# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 2 Aspects of Independence
### What Is Meant by Independence  
Independence can be viewed from different angles. It can relate to a property of a system, as well as the nature of coinciding events. Starting with the latter, mathematically speaking, two events \(A\) and \(B\) are independent if:  
\[P(B|A)=P(B)\times P(A\cap B)=P(A)\times P(B) \tag{1}\]  
This means that event \(B\) has the same probability of occurring regardless of whether \(A\) occurs or not (and vice versa). This also implies that the probability of two independent events occurring at the same time is given by the product of the probabilities. If this is not the case, the two events are dependent. When calculating the probability of failure on demand (PFD) for safety functions, the \(\beta\) factor is used to indicate the degree of dependency.  
An independent system is a system whose ability to function is not influenced in a negative way by other systems or its interaction with the environment. Various forms of dependencies can be introduced, some of which may be unintended and unknown to the system owner. In this paper, we employ the following qualitative classification of dependency (not necessarily mutually exclusive).  
Functional dependency, i.e., a system relies on another system to function.  
Cascading faults--that is, faults in one system that occur as a direct result of faults in another system--can be associated with hardware and software errors.  
Common components--i.e., the same component or module is part of multiple systems--this may also include common software.  
Common cause failures that stem from faults introduced due to similarities in exposure, design, installation, use, and/or maintenance. For example, a common location that allows the systems to be subjected to common influence from either the environment (external influence) or operational personnel (human influence).  
Some dependencies between systems and components can be obvious, such as a pump needing cooling to function or having a common Emergency Shuttdown Device (ESD) and process safety valve, while other dependencies--such as common networks or the same software--may be more demanding to uncover.  
Dependencies are often created as a result of technology development, operational, and economic assessments, increased standardisation in projects, and software upgrades.  
We present some examples of links and dependencies that are now quite common in the Norwegian petroleum industry:  
* Dependencies between the process control and PSD system, for example through the sharing of common operator stations and common networks shared with other safety systems, such as ESD and F&G.
* Dependencies between PSD, ESD, and F&G and related support systems, such as the seawater system to feed fire pump systems, the use of common components (such as valves and pumps) to perform normal ballasting control and emergency ballasting, and the HVAC system to stop fans and close dampers on the command from the fire and gas system.
* Common components, such as firewalls, network components, operator drives/HMI, configuration tools, clock systems, and domain controllers.  
From a safety perspective, dependencies are generally undesirable, such as between the safety systems and process control systems. At the same time, complete independence means duplication of equipment, which adds more complexity (network-wise, to accommodate the need for data exchange) and potentially new hazards (mechanics-wise, such as new leakage points associated with additional flanges). Complete independence _could_ therefore reduce the overall safety, in addition to being more costly. The compromise is therefore a technical solution that provides sufficient independence and where a further decrease of dependency cannot be made without a negative impact on safety.