Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 1/58

Purpose
This guide is intended to provide guidelines for Process engineers in charge of defining High Integrity Protection Systems (HIPS) during conceptual phases / preproject and/or supervising the process aspects of HIPS design performed by Contractors during project phases.

Application
These guidelines apply to all facilities or projects operated by Total or where Total is a shareholder, either offshore or onshore installations. They also apply to major modifications of existing installations, as well as to the design of HIPS retrofitted onto existing facilities as measures implemented in order to upgrade the level of protection.

Revisions

00 Rev.

09/2009 Date

First issue Notes

Approbation
Prepared by: Checked by: Authorised by:

Name: G. SITEUR Date: 09/09

Name Date:

D. LARREY de TORREBREN 09/09

Name: Ph. GERLACH Date: 09/09

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 2/58

Contents

Purpose .......................................................................................................................... 1 Application ..................................................................................................................... 1 1. Glossary...................................................................................................................6 2. Objectives ................................................................................................................9 3. Overview of the Referential ..................................................................................10 4. Process Engineer Responsibilities......................................................................11
4.1 4.2 Context ............................................................................................................................11 Different stages of design and HIPS life ..........................................................................11

5. Design Principles ..................................................................................................17
5.1 5.2 Justification and basic design for HIPS ...........................................................................17 Description of a safety system.........................................................................................21

6. HIPS design ...........................................................................................................23
6.1 6.2 6.3 6.4 6.5 The location of a HIPS.....................................................................................................23 HIPS setting.....................................................................................................................25 HIPS response time.........................................................................................................26 Preventive or reactive HIPS.............................................................................................27 HIPS adaptability throughout design life..........................................................................28

7. Process Dynamics ................................................................................................29
7.1 7.2 Dynamic simulations........................................................................................................29 Arrangement of installations & incident scenarios ...........................................................30

8. HIPS Dossier..........................................................................................................33
8.1 8.2 8.3 8.4 Objective of the HIPS dossier..........................................................................................33 Submission of the HIPS dossier ......................................................................................33 Content of the HIPS dossier ............................................................................................34 Specific requirements for process documentation...........................................................35

9. Operational Constraints .......................................................................................36
This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 3/58

10. Applications of HIPS .............................................................................................37
10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 Riser HIPS .......................................................................................................................37 Gas Plant Inlet Pressure Let-down HIPS.........................................................................43 Subsea HIPS ...................................................................................................................44 Gas Blow-by HIPS ...........................................................................................................47 Liquid Carry-over HIPS....................................................................................................49 Flare Knock-out Drum Overflow / Overload.....................................................................51 HIPS Against Overpressure by Compressor ...................................................................52 HIPS Stopping ESP’s ......................................................................................................54

Appendix 1 Appendix 2 Appendix 3

HIPS Flow Chart ...................................................................................56 Pressure Settings Diagram..................................................................57 Pressure Settings Diagram..................................................................58

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 4/58

Reference documents
Unless otherwise stipulated, the applicable version of the reference documents listed below, including relevant appendices and supplements, is the latest revision published.

Standards
Reference Not Applicable Title

Professional Documents
Reference API RP 14 C (ISO 10418) API RP 520 API RP 521 (ISO 23251) Title Recommended Practice for Analysis, Design, and Testing of Basic Surface Safety Systems for Offshore Production Platforms Sizing, Selection and Installation of Pressure Relieving Devices in Refineries Pressure-Relieving and Depressuring Systems

Regulations
Reference Not Applicable Title

Codes
Reference DNV-OS-F101 IEC 61508 IEC 61511 Title Rules for submarine pipeline systems Functional safety of electrical/electronic/programmable electronicsafety related systems Functional safety : safety instrumented systems for the process industry sector

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 5/58

Other documents
Reference Not Applicable Title

Other Total documents
Reference CR EP HSE 041 CR EP HSE 042 GM EP SAF 010 GS EP ECP 103 GS EP ECP 105 GS EP SAF 260 GS EP SAF 261 GS EP SAF 262 Title Technological Risk Management Instructions for the selection, definition and operation of high integrity protection systems Safety acronyms & definitions Process sizing criteria Process documents to be prepared during engineering phase Design of High Integrity Protection System (HIPS) Emergency Shut-Down and Emergency De-Pressurisation (ESD & EDP) Pressure protection relief and hydrocarbon disposal systems

Local Regulations might be more restricting than Standards and Company referential (or propose alternative methods) and must be adhered to.

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Maximum Operating Conditions Maximum Allowable Incidental Condition (MAIC).doc . Safety Integrity. Mitigation Definitions given in CR EP HSE 042 HIPS. reproduced or disclosed to others without written authorisation from the Company. Risk Assessment. a cross-reference to this document is made instead of copying/pasting the definition. Over-pressurisation. PTR This document is the property of Total. Process Shut Down (PSD) Incident. It must not be stored. SPOT. Safety Integrity Level (SIL). Reliability Emergency Shut Down (ESD). Risk Reduction Measure. HAZID. Risk analysis. Risk Matrix. OPERSAFE. ALARP HAZOP. Incident Severity level Definitions given in CR EP HSE 041 Central critical event (also named Undesirable Event in API RP 14C). This document is the official English version. HIPS committee Safety Instrumented System. Definitions given in GS EP SAF 260 HIPS dossier Design condition Normal Operating Conditions. Probability Risk.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 6/58 1. Barrier. Scenario. Frequency. Glossary When the definition of a term is provided in any of the reference documents. Maximum Allowable Working Condition Safety Function. HIPS categorisation. GM_EP_ECP_260_00_EN. Prevention. Hazard.

