Is it necessary to install a downhole safety valve in a subsea ... - NTNU

Is it necessary to install a downhole safety valve in a subsea oil/gas well?
undesired events, corresponding to the upper horizontal line in the ALARP-principle. A
situation is unacceptable and must be treated further if a Quantitative Risk Assessment (QRA)
reveals higher probabilities than accepted. The ALARP-principle shown in Figure 3-1 is
commonly accepted. In the ALARP region additional efforts may be performed to reduce the
risk further. A weighing of cost and risk is done.
Unacceptable region
The ALARP or Tolerability
region (Risk is undertaken only
if a benefit is desired)
Broadly acceptable region
(No need for detailed work to
demonstrate ALARP)
Negligible risk
Figure 3-1 Levels of risk and the ALARP principle [32]
Risk cannot be justified except
in extraordinary circumstances
Tolerable only if risk reduction
is impracticable or its cost is
grossly disproportionate to the
improvement gained
Tolerable if cost of reduction
would exceed the improvement
gained
Necessary to maintain
assurance that risk remains at
this level
3.2 Safety integrity level (SIL)
The Norwegian Oil Industry Association has provided recommended guidelines for the
application of IEC 61508 and IEC 61511 standards in the petroleum activities on the
Norwegian Continental Shelf. A list of minimum safety integrity levels (SIL) for the most
common safety functions has been provided. [28]
SIL is a discrete level for specifying the safety integrity requirements of the safety functions.
The SIL requirements are based on experience, with a design practice that has resulted in an
adequate safety level. This reduces the need for time-consuming SIL calculations on “standard
solutions” and ensures a minimum level of safety. Another advantage of using pre-determined
SIL is that these figures can be used as input to a Quantitative Risk Analysis (QRA) during
early design stages and thereby set between the risk analysis and the integrity levels for
important safety functions.
For several safety functions it is difficult to establish generic definitions. Due to process
specific conditions, design and operational philosophies etc., the number of final elements to
be activated will differ from case to case. Consequently, several of the requirements are given
on a sub-function level.
It is important to emphasise that SIL requirements are minimum values, and therefore need to
be verified with respect to the overall risk level. If the QRA reveals that the overall risk level is
too high, e.g. due to a particularly large number of high pressure wells or risers, then this could
trigger a stricter requirement to one or more of the safety functions. Table 3-2 is found in ref.
[28] and shows the quantification of the four different SIL levels. The SIL requirement applies
only to a complete function, i.e. the field sensor, the logic solver and the final element. It is
therefore incorrect to refer to any individual item or equipment having a safety integrity level.
Diploma thesis, NTNU 2002
9