Author: Alan Coakley, Engineer II, HIPS team, Saudi Aramco The answer is yes and the method employed is HIPS. High Integrity Protection Systems- HIPS or also written as HIPPS (High Integrity Pressure Protection system) is an oil and gas upstream technology application that is being used by oil and gas majors to reduce capital expenditure while not compromising on process safety. [caption id="attachment_24197" align="alignright" width="300"]HIPS3 Fig 1: Modified and simplified HIPS sketch of HIPS logic with 2oo3 voting actuating two final elements.[/caption] Considered a reliable and mature cost effective solution, the technology works by responding to overpressure scenarios within the process safety time to prevent a loss of containment and maintain tight shutoff. HIPS can replace traditional relief systems such as flares and cold vents. The approach is simple, keep it in the pipe. In this article we will look at the different aspects of using HIPS. First, we will look at what is a HIPS system and how it works and its advantages. Second, we will explore what components are used. Finally, we will examine what are the standards that you can refer to when designing or operating HIPS systems and advice on what to look out for as an end user. [caption id="attachment_24199" align="alignright" width="300"]HIPS5 Fig 2: Pressure Rise against time leading to loss of containment after the MAOP is breached[/caption] A HIPS system is the last line of defence in a pressure protection system before the maximum allowable operating pressure is breached as shown in figure 2.

Full bore rupture and toxic gas dispersion

In the worst-case transient scenario, the result could develop into a full bore rupture leading to multiple fatalities and in sour services, toxic gas dispersion. The good news is that HIPS systems are ultra-reliable with safety availability figures of 99.99 per cent achievable. HIPS is ideal for low demand, high consequence scenarios such as offshore platforms, FPSOs (Floating storage production and offloading) and on multi-well pad manifolds onshore. As HIPS is an isolation system at heart it has a number of advantages over traditional relief systems. First, for the pipe work downstream of the HIPS, it is feasible to install piping with reduced wall thickness Reduced CAPEX costs utilizing thinner pipe downstream of the HIPS results in huge savings for subsea projects .A HIPS system can reduce the size and weight of the flow lines and risers to the topsides of an FPSO. Fully rated risers to FPSOs would not be feasible in most scenarios. Second, emissions by venting or flaring are eliminated. For projects onshore HIPS can eliminate the need for flares at each well site leading to an environmentally beneficial option as a design basis for newly discovered Gas fields coupled with the fact that you are not burning your product needlessly during demands & spurious trips. Furthermore significant costs savings are achieved by using HIPS as an alternative to installing, operating and maintaining a flare system. [caption id="attachment_24201" align="alignright" width="225"]HIPS-2 Fig 3: HIPS valves and actuators: courtesy of IMI CCI Italy[/caption] Third, HIPS does not need reconditioning after a demand is placed on it.

Pressure sensor, logic solver and final elements

A typical HIPS architecture will consist of pressure sensors, a logic solver and final elements. The components at first glance are much like any other safety instrumented system but the difference with HIPS is that the reliability of the system as a whole is so robust they can in practice be designed and built to give a risk reduction by four orders of magnitude (1.0E-04). [caption id="attachment_24279" align="alignright" width="294"]aaa Fig 4: Reliability block diagram of a typical HIPS system, note the redundancy and hardware fault tolerance of the system. Three pressure sensors, one highly reliable logic solver & two final elements. CCF stands for common cause failure[/caption] Companies however will diversify their safety systems into layers of protection and have two to three layers of protection to prevent loss of containment which include BPCS (Basic Process Control System), ESD (Emergency Shutdown) and HIPS. Depending on the safety integrity level target as decided by LOPA (Layers of Protection Analysis), FTA (fault tree analysis), QRA (quantitative Risk Assessment) the risk gap the HIPS will have to close may be required to be a SIL 2 or SIL 3 application. International standards to refer to when designing HIPS systems are API-14C, API-17o -Subsea HIPS, API-521, IEC 61508 & IEC 61511. A comprehensive list of standards applicable to HIPS is available online in the International association of oil and gas producers report number 443 - HIPS recommended practice. This report is available at http://www.iogp.org/pubs/443.pdf . This is a very useful document which aims to compresses the knowledge required for HIPS into one document and a good starting point for guidance on HIPS. When choosing a HIPS system over conventional relief systems a rigorous approach must be adhered to such as the functional safety lifecycle concept in IEC61511. Hazards and consequences must be identified and clearly understood before selecting, designing and implementing HIPS as a safety instrumented system. For the HIPS components, the pressure sensors can be voted in a two out of three (2oo3) logic block through a highly robust and redundant logic solver to actuate valves and shut off the source of overpressure thereby preventing loss of containment. The art in designing a HIPS system comes down to choosing the components that are suitable for the task.