GM_EP_ECP_260_00_EN. the PFH (Probability of hazardous Failures per Hour) shall be calculated : SIL level 1 2 3 4 PFH 10-6 . In simple terms.10-6 / hour 10-8 .doc . or to specify a target level of risk reduction.10-7 / hour 10-9 .00001 RRF 10-100 100-1000 1000-10000 10000-100000 For Safety Instrumented Functions operating in High Demand (Continuous) mode (i. It must not be stored.01 0. SIL is a measurement of performance required for a Safety Instrumented Function (SIF). This document is the official English version. reproduced or disclosed to others without written authorisation from the Company. Demand Frequency >> Test Frequency). PFDavg (Average Probability of Failure on Demand) and RRF (Risk Reduction Factor) for different SIL Levels as defined in IEC61508 and IEC61511 are as follows: SIL level 1 2 3 4 PFDavg 0.01-0. For Safety Instrumented Functions operating in Low Demand mode (i.0001 0.e. Demand Frequency << Test Frequency).e.0001-0.1-0.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 7/58 Other definitions Protection (or Safety) Barrier Part of a Safety System.10-8 / hour This document is the property of Total.001-0.001 0. See also CR EP HSE 041 Safety System A Safety System is made of several Protection Barriers A Safety System performs a Safety Function See also API RP 14C SIL (Safety Integrity Level) Safety Integrity Level (SIL) is defined as a relative level of risk-reduction provided by a safety function.10-5 / hour 10-7 .

reproduced or disclosed to others without written authorisation from the Company.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 8/58 Abbreviations ESD ESDV ESP FPSO HIPS HIPPS HP KO drum LAH LAL LCV LSLL OPPS OCWR PAH P&ID PCS PCV PFD PID controller PSD PSS PSHH PSV PV ROV RHSIP SCSSV SDV SIS WHSIP Emergency ShutDown Emergency ShutDown Valve Electrical Submersible Pump Floating Production Storage and Offloading High Integrity Protection System High Integrity Pressure Protection System High Pressure Knock Out Drum Level Alarm High Level Alarm Low Level Control Valve Level Switch Low Low OverPressure Protection System Overall Control of Wells and Risers Pressure Alarm High Process & Instrumentation Diagram Process Control System Pressure Control Valve Process Flow Diagram Proportional Integral Differential controller Process ShutDown Process Safety System Pressure Switch High High Pressure Safety Valve Pressure Valve Remotely Operated Valve Riser Head Shut-In Pressure Surface Controlled Subsurface Safety Valve ShutDown Valve Safety Instrumented System Well Head Shut-In Pressure This document is the property of Total. It must not be stored. GM_EP_ECP_260_00_EN.doc . This document is the official English version.

GM_EP_ECP_260_00_EN. • Chemical hazards (H2S etc. This document is the official English version. As per CR EP HSE 042 a HIPS is an instrument-based systems of sufficient integrity (involving high reliability redundant and/or diversified instruments) so as to make the probability of exceeding the design parameters lower than a target value. Most HIPS are designed to protect against overpressure. It must not be stored. • Exceeding the design temperature (either high or low). A HIPS is never a standard system. GAP ANALYSIS) This document is the property of Total. Process and Safety engineers in Affiliates and Project Teams have the responsibility to state where the implementation of a HIPS: needs to be considered to achieve a given safety integrity To ensure that all design configurations involving Safety Instrumented System (SIS) of high Safety Integrity Level (SIL). The choice of HIPS as an ultimate protection barrier is not an option given preference by COMPANY. HAZOP) >>> Following analysis of existing installations (OPERSAFE. are identified as High Integrity Protection Systems (HIPS) according to DGEP rule CR EP HSE 042 To ensure the choice of HIPS as a protection barrier is duly justified against industry standards / conventional solution To ensure that a consistent approach is applied to the process definition of High Integrity Protection Systems - >>> Following preliminary evaluation >>> Following project review (PTR. but HIPS can also be applied to prevent from other hazards. Objectives This guide is intended to be used by Process engineers during conceptual design / preproject for the preparation of the Preliminary HIPS Dossier and during the Project phases for the supervision of the design work performed by the Contractor.doc . SPOT.). • Exceeding the radiation criteria. such as: • Exceeding the design flow.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 9/58 2. reproduced or disclosed to others without written authorisation from the Company. as an alternative to industry standards for the protection of production installations.

HIPS Characterisation and Categorisation: HARD vs. SOFT 3. reproduced or disclosed to others without written authorisation from the Company. HIPS Applicability 2. HIPS Design principle This document is the property of Total. HIPS Dossier 5.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 10/58 3. Overview of the Referential The main contents of the two documents constituting COMPANY referential dedicated to HIPS are the following: • Company Rule CR EP HSE 042: 1. HIPS Committee • General Specification GS EP SAF 260: 4. GM_EP_ECP_260_00_EN.doc . This document is the official English version. It must not be stored.

