Subsea Shutdown System SIL Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing a Safety Integrity Level (SIL) rated production shutdown system in subsea hydrocarbon production facilities is challenging due to the use of non-safety-rated components, particularly in systems with specific software components or third-party electronics within the Subsea Electronics Module (SEM) or Master Control Station (MCS), where rating the entire loop is not feasible.
Innovation Solution
A shutdown system design where only the components at each end of the system, specifically the safety system and drive control means, are SIL-rated, utilizing a 'Black Channel' between the SIL-rated interface unit on the surface and the SIL-rated components in the SEM, with the rest of the system considered unreliable from a safety perspective.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all components within the production control system are rated according to SIL, then the safety integrity level is improved, but the device complexity and cost increase significantly
Solution Approach 1:
The system is segmented into two distinct parts: a SIL-rated control station that requires high safety integrity, and a non-rated SEM that handles communication and basic control functions. This segmentation allows only the critical control logic to be SIL-rated, while communication infrastructure can use standard, less complex components.
Solution Approach 2:
A communication interface acts as an intermediary between the SIL-rated control station and the non-rated SEM. This interface isolates the safety-critical domain from non-critical communication functions, allowing the SEM to operate without SIL certification while still receiving safe control commands.
2Ease of manufacture
If third party electronics and specific software components are used in the SEM or MCS, then the ease of manufacture and adaptability improve, but the ability to achieve SIL rating deteriorates
Solution Approach 1:
The control system is divided such that third-party electronics and generic software can be used in the non-rated SEM, while the SIL-rated control station uses only certified components. This segmentation enables ease of manufacture for the SEM while preserving safety integrity in the control station.
Solution Approach 2:
The safety-critical functions are extracted from the SEM and placed in the dedicated SIL-rated control station. This extraction allows the SEM to use inexpensive, easy-to-manufacture third-party components, while the essential safety functions reside in certified hardware.
3Reliability
If the entire loop is rated according to SIL, then the safety integrity level is improved, but the loss of time and productivity increase due to certification requirements
Solution Approach 1:
The control loop is segmented into SIL-rated and non-rated portions. Only the control station requiring SIL certification undergoes time-consuming certification processes, while the SEM and communication infrastructure can be deployed immediately using standard components, significantly reducing overall implementation time.
Data Source
AI summary
A production shutdown system for an underwater hydrocarbon production facility, comprising, on the topside:a safety system, anda communications module;and, underwater;drive control means, andan underwater communications component;wherein in use safety signals are passed from the safety system to the drive control means via the topside communications module and the underwater communications component, and wherein the safety system and drive control means are rated according to a prescribed safety level but the communications module and underwater communications component are not so rated.