Not limited to Exida, SIRA and TÜV

Picking components from manufacturers with very low failure rates and failure rate data which has been certified by a third party, for example, but not limited to Exida, SIRA and TÜV will lead to a robust system which the designer can verify and demonstrate compliance with international standards and best practice. Failure rate data can be found from a number of sources. In house reliability and failure data is the best possible source of data as this will be a base line to benchmark your current safety instrumented systems against and are subjected to your environmental and operating conditions. However typically only large companies will maintain such records and it is dependent on compliance in recording failure data. Manufactures returns can also be a useful source of data but will most likely underestimate the number of failures due to companies replacing rather than returning components for repair. Databases such as SINTEF, OREDA and the PDS handbook are failure data references which include data from a number of North Sea operators and are generally the de facto go to reference for consultants and design houses. In terms of failures rates there can be a wide range of difference between vendor specific and generic data. When reviewing failure rate data, be mindful of the conditions it was tested under and apply a service factor if required. Ensure you read the SIL certificates with all the components and the test reports to verify the equipment will operate for your specific conditions.  Assumptions can be made in error and taking the time to read the SIL certs for the conditions of use is a worthwhile exercise.

Nothing less than a SIL 3 logic solver will do in a HIPS system

Logic solvers are extremely reliable and are at the heart of any safety system. Typically nothing less than a SIL 3 logic solver will do in a HIPS system. They vary in design and may be triple modular redundant programmable systems or non-programmable solid state systems. Both have their advantages and disadvantages and each should be selected on a case by case basis. Programmable systems are generally suited to designs where there is a possibility of addition of inputs and outputs or where the parameters of the field will change such as the trip set points or range of the pressure sensors. The solid state logic solvers cannot be reprogrammed once in operation and offer protection against human error manipulating the program, setpoint or leaving forces in place in the logic. Solid state logic solvers provide a practical way to maintain a logic solver for the life cycle of the system without having to deal with software updates or vendors not supporting old revisions. Furthermore, the connections are soldered or thermi-pointed rather than connected through terminals and plugs as used in programmable systems. Solid state logic solvers have extremely fast execution times. If additions or modifications to the HIPS system are foreseen, such as addition of new wells in the future, then the programmable logic solver provides the flexibility to configure the system with minimal interruption and can be done online while the process is running. The final elements will typically contribute the most to the probability of failure on demand in a HIPS system and so the choice of valves and actuators are absolutely critical to meeting the mission of a HIPS; Quick closure and tight shut off. The valves are typically ball or gate type. A reverse acting slab gate valve offers the quickest closure time as the process fluid assists the valve closure during a demand event. Actuators can be hydraulic, electric or pneumatic. Hydraulic systems offer greater all round efficiency in terms of operating costs and amount of force that can be applied to an actuator to overcome the pressures required for closing and opening. Accumulators should be used where there are ambient temperature swings which may cause the actuator to loose pressure due to thermal effects and result in spurious closure of the HIPS valves. Quick exhaust valves need to be sized so the CV value is big enough to dump the actuating medium fast enough for the valves to close on demand. The HIPS solenoids are one of the most critical components in the whole safety loop. They need to be tough and reliable. Failures could result in spurious trips leading to loss of production. The solenoids will be continuous duty and de-energize to trip thereby making them failsafe.  The coils in the solenoids shall be suitable for the environment for example Arctic conditions, desert conditions and shall not be subject to overheating. There are HIPS systems in operation which need to respond in less than four seconds to an overpressure scenario. Transient analysis by dynamic simulation of the pipe network from well head to slug catcher/separator will determine the process safety time and set the design constraints for the closure time of the final elements by looking at the worst credible scenarios. The reaction and response time of the HIPS shall be less than the process safety time.

Aim for response time which is half the process safety time

A good rule of thumb is to aim for a response time which is half the process safety time. Initiating events of overpressurisation are typically caused by pigging operations with the pig getting stuck causing a blockage, valve closures downstream of the HIPS either spuriously or due to human error and hydrate formation causing blockage. Proof testing of HIPS systems must be carried out with the frequency as mandated in the safety requirement specification. There is no legislation which specifies how often a HIPS system is required to be tested. The end user must be able to demonstrate through proof testing that the system operates as prescribed in the narrative, the target safety integrity level is being maintained and the performance of the system is not degrading to a level where there is an increase in closure times beyond the process safety time or an increase in the allowable valve seat leakage. Where this occurs the system shall be overhauled to a condition that is good as new. Mandate in design stage for a mission time for the lifetime of the field where possible, for example subsea HIPS. Proof testing is outside the scope of this article but there are many papers available on the topic as well as guidance in IEC 61511. In conclusion with the right components and effective proof testing, HIPS is an effective and reliable solution to over pressure events. Moreover it is a cost effective approach which is crucial with current low oil prices.