Hips

Guides & Manuals GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production Rev: 00 Date: 09/2009 Page: 1/58

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company.

This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Purpose This guide is intended to provide guidelines for Process engineers in charge of defining High IntegrityProtection Systems (HIPS) during conceptual phases / preproject and/or supervising the process aspectsof HIPS design performed by Contractors during project phases.

Application These guidelines apply to all facilities or projects operated by Total or where Total is a shareholder, eitheroffshore or onshore installations. They also apply to major modifications of existing installations, as well as to the design of HIPS retrofitted onto existing facilities as measures implemented in order to upgradethe level of protection.

Revisions

00 09/2009 First issue

Rev. Date Notes

Approbation Prepared by: Checked by: Authorised by:

Name: G. SITEUR Name D. LARREY de TORREBREN

Name: Ph. GERLACH

Date: 09/09 Date: 09/09 Date: 09/09







Contents

Purpose ..........................................................................................................................1

Application .....................................................................................................................1

1. Glossary...................................................................................................................6

2. Objectives ................................................................................................................9

3. Overview of the Referential ..................................................................................10

4. Process Engineer Responsibilities......................................................................11 4.1 Context ............................................................................................................................11 4.2 Different stages of design and HIPS life ..........................................................................11

5. Design Principles ..................................................................................................17 5.1 Justification and basic design for HIPS ...........................................................................17 5.2 Description of a safety system.........................................................................................21

6. HIPS design ...........................................................................................................23 6.1 The location of a HIPS.....................................................................................................23 6.2 HIPS setting.....................................................................................................................25 6.3 HIPS response time.........................................................................................................26 6.4 Preventive or reactive HIPS.............................................................................................27 6.5 HIPS adaptability throughout design life..........................................................................28

7. Process Dynamics ................................................................................................29 7.1 Dynamic simulations........................................................................................................29 7.2 Arrangement of installations & incident scenarios ...........................................................30

8. HIPS Dossier..........................................................................................................33 8.1 Objective of the HIPS dossier..........................................................................................33 8.2 Submission of the HIPS dossier ......................................................................................33 8.3 Content of the HIPS dossier ............................................................................................34 8.4 Specific requirements for process documentation...........................................................35

9. Operational Constraints .......................................................................................36







10. Applications of HIPS.............................................................................................37 10.1 Riser HIPS.......................................................................................................................37 10.2 Gas Plant Inlet Pressure Let-down HIPS.........................................................................43 10.3 Subsea HIPS ...................................................................................................................44 10.4 Gas Blow-by HIPS ...........................................................................................................47 10.5 Liquid Carry-over HIPS....................................................................................................49 10.6 Flare Knock-out Drum Overflow / Overload.....................................................................51 10.7 HIPS Against Overpressure by Compressor ...................................................................52 10.8 HIPS Stopping ESP’s ......................................................................................................54

Appendix 1 HIPS Flow Chart ...................................................................................56

Appendix 2 Pressure Settings Diagram..................................................................57

Appendix 3 Pressure Settings Diagram..................................................................58







Reference documents

Unless otherwise stipulated, the applicable version of the reference documents listed below, including relevant appendices and supplements, is the latest revision published.

Standards

Reference Title

Not Applicable

Professional Documents

Reference Title

API RP 14 C (ISO 10418) Recommended Practice for Analysis, Design, and Testing of Basic Surface Safety Systems for Offshore Production Platforms

API RP 520 Sizing, Selection and Installation of Pressure Relieving Devices in Refineries

API RP 521 (ISO 23251) Pressure-Relieving and Depressuring Systems

Regulations

Reference Title

Not Applicable

Codes

Reference Title

DNV-OS-F101 Rules for submarine pipeline systems

IEC 61508 Functional safety of electrical/electronic/programmable electronic-safety related systems

IEC 61511 Functional safety : safety instrumented systems for the process industry sector







Other documents

Reference Title

Not Applicable

Other Total documents

Reference Title

CR EP HSE 041 Technological Risk Management

CR EP HSE 042 Instructions for the selection, definition and operation of high integrity protection systems

GM EP SAF 010 Safety acronyms & definitions

GS EP ECP 103 Process sizing criteria

GS EP ECP 105 Process documents to be prepared during engineering phase

GS EP SAF 260 Design of High Integrity Protection System (HIPS)

GS EP SAF 261 Emergency Shut-Down and Emergency De-Pressurisation (ESD & EDP)

GS EP SAF 262 Pressure protection relief and hydrocarbon disposal systems

Local Regulations might be more restricting than Standards and Company referential (or propose alternative methods) and must be adhered to.







1. Glossary When the definition of a term is provided in any of the reference documents, a cross-reference to this document is made instead of copying/pasting the definition.

Definitions given in GS EP SAF 260

HIPS dossier Design condition Normal Operating Conditions, Maximum Operating Conditions Maximum Allowable Incidental Condition (MAIC), Maximum Allowable Working Condition Safety Function, Safety Integrity, Safety Integrity Level (SIL), Reliability Emergency Shut Down (ESD), Process Shut Down (PSD) Incident, Over-pressurisation, Prevention, Mitigation

Definitions given in CR EP HSE 042

HIPS, HIPS categorisation, HIPS committee Safety Instrumented System, Incident Severity level

Definitions given in CR EP HSE 041

Central critical event (also named Undesirable Event in API RP 14C), Hazard, Scenario, Barrier, Frequency, Probability Risk, Risk analysis, Risk Assessment, Risk Matrix, Risk Reduction Measure, ALARP HAZOP, HAZID, SPOT, OPERSAFE, PTR







Other definitions

Protection (or Safety) Barrier Part of a Safety System.

See also CR EP HSE 041

Safety System A Safety System is made of several Protection Barriers

A Safety System performs a Safety Function

See also API RP 14C

SIL (Safety Integrity Level) Safety Integrity Level (SIL) is defined as a relative level of risk-reduction provided by a safety function, or to specify a target level of risk reduction. In simple terms, SIL is a measurement of performance required for a Safety Instrumented Function (SIF).

For Safety Instrumented Functions operating in Low Demand mode (i.e. Demand Frequency << Test Frequency), PFDavg (Average Probability of Failure on Demand) and RRF (Risk Reduction Factor) for different SIL Levels as defined in IEC61508 and IEC61511 are as follows:

SIL level PFDavg RRF

1 0.1-0.01 10-100

2 0.01-0.001 100-1000

3 0.001-0.0001 1000-10000

4 0.0001-0.00001 10000-100000

For Safety Instrumented Functions operating in High Demand (Continuous) mode (i.e. Demand Frequency >> Test Frequency), the PFH (Probability of hazardous Failures per Hour) shall be calculated :

SIL level PFH

1 10-6 - 10-5 / hour

2 10-7 - 10-6 / hour

3 10-8 - 10-7 / hour

4 10-9 - 10-8 / hour







Abbreviations ESD Emergency ShutDown

ESDV Emergency ShutDown Valve

ESP Electrical Submersible Pump

FPSO Floating Production Storage and Offloading

HIPS High Integrity Protection System

HIPPS High Integrity Pressure Protection System

HP High Pressure

KO drum Knock Out Drum

LAH Level Alarm High

LAL Level Alarm Low

LCV Level Control Valve

LSLL Level Switch Low Low

OPPS OverPressure Protection System

OCWR Overall Control of Wells and Risers

PAH Pressure Alarm High

P&ID Process & Instrumentation Diagram

PCS Process Control System

PCV Pressure Control Valve

PFD Process Flow Diagram

PID controller Proportional Integral Differential controller

PSD Process ShutDown

PSS Process Safety System

PSHH Pressure Switch High High

PSV Pressure Safety Valve

PV Pressure Valve

ROV Remotely Operated Valve

RHSIP Riser Head Shut-In Pressure

SCSSV Surface Controlled Subsurface Safety Valve

SDV ShutDown Valve

SIS Safety Instrumented System

WHSIP Well Head Shut-In Pressure







2. Objectives This guide is intended to be used by Process engineers during conceptual design / preproject for the preparation of the Preliminary HIPS Dossier and during the Project phases for the supervision of the design work performed by the Contractor.

As per CR EP HSE 042 a HIPS is an instrument-based systems of sufficient integrity (involving high reliability redundant and/or diversified instruments) so as to make the probability of exceeding the design parameters lower than a target value.

A HIPS is never a standard system. The choice of HIPS as an ultimate protection barrier is not an option given preference by COMPANY.

Most HIPS are designed to protect against overpressure, but HIPS can also be applied to prevent from other hazards, such as:

• Exceeding the design flow.

• Exceeding the radiation criteria.

• Exceeding the design temperature (either high or low).

• Chemical hazards (H2S etc.).

Process and Safety engineers in Affiliates and Project Teams have the responsibility to state where the implementation of a HIPS:

needs to be considered to achieve a given safety integrity - To ensure that all design configurations involving Safety Instrumented System (SIS) of

high Safety Integrity Level (SIL), as an alternative to industry standards for the protection of production installations, are identified as High Integrity Protection Systems (HIPS) according to DGEP rule CR EP HSE 042

- To ensure the choice of HIPS as a protection barrier is duly justified against industry standards / conventional solution

- To ensure that a consistent approach is applied to the process definition of High Integrity Protection Systems

>>> Following preliminary evaluation

>>> Following project review (PTR, SPOT, HAZOP)

>>> Following analysis of existing installations (OPERSAFE, GAP ANALYSIS)







3. Overview of the Referential The main contents of the two documents constituting COMPANY referential dedicated to HIPS are the following:

• Company Rule CR EP HSE 042:

1. HIPS Applicability

2. HIPS Characterisation and Categorisation: HARD vs. SOFT

3. HIPS Committee

• General Specification GS EP SAF 260:

4. HIPS Dossier

5. HIPS Design principle







4. Process Engineer Responsibilities This chapter sets out the responsibilities of the process engineer throughout the HIPS design process. § 4.1 gives the entities involved and § 4.2 gives the tasks which shall be undertaken by the process engineer.

4.1 Context The management of HIPS involves several DGEP Entities:

• Safety Engineering

• Instrumentation

• Reliability/Operations

• Process

This guide is dedicated to Process engineers and does not aim to be a design guideline for Safety, Reliability and Instrumentation engineers. During the conceptual study phase the process engineers will have to initiate studies on the choice of a HIPS and propose its initial design. Therefore, Process engineers must have a clear view of the overall methodology for the management of HIPS. Consequently, this guide not only deals with Process related information but also gathers information from reference documents governed by other Entities.

When possible, cross-references to reference documents are made instead of copying/pasting information.

This guide is designed to allow Process engineers understanding the context and starting the study in a proper manner. To avoid disagreements between different fields of expertise, the remit of Process engineers at each stage of the HIPS design are defined (see § 4.2).

In doubt regarding responsibilities, Process engineers are advised to liaise and coordinate with other DGEP entities.

4.2 Different stages of design and HIPS life The HIPS Flow Chart (Appendix 1) summarizes the main steps of the justification & design of a HIPS:

• Applicability of HIPS

• HIPS Categorization

• HIPS Design and Approval

• HIPS in Operation

with regard to the main participants in the process:

• The concerned DGEP entities (e.g. the Project or the affiliate in charge)

• DGEP HIPS Committee

• The Field Operations entity







The specific roles of the different metiers within concerned DGEP entities and DGEP HIPS Committee groups are not detailed out in this GM.

