High integrity pressure protection systems (HIPPS) are regarded as a ‘must have’ for many offshore gas installations, and it isn’t hard to see why. Crucially, a HIPP serves as the last line of defence in the event of an over-pressurisation incident, automatically shutting off and isolating the source of the high pressure before the design pressure of the system can be exceeded. What such systems do is prevent an uncontrolled loss of containment – in effect, creating a barrier between a high-pressure and low-pressure section of pipe, ensuring people, plant and equipment downstream are protected.
Unlike an emergency shut down (ESD) system, which provides a safe and orderly cessation of a process, HIPPS is very much an emergency response to a pressure build-up by rapidly closing the pipeline. Without such systems in place, a catastrophic outcome to plant, equipment and personnel might well be the result.
While overpressure events have been resolved historically using mechanical pressure release systems, the downside is that these solutions generally need a sizeable footprint to function effectively, and may not be suitable where space is limited, or if the fluid is flammable or toxic, as is the case in offshore applications. Enter the fray, therefore, safety instrumented systems, and most particularly HIPPS, which have become increasingly a solution of choice in managing the risks of ever more demanding environments – and none more so than offshore gas installations.
CATASTROPHE IN WAITING
“As high temperature/high pressure (HT/HP) applications become more commonplace, the consequences of a significant increase in upstream pressure can be catastrophic, not only to people and equipment, but also to the environment,” says Tony Brayford (pictured, above right), director for oil and gas at Schneider Electric UK & Ireland.
Trigger points, he identifies, for HIPPS being called into action are where: an application involves high pressures or flow rates; the environmental risks are great; the economics of the process need to be improved; and the risk level is too high.
“There are also commercial incentives,” adds Brayford. “One context where a HIPPS could deliver value to an offshore asset would be when an existing mature well, which operates at a certain pressure, is having another new well brought online. The new well may exceed the pressures that the existing infrastructure can handle. The introduction of a HIPPS system would enable the facility to exploit new wells safely, without needing to upgrade existing infrastructure.”
There are several stages involved in a HIPPS operation. Critically, block valves are used, because they have high-reliability and low operating torque requirements. “Three pressure sensors are installed to detect upstream pressure,” he says. “To prevent any spurious trips, they use a ‘two out of three’ voting logic. This means that, if all three sensors don’t agree, the two that align are taken as correct and the system responds accordingly.” (See also nuclear seismic sensor article, Operations Engineer April 2019, or visit www.is.gd/apodev).
On top of that there is the logic solver. “This reacts to the conditions presented by the pressure sensors and determines whether the block valves should close,” he explains. “In an overpressure situation, at least two of the three pressure sensors report pressure equal to, or greater than, the high pressure set point.”
What are the downsides of not having HIPPS installed, in his view? “The high pressures associated with deep water drilling can cause oil wells to burst. A HIPPS can isolate the well that loses control, resolving the crisis before it becomes a catastrophe.”
With so much at stake, it is essential that the right levels of professional instruction on the safe operation of the system are delivered, once the provider has completed the handover. Brayford adds: “Functional safety expertise in the design of the system, and both SIF and SIL requirements from international SIS standards such as ANSI/ISA 84 and IEC 61511, are equally crucial.”
CLEAR DISADVANTAGES
Where traditional systems might be seen as having a disadvantage (when set alongside HIPPS) is that over-pressure is dealt with through relief valves, leading to venting systems. “These systems have obvious disadvantages, such as release of (flammable and toxic) process fluids in the environment, and often a large footprint of the installation,” says Niels Huttenhuis, account manager at Safety Solutions (Yokogawa Europe Solutions BV). “With the increasing environmental awareness, relief systems are no longer an acceptable solution.”
How do HIPPS actually function when determining an emergency shutdown needs to be implemented? Essentially, they are constructed as a complete functional loop, consisting of the initiators that detect the unacceptable levels of high pressure that are occurring. “These initiators are typically electronic pressure transmitters and they measure the actual pressure in the pipeline,” he points out. “Meanwhile, a safety logic solver processes the input from the initiators to determine the need to close the final elements – these elements physically performing the corrective actions in the field by, for example, closing the valves and bringing the process to a safe state. The final element consists of a valve, plus actuator and solenoids.”
HIPPS can be used for a variety of reasons, he continues: “To avoid human injuries, due to chemical release, fire and explosion; to avoid financial loss, such as damage to the asset, unnecessary insurance costs, reduction of pressure relief capacity, piping classes (weight, cost); or to avoid damage to the environment, by spilling or CO2 emission.”
An example, he cites, of where HIPPS could have prevented a major incident was the Deepwater Horizon event in 2010. On 20 April, the Macondo well – located about 50 miles from New Orleans – blew out, costing the lives of 11 men and spilling more than four million barrels of crude oil into the Gulf of Mexico. The root causes, identified by the President’s Oil Spill Commission, were associated with zonal isolation during cementing and the failure to create a competent barrier to uncontrolled flow. Other risk factors were associated with well monitoring equipment on the Deepwater Horizon, including data displays. The environmental damage is enormous and irreversible, Huttenhuis points out.
According to a US Department of Energy ‘Offshore Safety and Spill Prevention’ review (www.is.gd/zerejo), in the wake of the Deepwater Horizon catastrophe, increased interest in HIPPs is an important trend. “This system can be helpful in pressure protection of existing low-pressure pipelines, when new high-pressure pipelines are connected to the systems,” it states.
Huttenhuis also emphasises the imperative for the highest levels of training and instruction to ensure that safety is the priority when operating in such environments. “The applicable safety standard IEC-61511 demands that everybody working in one part of the safety lifecycle (design, installation, operation, maintenance and decommissioning) shall be proven competent, but also working under a functional safety management system. Competency basically consists of knowledge and experience. This can be cultivated by hands-on training and kept relevant by frequent practice. The functional safety management system is part of the HSE system, and consists of a strict set of work instructions and operating procedures necessary to reduce human and systematic failures.”
Graphic: Yokogawa Electric Corporation/Phil Holmes