In doubt regarding responsibilities.g.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 11/58 4. § 4. the Project or the affiliate in charge) • DGEP HIPS Committee • The Field Operations entity This document is the property of Total.2). Process engineers must have a clear view of the overall methodology for the management of HIPS. Process Engineer Responsibilities This chapter sets out the responsibilities of the process engineer throughout the HIPS design process. Reliability and Instrumentation engineers. Process engineers are advised to liaise and coordinate with other DGEP entities.2 gives the tasks which shall be undertaken by the process engineer. 4. During the conceptual study phase the process engineers will have to initiate studies on the choice of a HIPS and propose its initial design. Consequently. 4. this guide not only deals with Process related information but also gathers information from reference documents governed by other Entities.1 Context The management of HIPS involves several DGEP Entities: • Safety Engineering • Instrumentation • Reliability/Operations • Process This guide is dedicated to Process engineers and does not aim to be a design guideline for Safety. cross-references to reference documents are made instead of copying/pasting information. GM_EP_ECP_260_00_EN.1 gives the entities involved and § 4. This document is the official English version. It must not be stored. the remit of Process engineers at each stage of the HIPS design are defined (see § 4.2 Different stages of design and HIPS life The HIPS Flow Chart (Appendix 1) summarizes the main steps of the justification & design of a HIPS: • Applicability of HIPS • HIPS Categorization • HIPS Design and Approval • HIPS in Operation with regard to the main participants in the process: • The concerned DGEP entities (e. reproduced or disclosed to others without written authorisation from the Company. To avoid disagreements between different fields of expertise. When possible.doc . This guide is designed to allow Process engineers understanding the context and starting the study in a proper manner. Therefore.

This document is the official English version. Basic Engineering 14. System design 7. Conceptual Studies (the activities given are specifically applicable to a design where the HIPS is critical to the feasibility of the project. piping.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 12/58 The specific roles of the different metiers within concerned DGEP entities and DGEP HIPS Committee groups are not detailed out in this GM. Documentation • Activities per stage of design 11. The activities marked with a * will have to be carried out by the discipline engineers listed hereunder (but they should be followed up by the process engineer): *(1) Safety and/or reliability engineer *(2) Field operations engineer *(3) Rotating equipment. reproduced or disclosed to others without written authorisation from the Company. the implementation of a HIPS is considered (and then followed up). Definition of hazards and scenarios (refer to CR EP HSE 041 which gives rules for the risk assessment method) 9.doc . vessel or pipeline engineer/specialist etc. Detailed Engineering When. Consequences assessment (refer to CR EP HSE 041 which gives rules for the risk assessment method) 10. During the Operations phase (not listed in the table) the Process Engineer shall be in charge of preparing and updating any modifications of the HIPS in the HIPS dossier. This document is the property of Total. from the preliminary evaluation. These modifications need to be approved by the HIPS Committee. in other cases it could be considered to carry out the activity in a later stage) 12. HIPS design 8. It must not be stored. The GM provides the following information to the attention of Process engineers: 6. Details on all technical issues are then provided further in this guide. GM_EP_ECP_260_00_EN. Pre-projects 13. the responsibilities of the Process engineer at each step of the design are summarized in Table 1.

Basic Engineering • Elaborate the complete pressure settings diagram.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 13/58 SYSTEM DESIGN Conceptual Study Location and level of derating • Verify if full conditionrated mechanical design is feasible. If yes. Protection barriers set points • Evaluate the set points of the protection barriers of the installation. This document is the official English version. HIPS Justification This document is the property of Total. assess their acceptability. define the level and location of derating. Detailed Engineering • Optimize (if required) the set points of protection barriers. • Check set points with latest design modifications (if any). reproduced or disclosed to others without written authorisation from the Company. It must not be stored. GM_EP_ECP_260_00_EN. • Predefine the set points of protection barriers based on preliminary process dynamics. • Verify if the HIPS solution is acceptable (exclusions are mentioned in CR EP HSE 042) and feasible. • Verify if a conventional protection system is feasible. If not. If not. • Define the set points of protection barriers.doc . See Appendix 2 and Appendix 3. Pre-Project • Verify the level and location of de-rating for each design condition. justify the reason why. • Check if there is any interaction between the responses of protection barriers.

• Determine required response time for the HIPS (preliminary process dynamics). • Calculate the process dynamics in order to determine the set points and response times of the HIPS. *(1) • Calculate SIL achievement in order to confirm SIL assessment. HAZARDS AND SCENARIOS Conceptual Study Risk assessment • Identify main hazards and critical events. (e. • Verify the absence / acceptability of secondary effects. Pre-Project • Continue the HIPS design taking into account the preliminary process dynamics. • Consider the influence of existing protection barriers (if any). Basic Engineering • Continue the HIPS design.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 14/58 HIPS DESIGN Conceptual Study Design of the HIPS • Define the location of the HIPS (valve. SIL assessment / achievement • Carry out the preliminary SIL requirement evaluation. • Reconfirm SIL achievement. *(1) • Finalize SIL assessment. sensors) and its basic architecture. *(2) Detailed Engineering • Define an extensive list of sensitivity cases based on worst case scenarios. reproduced or disclosed to others without written authorisation from the Company. This document is the property of Total. HIPS setting • Evaluate the set points of the HIPS. Detailed Engineering • Finish the design of the HIPS.g. GM_EP_ECP_260_00_EN. Pre-Project • Assess the credibility/likelin ess of the scenarios. Basic Engineering • (Re-) assess the likeliness / credibility of the scenarios. water hammer) • Optimize the set points of the HIPS (if required). • Preliminary calculations on identified scenarios. *(2) • Evaluate the impact of possible future developments. • Identify the configurations and scenarios for which a HIPS is required. The HIPS should be designed on P&ID level. This document is the official English version. It must not be stored. • Consider all operating cases. *(1) • Reconfirm SIL assessment.doc . • Identify possible risk reduction measures.