The GM provides the following information to the attention of Process engineers:

6. System design

7. HIPS design

8. Definition of hazards and scenarios (refer to CR EP HSE 041 which gives rules for the risk assessment method)

9. Consequences assessment (refer to CR EP HSE 041 which gives rules for the risk assessment method)

10. Documentation

• Activities per stage of design

11. Conceptual Studies (the activities given are specifically applicable to a design where the HIPS is critical to the feasibility of the project, in other cases it could be considered to carry out the activity in a later stage)

12. Pre-projects

13. Basic Engineering

14. Detailed Engineering

When, from the preliminary evaluation, the implementation of a HIPS is considered (and then followed up), the responsibilities of the Process engineer at each step of the design are summarized in Table 1. Details on all technical issues are then provided further in this guide. The activities marked with a * will have to be carried out by the discipline engineers listed hereunder (but they should be followed up by the process engineer):

*(1) Safety and/or reliability engineer

*(2) Field operations engineer

*(3) Rotating equipment, piping, vessel or pipeline engineer/specialist etc.

During the Operations phase (not listed in the table) the Process Engineer shall be in charge of preparing and updating any modifications of the HIPS in the HIPS dossier. These modifications need to be approved by the HIPS Committee.







SYSTEM DESIGN

Conceptual Study Pre-Project Basic Engineering

Detailed Engineering

Location and level of derating

• Verify if full condition-rated mechanical design is feasible. If not, define the level and location of de-rating.

• Verify the level and location of de-rating for each design condition.

• Elaborate the complete pressure settings diagram. See Appendix 2 and Appendix 3.

• Optimize (if required) the set points of protection barriers.

HIPS Justification • Verify if a conventional protection system is feasible. If not, justify the reason why.

• Verify if the HIPS solution is acceptable (exclusions are mentioned in CR EP HSE 042) and feasible.

Protection barriers set points

• Evaluate the set points of the protection barriers of the installation.

• Predefine the set points of protection barriers based on preliminary process dynamics.

• Define the set points of protection barriers.

• Check if there is any interaction between the responses of protection barriers. If yes, assess their acceptability.

• Check set points with latest design modifications (if any).







HIPS DESIGN



Design of the HIPS • Define the location of the HIPS (valve, sensors) and its basic architecture.

• Continue the HIPS design taking into account the preliminary process dynamics.

• Continue the HIPS design. The HIPS should be designed on P&ID level.

• Finish the design of the HIPS.

HIPS setting • Evaluate the set points of the HIPS.

• Preliminary calculations on identified scenarios.

• Determine required response time for the HIPS (preliminary process dynamics).

• Calculate the process dynamics in order to determine the set points and response times of the HIPS.

• Verify the absence / acceptability of secondary effects. (e.g. water hammer)

• Optimize the set points of the HIPS (if required).

HAZARDS AND SCENARIOS



Risk assessment • Identify main hazards and critical events.

• Identify the configurations and scenarios for which a HIPS is required.

• Consider the influence of existing protection barriers (if any).

• Consider all operating cases.

• Identify possible risk reduction measures.

• Assess the credibility/likeliness of the scenarios. *(2)

• Evaluate the impact of possible future developments.

• (Re-) assess the likeliness / credibility of the scenarios. *(2)

• Define an extensive list of sensitivity cases based on worst case scenarios.

SIL assessment / achievement

• Carry out the preliminary SIL requirement evaluation. *(1)

• Finalize SIL assessment. *(1)

• Calculate SIL achievement in order to confirm SIL assessment. *(1)

• Reconfirm SIL assessment.

• Reconfirm SIL achievement.







CONSEQUENCES ASSESSMENT



Consequences • Evaluate the extreme conditions reached by the system in case of HIPS failure.

• Identify the weak points of the installations in case design conditions are exceeded. *(3)

• Calculate the extreme conditions reached by the system.

• Compare the extreme conditions to allowable limits.

• Assess the correspondence between the level of extreme conditions and consequence severities as a function of the integrity of the installations.

HIPS categorization • Evaluate the category of the HIPS by carrying out a risk analysis.

• Confirm the category of the HIPS. If needed (hard HIPS), request derogation.

DOCUMENTATION



Documentation to be prepared

• Describe at a conceptual level the HIPS function (in the process report).

• Establish a HIPS document containing the elements mentioned under the other items to be carried out during the Conceptual phase

• Establish a preliminary HIPS dossier and submit it to HIPS committee.

• Identify clearly the HIPS in Process drawings

• Ensure that the HIPS is listed in the SOR and addressed in the Safety Concept and in the Operating Philosophy.

• Update the HIPS dossier, in compliance with General Specifications and Company Rules and submit to HIPS committee.

• Ensure that the HIPS is addressed in the Safety Concept and in the Operating Philosophy.

• Elaborate the technical documentation related to process.

• Update the HIPS dossier for hand-over to Field Operations (in compliance with Company Rules).

Table 1: Process engineer responsibilities at different stages of the design When an existing SIS protection is identified as a HIPS (during audits for example), the same approach should be followed as for new installations. Specific constraints associated to installations and protection barriers installed prior to HIPS referential should be integrated in the HIPS justification and design choices.







During the operational phase of a HIPS the tasks of the process engineer working for the asset are the following:

1. Participation to management of modifications impacting the HIPS function (this shall go through the HIPS Committee).

2. Participation to management of downgraded situations impacting the HIPS function.

3. Making sure the HIPS dossier is updated (by the Operators in charge).







5. Design Principles This chapter sets out the basics for the design of a HIPS.

5.1 Justification and basic design for HIPS This paragraph describes when a safety system shall be qualified as a HIPS as well as the basis for its design.

5.1.1 HIPS qualification All deviations from industry standards describing conventional protection systems (essentially API RP 14C, now ISO 10418) are treated as HIPS. An ultimate protection relying solely on Safety Instrumented Systems (SIS) is qualified as HIPS, irrespective of its required Safety Integrity Level (SIL).

During conceptual studies the process engineer shall use the above definition to verify if any of the protection systems shall be qualified as a HIPS. For HIPS critical to the feasibility of the project the process engineer may evaluate whether it is necessary to develop the following documents in conceptual studies phase to base its conclusion on:

• PFD's which show the ESDV's, the specification breaks and the PSV's (when in Conceptual Study phase). These specific PFD's are not normally part of the Conceptual Study, but should be developed to better understand the need for HIPS.

• Simplified P&ID's

• P&ID's

• Up-to-date P&ID's (when being already in the Operations phase)

• The flare study

• The pipe specifications

N.B. This list is not exhaustive.

5.1.2 Justification for a HIPS As further explained in § 5.1.3, the installation of HIPS must be as far as possible restricted. However, the installation of a HIPS can be justified in the following cases:

• When no industry standard recommendations exist for a given application

2. This is the case with Subsea Production System applications (and associated flowlines and risers) [within the framework of API 17O task group, but no RP (Recommended Practice) issued yet]

• When industry standards do not address a specific hazard

3. Chemical hazard not addressed by ISO 10418 and API RP 14C

• When current industry standards CANNOT be implemented

4. They would involve an unproven technology or a technology beyond the present state-of-the-art







• When installation of a conventional safety system would imply impractical design constraints

5. Environmental considerations (avoid relief to atmosphere through relief valve)

6. Lay-out constraints (size of relief headers and associated downstream systems: vents, flares, etc…)

• When installation of a conventional safety system would imply disproportionate costs

7. Where "Disproportionate" implies the definition of a ratio of costs

The impracticality of a conventional solution must be demonstrated i.e. design calculations relating to the conventional solution must be provided.

The field of applicability of the HIPS solution is described in CR EP HSE 042. For the case of overpressure protection systems (OPPS), see GS EP SAF 262

5.1.3 System design approaches The standard design options for the protection of an installation are given in CR EP HSE 042 and summarized below. They shall be applied to any incident that leads to uncontrolled release of hydrocarbons or damage to the facilities.

The following design approaches can be selected for an installation:

• OPTION 1: “Safety-by-design”

Design of the whole installation to the worst possible conditions (pressure,temperature, flow, composition etc.) which may occur

• OPTION 2: “Specification Break + Safety System”

Upstream design only to the worst possible conditions which may occur

The following design options can be selected for the safety system to protect the downstreampart:

• OPTION 2-A: “Conventional”

Safety system designed in accordance with Industry standards

• OPTION 2-B: “Non conventional”

Safety system not designed in accordance with Industry Standards – amongwhich HIPS







The following order of preference shall be applied:

1. Design Option 1 (e.g. full pressure-rated mechanical design)

2. Design Option 2-A must be selected (conventional safety system).

3. Design Option 2-B (HIPS) can be selected only if the two other options are not practicable.

For option 2a specification break is introduced in the system, requiring the consideration of a safety system. When the safety system can be and is designed as per Industry standards recommendations (API RP 14C), it is referred to as conventional (option 2-A). If not, it is referred to as non conventional and is a HIPS (option 2-B).

The standard practice for the design of a safety system is reminded in CR EP HSE 042: the design of a safety system shall be made of at least two independent barriers of different nature, in accordance with standard recommendations of API RP 14C.

Application to Over-Pressure Protection System:

According to GS EP SAF 262, three main approaches are possible for pressure protection systems (in order of preference):

• Full pressure-rated mechanical design

• Relief systems (PSV + flare)

• Over-Pressure Protection Systems (OPPS), belonging to the HIPS category.

5.1.4 Level of de-rating In case of an incident scenario for option 2, the downstream part of the system can be subject to an incident condition exceeding its design condition. Within Design Option 2, several sub-options can be selected and correspond to different levels of de-rating. These sub-options are differentiated by the relative positions between the incident condition and downstream facilities characteristics: design condition / maximum allowable incidental condition / test condition / yield/ leak condition / burst / rupture condition.

Note:

For example, General Specification GS EP ECP 103 provides the definition of the Maximum Allowable Incidental Pressure (MAIP) and Incidental Pressure (IP) for Offshore pipeline systems constructed under DNV-OS-F101 code.

These two basic design options and associated sub-options are represented in Figure 1:







UPSTREAM

OPTION 1Safety-by-Design

No damage Yield/leak Unlikely Yield likely Burst Critical

Soft HIPS

Burst / Rupture

Test condition Burst / Rupture

Design condition Test condition Burst / Rupture

Incident ConditionDesign condition Burst / Rupture

Test condition

Normal Operating Condition Design condition Test condition

Design conditionNormal Operating Condition

DOWNSTREAM

OPTION 2Spec Break and Safety System

Hard HIPS

Figure 1: possible design options for the system

Option 1: "No damage" - the incident condition is under the design condition of the downstream facilities (or maximum allowable incident condition according to applicable codes).

Option 2-1: "Yield / leak Unlikely" - the incident condition is over the design condition of the downstream facilities but below its test condition (according to applicable codes). Specific requirements from construction codes may apply in case of incident.

Option 2-2: "Yield likely" - the incident condition is over the test condition of the downstream facilities but below its burst/rupture condition. The serviceability of the downstream facilities is at risk in case of incident.

Option 2-3: "Burst Critical" - the incident condition is over the burst/rupture condition of the downstream facilities. There is a high risk of burst/rupture of a pipeline/equipment in case of incident.

For pipelines already in service the actual mechanical conditions shall be established by instrumental inspections in order to re-assess the yield / leak and burst / rupture conditions.

