecycle is a systematic way to ensure that all the necessary activities to achieve functional safety are carried out, and also to demonstrate that the activities have been carried out in the right order. Safety needs to be documented in order to pass information to different engineering disciplines.

For the oil and gas industry, safety standards comprise a set of corporate, national and international laws, guidelines and standards. Some of the primary international standards are:

IEC 61508

Functional safety of electrical/electronic/programmable electronic safety-related systems

IEC 61511

Functional safety - Safety instrumented systems for the process industry sector

A safety integrity level is not directly applicable to individual subsystems or components. It applies to a safety function carried out by the safety instrumented system (end-to-end: sensor, controller and final element).

IEC 61508 covers all components of the E/E/PE safety-related system, including field equipment and specific project application logic. All these subsystems and components, when combined to implement the safety function (or functions), are required to meet the safety integrity level target of the relevant functions. Any design using supplied subsystems and components that are all quoted as suitable for the required safety integrity level target of the relevant functions will not necessarily comply with the requirements for that safety integrity level target.

Suppliers of products intended for use in E/E/PE safety-related systems should provide sufficient information to facilitate a demonstration that the E/E/PE safety-related system complies with IEC 61508. This often requires that the functional safety for the system be independently certified.

There is never one single action that leads to a large accident. It is often a chain of activities. There are many layers to protect against an accident, and these are grouped two different categories:

• Protection layers — to prevent an incident from happening. Example: rupture disk, relief valve, dike.
• Mitigation layers — to minimize the consequence of an incident. Example: Operator intervention or safety instrumented system (SIS)

An SIS is a collection of sensors, controllers and actuators that execute one or more SIFs/safety loops that are implemented for a common purpose. Each SIF has its own safety integrity level (SIL) and all sensors, controllers and final elements in one SIF must comply with the same SIL, i.e., the end-to-end safety integrity level. The SIS is typically divided into the following subsystems:

• Emergency shutdown system (ESD) to handle emergency conditions (high criticality shutdown levels)
• Process shutdown system (PSD) to handle non-normal but less critical shutdown levels
• Fire and gas systems to detect fire, gas leakage and initiate firefighting, shutdown and isolation of ignition sources

The purpose of an SIS is to reduce the risk that a process may become hazardous to a tolerable level. The SIS does this by decreasing the frequency of unwanted accidents:

• SIS senses hazardous conditions and takes action to move the process to a safe state, preventing an accident from occurring.
• The amount of risk reduction that an SIS can provide is represented by its SIL, which is a measure of the risk reduction factor provided by a safety function. IEC 61508 defines four levels, SIL 1–4, and the corresponding requirements for the risk reduction factor (RFF) and probability of failure on demand (PFD):

SIL	PFD	RRF
1	0.1–0.01	10–100
2	0.01–0.001	100–1000
3	0.001–0.0001	1000–10,000
4	0.0001–0.00001	10,000–100,000

The SIL for a component is given by its PFD, safe failure fraction and design to avoid influence of systematic errors.

The emergency shutdown (ESD) and process shutdown (PSD) systems will take action when the process goes into a malfunction or dangerous state. For this purpose, the system maintains four sets of limits for a process value, LowLow (LL), Low (L), High (H) and HighHigh (HH). L and H are process warning limits which alert to process disturbances. LL and HH are alarm conditions and detect that the process is operating out of range and there is a chance of undesirable events and malfunction.

Separate transmitters are provided for safety systems. One example is the LTLL (level transmitter LowLow) or LSLL (level switch LowLow) alarm for the oil level. When this condition is triggered, there is a risk of blow-by, which means gas leaks out of the oil output and causes high pressure in the next separation stage or other following process equipment, such as a desalter. Transmitters are preferred over switches because of better diagnostic capabilities.

Emergency shutdown actions are defined in a cause-andeffect chart based on a HAZOP of the process. This study identifies possible malfunctions and how they should be handled. On the left of the chart, we have possible emergency scenarios. On top, we find possible shutdown actions. At an oil and gas facility, the primary response is to isolate and depressurize. In this case, the typical action would be to close the inlet and outlet sectioning valves (EV 0153 20, EV 0108 20 and EV 0102 20 in the diagram), and open the blowdown valve (EV 0114 20). This will isolate the malfunctioning unit and reduce pressure by flaring of the gas.

Events are classified on a scale, e.g., 0 to 5, where a full abandon platform/facility shutdown (APS – ESD0) as the highest level means a complete shutdown and evacuation of the facility. The next levels (ESD1, ESD2), define emergency complete shutdown. The lower levels (e.g., PSD 3, PSD 4 and PSD 5) represent single equipment or process section shutdowns. A split between APS/ESD and PSD is done in large installations because most signals are PSD and can be handled with less strict requirements

These actions are handled by the emergency shut down system (ESD) and process shut down system (PSD) according to functional safety requirements and standards. Thus, a typical ESD function might require a SIL 3 or even SIL 4 level, while PSD loops could be SIL 2 or SIL 3.

Smaller ESD systems, e.g., on wellhead platforms, can be hydraulic or hardwired (non-programmable).