• Update the HIPS dossier for handover to Field Operations (in compliance with Company Rules). Specific constraints associated to installations and protection barriers installed prior to HIPS referential should be integrated in the HIPS justification and design choices. It must not be stored. This document is the official English version.doc . If needed (hard HIPS). This document is the property of Total. • Establish a HIPS document containing the elements mentioned under the other items to be carried out during the Conceptual phase Pre-Project • Establish a preliminary HIPS dossier and submit it to HIPS committee. • Compare the extreme conditions to allowable limits. in compliance with General Specifications and Company Rules and submit to HIPS committee. Table 1: Process engineer responsibilities at different stages of the design When an existing SIS protection is identified as a HIPS (during audits for example). Detailed Engineering • Elaborate the technical documentation related to process. Consequences HIPS categorization • Evaluate the category of the HIPS by carrying out a risk analysis. • Confirm the category of the HIPS. reproduced or disclosed to others without written authorisation from the Company.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 15/58 CONSEQUENCES ASSESSMENT Conceptual Study • Evaluate the extreme conditions reached by the system in case of HIPS failure. • Ensure that the HIPS is addressed in the Safety Concept and in the Operating Philosophy. Pre-Project • Identify the weak points of the installations in case design conditions are exceeded. GM_EP_ECP_260_00_EN. request derogation. • Identify clearly the HIPS in Process drawings • Ensure that the HIPS is listed in the SOR and addressed in the Safety Concept and in the Operating Philosophy. the same approach should be followed as for new installations. *(3) Basic Engineering • Calculate the extreme conditions reached by the system. DOCUMENTATION Conceptual Study Documentation to be prepared • Describe at a conceptual level the HIPS function (in the process report). Basic Engineering • Update the HIPS dossier. Detailed Engineering • Assess the correspondence between the level of extreme conditions and consequence severities as a function of the integrity of the installations.

Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 16/58 During the operational phase of a HIPS the tasks of the process engineer working for the asset are the following: 1. Participation to management of downgraded situations impacting the HIPS function.doc . reproduced or disclosed to others without written authorisation from the Company. 3. Participation to management of modifications impacting the HIPS function (this shall go through the HIPS Committee). This document is the official English version. It must not be stored. Making sure the HIPS dossier is updated (by the Operators in charge). This document is the property of Total. GM_EP_ECP_260_00_EN. 2.

GM_EP_ECP_260_00_EN. 5.1. However. For HIPS critical to the feasibility of the project the process engineer may evaluate whether it is necessary to develop the following documents in conceptual studies phase to base its conclusion on: • PFD's which show the ESDV's. An ultimate protection relying solely on Safety Instrumented Systems (SIS) is qualified as HIPS. This is the case with Subsea Production System applications (and associated flowlines and risers) [within the framework of API 17O task group.1 HIPS qualification All deviations from industry standards describing conventional protection systems (essentially API RP 14C. the installation of HIPS must be as far as possible restricted. but no RP (Recommended Practice) issued yet] • When industry standards do not address a specific hazard 3. 5. now ISO 10418) are treated as HIPS.1. This list is not exhaustive. This document is the official English version. It must not be stored. They would involve an unproven technology or a technology beyond the present stateof-the-art This document is the property of Total. the specification breaks and the PSV's (when in Conceptual Study phase). but should be developed to better understand the need for HIPS. reproduced or disclosed to others without written authorisation from the Company.2 Justification for a HIPS As further explained in § 5.3. • Simplified P&ID's • P&ID's • Up-to-date P&ID's (when being already in the Operations phase) • The flare study • The pipe specifications N.doc . the installation of a HIPS can be justified in the following cases: • When no industry standard recommendations exist for a given application 2.B.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 17/58 5. irrespective of its required Safety Integrity Level (SIL). These specific PFD's are not normally part of the Conceptual Study. Design Principles This chapter sets out the basics for the design of a HIPS. During conceptual studies the process engineer shall use the above definition to verify if any of the protection systems shall be qualified as a HIPS.1 Justification and basic design for HIPS This paragraph describes when a safety system shall be qualified as a HIPS as well as the basis for its design. Chemical hazard not addressed by ISO 10418 and API RP 14C • When current industry standards CANNOT be implemented 4.1. 5.

doc . flares. The field of applicability of the HIPS solution is described in CR EP HSE 042.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 18/58 • When installation of a conventional safety system would imply impractical design constraints 5.3 System design approaches The standard design options for the protection of an installation are given in CR EP HSE 042 and summarized below. GM_EP_ECP_260_00_EN. Lay-out constraints (size of relief headers and associated downstream systems: vents. design calculations relating to the conventional solution must be provided. The following design approaches can be selected for an installation: • OPTION 1: “Safety-by-design” Design of the whole installation to the worst possible (pressure. Where "Disproportionate" implies the definition of a ratio of costs The impracticality of a conventional solution must be demonstrated i. For the case of overpressure protection systems (OPPS). composition etc. flow. They shall be applied to any incident that leads to uncontrolled release of hydrocarbons or damage to the facilities.) which may occur • OPTION 2: “Specification Break + Safety System” Upstream design only to the worst possible conditions which may occur The following design options can be selected for the safety system to protect the downstreampart: • OPTION 2-A: “Conventional” Safety system designed in accordance with Industry standards • OPTION 2-B: “Non conventional” Safety system not designed in accordance with Industry Standards – amongwhich HIPS conditions This document is the property of Total.e. It must not be stored.temperature. etc…) • When installation of a conventional safety system would imply disproportionate costs 7. Environmental considerations (avoid relief to atmosphere through relief valve) 6.1. This document is the official English version. see GS EP SAF 262 5. reproduced or disclosed to others without written authorisation from the Company.