The chosen option has a strong influence on the severity of consequences in case of an incident scenario and is therefore of primary importance regarding the specifications (HIPS category and the SIL requirement) of a HIPS. According to CR EP HSE 042 the HIPS is categorized (as guidance) as HARD when the maximum pressure reached during an incident scenario (without the HIPS intervening) can exceed the test pressure. This corresponds with the pink and purple diagrams in Figure 1.







The responsibility of the Process engineer is to strike a balance between the level of de-rating of pipeline/equipment design or test pressure, the expected HIPS category and the SIL requirement for the HIPS. The choice of the design pressure of downstream facilities also involves other parameters (on which the Process engineer can play) such as pipeline diameter: the larger the diameter, the lower the pressure loss, and the lower the design pressure required (especially for long pipeline networks).

Note:

The typical ratio between pipeline/equipment burst/rupture condition and design condition is strongly dependent on the type of line (process pipeline, piping, umbilical, flexible pipes) or equipment and can be important.

5.2 Description of a safety system This paragraph discusses the basics of a safety system, and its design characteristics needed in order to design a HIPS.

5.2.1 Installation characteristics table In order to visualize the installation characteristics of a design, operating and protection barriers setting values (for a given condition) should be represented on a diagram. Values associated respectively to upstream and downstream parts of specification break (usually choke valve location) should be clearly distinguished. Examples of such diagrams are provided in Appendix 2 and Appendix 3.

Whenever applicable, the following values should be indicated:

Operating parameters Design choices o Well shut-in max condition

o Operating conditions

Normal operating condition

Maximum operating condition

Start-up condition range

o Design conditions

Maximum allowable operating condition (pipelines)

Maximum allowable working condition (process equipment)

Maximum allowable incidental condition

Test condition

Yield / Leak condition [if known]

Burst / Damage condition [if known]

o Sensors set points

Condition high

Condition low

o Pressure relieving systems set points

Relief condition

Accumulation condition







The set points of a protection barrier must be chosen in relation to operating and design conditions, but also set points of other barrier(s) of the safety system. Additional rules or guidelines concerning the setting of safety system components are provided in § 6.2.

5.2.2 Response of a safety system The normal response of the safety system is presented in this section, taking no account of the potential failure of any of the safety system components. Such failure would however possibly be considered in one or more incident scenario(s) (refer to CR EP HSE 041).

A safety system is designed with several protection barriers which trip successively (different layers - or levels - of protection). Each protection layer achieves a given safety function (in normal or degraded mode).

The response of a safety system can be described by the response of its protection barriers. Therefore, the action of the protection barriers must be presented clearly.

The response of each protection layer is described by:

• the event for which the protection barrier should trip (for example: a blocked outlet);

• the initiator causing the protection barrier to trip (for example: high pressure detection);

• the actuators affected during the trip and configuration of all actuators after the trip (for example: end of valve closure).

The response time of a safety system includes all protection layers.

In conjunction with the table representing the response of the safety system, a shutdown logic diagram should be provided. This diagram shall have a dedicated shut down bar on the shutdown logic diagram and should clearly identify:

• components specifically dedicated to the HIPS

• components common to the HIPS and the other barriers

• components not used by the HIPS







6. HIPS design This chapter gives guidelines on the location, the setting and the type (preventive or reactive) of a HIPS.

6.1 The location of a HIPS § 6.1.1 to 6.1.4 discuss and set out the criteria to be considered for the main elements normally forming part of a HIPS.

6.1.1 HIPS position within the installation The choice of HIPS location must be driven by the following basic design rules. Among all possible HIPS locations and configurations, the preferred option from a process point of view is the one:

• Allowing the longest reaction time before a critical event occurs;

• Having the least probability for causing excessive trips.

• Requiring the simplest set of components and links between them and being easily accessible for testing and maintenance;

• For which simplified dynamic calculations can be used to ensure the required risk reduction.

6.1.2 Local reinforcement of the installation Within an installation, some pipelines (or equipment) are more critical than others. In that respect, the design of specific sections of the installation may be locally reinforced so that these critical pipelines (or equipment) are mechanically protected against critical events. The sections that are not reinforced would be damaged first: they are the "fuse" in case of incident.

Example 1:

Let's consider a pipeline arriving to a platform. Should this pipeline be subject to an overpressure risk, it is safer for people and would have lower consequences on assets if the damaged section of the pipeline is far from the platform rather than being close to it. Consequently, the risk on people and assets would be reduced if the pipeline is locally reinforced.







The event “pipeline bursting close to the platform” may have a high severity due to the presence of people nearby.

Moreover, the consequences on assets if a riser line is damaged may be severe (possible “side effects” and escalation of consequences with the damage of other riser lines). In the worst case, the whole production can be jeopardized if the riser needs to be replaced.

By comparison, the event “section bursting far away from the platform” has a lower severity for people than the previous event. For that case, we would consider that a subsea flowline is bursting instead of a riser line and/or flexible jumper.

High design pressure network

Low design pressure network

Pipeline at risk in case of incident scenario

Figure 2: place of overpressurization risk

6.1.3 Location of HIPS valves The location of HIPS valves is of utmost importance when considering the adequacy of HIPS response with the dynamic behaviour of the effluent. For that purpose, initiating events of incident scenarios must be considered. If the HIPS valves (and the specification break) are located close to a source of hazard, the required response time will have to be very short and possibly too short to even allow designing the HIPS according to specifications.

Therefore, the consistency of HIPS valves location within the installation must be checked versus specific points such as the location of other valves (for example, no automatic valve should be installed on the de-rated section just after a HIPS).

The HIPS valves should be located as far as possible away from any potential cause of blocked outlet (in order to lengthen the allowable reaction time for the HIPS).

6.1.4 Location of HIPS sensors Hazards associated to the fluid composition

The following hazards in relation with the fluid composition must be assessed:

• Hydrate

Platform

Platform







• Paraffin / Wax

• Scales / Deposit

• Sand

The risk is that the tapping of pressure sensors of the HIPS is blocked. This risk can be mitigated by:

• suitably locating the sensors tapping.

• selecting impulse lines with 2" minimum connection (as prescribed by GS EP SAF 260).

• trace-heating impulse lines and installing the sensors in heated enclosures.

• methanol flushing.

If dynamic effects are fast, the sooner the HIPS reacts, the lower the consequences of dynamic effects will be. The HIPS response time is always faster if sensors are located upstream the specification break. If the sensors of the HIPS are located downstream the specification break, the reaction time of HIPS valve may be too slow to prevent dynamic effects threatening the de-rated sections of the installation.

Locating sensors upstream the specification break implies that more unwanted activations of the HIPS could occur than when sensors are located downstream. Such a HIPS may trip even if no hazard actually threatens downstream pipelines/equipments, considering a possible damping of peak conditions (below design conditions) on the way from upstream measurement point to the downstream de-rated section of the installation.

6.1.5 By-pass of a HIPS No by-pass of a HIPS shall be allowed at any time (neither during normal operation nor during restart) unless:

• By-pass line is protected with a HIPS valve as is the production line

• No critical event may occur during operation through the by-pass line (small diameter plus conventional relief system designed for the maximum flow through the by-pass line)

For example, a by-pass line may have a smaller diameter or may be fitted with a smaller choke valve (lower Cv) than the production line. In that case and if a conventional relief system is installed and designed for the maximum flow through the by-pass line or the fully open small choke, then the by-pass line may not be equipped with a dedicated HIPS valve. The maximum Cv of the small choke valve must clearly be specified. Any by-pass shall be clearly described as such in the HIPS dossier.

This section does not address inhibitions.

6.2 HIPS setting The installation characteristics table (see § 5.2.1) allows identifying clearly the relations between the different conditions (operating, design, instruments setting, etc.). This diagram is important because the HIPS set points are chosen respectively in relation to operating condition, design condition and other instruments setting.

Requirements on dynamic response and instrument settings are included in GS EP SAF 260.







6.2.1 HIPS setting vs. operating conditions First, the HIPS set point(s) must be set above normal operating condition (plus margin) as well as above the primary safety barriers (PSS, ESD system), but at the lowest possible value compatible with operating flexibility. For that purpose, the fluctuations of operating pressure due to vicinity of a choke valve, slug flow in a multiphase fluid, compressibility of the fluid must be duly considered.

Example:

The margin between normal operating condition and the HIPS tripping condition may need to be greater for an oil system compared to a gas system as the oil system can pack up quicker as the fluid is incompressible.

Note that increasing the margin tends to reduce the number of spurious trips. Also the margin should be sufficient to allow setting the other protection barriers (see § 6.2.3).

6.2.2 HIPS setting vs. design condition "The set point of the sensor(s) activating the HIPS barrier(s) shall be such that the full isolation of the source is achieved before the conditions exceed the maximum allowable incidental conditions of the equipment." [GS EP SAF 260]

6.2.3 HIPS setting vs. other protection barriers setting The HIPS should trip after all other safety barriers but before pressure-relief barriers, if any. For that purpose, a sufficient margin must be taken between operating condition and HIPS set points (see § 6.2.1). A possible drift in the sensor calibration should be considered (when critical).

"The design shall minimise the demand rate of the HIPS. As a consequence, the set point of the sensor(s) initiating each barrier shall be such that the activation of the other barriers is avoided during its operation." [GS EP SAF 260] If this cannot be achieved, due to the fast dynamic of the incident, the demand rate on the HIPS itself, hence the reliability of the whole protection is impacted.

The setting of relative trip levels of all protection barriers including HIPS may be complex and vary between developments. The dynamic response of the system is of primary importance regarding that last issue.

Example:

Trip settings for gas fields can be closer to each other than oil field trip settings due to the influence of the compressibility of the product

6.2.4 Confirmation of set points The confirmation of HIPS set points is usually made using dynamic simulations (see § 2).

6.3 HIPS response time Dynamic simulations allow evaluating and quantifying the process dynamics in normal and abnormal operating conditions, in start-up & shutdown conditions and in case of incident scenarios.







For the determination of required HIPS reaction time, the main output of the simulations is the time for the upset condition to reach the maximum allowable incidental conditions of the equipments.

A specific requirement on dynamic response of the HIPS is included in GS EP SAF 260:

"HIPS overall response time, from safety initiation to total completion of isolation, shall be three times shorter than the calculated time for the upset condition to reach the maximum allowable incidental conditions of the equipments." [GS EP SAF 260]

If the HIPS response time is found to be unachievable, then the configuration (or even the implementation) of the HIPS must be reconsidered.

The closure time of the HIPS valve(s) is a major contributor to the overall response time:

• Typical closure time of standard valves: between 1 and 2 seconds per inch

• Better closure times can be achieved by using fast acting valves, such as axial valves (e.g. Mokveld). One should be aware that these are not piggable and that no partial stroking tests can be done.

When fast-acting barriers are required, due consideration must be given to possible "secondary" effects (e.g. pressure surge or water hammer), which may have worse consequences than the primary critical event.

6.4 Preventive or reactive HIPS Depending on the way the HIPS protects against an hazard, the HIPS can be classified as a "preventive" or a "reactive" HIPS. When the HIPS prevents a certain scenario to start off, (preventing the initiating event to occur) the HIPS is referred to as a preventive HIPS. Normally this consists of sensors upstream of a specification break preventing an isolation (HIPS) valve to be opened, when certain conditions (pressure level) are not satisfied. This type of HIPS is often combined with an interlock preventing the opening of the HIPS valve(s) when another isolation valve is open. When the HIPS reacts on a certain scenario which has already started off (often detected as an increase of pressure) and protects by isolating/stopping the source of hazard, the HIPS is referred to as a "reactive HIPS". In case of overpressure this HIPS normally consists of pressure sensors closing isolation valve at a certain pressure level. It is clear that in the case of a "reactive HIPS" dynamics (reaction time) of the HIPS play an important role. Depending on the required reliability of the HIPS, both HIPS can be implemented to protect against the same hazard.