The fire and gas system is not generally related to any particular process. Instead, it divides into fire areas by geographical location. Each fire area should be designed to be self-contained, in that it should detect fire and gas by several types of sensors, and control fire protection and firefighting devices to contain and fight fire within the fire area. In the event of fire, the area will be partially shut off through closure of ventilation fire dampers. A fire area protection data sheet typically shows what detection exists for each fire area, and which fire protection action should be taken in case of an incident.

The type and number of the detection, protection and fighting devices depends on the type of equipment and size of the fire area and will vary for different process areas, e.g., electrical rooms and accommodation rooms.

Fire detection:

• Gas detection: Combustible and toxic gas, electro-catalytic or optical (IR) detector
• Flame detection: Ultraviolet (UV) or infra red (IR) optical detectors
• Fire detection: Heat and ionic smoke detectors
• Manual pushbuttons

Firefighting, protection:

• Gas-based firefighting, such as CO₂
• Foam-based firefighting
• Water-based firefighting: sprinklers, mist (water spray) and deluge
• Protection: Interface to emergency shutdown and HVAC fire dampers.
• Warning and escape: PA systems, beacons/lights, fire door and damper release

A separate package related to fire and gas is the diesel- or electrically-driven fire water pumps for the sprinkler and deluge ring systems.

For fire detection, coincidence and logic are often used to identify false alarms. In such schemes, several detectors in the same area are required to detect a fire condition or gas leakage for automatic reaction. This will include different detection principles, e.g., a fire, but not welding or lightning strike.

Action is controlled by a fire and gas system (F&G). Like the ESD system, F&G action is specified in a cause and action chart called the Fire Area Protection Datasheet. This chart shows all detectors and fire protection systems in a fire area and how the system will operate.

The F&G system often provides supervisory functions, either in the F&G or the information management system (IMS) to handle such tasks as maintenance, calibration or replacement and hot work permits, e.g., welding. Such actions may require that one or more fire and gas detectors or systems are overridden or bypassed. Specific work procedures should be enforced, such as a placing fire guards on duty, to make sure all devices are reenabled when the work permit expires or work is complete.

Piping and instrumentation diagrams (P&ID) show the process. Additional information is needed for the specification of the process control and safety systems design and their control logic. These include: Loop diagram, Instrument datasheet, Cable schedule and Termination list.

The illustration shows one typical format. This is the common format for the NORSOK SCD standard. (Example for the Njord Separator 1 and 2 systems control diagram). Essentially, the P&ID mechanical information has been removed, and control loops and safety interlocks drawn in with references to typical loops.

Supervisory control and data acquisition (SCADA) is normally associated with telemetry and wide area communications, for data gathering and control over large production sites, pipelines, or corporate data from multiple facilities. With telemetry, the bandwidth is often quite low and based on telephone or local radio systems. SCADA systems are often optimized for efficient use of the available bandwidth. Wide area communication operates with wideband services, such as optical fibers and broadband internet.

Remote terminal units (RTU) or local controls systems on wells, wellhead platforms, compressor and pump stations, are connected to the SCADA system by means of the available communication media. SCADA systems have many of the same functions as the control system, and the difference between them is mainly their data architecture and use of communications.

Solution for data acquisition, modeling and visualization between facility operators and central company experts to provide:

• Drilling simulation and visualization, automatic diagnostics and decision support, real-time measurements while drilling in order to locate the best targets
• Reservoir models based on real-time reservoir data, analysis of 4D seismic, in-situ measurements of changes. On-line integration with well-serviced company data
• Optimization models for increased production, based on in-reservoir properties during production, with decision support incorporated to improve productivity

Optimizing the production or improving productivity is a complex problem. In addition to the production optimization of the downhole, subsea and topside process, one has to consider operational costs, hardware damage, reservoir performance, environmental requirements and operational difficulties within each well and/or topside. To further complicate optimization, the individual challenges will change over time, e.g., reservoir behavior changes as an effect of depletion, shutdown of wells due to slugging, failed sensors and the change of efficiencies within the topside process system. Some of the applications included in production optimization are:

• Flowline control to stabilize multiphase flow in gathering systems, risers and flow lines.
• Well control that will stabilize and optimize gas lift and naturally flowing wells. This application should prevent flow and pressure surges while maintaining minimal backpressure and maintain maximum production as well as continuing production at the optimum lift gas rate.
• Gas-lift optimization is provided to ensure the best possible distribution of lift-gas between gas lifted wells.
• Slug management helps mitigate variations in inflow impact. The separation and hydrocarbon processing during startup, upset and normal operation.
• Well monitoring systems (WMS) are used to estimate the flow rates of oil, gas and water from all the individual wells in an oil field. The real-time evaluation is based on data from available sensors in the wells and flow lines.
• Hydrate prediction tools help to avoid hydrate formation, which may occur if a subsea gathering system is allowed to cool down too much before the necessary hydrate preventive actions are performed.
• Optimal operation is defined by a set of constraints in the wells and production facilities. A constraint monitoring tool monitors the closeness to all constraints. This provides decision support for corrective actions needed to move current operation closer to its true potential.
• Advanced control and optimization solutions to improve the performance of product quality control, while adhering to operating constraints. This is typically done with two technologies: model predictive control to drive the process closer to operating targets, and inferential measurement to increase the frequency of product quality feedback information.
• Tuning tools are designed to optimize and properly maintain the optimal setting of control loops in the process automation system.