When the safety system can be and is designed as per Industry standards recommendations (API RP 14C). several suboptions can be selected and correspond to different levels of de-rating. If not. reproduced or disclosed to others without written authorisation from the Company. Application to Over-Pressure Protection System: According to GS EP SAF 262. The standard practice for the design of a safety system is reminded in CR EP HSE 042: the design of a safety system shall be made of at least two independent barriers of different nature. Within Design Option 2.4 Level of de-rating In case of an incident scenario for option 2. belonging to the HIPS category. Design Option 2-A must be selected (conventional safety system). the downstream part of the system can be subject to an incident condition exceeding its design condition. full pressure-rated mechanical design) 2. GM_EP_ECP_260_00_EN. it is referred to as non conventional and is a HIPS (option 2-B).g. in accordance with standard recommendations of API RP 14C. These sub-options are differentiated by the relative positions between the incident condition and downstream facilities characteristics: design condition / maximum allowable incidental condition / test condition / yield/ leak condition / burst / rupture condition. This document is the official English version. three main approaches are possible for pressure protection systems (in order of preference): • Full pressure-rated mechanical design • Relief systems (PSV + flare) • Over-Pressure Protection Systems (OPPS). Design Option 1 (e. It must not be stored. requiring the consideration of a safety system. it is referred to as conventional (option 2-A). These two basic design options and associated sub-options are represented in Figure 1: This document is the property of Total. 3. For option 2a specification break is introduced in the system. Note: For example.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 19/58 The following order of preference shall be applied: 1. Design Option 2-B (HIPS) can be selected only if the two other options are not practicable. 5.doc . General Specification GS EP ECP 103 provides the definition of the Maximum Allowable Incidental Pressure (MAIP) and Incidental Pressure (IP) for Offshore pipeline systems constructed under DNV-OS-F101 code.1.

This document is the official English version.the incident condition is under the design condition of the downstream facilities (or maximum allowable incident condition according to applicable codes).the incident condition is over the burst/rupture condition of the downstream facilities. GM_EP_ECP_260_00_EN. Specific requirements from construction codes may apply in case of incident.the incident condition is over the design condition of the downstream facilities but below its test condition (according to applicable codes).doc . There is a high risk of burst/rupture of a pipeline/equipment in case of incident. According to CR EP HSE 042 the HIPS is categorized (as guidance) as HARD when the maximum pressure reached during an incident scenario (without the HIPS intervening) can exceed the test pressure. This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 20/58 UPSTREAM OPTION 1 Safety-by-Design No damage DOWNSTREAM OPTION 2 Spec Break and Safety System Yield likely Burst Critical Yield/leak Unlikely Soft HIPS Burst / Rupture Hard HIPS Test condition Design condition Burst / Rupture Test condition Design condition Test condition Burst / Rupture Burst / Rupture Incident Condition Normal Operating Condition Design condition Test condition Design condition Normal Operating Condition Figure 1: possible design options for the system Option 1: "No damage" . The serviceability of the downstream facilities is at risk in case of incident. Option 2-1: "Yield / leak Unlikely" . It must not be stored. For pipelines already in service the actual mechanical conditions shall be established by instrumental inspections in order to re-assess the yield / leak and burst / rupture conditions.the incident condition is over the test condition of the downstream facilities but below its burst/rupture condition. The chosen option has a strong influence on the severity of consequences in case of an incident scenario and is therefore of primary importance regarding the specifications (HIPS category and the SIL requirement) of a HIPS. reproduced or disclosed to others without written authorisation from the Company. This corresponds with the pink and purple diagrams in Figure 1. Option 2-3: "Burst Critical" . Option 2-2: "Yield likely" .

5. the expected HIPS category and the SIL requirement for the HIPS. Note: The typical ratio between pipeline/equipment burst/rupture condition and design condition is strongly dependent on the type of line (process pipeline. the lower the pressure loss. Values associated respectively to upstream and downstream parts of specification break (usually choke valve location) should be clearly distinguished. It must not be stored. flexible pipes) or equipment and can be important. 5. operating and protection barriers setting values (for a given condition) should be represented on a diagram. Whenever applicable.2. umbilical. The choice of the design pressure of downstream facilities also involves other parameters (on which the Process engineer can play) such as pipeline diameter: the larger the diameter. and the lower the design pressure required (especially for long pipeline networks). This document is the official English version. and its design characteristics needed in order to design a HIPS.2 Description of a safety system This paragraph discusses the basics of a safety system.doc .Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 21/58 The responsibility of the Process engineer is to strike a balance between the level of derating of pipeline/equipment design or test pressure. the following values should be indicated: Operating parameters o Well shut-in max condition o Operating conditions Normal operating condition Maximum operating condition Start-up condition range Design choices o Design conditions Maximum allowable operating condition (pipelines) Maximum allowable working condition (process equipment) Maximum allowable incidental condition Test condition Yield / Leak condition [if known] Burst / Damage condition [if known] o Sensors set points Condition high Condition low o Pressure relieving systems set points Relief condition Accumulation condition This document is the property of Total. GM_EP_ECP_260_00_EN.1 Installation characteristics table In order to visualize the installation characteristics of a design. piping. Examples of such diagrams are provided in Appendix 2 and Appendix 3. reproduced or disclosed to others without written authorisation from the Company.