Two main drivers must be considered for the choice of the type of HIPS:

• The dynamics of the system and associated HIPS required response time

• The production availability and excessive trips of the HIPS

The main driver for the choice of the type of HIPS is the HIPS required response time (refer to the safety specifications defined in § 2), closely associated with the HIPS position within the installation (see § 6.1.1).

In any case, the dynamic analysis must confirm that a HIPS with the adequate reaction time is feasible. If not, the architecture of the whole safety system should be further optimized in order to attain an acceptable required reaction time.







Note:

The choice of reactive or preventive HIPS has noticeable consequences on reliability calculations. TDO/EXP/SRI entity should be consulted on that matter.

6.5 HIPS adaptability throughout design life When designing a HIPS the adaptability to future developments (see § 6.5.1) as well as changing reservoir conditions (see § 6.5.2) shall be taken into account.

To cope with the change of the conditions during field life, mechanical adaptation is preferred respectively to software limitations and procedural adaptations. This adaptation shall be indicated on the P&ID's.

For example, refer to the case of the adaptation of the Cv of a choke valve to inlet flow rate (see § 7.2.1).

6.5.1 Accounting for future developments When designing a HIPS, possible future well tie-ins / extensions or flow rate increases requiring higher design conditions must be taken into account. If it is planned to connect a more stringent source than the actual ones, either the HIPS should be designed to the future conditions or an upgrade of the HIPS or the installations should be planned (if expected to be required).

Dynamic studies must be updated before each new tie-in or flow rate increase and adequacy of HIPS sizing verified.

6.5.2 Modification of the characteristics of the source of hazard In the case of a reservoir, the condition of the source of hazard (e.g. reservoir pressure) may decrease with time (natural depletion, low injection) until the system design is back to:

• A "Safe-by-design" configuration

• Within the capacity of the conventional safety system (e.g. ESD + PSV)

In such case, the HIPS might not be required any more.

Before any modification is applied on the HIPS (or when the HIPS is decommissioned), a complete re-assessment of the risks must be carried out (the HIPS dossier must be updated).







7. Process Dynamics This chapter describes the components impacting the process dynamics and the subsequent simulations.

7.1 Dynamic simulations Before the HIPS is designed, steady state and dynamic simulations have generally already been performed for standard equipment design and flow assurance purposes. The calculation cases related to the HIPS are then only particular cases of these simulations.

Calculations must be performed not only during shut-down events but also during start-up or restart of the installations.

Simulations shall be carried out on the basis of pre defined scenarios. These scenarios shall be established by the process engineer and field operations engineer based on credible configurations. More details on scenarios can be found in 10.

Attention must be paid to the fact that the model and parameters for the HIPS related simulations are consistent with those of the initial simulations (the typical unwanted situation is when the HIPS design is fully contracted and when the contractor builds a new model instead of using the existing one - both possibly being not consistent with each other).

7.1.1 Purpose of dynamic simulations The purpose of the dynamic simulations during the different phases of a project is:

• At pre-project stage using typical assumptions for critical equipment (if deemed necessary, or otherwise during project basic engineering):

2. to define on a preliminary level the HIPS specifications (incl. the required HIPS response time) - prior to HIPS installation

3. to set the different protection barriers

• During basic and detailed engineering:

4. to confirm the performance of the safety system including the HIPS

5. optimization (if required) of the set points of the HIPS barrier

6. optimization (if required) of all other settings (SDV closure time, PSV settings, etc.)

7.1.2 Choice of the dynamic simulator If applicable, multiphase and process dynamic simulations should be coupled. If not, conservative data must be selected for input parameters and system conditions of each separate dynamic simulation (for example: liquid hold up, initial pressure…). In some (very simple) cases a spreadsheet calculation with conservative assumptions tuned against a steady state dynamic calculation can be fit for purpose.

In case insufficient (or not reliable) well data is available the wells shut in time, behaviour and riser pressure should be kept constant (well to be modelled as infinite source with constant molar flow rate).







The time interval (step) taken in thermodynamic calculations shall be sufficiently small in order to not miss the peak (maximum) in the results of the simulation.

One should be aware that results obtained from simulation programs are not always reliable (water hammer for example is known as a phenomenon that is often not well calculated), and differences of up to a factor 3 have been found between results obtained with different software programs.

7.1.3 Choice of the operating parameters The operating conditions used in the simulation shall be chosen with a conservative approach, typically:

• Maximum operating pressure (at PAH)

• Maximum liquid level in separator (at LAH) for the blocked outlet or gas blow-by from the upstream section case.

• Minimum liquid level in separator (at LAL) for the gas blow-by to the downstream section case.

• Maximum liquid hold-up in pipeline.

A 100 percent gas flow gives other dynamics results than mixed flow. If deemed necessary both cases shall be studied.

7.2 Arrangement of installations & incident scenarios A pressure-relieving system is designed for a given flow rate. As long as the required relief flow rate remains within the pressure-relieving system capacity, no consequences are expected. However, as soon as the relief flow rate exceeds this capacity (while the pressure of the protected equipment being above the relief pressure), consequences are expected (see § 7.2.3 for detailed considerations on dynamics).

In some cases (especially when there is a large gas flow) the required relief capacity cannot be installed since it would require a very high flare to satisfy the radiation criteria (see GS EP SAF 262). In this case one could investigate the possibility to satisfy the flow criteria of the flare for the maximum relief capacity needed without completely satisfying the radiation criteria. A HIPS is then implemented to avoid exceeding the relief flow of the flare in terms of radiation. In this way the HIPS is to protect against exceeding the radiation criteria (or apply a less stringent category of the radiation criteria, see GS EP SAF 262) of the flare and not against over pressurizing the installation. Since the consequences of a failure on demand of the HIPS are not the same in these two cases, the HIPS could then be classified as a SOFT HIPS instead of a HARD HIPS, depending on the outcome of the hazard assessment as per CR EP HSE 041. It shall be clear that (as is with all HIPS) such a HIPS (as all HIPS) is not an option given preference by COMPANY and a Project aiming to implement such a HIPS shall justify with strong arguments its choice.

7.2.1 Influence of choke characteristics A common incident scenario involves the full opening of a choke valve when there is no pressure-relieving system or the pressure-relieving system is not sized for full flow. In that case, the Cv of the choke is critical because it determines the maximum relief rate.







A good design practice is to specify a maximum Cv of the choke so that the maximum relief rate remains within the capacity of the pressure-relieving system (if any). This may be achieved by implementing 2 choke valves (of different size, if necessary) in parallel to cover the whole range of operating conditions. (See also Figure 3 in § 10.1.5). One of the chokes being isolated in case of process upset conditions and the other one being sized such that it cannot overpressure the downstream part of the installation.

As the design of the system becomes more detailed, initial calculations must be updated:

• Confirm choke valve sizing philosophy ("try to reduce choke valve Cv's").

• Revise choke valve sizing and high pressure trip settings based on updated production profiles.

If during field life, the maximum relief rate is modified (see § 6.5), a reassessment of the installations design must be done so that the hazardous event "Overflow" is prevented.

The following measures can be taken to suppress the hazard:

1. Adequate re-sizing of the choke valve with regard to the maximum capacity of the relief system.

2. Installation of a mechanical stop on the choke valve or a restriction orifice (fixed choke).

Note that the following measures are not approved by the HIPS Committee:

1. Software limitation of the allowable opening of the choke valve

2. Operational procedures limiting the risk of wrong setting of the choke valve opening

7.2.2 Influence of SDV characteristics In other scenarios involving the spurious closure/opening of an ESDV/SDV, the opening/closure time of the ESDV/SDV is critical. For example, if the opening time of an ESDV/SDV is too quick, the HIPS may not have the time to react before the maximum allowable incidental conditions are reached. In such case, an opening time higher than usual may be specified for the ESDV/SDV. In most cases this is difficult to achieve since the flow when opening is not linear with the time. A throughput close to the maximum valve capacity is reached when the valve is only opened at a few percent. An ESDV/SDV interlocking logic can often be used in order to avoid problems due to opening dynamics.

In addition, the characteristics (in particular opening/closure time) of all other valves which are part of the safety system have to be set so that the dynamic response is optimized (see § 2). Indeed, if the closure time of a SDV/ESDV (part of a protection layer) is too long, other protection layers (including HIPS) may be activated improperly.

7.2.3 Influence of pressure-relieving devices The combination of an instrumented barrier (typically PSS/ESD system) and a mechanical barrier (typically a PSV) constitutes the conventional design of a safety system (see § 5.1.3).

The conventional sizing of a relief system shall be made in accordance with the failure cases addressed in GS EP SAF 262 and GS EP ECP 103 (fire, multiple wells relief, failure of control valves, etc.).







The design requirements from GS EP SAF 262 and GS EP ECP 103 regarding normal and peak flow rates to the flare shall also be followed.

If a pressure-relieving device can be installed but can not be sized for some realistic, yet remote, incident scenarios (due to design constraints or for example the connection of a new network to an existing flare), then the installation of a HIPS in addition to the flare could be considered.

As a HIPS shall be designed only for protection against a single incident, the installation of conventional safety barriers (such as PSVs) might be required for others scenarios, such as:

• The fire case, against which a solely instrumented protection is not sufficient.

• The liquid over case, against which HIPS protection are generally not accepted by the HIPS Committee (i.e. PSV must be sized for full flow gas and liquids).

Even if not sufficient to protect against some critical events, the action of pressure-relieving devices is beneficial in terms of process dynamics as they slow down the rate of pressure surge. The allowable HIPS reaction time is consequently increased. Therefore the influence of pressure-relieving devices must be duly taken into account in calculations. The opening of spill off PV's (not a safety system) to the flare system can not be counted on when calculating the needed HIPS reaction time.

The possible interactions between different protection barriers must be carefully studied (e.g. opening of a PSV during the HIPS barrier activation). As a base case, all interaction should be avoided (see § 6.2.3): the set pressure should then be adjusted in order to ensure that the pressure peak in the separator remains below PSV accumulation pressure.

However, pending on dynamic simulation results, some interactions could be accepted (e.g. the PSV may lift while the HIPS valves are not fully closed). In such a case i.e. HIPS and the PSV/PV are activated simultaneously, the HIPS reaction time should be minimised to limit the duration of the relief to the flare.

If required, an increase of downstream facilities design pressure should be considered to allow setting trip points in order to avoid interaction.

As the design of the system becomes more detailed, initial calculations must be updated:

• Update Separator and Piping Volumes (line sizing and improved piping layout)

• PSV sizing

• PV sizing calculations (try to reduce PV size to reduce flaring rate)

If eventually no solution is found acceptable (required HIPS reaction time too short, flaring rate too high), other measures must be implemented. As part of the above design optimisation, the increase of the equipment design pressure could eventually be considered if not leading to detrimental impact on downstream equipment gas blow-by protection or on overall EDP flow rate. Moreover, additional load on topsides may not be feasible.







8. HIPS Dossier This chapter describes the HIPS dossier, and aims to complete (from a process engineering point of view), the information already given in GS EP SAF 260 and CR EP HSE 042.