An asset optimization (AO) system reduces costly production disruptions by enabling predictive maintenance. It records the maintenance history of an asset and identifies potential problems to avert unscheduled shutdowns, maximize up-time and operate closer to plant production prognoses. This functionality supports maintenance workflow as the AO system communicates with a maintenance system, often denoted as a computerized maintenance management system (CMMS).

Condition monitoring includes both structural monitoring and condition monitoring for process equipment such as valves and rotating machinery. For structural monitoring, the devices are corrosion meters (essentially plates that corrode, so that corrosion may be metered), tension force meters and free swinging strings. These statistics are logged to a central structure condition monitoring system, to show what forces are acting against the installation, and the effect those forces are having.

Condition monitoring of machinery is generally used for large rotating apparatus, such as turbines, compressors, generators and large pumps. Input devices are vibration meters, temperature (bearing, exhaust gases, etc.), as well as the number of start/stops, running time, lubrication intervals and over-current trip-outs. For other process equipment, such as valves, the system can register closing times, flow and torque. A valve that exhibits a negative trend in closing time or torque ("stiction") can be diagnosed. The maintenance trigger is the mechanism whereby field device or equipment monitor resident information, in the form of digital status signals or other numerical or computed variables are interpreted to trigger a maintenance request. A work order procedure is then automatically initiated in the CMMS. Maintenance support functionality will plan maintenance, based on input from condition monitoring systems, and a periodic maintenance plan. This will allow the system to schedule personnel for such tasks as lubrication or cleaning, and plan larger tasks such as turbine and compressor periodic maintenance.

A specific information management system (IMS) can be used to provide information about the operation and production of the facility. This can be a separate system, or an integral part of the control system or SCADA system.

For oil and gas, IMS functionality includes:

• Oil & gas production reporting
• Safety management
• Maintenance
• Operator support
• Overall systems integrated and external
• Historical data, including post failure "flight recorder" data

Some of the applications provided by an IMS system may be:

• Drilling data acquisition and drilling data logging
• Electronic shift logbook
• Operator procedures
• Chemical injection
• Chemical consumption
• Laboratory analysis registration
• Alarm and incidents overview
• Alarm Statistics
• Valve leakage test
• Transmitter surveillance
• Run time monitoring
• Block log
• Production plan
• SIL statistics report
• Subsea valve signatures
• Production overview and prognosis
• Valve verification
• ESD/PSD verification, including shutdown analysis
• Data export
• Data browser tool
• Historical data and current trend
• Well test
• Daily production report with metering data
• Volumes in storage cells and consolidation of produced stored and dispatched volumes.
• Environmental reports
• Polynomial allocation (oil/gas/water) based on well test results

Training simulators are used to provide operator training in a realistic plant training environment. They use the actual control and safety applications of the plant, running on operator stations. Plant models simulate the feedback from the plant in real time, or in fast or slow motion. Training simulator applications include functions for backup and reload, including recreation of historical information and snapshots. Offsite training facilities are often connected (read only) to the live plant to provide information from the real operating situation.

For smaller installations, potable water can be brought in by supply vessels or tank trucks.

For larger facilities, it is provided on site by desalination of seawater though distillation or reverse filtering. Onshore potable water is provided by purification of water from above or below ground reservoirs.

Reverse filtering or osmosis requires a membrane driving pressure of about 7000 kPa/1 PSI of pressure per 100 ppm of solids dissolved in the water. For seawater with 3.5% salt, 2.5 MPa, 350 PSI is required.

Seawater is used extensively for cooling purposes. Cold water is provided to air compressor coolers, gas coolers, main generators and HVAC. In addition, seawater is used for the production of hypochlorite (see chemicals) and for fire water. Seawater is treated with hypochlorite to prevent microbiological growth in process equipment and piping.

Seawater is sometimes used for reservoir water injection. In this case, a deaerator is used to reduce oxygen in the water before injection. Oxygen can cause microbiological growth in the reservoir. The deaerator is designed to use strip gas and vacuum.

Ballast systems are found on drilling rigs, floating production ships, rigs and tension leg platforms (TLP). The object is to keep the platform level at a certain depth under varying conditions, such as mode of operation (stationary drilling, movement), climatic conditions (elevation of rig during storms), amount of product in storage tanks, and to adjust loading on TLP tension members.

Ballasting is accomplished by means of ballast tanks, pumps and valves, which are used in combination with position measuring instruments and tension force meters (TLP) to achieve the desired ballasting.

If fresh water is produced, it can be used as ballast to avoid salt water. Additionally, if ballast water has become contaminated from oil tanks, it must be cleaned before discharge at sea.