Each protection layer achieves a given safety function (in normal or degraded mode).2 Response of a safety system The normal response of the safety system is presented in this section. Therefore. • the initiator causing the protection barrier to trip (for example: high pressure detection). This diagram shall have a dedicated shut down bar on the shutdown logic diagram and should clearly identify: • components specifically dedicated to the HIPS • components common to the HIPS and the other barriers • components not used by the HIPS This document is the property of Total. This document is the official English version. The response time of a safety system includes all protection layers.2.doc . taking no account of the potential failure of any of the safety system components. 5. A safety system is designed with several protection barriers which trip successively (different layers . reproduced or disclosed to others without written authorisation from the Company. The response of a safety system can be described by the response of its protection barriers. a shutdown logic diagram should be provided.or levels . GM_EP_ECP_260_00_EN.of protection). Such failure would however possibly be considered in one or more incident scenario(s) (refer to CR EP HSE 041). • the actuators affected during the trip and configuration of all actuators after the trip (for example: end of valve closure). In conjunction with the table representing the response of the safety system. It must not be stored. Additional rules or guidelines concerning the setting of safety system components are provided in § 6. The response of each protection layer is described by: • the event for which the protection barrier should trip (for example: a blocked outlet).2. but also set points of other barrier(s) of the safety system.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 22/58 The set points of a protection barrier must be chosen in relation to operating and design conditions. the action of the protection barriers must be presented clearly.

2 Local reinforcement of the installation Within an installation. reproduced or disclosed to others without written authorisation from the Company. the setting and the type (preventive or reactive) of a HIPS.1 HIPS position within the installation The choice of HIPS location must be driven by the following basic design rules. the preferred option from a process point of view is the one: • Allowing the longest reaction time before a critical event occurs. some pipelines (or equipment) are more critical than others. 6. This document is the official English version. • Requiring the simplest set of components and links between them and being easily accessible for testing and maintenance. The sections that are not reinforced would be damaged first: they are the "fuse" in case of incident. Should this pipeline be subject to an overpressure risk. the risk on people and assets would be reduced if the pipeline is locally reinforced.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 23/58 6.1 to 6.1. This document is the property of Total.doc . Consequently. the design of specific sections of the installation may be locally reinforced so that these critical pipelines (or equipment) are mechanically protected against critical events. • For which simplified dynamic calculations can be used to ensure the required risk reduction. 6.1 The location of a HIPS § 6. It must not be stored.1. HIPS design This chapter gives guidelines on the location. Example 1: Let's consider a pipeline arriving to a platform. Among all possible HIPS locations and configurations.1.1.4 discuss and set out the criteria to be considered for the main elements normally forming part of a HIPS. 6. GM_EP_ECP_260_00_EN. In that respect. it is safer for people and would have lower consequences on assets if the damaged section of the pipeline is far from the platform rather than being close to it. • Having the least probability for causing excessive trips.

The HIPS valves should be located as far as possible away from any potential cause of blocked outlet (in order to lengthen the allowable reaction time for the HIPS). reproduced or disclosed to others without written authorisation from the Company. It must not be stored. initiating events of incident scenarios must be considered. If the HIPS valves (and the specification break) are located close to a source of hazard. the consequences on assets if a riser line is damaged may be severe (possible “side effects” and escalation of consequences with the damage of other riser lines). Therefore. High design pressure network Low design pressure network Pipeline at risk in case of incident scenario Figure 2: place of overpressurization risk 6. the event “section bursting far away from the platform” has a lower severity for people than the previous event. we would consider that a subsea flowline is bursting instead of a riser line and/or flexible jumper.3 Location of HIPS valves The location of HIPS valves is of utmost importance when considering the adequacy of HIPS response with the dynamic behaviour of the effluent.doc . 6.1. This document is the official English version. For that case. GM_EP_ECP_260_00_EN. Platform By comparison. In the worst case.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 24/58 Platform The event “pipeline bursting close to the platform” may have a high severity due to the presence of people nearby.1. Moreover. the required response time will have to be very short and possibly too short to even allow designing the HIPS according to specifications. no automatic valve should be installed on the de-rated section just after a HIPS). the whole production can be jeopardized if the riser needs to be replaced. the consistency of HIPS valves location within the installation must be checked versus specific points such as the location of other valves (for example.4 Location of HIPS sensors Hazards associated to the fluid composition The following hazards in relation with the fluid composition must be assessed: • Hydrate This document is the property of Total. For that purpose.

In that case and if a conventional relief system is installed and designed for the maximum flow through the by-pass line or the fully open small choke. Such a HIPS may trip even if no hazard actually threatens downstream pipelines/equipments. This diagram is important because the HIPS set points are chosen respectively in relation to operating condition. It must not be stored. the sooner the HIPS reacts. etc. design condition and other instruments setting. GM_EP_ECP_260_00_EN. Any by-pass shall be clearly described as such in the HIPS dossier. Requirements on dynamic response and instrument settings are included in GS EP SAF 260.1. If dynamic effects are fast. If the sensors of the HIPS are located downstream the specification break. This risk can be mitigated by: • suitably locating the sensors tapping.1) allows identifying clearly the relations between the different conditions (operating. This document is the property of Total. This section does not address inhibitions. the lower the consequences of dynamic effects will be. The maximum Cv of the small choke valve must clearly be specified.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 25/58 • Paraffin / Wax • Scales / Deposit • Sand The risk is that the tapping of pressure sensors of the HIPS is blocked. The HIPS response time is always faster if sensors are located upstream the specification break. reproduced or disclosed to others without written authorisation from the Company.doc .). considering a possible damping of peak conditions (below design conditions) on the way from upstream measurement point to the downstream de-rated section of the installation. This document is the official English version. • methanol flushing. • selecting impulse lines with 2" minimum connection (as prescribed by GS EP SAF 260).2.5 By-pass of a HIPS No by-pass of a HIPS shall be allowed at any time (neither during normal operation nor during restart) unless: • By-pass line is protected with a HIPS valve as is the production line • No critical event may occur during operation through the by-pass line (small diameter plus conventional relief system designed for the maximum flow through the by-pass line) For example. design.2 HIPS setting The installation characteristics table (see § 5. • trace-heating impulse lines and installing the sensors in heated enclosures. then the by-pass line may not be equipped with a dedicated HIPS valve. 6. Locating sensors upstream the specification break implies that more unwanted activations of the HIPS could occur than when sensors are located downstream. 6. the reaction time of HIPS valve may be too slow to prevent dynamic effects threatening the derated sections of the installation. a by-pass line may have a smaller diameter or may be fitted with a smaller choke valve (lower Cv) than the production line. instruments setting.