8.1 Objective of the HIPS dossier The aim of the HIPS dossier is to:

1. keep a record of the design features and choices.

2. demonstrate that the HIPS alone meets the safety targets.

3. describe the HIPS system and the operating philosophy.

4. demonstrate the overall probability of incidents evaluated in taking into account all relevant protection layers, including the HIPS, is acceptable.

8.2 Submission of the HIPS dossier A tentative planning for the submission of the HIPS dossier must be followed:

• Pre-project:

2. HIPS justification and preliminary design

3. Perform hazard identification and preliminary risk assessment (this should include a consequence analysis as well as a preliminary HIPS category, HARD or SOFT, evaluation (by Safety Engineer)

4. Estimate SIL requirement (by Safety Engineer)

The preliminary HIPS dossier shall be issued to the HIPS Committee. The HIPS requirement shall be identified in the SOR.

• Basic engineering:

5. Update hazard identification and preliminary risk assessment (by Safety Engineer)

6. Confirm the HIPS category, and issue the derogation request, in case of a HARD HIPS (refer to CR EP HSE 042).

7. Perform SIL assessment (by Safety and/or reliability Engineer)

The HIPS dossier shall be issued. Depending on the status of the project and the HIPS dossier, the HIPS Committee might decide that no further HIPS Committee meetings are needed.

• Detailed engineering:

8. Update preliminary risk assessment & SIL assessment (by Safety Engineer)

9. Perform Detailed and quantified analysis of risks & SIL achievement (by Instrumentation Engineer)

10. All deviations from the HIPS design specification (GS EP SAF 260) are identified and derogations requested. (in co-operation with Safety Engineer)







The final HIPS dossier shall be issued to the HIPS Committee.

8.3 Content of the HIPS dossier The content of the HIPS dossier is prescribed in GS EP SAF 260 as well as CR EP HSE 042, and shall contain the following:

8.3.1 Preliminary dossier The preliminary HIPS dossier shall be submitted during the pre project phase and shall contain:

• HIPS justification against industry standard,

• The Hazard assessment: identification of sources of hazard (hazard scenarios), protection selected for management of the hazard, associated ESD logic, dynamic studies if applicable,

• Consequence analysis: evaluation of the consequences of the hazard,

• The locations of de-rating of the installation, the preliminary set points of the protection barriers including the preliminary set points of the HIPS

• HIPS Design and OPERATING PHILOSOPHY, HIPS demand rate evaluation (preliminary evaluation of the frequency of occurrence of the hazard scenario triggering the whole protection system - PSS, ESD, HIPS),

• Safety Integrity Level (SIL) required of the whole protection system (corresponding to a required PFD and vice versa), and the Probability of Failure on Demand (PFD) required for the (regular) safety system and the applied HIPS components.

8.3.2 HIPS dossier The HIPS dossier shall be submitted during the basic engineering phase and shall contain:

• Update of HIPS justification against industry standard.

• Update of the hazard assessment.

• Update of the consequence analysis.

• The process dynamics study, demonstrating that the reaction time of the HIPS is sufficient. (see § 6.3).

• The pressure settings diagram (See Appendix 2 and Appendix 3).

• HIPS design principles, including the demonstration of :

11. the PFD (Probability of Failure on Demand) of the (regular) safety system components prior to HIPS installation,

12. the PFD (corresponding to a SIL) of the whole safety system prior to HIPS installation,

13. the PFD of the applied HIPS components,

14. the PFD (corresponding to a SIL) of the whole safety installation after HIPS installation,

• HIPS detailed specification for the engineering and construction phases.







• Reliability and availability calculations (SIL achievement), at detailed design phase when the HIPS components

• (sensors, logic solvers, final control elements) have been selected, including:

15. Diagnostic coverage of failures,

16. Detailed common cause/ mode failure analysis,

17. Effect of spurious failures on the availability of the production installation.

• Engineering documentation including :

18. an exact graphical scheme of the HIPS,

19. Piping & Instrumentation Diagrams (P&IDs),

20. Cause & Effect Charts,

21. ESD Logic Diagram,

22. Material selection (instrument data-sheet, vendor curves, …),

23. Calculation notes (as for example dynamic calculations when required to demonstrate that the response time target is reached).

• Dedicated HIPS Maintenance, Testing and Repair policy with a frequency to be defined based on availability calculations.

• The restart procedure after a trip of the HIPS.

8.4 Specific requirements for process documentation HIPS components must be clearly identified as parts of HIPS on P&ID's and Shutdown Logic Diagrams. Process and Safety Diagrams (as defined in GS EP ECP 105) must be provided. The HIPS shall have a dedicated shut down bar on the shutdown logic diagram.

All valves characteristics which are key elements of the protection by a HIPS are documented as such in the instrument data sheets: this includes the Cv's of chokes, closure times of the fast acting valves and the opening time of the chokes and SDV's, when applicable.

The dynamic studies shall demonstrate that the reaction time of the HIPS is sufficient. (see § 6.3).







9. Operational Constraints The following operational constraints shall be checked when designing a HIPS:

• A rigorous operations organisation must be put in place particularly defining qualifications/competences required to adjust HIPS related settings, carry out maintenance on HIPS, etc.

• The Operating Philosophy shall describe all operations necessary to operate the HIPS (including but not limited to the test and maintenance policy).

• Verification if a HIPS valve needs to be pigged (and in that case can be pigged).

• Dead oil circulation, start up, slug management, temperature etc. to be considered for the setting of sensors / valves, the dynamic calculations

• After a trip of the HIPS, by design, the start-up shall not require a by-pass or inhibition of the HIPS.

• The maintenance and test programme shall ensure the needed reaction time is guaranteed throughout the life of the HIPS.

• The design of the HIPS shall be such as to avoid a very high testing frequency of its components (more than once every six months) needed to maintain its required SIL.







10. Applications of HIPS This chapter provides the various applications of HIPS and some practical examples. It shall be clear that each HIPS design is unique for each case, but using feedback of already designed HIPS can improve and ease the preliminary process design.

10.1 Riser HIPS The riser HIPS (an example with schematic overview is given in 10.1.5) is used to protect a de-rated part of an installation after a specification break at the arrival on FPSO / platform. Normally a flare system is in place, but it can not be sized in a practical way for all incident scenarios.

Examples:

• AKPO, CLOV, Dalia, Moho-Bilondo, Pazflor, Rosa, Usan, Egina, Forvie, Glenelg, L4G

The riser HIPS (especially on FPSO's) is generally justified by the following:

• A full pressure (at WHSIP) rating (a.k.a. "safe by design") would be too costly and would have a significant weight impact on the installations, making the installations unfeasible.

• A conventional overpressure protection system relying on a primary protection provided by a PSHH which isolates all high pressure feeds and a secondary protection provided by a relief valve would be unpractical for the de-packing scenario. The de-packing scenario requiring sometimes a relief capacity of up to 5 times the blocked outlet scenario (the second most restricting relief flow scenario), thus requiring a very large flaring capacity.

10.1.1 Typical riser HIPS scenarios This paragraph lists the scenarios to be considered to design a riser HIPS upon.

De-packing case The de-packing case is the most common design case for a riser HIPS. This scenario involves the packing of the upstream lines up to the Topsides (Maximum Riser Head Shut In Pressure) at high pressure (above downstream design pressure). In case of incident, the de-packing flow rate could exceed the flare network design capacity.

The central critical event associated to this scenario is over-pressurisation of topsides equipment (both first stage and test separators) and piping (production and test headers, depending on the location of the pressure break) due to the presence of a high pressure source at the top of riser and in case of uncontrolled opening of a choke valve or unwanted opening of a (E)SDV.

Additionally there is a risk of over-loading of the flare system, from all PSV's both on the headers (when applicable) and on the separator(s) plus the separator(s) PV relieving simultaneously in case of the incident scenario.

Therefore the HIPS may have to ensure both over-pressure protection and flare system over-loading protection and be designed accordingly.

In addition, adequately sized PSV's are provided on the test and 1st stage separator (as per API RP 14C) to ensure overpressure protection for the following scenarios:







• Full blocked Outlet (liquids and gas) at facilities design flow rate.

• Fire

The first scenario discussed is the opening of riser ESDV at maximum packing pressure. This is the most restricting scenario, but less probable than the other scenarios to occur.

Case Opening of the Riser ESDV of a packed riser

Scenario 1. Packing of the Riser at RHSIP *

2. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open

3. Opening of one Riser ESDV

*: or at gas lift circulation pressure, when applicable

Case Opening of a SDV

Scenario 1. Restart of the fully packed riser after a shutdown

2. Upstream pressure at PSHH trip pressure

3. Opening of a SDV upstream of the large choke

Case Opening of a large choke valve or PCV

Scenario 1. Restart of the fully packed riser after a shutdown

2. Upstream pressure at PSHH trip pressure

3. Failure open or spurious opening of one (or more) of the large choke valves

The spurious opening of a number of chokes, simultaneously with a packed riser is to be evaluated in order to assess its credibility. A fault-tree analysis of the operating scenarios should be developed in order to determine their probability of occurrence, the causes and common mode of the spurious opening case on the various risers. In addition, a review of the flowing pressure conditions during normal operation, credible packed conditions (with some sub-sea choking at the wells) and gas-lifted operations, consistent with the production profiles should be carried out.

Depacking with blocked outlet As a base case, the flare must be sized for a blocked outlet on test or first stage separator with maximum operating flow.

However, a de-packing scenario associated to a blocked outlet on test or first stage separator would be the most onerous scenario in terms of process dynamics.







Case Opening of one Riser ESDV

Scenario 1. Packing of the Riser at RHSIP *

2. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open

3. Blocked outlet on test or first stage separator

4. Opening of one Riser ESDV

*: or at gas lift circulation pressure

Case Opening of a SDV

Scenario 1. Upstream pressure at PSHH trip pressure

2. Blocked outlet on test or first stage separator

3. Opening of a SDV upstream of the large choke

For an example of a list of scenarios studied for a HIPS design, find the following table listing the scenarios studied for the riser HIPS of the CLOV FPSO.

Depacking cases

1 Spurious opening of ESDV Lirio (flowline packed at 240 barg) with 3 other flowlines producing in packed conditions (100 barg). In this instance the downstream valves are OPEN.

2 Spurious opening of SDV1 Lirio through both chokes (flowline packed at 43 barg) with 3 other flowlines producing in packed conditions (100 barg).

3 Spurious opening of SDV1 Lirio through start up choke (flowline packed at 100 barg) with 3 other flowlines producing in packed conditions (100 barg).

Choke failure cases¹

1 Main choke Lirio failure (flowline producing at 43 barg) with 3 other flowlines producing in packed conditions (100 barg).

2 Start up choke Lirio failure (flowline producing at 100 barg) with 3 other flowlines producing in packed conditions (100 barg).

¹These choke valve failure cases are assumed to occur during normal (multiphase) production and thus the chokes handle both liquids and gas in these scenarios. The failure case considered is damage to the choke valve trim due to a large solid item passing through the choke.

Table 2: Scenarios studied for CLOV riser HIPS

10.1.2 HIPS location & architecture The conceptual design of a HIPS must take into account piping layout issues in congested areas: one should not install too many valves in serie. A solution can be to use one (E)SDV for two shutdown actions by using one dedicated solenoid for each action (see GS EP SAF 260).







The installation of a spool for the implementation of one or more dedicated HIPS valve(s) may be considered during the detailed design in order to attain the required SIL.

