# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 1 Introduction  
The petroleum industry remains one of the major energy providers as well as the supplier of products to petro-chemical industries. It represents a critical infrastructure that at the same time needs to manage the risks of potential major accidents from handling hazardous materials. Norway is one of the larger oil and gas producers, with a high number of subsea production and processing facilities, topside platforms with seabed mounted or submersible structures, and floating production, storage, and offloading vessels located on the Norwegian Continental Shelf. The control and safety of the operation are ensured by the on-board Operational Technology (OT) systems. The term \"OT systems\" is commonly defined with reference to Gartner Glossary as \"hardware and software that detects or causes a change, through the direct monitoring and/or control of industrial equipment, assets, processes, and events\" [1]. In the past, OT systems used to be physically separated from the outside world and largely built upon proprietary technologies. In recent years, more off-the shelf information and communication (ICT) technologies have been integrated into OT systems to meet the demands for high connectivity and open platforms for data exchange. This demand for connectivity and data exchange go beyond the borders of the OT systems, as many applications that rely on data, such as systems for condition monitoring, plant optimization, and maintenance planning, are located in various information technology (IT) networks. New ways of operating the facilities means that vital OT functions, such as control, are moved to remote operation centres. IT equipment is also increasingly used to safeguardOT functions. Examples are field instrument monitoring, maintenance, and configuration systems that have traditionally been seen as IT systems because they do not directly affect production. This creates a need for more holistic solutions where OT systems must be able to operate without the negative influence by outside IT systems. This includes the management and monitoring of the multiple connection points to the company's IT systems and their extensions via the internet to external networks and cloud solutions. Parts of the OT systems are dedicated to ensure safety. This includes systems, such as emergency shutdown (ESD) systems, fire and gas (F&G) detection systems, and process shutdown (PSD) systems. A key principle advocated in international standards regarding the design and operation of these systems, such as IEC 61508 [2] and IEC 61511 [3], is to ensure their ability to act independently of other systems, including in the case of faults. The increased complexity of IT systems means that new dependencies are introduced and that the systems are therefore more closely connected. This may make the facilities more difficult to understand, operate, and maintain, and, in emergencies, it may be more difficult for the operator to obtain an overview of the situation. The requirement about independent systems is also enforced through the Norwegian national regulations, a requirement that stems from lessons learned, for instance, from the Piper Alpha accident in 1988 and the Bravo Blowout in 1977. The paper builds on the results of a recent project conducted for the Norwegian Petroleum Safety Authority (PSA). The starting point for this project was to investigate how the independence of OT systems is ensured on existing Norwegian oil and gas facilities for older facilities that have been subject to several upgrades of OT systems to new facilities where the OT systems are quite modern. The research method approach applied consisted of four main steps: First, a literature survey was carried out with a focus on identifying requirements and potentially concerns relating to independence, in light of standards and trends in new OT technologies. Second, the insights from step one were used to construct an interview guide to address the industry status and awareness of the requirements and concerns.