# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 2 Aspects of Independence
### Modelling and Analysis of Dependencies  
In general, today's reliability and risk analyses are incorporating the impact of dependencies. Yet, the underlying models and data build on certain assumptions and simplifications, which do not cater well to the new types of dependencies introduced with the more interconnected IT and OT systems. This is discussed further for the key analysis methods below. Quantitative risk analyses of the type TRA (Total Risk Analysis) often include all physical areas and safety functions on a facility and cover most incident categories that contribute to the major accident risk. By nature, these analyses are therefore relatively rough and rarely address details related to complexity and links between the systems. For example, common components, common influences, cascade errors, and operational dependencies are analysed only to a limited extent. For hydrocarbon incidents, the analysis normally starts in the event of a leak, which means that the control system and the process shutdown system have been analysed only to a limited extent. Generic data is mostly used, which implies that an average performance of technical systems and personnel is assumed. Analysis of underlying causes of error and correlations is therefore often limited. Potential dependencies and vulnerabilities in user interfaces and networks, for example, are therefore rarely captured in such high-level risk analyses (type TRA/Safety Case). It should be noted that the primary purpose of the overall risk analyses is to verify an acceptable total risk for the facility under consideration, as well as provide input to design at a relatively rough level. It is therefore not given that these analyses are suitable to go into the kind of detail that will be required to analyse possible dependencies and links. Rather, specific studies and analyses of the architecture of the safety and security systems are more suitable for this purpose. Reliability analyses, including safety integrity level (SIL) analyses, normally focus on individual systems, and therefore often go into greater detail on these than is the case in a TRA (where reliability of safety systems often emerges as branch probabilities in a fault tree). However, since reliability analyses normally focus on individual systems, it is in their nature that links to and dependencies on other systems can quickly fall outside the scope. The same arguments also apply to FMECA analyses (Failure Mode, Effect, and Criticality Analyses). There is not much variation between the analyses, and of course there are exceptions to these general considerations. Layer of Protection Analyses (LOPA) [5] has become a popular method for determining risk reduction requirements and performance requirements for different layers of protection (safety features). On the Norwegian Continental Shelf (NCS), the methodology is often used as an alternative or supplement to the NOROG 070 [6] guideline for the use of IEC 61508 [2] and 61511 [3] (with deterministic minimum SIL requirements). Simply put, the steps in LOPA are as follows:  
1. Identify unwanted incidents. 2. For a given event, identify how often protection is needed to avoid this (demand rate). 3. Identify independent layers of protection (IPL) to avoid unwanted incidents. 4. Determine the risk reduction requirements for the various IPLs that provide protection. Normally, these analyses derive their input parameters/numerical values from predefined tables and then multiply the probability of error (PFD) of the individual independent protections together to estimate the performance of all identified layers of protection seen in context. Since the LOPA methodology itself places limited emphasis on special assessments of possible dependencies, the quality of any such assessment will largely depend on the competence of the LOPA team and, of course, the time and resource use allocated for the analyses. Some other challenges related to the follow-up of LOPA analyses are:  
1.