The HIPS architecture is selected with due consideration of the pressure rating breaks and of the normal and start-up pressure range (as defined by the flow assurance study and plotted on the pressure settings diagram, see Appendix 2).

Location of sensors:

The installation of preventive HIPS barriers upstream of the riser chokes is recommended in order to limit maximum upstream pressure during packed operation.

Production manifold fully rated after choke valve:

The specification break should be after the SDV just upstream of the production/test separator.

The location of piping class rating break downstream of the manifolds is recommended. From a general point of view, the location of piping class rating break should be as close as possible to the separators. It is recommended to specify it at the vessel flange.

Interlocks:

To minimize the risk of over pressurization due to spurious opening of valves having a packed pipeline upstream, one could apply the following interlock:

• An interlock preventing ESDV opening while downstream SDV's and choke valves are not closed

Interlocks which are not part of the HIPS function can be programmed into the PCS or ESD system. However in case the interlock is part of the HIPS function, it shall be incorporated in the dedicated HIPS logic solver. The interlock can also be implemented or reinforced by using mechanical interlocks.

Several production loops:

Given the probable difference in preventive HIPS set points, it is recommended to install one dedicated logic solver for these preventive HIPS barriers per production loop. This will reduce the risk of confusion, during field life operation.

The following could be implemented:

• one logic solver per production loop treating the preventive HIPS and reactive HIPS barriers (in case of one PSHH set per branch), or

• one logic solver per production loop treating the preventive HIPS and one common logic solver for the reactive HIPS (in case of common set of PSHH on each manifold).

10.1.3 Dynamic simulations Dynamic simulations shall be performed to determine / confirm the required HIPS reaction time and set points. Both first stage and test separators (with control loops, if applicable) shall be considered.

The following shall be taken into account for the dynamic simulator model:

• Actual volumes calculated from line isometrics and vessel data sheets

• Actual pressure profile from inlet ESDV's to Separators calculated from line isometrics







• Maximum liquid level in the separator / maximum operating pressure in the separator

• Actual ON/OFF valve characteristic (Cv as function of % of opening) and actuator law on opening and closing (stroke versus time)

• Actual size and characteristic (e.g. pilot type) of PSV's

• Actual HP flare network volume and pressure profile calculated from line isometrics and HP flare tip characteristic

• the choke valve's Cv and opening curve (vendor data).

10.1.4 Risk mitigation measures The purpose of this paragraph is to identify additional mitigation measures that could be considered to prevent the cause of an accidental scenario from happening (reduction of the risk). The following risk mitigation measures should be taken into account when designing a HIPS:

• The (outboard) riser ESDV shall not be used as a shared HIPS valve (except for the re-opening interlock). The HIPS valves shall thus come in addition to the (outboard) riser ESDV.

• The use of a dedicated HIPS valve should be considered, unless it is demonstrated that the implementation of dedicated HIPS valves does not yield a significant improvement of the SIL of the whole protection.

• When HIPS valves are shared with the PCS and/or ESD system, the HIPS function shall have dedicated solenoids actuating these valves (refer to GS EP SAF 260).

10.1.5 Riser HIPS example An example of a riser HIPS is given in Figure 3, representing the riser HIPS proposed for the CLOV FPSO.







M

M

ESDV10101

SDV10101A(Note 1) HIPPS1

PSS1 PSS2

PSS

HIPP

S1/2

SDV10102From Cravo / Lirio Right

From O11 / OV Central Right

From O11 / OV Central Left

PSSSDV10103

PSS4PSS4

PigLauncher / Receiver

First Stage Separator

Production Manifold

HP Flare

HP Compression

HP Flare(Flowline Depressurisation )

1500

#30

0#15

00#

300#

Note:1. SDV10yxxA provided with a bypass line (C/W SDV10yxxB plus globe )

not shown for clarity purpose . xx: 01 or 04

PV

PSS4

Set @ 43 barg

Set @ 40 barg Set @ 92 barg

Set @ 27 barg

Set @ 28 barg

Set @ 26.5 barg

Set @ 29 barg

Set @ 25 barg

HIPPS2

HIP

PS

INT

ER

LOC

K

HIP

PS

INTE

RLO

CK

PSS

ESD

ESD

PSHH10101A

PSHH10101B

PSHH10101C

2oo3 VOTING

PSHH101xx

PSHH101xx

Set @ 100 barg

HIPPS2

PSHH10102A

PSHH10102B

PSHH10102C

2oo3 VOTING

HIPPS3

PSHH

10103APSH

H10103B

PSHH

10103C

2oo3 VO

TING

PSHH101xx

PSHH

101xx

2/3/4

HIPPS3

1/2/3/

4

HIPP

S3

Figure 3: CLOV riser HIPS schematic

To fulfil the SIL requirement this riser HIPS consists of a preventive protection system (HIPPS 1 and HIPPS 2), a reactive protection system (HIPPS 3) and a preventive interlock system. The working of the HIPS systems (which comes in addition to PCS and ESD protection) is as follows:

1. If the operating pressure rises to 43 barg upstream of the choke valves, HIPPS1 PSHH10101A/B/C will initiate closure of SDV10102 upstream of the large choke valve. The small choke valve is designed to handle operating scenarios above 43 barg, for example during start-up.

2. If the operating pressure rises to 100 barg upstream of the choke valves, HIPPS2 PSHH10102A/B/C will initiate closure of SDV10101A/B, and SDV10102 upstream of the large and small choke valves.

3. If the operating pressure downstream of the choke valves rises to 28 barg, HIPPS3 PSHH10103A/B/C will initiate the closure of SDV10101A/B, and SDV10102.

4. Upon any closure of ESDV10101 (via ESD, manual or spurious action), interlock logic is triggered to prevent re-opening of this ESDV if SDV10101A/B (B is the by-pass) are not closed, and the pressure measured by PSHH10102A/B/C has not decreased below 100 barg. This interlock function includes three detection means (2oo3 between smart valve position transmitter, valve limit switch and pressure sensors on air supply). The logic is hard wired.







The SIL this HIPS reaches against the most onerous scenario (depacking with flowline packed at 240 barg and choke valves completely opened) is a continuous SIL3.

10.2 Gas Plant Inlet Pressure Let-down HIPS The pressure let-down HIPS is very similar to the riser HIPS (see § 10.1), but is not installed on a flow line arrival but on a pipeline. A pressure let-down protection is often installed at the inlet of a plant, but could also be applied to protect a downstream pipeline with a lower pressure rating.

10.2.1 Typical pressure let-down HIPS scenarios The scenarios to be considered when designing a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10.1.1.

10.2.2 HIPS location & architecture The location constraints and recommendations for a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10.1.2.

10.2.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the riser HIPS which are given in § 10.1.3.

10.2.4 Risk mitigation measures The risk mitigation measures which could be taken into consideration for the pressure let-down HIPS are the same as for the riser HIPS which are given in § 10.1.4.

A Venturi pipe could be studied as an alternative to prevent the flow from exceeding the flare capacity.

10.2.5 Pressure let-down example An example of a pressure let-down HIPS is the HIPS design proposed for South Pars Phase 11 (not been constructed though), see Figure 4.







OFFSHOREINSTALLATIO Slugcatchers LNG

PLANTSEALINE

PSHH : 133 baraPC

SP 11 ONSHORE

To Flare

ESDVs Export

is CLOSED

ESDVsOffshore

ESDVs Incoming

Offshore - Onshore: 135 km

PSHHPV to Flare

Design Pressure: 139 barg Design Pressure: 75 barg

To Flare

BXV

SDV-1

PSV Full Flow (1 BSCFD)

PSHHSet @ 71 barg

PSHH

PSHH u/sSet @ 110 barg

ESDV-025

Fire Zone Battery Limit

ESDV-026

PIC

CLOSE

PSH u/sSet @ 90 barg

OFFSHOREINSTALLATIO Slugcatchers LNG

PLANTSEALINE

PSHH : 133 baraPC

SP 11 ONSHORE

To Flare

ESDVs Export

is CLOSED

ESDVsOffshore

ESDVs Incoming

Offshore - Onshore: 135 km

PSHHPV to Flare

Design Pressure: 139 barg Design Pressure: 75 barg

To Flare

BXV

SDV-1

PSV Full Flow (1 BSCFD)

PSHHSet @ 71 barg

PSHH

PSHH u/sSet @ 110 barg

ESDV-025

Fire Zone Battery Limit

ESDV-026

PIC

CLOSE

PSH u/sSet @ 90 barg

Figure 4: South Pars Phase 11 pressure let-down HIPS

The main principle of this HIPS (pipeline diameter is 30") is based on installing preventive barriers upstream of 3X33% PCVs in order to:

• isolate the low pressure rated unit (separators, gas heater) from the high pressure source when the upstream system (slugcatcher, sealine) is packed above 110 barg.

• close two inlet PCVs (by action on upstream SDV's on each branch) according to upstream pressure rise.

The installation cannot be overpressured by depacking at 110 barg through one PCV only.

No downstream reactive barrier is considered due to the extremely fast pressure surge dynamics which would lead to unrealistic valve closure time (circa 1s), due to the limited buffer volume (330 m3) upstream export ESDV to LNG Plant.

Since the study on South Pars Phase 11 did not come to a very detailed phase, the SIL obtained by the architecture shown in Figure 4 has not been calculated.

10.3 Subsea HIPS The subsea HIPS is generally an overpressure protection HIPS but with the difference that it is operating underwater and not on a platform, FPSO or onshore. The reason to use a pressure let-down subsea HIPS could be to allow production flow lines or pipelines to have a lower design pressure than the MIP (Maximum Incidental Pressure, as defined in DNV-OS-F101). A subsea HIPS is a lot more difficult to design, build and maintain than a normal pressure let-down HIPS.

There are two general cases where a subsea HIPS could be applied:

1. To protect a flow line downstream production wells, when the flow line has a lower pressure rating than the WHSIP. This HIPS will normally only be used when having a subsea production system without satellite well platforms.







2. To protect a pipeline downstream a pressure let down station from a higher pressure rated tie-back.

The subsea HIPS is a very recent development in the oil and gas industry, thus requiring a lot of effort during the design phase (especially during basic engineering), when applied.

Since the subsea HIPS gives a lot of operating (maintenance) constraints, it is very important to define a clear Operating Philosophy in an early stage of the HIPS design, including logistics, and the impact on the overall availability of the installations.

10.3.1 Typical subsea HIPS scenarios Typical scenarios to be considered when designing a subsea HIPS are the following:

Case Blocked outlet downstream of derating

Scenario Blocked outlet downstream (blocked outlet due to pig stuck, valve closed, hydrate formation, paraffin formation etc.)

Pressure increasing due to failing PCS and PSS.

Case Opening of a PCV (or choke) or (E)SDV with pipeline upstream packed

Scenario Pressure upstream of derating higher than pressure rating downstream

Blocked outlet downstream of derating

Opening of a SDV upstream of the Specification break

10.3.2 HIPS location & architecture The location of a subsea HIPS gives its main architectural difficulty, since the reliability of a HIPS is of utmost importance, depending a lot on inspection and/or testing and more particularly on maintenance and repair, which for accessibility reasons is a lot more difficult to carry out on a subsea system than on a system above the waterline. When designing a subsea HIPS it shall be clear that a lot of attention must be paid to the reliability and maintainability of the system as well as its impact on production availability.

