The BOP is a critical safety system of an offshore drilling rig, as shown in the 2010 Macondo accident. A challenge for the oil and gas industry is to decide what to do when the BOP is failing. Pulling the BOP to the surface during operations for inspection and testing is a costly and timely operation. Many of the potential failures are not critical to overall safety as multiple levels of redundancy are often available. Scandpower and Moduspec, both subsidiaries of Lloyd’s Register, have developed a BOP risk model that will assist the industry make the pull or no pull decisions. Scandpower’s proprietary software RiskSpectrum is used for the modelling. This software is used for equivalent decision support in the nuclear power industry, where the risk levels of total nuclear power plants are monitored live by operators in the control rooms. By modelling existing BOPs and their submerged control systems, and using risk monitor software for keeping track on the status of the BOP subsystems and components, the industry is able to define the real-time operational risk level the BOP is operating at. It, therefore, allows the inclusion for sensitivity modelling with possible faulty components factored in the model. The main task of the risk model is to guide and support energy companies and regulators in the decision process when considering whether to pull the BOP for repairs. Moreover, it will help the communication with the regulators, since the basis for the decisions are more traceable and easier to follow for a third party.

According to the functional safety standard IEC 61508 (2010), requirements apply to Safety Instrumented Functions (SIFs) for achieving a certain Safety Integrity Level (SIL). A typical SIF comprises of initiators (e.g. sensors), logic solvers and final elements (e.g. valves). A common method for SIF equipment vendors to document compliance with the standard is the use of SIL product certificates. This can be an efficient way of demonstrating functional safety compliance, but also involves certain challenges which will be discussed in this paper. A study has been undertaken to identify recurring issues in functional safety compliance. This study is based on experience with SIL projects undertaken for various vendors, integrators/engineering companies and operators. The projects comprise SIL Failure Mode, Effects and Diagnostic Analyses (FMEDAs), safety manuals, certifications and SIL compliance reports. The main aim of the study is to identify challenges and pitfalls and to provide solutions for preparing traceable and unambiguous compliance documentation. During the study it became evident that final elements presented unique challenges to SIL compliance, so this paper particularly focuses on documenting compliance for valves. The study reveals challenges related to the methodology used to reach a rational conclusion to the integrity of SIF elements covered in each certificate. This especially relates to definition of safe state for the relevant SIFs. It is important to have a clear and unambiguous definition of safe state, as this might give a different result regarding compliance. Clearly stating the application where the element is going to be used is important; this includes operational and environmental conditions. Challenges are also related to the failure rate derivation and whether the scope of the FMEDA is the element isolated or the element in a given application/system. The paper presents concrete examples of challenges, describes the impact of erroneous analyses and proposes solutions for each challenge. This paper considers best practices for issuing SIL certificates, limitations and advantages of SIL certification, and methods to ensure efficient compliance documentation, reliable results, and avoidance of the challenges discussed.