It must not be stored. For that purpose. operating conditions First. reproduced or disclosed to others without written authorisation from the Company. if any. As a consequence. The setting of relative trip levels of all protection barriers including HIPS may be complex and vary between developments.2. design condition "The set point of the sensor(s) activating the HIPS barrier(s) shall be such that the full isolation of the source is achieved before the conditions exceed the maximum allowable incidental conditions of the equipment. the set point of the sensor(s) initiating each barrier shall be such that the activation of the other barriers is avoided during its operation. in start-up & shutdown conditions and in case of incident scenarios.1).2. but at the lowest possible value compatible with operating flexibility. hence the reliability of the whole protection is impacted. A possible drift in the sensor calibration should be considered (when critical).doc ." [GS EP SAF 260] If this cannot be achieved. other protection barriers setting The HIPS should trip after all other safety barriers but before pressure-relief barriers." [GS EP SAF 260] 6. This document is the official English version.3 HIPS response time Dynamic simulations allow evaluating and quantifying the process dynamics in normal and abnormal operating conditions. "The design shall minimise the demand rate of the HIPS.3).2 HIPS setting vs.2. compressibility of the fluid must be duly considered. the demand rate on the HIPS itself. Example: The margin between normal operating condition and the HIPS tripping condition may need to be greater for an oil system compared to a gas system as the oil system can pack up quicker as the fluid is incompressible. Note that increasing the margin tends to reduce the number of spurious trips. 6. GM_EP_ECP_260_00_EN.3 HIPS setting vs. 6.2. the HIPS set point(s) must be set above normal operating condition (plus margin) as well as above the primary safety barriers (PSS.2. due to the fast dynamic of the incident. the fluctuations of operating pressure due to vicinity of a choke valve. This document is the property of Total.2. For that purpose.1 HIPS setting vs. slug flow in a multiphase fluid. The dynamic response of the system is of primary importance regarding that last issue. Also the margin should be sufficient to allow setting the other protection barriers (see § 6. ESD system).4 Confirmation of set points The confirmation of HIPS set points is usually made using dynamic simulations (see § 2). Example: Trip settings for gas fields can be closer to each other than oil field trip settings due to the influence of the compressibility of the product 6. a sufficient margin must be taken between operating condition and HIPS set points (see § 6.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 26/58 6.

When the HIPS prevents a certain scenario to start off. This document is the official English version. closely associated with the HIPS position within the installation (see § 6. GM_EP_ECP_260_00_EN.g. A specific requirement on dynamic response of the HIPS is included in GS EP SAF 260: "HIPS overall response time.1. The closure time of the HIPS valve(s) is a major contributor to the overall response time: • Typical closure time of standard valves: between 1 and 2 seconds per inch • Better closure times can be achieved by using fast acting valves. shall be three times shorter than the calculated time for the upset condition to reach the maximum allowable incidental conditions of the equipments. the HIPS is referred to as a "reactive HIPS". It must not be stored. pressure surge or water hammer).g. when certain conditions (pressure level) are not satisfied. In case of overpressure this HIPS normally consists of pressure sensors closing isolation valve at a certain pressure level. the main output of the simulations is the time for the upset condition to reach the maximum allowable incidental conditions of the equipments. the dynamic analysis must confirm that a HIPS with the adequate reaction time is feasible. such as axial valves (e. If not.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 27/58 For the determination of required HIPS reaction time. due consideration must be given to possible "secondary" effects (e. from safety initiation to total completion of isolation. the architecture of the whole safety system should be further optimized in order to attain an acceptable required reaction time. both HIPS can be implemented to protect against the same hazard.1). When fast-acting barriers are required. In any case. When the HIPS reacts on a certain scenario which has already started off (often detected as an increase of pressure) and protects by isolating/stopping the source of hazard.4 Preventive or reactive HIPS Depending on the way the HIPS protects against an hazard. then the configuration (or even the implementation) of the HIPS must be reconsidered. which may have worse consequences than the primary critical event." [GS EP SAF 260] If the HIPS response time is found to be unachievable. This document is the property of Total. It is clear that in the case of a "reactive HIPS" dynamics (reaction time) of the HIPS play an important role. reproduced or disclosed to others without written authorisation from the Company. This type of HIPS is often combined with an interlock preventing the opening of the HIPS valve(s) when another isolation valve is open. 6. One should be aware that these are not piggable and that no partial stroking tests can be done. (preventing the initiating event to occur) the HIPS is referred to as a preventive HIPS. Depending on the required reliability of the HIPS.doc . the HIPS can be classified as a "preventive" or a "reactive" HIPS. Two main drivers must be considered for the choice of the type of HIPS: • The dynamics of the system and associated HIPS required response time • The production availability and excessive trips of the HIPS The main driver for the choice of the type of HIPS is the HIPS required response time (refer to the safety specifications defined in § 2). Normally this consists of sensors upstream of a specification break preventing an isolation (HIPS) valve to be opened. Mokveld).