When hydrate inhibition system is foreseen, the system's design pressure should be set above the WHSIP to ensure that the hydrate inhibitor can be injected into the system. Hence the HIPS system (valves etc.) should be designed at the maximum hydrate inhibitor pressure which is a higher pressure than the WHSIP. This must be carefully considered when specifying and qualifying the system components.

One should also think about the possibility to test the system. Depending on the kind of tests to be carried out a methanol injection system which might already be considered against hydrate formation, could be used for testing.

10.3.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the pressure let-down HIPS which are given in § 10.2.3.







10.3.4 Risk mitigation measures The risk mitigation measures as given for the pressure let-down HIPS in § 10.2.4 could be considered but one should take into account the impact these could have on the maintainability and thus the reliability of the system.

10.3.5 Subsea HIPS examples At the time of writing, the only subsea HIPS designed is the JURA (UK) subsea HIPS.

This HIPS is represented in Figure 5:

ESV80440HV1 8", 600 barg,

2.9km

ESV-80420

R

690 barg 600 barg

520 barg

FCR

PT80450 PT8

0441

PT8044

2

PT8044

3

PT8044

4

PT8044

5

PT8044

6

MeOH

Injection point upstream chokes

Injection point at xmas tree

ESV80437

2"2"

Interlock to prevent HV1 or HV2 opening as long as XV2 is open

ROV80440

1oo2

2oo3

R

SV1A SV2A

SV1B SV2B

R

R

HV80432 ZT

ZT1

ZT2

ESV80439

SCMMB

1oo2 1oo2

SLS

SCM

1 2 3 4 5 6

1 2 3 4 5 6

Redundant fiber & communication

TT8044

5

TT8044

4 LLL

LLL

FV80448FC

From PCS

From PCSFrom

PCS

XV80406XV3

R

FONO

Pig launcher

R

XV80410XV1

NOFO

TT80442

HHHLLL

TT80443

HHHLLL

NOFC

PT80451

ESV80441HV2

NOFC

PT80452

XV80411XV2

NOFO

ZT80440

NOFO

NOFO

NOFOR R R

ZT ZT ZT

R R R

R

R FCNC

ESV80434

R

FCNC

FCNC

FCNO

R

R

ESV80433

FCNC

ESV80432

FCNC

ESV80436

FCNC

RFCNC

RR

ESV80431R

ESV80435

FCNC

FCNO

FV80451

PT80449

JURA HIPPS

Figure 5: Jura subsea HIPS







The sources of overpressure are the subsea production wells (WHSIP of 600 barg). The HIPS is installed in a subsea well head template located 2 km upstream of the lower rated section to be protected.

The working principle of this HIPS is not very complicated and consists of the following:

1. The two HIPS valves HV1/2 close when pressure at HIPS sensors reaches 250 barg.

2. An interlock preventing the two HIPS valves HV1/2 to open when the ESDV XV2 is open (restart must be done through ESDV XV2 bypass).

One should also note that methanol injection facilities are provided throughout the HIPPS to allow inhibition of the production fluids following a HIPPS trip and also to provide the facility to equalise across the HIPS valves prior to depressurisation. This may be required depending on the shut in pressure of individual section of the HIPPS. The methanol is also required for HIPPS transmitter flushing and testing (calibration cannot be done automatically though).

For information the Jura HIPS is only foreseen to be operational for a few years, until the WHSIP has decreased below the design pressure of the pipeline.

Depending on the chosen test frequency of the HIPS elements, this HIPS architecture can either be SIL2 or SIL3.

10.4 Gas Blow-by HIPS A gas blow-by HIPS could be applied when a separator has a risk of gas blow-by and the relief system (PSV's) on a second vessel downstream of the liquid exit of the first separator cannot handle the gas flow. Normally the second vessel should be protected against gas blow-by by mechanical means (PSV's), but in case this is not practical, a HIPS could be considered, but is not recommended due to the questionable reliability of level detection instrumentation.

The HIPS will close a valve upstream of vessel 2 in order to protect it against overpressure when the PSV's downstream cannot relieve the gas flow.

*: SDV, used also by HIPS function (this depends on SIL requirement)**: Triplicated (if necessary for the reliability)

Separator 1

LC

SDV*

Gas

HP flare

Oil Separator 2

LCV

LP Flare

HIPS

SDV

LSLL

LSLL**HIPS

Figure 6: Gas blow-by HIPS schematic







10.4.1 Typical gas blow-by HIPS scenarios The typical gas blow-by scenario is based on a failure of the first safety barrier which should close (E)SDV's downstream of the first separator after a LSLL signal.

Case Failure of the level control and first safety barrier (LSHH or (E)SDV) which should prevent from blow-by

Scenario Pressure in first separator at PSV opening pressure

Maximum incoming flow rate (slug) which can be expected

LCV to be modelled as being completely open

10.4.2 HIPS location & architecture The principle of this HIPS aims at preventing a blow-by by avoiding the level in the first separator to come below LSLL.

Since a reactive HIPS based on closing a valve upstream of the second vessel when reaching PSHH in vessel 2 is almost impossible to implement due to the fast dynamics with a blow-by, the only possible prevention is a preventive HIPS based on LSLL closing a valve upstream of vessel 2.

One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level.

Since the HIPS sensors upstream of the part of the installation to be protected against a possible overpressure, this HIPS can be qualified as a preventive HIPS (see § 6.1.4).

10.4.3 Dynamic simulations Since the pressure during a gas blow-by can increase very quickly, the most important aim of the dynamic simulations is to determine whether the reaction time of the designed HIPS would be sufficient.

10.4.4 Risk mitigation measures One could try to optimize the LCV in between the first separator and the second vessel in such a way that its Cv would not allow a gas blow-by to exceed the relief capacity of the PSV's of the second vessel (or at least slow down the blow down dynamics).

A solution avoiding the need of a gas blow-by HIPS is given in § 10.4.5.

10.4.5 Gas blow-by HIPS examples Examples of projects where HIPS against overpressure due to blow-by are used are Girassol and ROSA.

An example of a solution avoiding the need of a gas blow-by HIPS is the Ofon 2 project. By increasing the design pressure of the LP separator from 6 to 10 barg, the PSV's of the LP separator can be set at 10 barg thus allowing them to relief to the HP instead of the LP flare. The HP flare is designed for the gas blow-by relief flow whereas the LP flare was not. When







applying such a design, one shall ensure that there is no possibility to over pressurize the LP separator through an interconnection between the HP flare and the LP separator (for example through a manually operated depressurization by-pass).

This solution is only possible if the pressure of the HP flare KO drum during emergency relief is compatible with the maximum back-pressure, thus allowing the functioning of the PSV('s) (set at a low pressure) on the LP separator, and requires:

• Pilot type PSV's on the LP separator.

• A dedicated flare line from the second vessel up to the flare (incl. a dedicated inlet nozzle)

• An assessment of the probability of a simultaneous occurrence of gas blow-by and emergency depressurization.

When applying this solution, one shall take care not to move the overpressure problem from an upstream part of the installation to a downstream part.

See Figure 7 for the OFON 2 schematic.

TO WATER TREATMENT

WELLHEADS PRODUCTION TO MP/HP

COMPRESSORS

~ 13.5 barg Note (1)PSHH

28PV/AB202004

TO HP FLARE

28PSV202014-15-16-17

15BLOCKED OUTLET

28VS2020

LC

28ESDV20250828SDV202505

Pop = 6 barg

Pdes = 17 barg

~ 8 barg

1° LSLL

2° LSLL

(2oo3 VOTING)

TO LP COMPRESSOR

TO OIL EXPORT

Pop = 0.7– 1.4 barg

Pdes = 10 barg28VS2040


28PV/AB204004

TO HP FLARE10 28PSV204014-15-16

PSVs SIZED FOR GAS BLOW-BY – PILOT TYPE

~ 2.0 barg

28LV/AB202002

TO WATER TREATMENT

TO LP FLARE

Note (1): PSHH set point driven by downstream compressors SOP (settle-out pressure)

TO WATER TREATMENT

WELLHEADS PRODUCTION TO MP/HP

COMPRESSORS


28PV/AB202004

TO HP FLARE

28PSV202014-15-16-17

15BLOCKED OUTLET

28VS2020

LC

28ESDV20250828SDV202505

Pop = 6 barg

Pdes = 17 barg

~ 8 barg

1° LSLL

2° LSLL

(2oo3 VOTING)

TO LP COMPRESSOR

TO OIL EXPORT

Pop = 0.7– 1.4 barg

Pdes = 10 barg28VS2040


28PV/AB204004

TO HP FLARE10 28PSV204014-15-16

PSVs SIZED FOR GAS BLOW-BY – PILOT TYPE

~ 2.0 barg

28LV/AB202002

TO WATER TREATMENT

TO LP FLARE

Note (1): PSHH set point driven by downstream compressors SOP (settle-out pressure) Figure 7: Solution to avoid gas blow-by HIPS

10.5 Liquid Carry-over HIPS A liquid carry-over HIPS should be applied when the relief system is only sized for the gas relief flow during a blocked-outlet and not for the complete blocked-outlet case (gas + liquids). This can be the case with older installations where different design practices were applied during the design as the ones which are currently used.







In this case a liquid carry-over HIPS should be implemented to prevent from multiphase flow relief.

*: SDV, used also by the HIPS function (depending on the SIL requirement)*: Triplicated (if necessary for the reliability)

Separator

LC

Gas

HP flare

Oil

LCVSDV

HIPSvalve

LSHH**HIPS

LSHHSDV*

Figure 8: Liquid carry-over HIPS example

10.5.1 Typical liquid carry-over HIPS scenarios The typical liquid carry-over scenario is based on a failure of the first safety barrier which should close (E)SDV's upstream of the separator after a LSHH signal.

Case Relief system (PSV’s) not sized for full flow (liquids + gas) at blocked outlet

Scenario Blocked outlet downstream of separator

Maximum incoming liquid flow rate which can be expected

Gas relief through PSV’s while liquid level increasing

Liquid + gas relief through PSV’s

10.5.2 HIPS location & architecture The working principle of this HIPS is aimed at preventing a liquid carry-over by avoiding the liquid level in the separator to come above LSHH.

When the level in the separator comes above a certain level the HIPS valves at the inlet close in order to avoid more liquids and gas coming into the separator, which could cause a liquid carry over and a subsequent exceeding of the relief capacity of the relief system (hence overpressure in the vessel).

One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level.







Since the HIPS reacts on a certain scenario which has already started off (the pressure has already risen) and protects by isolating the separator from the inlet in order to protect it against a possible overpressure, this HIPS can be qualified as a reactive HIPS (see § 6.1.4).

10.5.3 Dynamic simulations It is important to study the dynamics of the system during a blocked-outlet in order to determine the safe liquid level to be taken as normal LSHH and HIPS LSHH.

10.5.4 Risk mitigation measures The implementation of the liquid carry-over HIPS shall be avoided, especially in grass root installations.

10.6 Flare Knock-out Drum Overflow / Overload One of the liquid carry-over HIPS (see § 10.5) which can be applied is the flare knock-out drum overflow HIPS. According to GS EP SAF 260 the sizing criteria shall be based on API RP 521, and concerning the sizing of the liquid side it shall be based on the sum of the liquid volume of 90 seconds of full flow production AND 15 minutes of production of the well (or the trunk line in the case of a riser platform receiving remote wellhead effluent) producing the largest flow rate.

Installations shall be developed to respect (at least) the above interpretation of API RP 521, but in the case of an upgrade it can happen that respecting this, would require major modifications and in this case (only) a HIPS could be considered.

According to GS EP SAF 262 a flare knock out drum shall be fitted with a LSHH initiating a shutdown without depressurisation (SD-2) of all units attached to the disposal system. But in case the above defined flare knock out drum volumes cannot be achieved, the installation of a HIPS could reduce the overflow risk.

10.6.1 Typical flare knock-out drum overflow HIPS scenarios The base scenarios for the sizing of the flare knock out drum, and thus a HIPS (when applied), are the following:

Direct cause Blocked outlet on PSV protected part of installation

Scenario Full flow (gas and liquids) from all sources through flare knock out drum (i.e. failure of all protection upstream of the PSV protected part of the installation)

Upstream pressure at PSV opening pressure

10.6.2 HIPS location & architecture The knock-out drum HIPS is normally based on a system as described in GS EP SAF 262 but with a higher reliability level (SIL). In general this mean the HIPS consists of a level switch (LSHH) working in 2oo3 voting mode (depending on required SIL), having a dedicated logic solver, and closing HIPS valves upstream of all equipment protected by the relief system equipped with the concerned flare knock-out drum. Depending on the dynamics of the system, the LSHH can either be placed on the knock-out drum or on the upstream separators. This last configuration will be used in particular when the PSV's installed on the protection vessel are not sized for the liquid flow rate.







It shall be noted that, especially when using (E)SDV's also used by the first protection barrier as HIPS valves, one should study common failure mode, because the fact that the HIPS would trip will often be caused due to a failure causing non-closure of these same valves.

A knock-out drum HIPS shall normally not be applied. This means that it should only be applied in exceptional cases, for example in the case of upgrading existing installations.

10.6.3 Dynamic simulations The dynamic simulations shall be based on scenarios given in § 10.6.1 as well as any other possible scenarios. One should well take into account the backpressure of the disposal system.

10.6.4 Risk mitigation measures The risk of overflowing the flare knock out drum can be mitigated by allowing a good monitoring and quick intervention by the operators from the control room (in case of manned facilities).

10.6.5 Example A knock-out drum HIPS has been studied (but not applied) for Buffalo (block 3, Angola).

10.7 HIPS Against Overpressure by Compressor A HIPS against overpressure by compressor can be used to protect an installation against the possibility of compressors running out of control and over pressurizing the part of the installation downstream. Normally each compression train is protected against an overpressurization by compressors running out of control with blocked outlet by having PSV's and a flare system designed to relief the maximum flow of all trains. In some cases, for example when having several compression trains in parallel, the simultaneous relief flow when several compression trains run out of control while having blocked outlet is not possible/practical and a HIPS could be considered.

10.7.1 Typical compressor HIPS scenario

Case Compressor overspeed with blocked outlet downstream

Scenario Blocked outlet downstream compressor train(s)

Compressor running on maximum speed

Compressor’s control logic and safety system not functioning

Inlet pressure of the compressor above normal pressure, increasing the outlet pressure (this could be part of the scenario)

10.7.2 HIPS location & architecture The compressor train shall have to be equipped in any case with PSV's and a relief system which can handle the full relief flow of one compression train. The flare shall mechanically and hydraulically be designed to handle the full relief flow of all compression trains together while the radiation criteria might be exceeded.

A compressor HIPS will in general consist of a pressure sensor (normally in 2oo3 voting mode in order to have a higher availability/reliability) with a dedicated logic solver shutting off the







compressor in case of an overpressure downstream of the compressor. A reliable way to shut down the compressor can be to shut off the fuel supply by closing two HIPS valves on the fuel gas line.

10.7.3 Dynamic simulations The dynamic simulations shall take into account the compressor dynamics (e.g. time to stop when fuel supply is cut off) to be expected when shutting off the fuel gas supply.

When dimensioning the protection system one shall well take into account the compression curve of the compressor and take into consideration that the highest pressure occurs at zero flow and thus not at maximum flow.

10.7.4 Risk mitigation measures It shall be clear that a fully pressure rated piping downstream the compressor is the best solution and avoids the need of a pressure protection system (PSV and/or HIPS).

10.7.5 Example At the time of writing, a compressor overpressure / overflow protection qualified as HIPS has never been applied at Total. A possible compressor HIPS is currently being studied (not yet approved) for the Shtokman project and a schematic of this HIPS is given in Figure 9. There will be three compression trains. The PSV's and the flare system are sized for full blocked outlet of one compression train, but from a radiation point of view the flare cannot accommodate the relief for more than one train at the same time (mechanically and hydraulically it can). Therefore, a HIPS has to be implemented.

The key characteristics of the HIPS design per compression train are the following:

1. The normal operating pressure at compressor discharge will be 153.6 barg. If the operating pressure rises to 169.3 barg, PSS PAHH will trip the compressor and initiate closure of discharge cooler SDV, By-Pass SDV and the compressor inlet SDV's.

2. If PSS PAHH fails to detect the compressor discharge high pressure, the HIPS PAHH pressure trip will be initiated when the pressure reaches 171.3 barg. This trip will close dedicated HIPS valves located on the gas turbine fuel gas supply line. Moreover, the compressor HIPS will trigger the riser top HIPS to protect the topsides in case of depacking.

3. If the HIPS PAHH fails to detect the compressor discharge high pressure, the full flow PSV will relieve to the HP flare system at 198.3 barg (i.e. 10% above set pressure of 180.3 barg). The usage of pilot operated with modulating action type relief valves already permits to reduce the accumulation pressure percentage from 16% to 10%.

Since the HIPS reacts on a certain scenario already being initiated, this HIPS can be qualified as a reactive HIPS (see § 6.1.4).







Figure 9: Shtokman compressor HIPS

10.8 HIPS Stopping ESP’s A HIPS stopping the ESP('s) can be applied when the source of possible over pressurization is an Electric Submersible Pump installed to activate well production.

10.8.1 Typical HIPS stopping ESP’s scenarios The typical HIPS stopping ESP's scenario is based on a failure of the first safety barrier which should close (E)SDV's and SCSSV's as well as stopping the ESP's upon PSHH detection.

Case Blocked outlet somewhere in the system.

Scenario Pressure increasing due to blocked outlet.

First safety barrier failing to close ESDV’s SCSSV’s and stopping ESP’s upstream of a pressure specification break.

10.8.2 HIPS location & architecture The working principle of this HIPS is based on shutting down the ESP's upon PSHH detection. The ESP stopping function should not be the only safety function of this HIPS. Typically, this HIPS shall protect against over pressurization by stopping the ESP's by using circuit breakers while (if necessary according to the reliability calculations) at the same time closing HIPS valve.







10.8.3 Dynamic simulations Dynamics simulations simulating the closure of the HIPS valves protecting the downstream part shall be carried out. In case the protection is not sufficient (because they do not close in time) dynamic simulation showing the ESP's stopping shall be carried out.

10.8.4 Risk mitigation measures The flowline and production/test manifold shall be fully pressure rated at maximum ESP discharge pressure (unless protected by PSV).

The pressure derating should be placed as far away as possible from the well. So in case of a well platform with ESP wells the derating should be downstream of the outboard ESDV of the pipeline departure of the platform.

10.8.5 HIPS stopping ESP’s example An ESP stopping function as part of a HIPS has been applied at Al Khalij in Qatar. The architecture of the HIPS is shown in Figure 10. The architecture has been applied at several platforms of the Al Khalij field. This ESP HIPS has not (yet) been approved by the HIPS Committee, and several improvements (such as having a completely segregated dedicated HIPS hydraulic control panel) should be considered.

The protection is based on the following actions taken by the HIPS system upon its activation which is caused by a high pressure detection (on a 2oo3 voting basis):

1. The ESDV on the outlet pipeline from the upstream platforms is closed.

2. The ESP's for each well of the platform are stopped by means of a stop signal to the pump (via the hydraulic control pannel).

3. The SCSSV's of each well are closed via the hydraulic control pannel.

4. The circuit breakers are opened to ensure stopping the ESP's.

Action 2 and 3 can not be considered as real HIPS actions since they are through the hydraulic control pannel which is not an HIPS element.

SD3

PSD/PSS

Hydraulic Control Pannel

ESDV

Incomerbreaker

HIPS2oo3

SD2

1oo2

1oo2

PSD/PSS

ESD/ESS

SSV

SCSSV

ESP'sbreakers

Figure 10: AL Khalij HIPS stopping ESP’s







Appendix 1 HIPS Flow Chart

Considerinstallation of

a HIPS

DGEP HIPS CommitteeConcerned DGEP entityCompany rules

Industry standardsGuidewords

Industrystandards can be

implemented

no

Properequipment design

or protection systemare feasible

yes

no

yes

Record decision in theStatement of Requirement

(SOR) and in theProject Safety Concept

Review and comment uponthe Preliminary HIPS Dossier

Decide on applicability

Review :- Compliance with ISO 10418and API RP 14 C- Material code- Overall hazard assessment

Establish aPreliminary HIPS Dossier andsubmit it to HIPS committee

Implement Industry standards Apply :- proper equipment design and- protection system design

New project orMajor modifications

Update the HIPS dossier,Comply with Company Rules

App

licab

ility

of H

IPS

HIP

S d

esig

n an

d ap

prov

alH

IPS

inop

erat

ion

Submit request for derogationfrom Company Rules

Advise on request forderogation from C.R.

Review reliability and detaileddesign

Quantitative Risk Assessmentis used to support request for

derogation

Field Operation Entity to- update the HIPS dossier- maintain and test the system- record and review HIPS failures

TDO / SEField Operation entity

Approval by TDO / SE

Agree on HIPS installation

Identifypre-existing

HIPS

Submit the as-built dossier toHIPS committee

Preliminary acceptance anddesign recommandation

FieldOperations

entity toreviewexisting

facilities fordeviation from

Industrystandards

HIPS approved

HIPS installation

Identify deviationsfrom industry standardsNotify HIPS committee

HIP

Sca

tego

risat

ion

Categorise HIPS :"soft" or "hard"

Approve HIPS

Preliminary acceptance

Document an as-built dossier







Appendix 2 Pressure Settings Diagram

Dalia Riser HIPS

PIPING DESIGN PRESSURE 220 barg

SHUT-IN MAX PRESSURE 200 barg

GAS LIFT MAX PRESSURE 150 barg

PSHH HIPS (120 barg)PSHH SSS (113 barg)PSHH PSS (105 barg)

97 barg

Header Test Pressure (76.5 barg (*))

Header PSV Accumulation (116%) Pressure (34.8 barg)

30 barg Header PSV Set Pressure (30 barg)

OPERATING / START-UPPRESSURE (14-97 barg)

25 barg Separator Test Pressure (25 barg)

20 barg Separator Accumulation (116%) Pressure (19.7 barg)PSHH HIPS (18.5 barg)PSHH PSS downstream choke (17 barg)Separator PSV Set Pressure (17 barg)PSHH Header (16.5 barg)PSHH Separator (15.5 barg (**))

Normal operating pressure 14 barg

(*) 76.5 = 1.5 x 51 (Piping class C513 pressure limit) (**) 15.5 = 17 - 10%

10 barg Normal Operating Pressure (9 - 11 barg)

DOWNSTREAM CHOKE VALVEUPSTREAM CHOKE VALVE







Appendix 3 Pressure Settings Diagram

AKPO Gas Line Tie-in on AMP2

Date post:	26-Oct-2015
Category:	Documents
Upload:	ganeshan
View:	181 times
Download:	1 times