refer to the case of the adaptation of the Cv of a choke valve to inlet flow rate (see § 7.5.g. 6. either the HIPS should be designed to the future conditions or an upgrade of the HIPS or the installations should be planned (if expected to be required). low injection) until the system design is back to: • A "Safe-by-design" configuration • Within the capacity of the conventional safety system (e. 6. GM_EP_ECP_260_00_EN. TDO/EXP/SRI entity should be consulted on that matter.1 Accounting for future developments When designing a HIPS. reservoir pressure) may decrease with time (natural depletion. the HIPS might not be required any more.2) shall be taken into account. a complete re-assessment of the risks must be carried out (the HIPS dossier must be updated).1) as well as changing reservoir conditions (see § 6. This document is the property of Total. mechanical adaptation is preferred respectively to software limitations and procedural adaptations. reproduced or disclosed to others without written authorisation from the Company. 6.5.5.g.5 HIPS adaptability throughout design life When designing a HIPS the adaptability to future developments (see § 6. If it is planned to connect a more stringent source than the actual ones. possible future well tie-ins / extensions or flow rate increases requiring higher design conditions must be taken into account.doc . To cope with the change of the conditions during field life.2. For example. It must not be stored. This document is the official English version. Before any modification is applied on the HIPS (or when the HIPS is decommissioned).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 28/58 Note: The choice of reactive or preventive HIPS has noticeable consequences on reliability calculations. This adaptation shall be indicated on the P&ID's. ESD + PSV) In such case. Dynamic studies must be updated before each new tie-in or flow rate increase and adequacy of HIPS sizing verified.5.1).2 Modification of the characteristics of the source of hazard In the case of a reservoir. the condition of the source of hazard (e.

Simulations shall be carried out on the basis of pre defined scenarios. This document is the property of Total.1 Purpose of dynamic simulations The purpose of the dynamic simulations during the different phases of a project is: • At pre-project stage using typical assumptions for critical equipment (if deemed necessary. Process Dynamics This chapter describes the components impacting the process dynamics and the subsequent simulations. the required HIPS response time) . Calculations must be performed not only during shut-down events but also during start-up or restart of the installations. 7. The calculation cases related to the HIPS are then only particular cases of these simulations. or otherwise during project basic engineering): 2. GM_EP_ECP_260_00_EN. initial pressure…). In case insufficient (or not reliable) well data is available the wells shut in time.1 Dynamic simulations Before the HIPS is designed.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 29/58 7. 7.2 Choice of the dynamic simulator If applicable. conservative data must be selected for input parameters and system conditions of each separate dynamic simulation (for example: liquid hold up. multiphase and process dynamic simulations should be coupled.both possibly being not consistent with each other). to set the different protection barriers • During basic and detailed engineering: 4.prior to HIPS installation 3. This document is the official English version. optimization (if required) of all other settings (SDV closure time.doc .) 7. Attention must be paid to the fact that the model and parameters for the HIPS related simulations are consistent with those of the initial simulations (the typical unwanted situation is when the HIPS design is fully contracted and when the contractor builds a new model instead of using the existing one . PSV settings. If not. steady state and dynamic simulations have generally already been performed for standard equipment design and flow assurance purposes.1. reproduced or disclosed to others without written authorisation from the Company.1. optimization (if required) of the set points of the HIPS barrier 6. to confirm the performance of the safety system including the HIPS 5. More details on scenarios can be found in 10. behaviour and riser pressure should be kept constant (well to be modelled as infinite source with constant molar flow rate). It must not be stored. These scenarios shall be established by the process engineer and field operations engineer based on credible configurations. In some (very simple) cases a spreadsheet calculation with conservative assumptions tuned against a steady state dynamic calculation can be fit for purpose. to define on a preliminary level the HIPS specifications (incl. etc.

This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 30/58 The time interval (step) taken in thermodynamic calculations shall be sufficiently small in order to not miss the peak (maximum) in the results of the simulation. 7. no consequences are expected.2. • Maximum liquid hold-up in pipeline. As long as the required relief flow rate remains within the pressure-relieving system capacity. and differences of up to a factor 3 have been found between results obtained with different software programs. 7. GM_EP_ECP_260_00_EN.3 for detailed considerations on dynamics). One should be aware that results obtained from simulation programs are not always reliable (water hammer for example is known as a phenomenon that is often not well calculated).doc . However. typically: • Maximum operating pressure (at PAH) • Maximum liquid level in separator (at LAH) for the blocked outlet or gas blow-by from the upstream section case. A HIPS is then implemented to avoid exceeding the relief flow of the flare in terms of radiation. as soon as the relief flow rate exceeds this capacity (while the pressure of the protected equipment being above the relief pressure). In that case. In some cases (especially when there is a large gas flow) the required relief capacity cannot be installed since it would require a very high flare to satisfy the radiation criteria (see GS EP SAF 262). It must not be stored. the Cv of the choke is critical because it determines the maximum relief rate. In this case one could investigate the possibility to satisfy the flow criteria of the flare for the maximum relief capacity needed without completely satisfying the radiation criteria. 7. Since the consequences of a failure on demand of the HIPS are not the same in these two cases. see GS EP SAF 262) of the flare and not against over pressurizing the installation. A 100 percent gas flow gives other dynamics results than mixed flow. It shall be clear that (as is with all HIPS) such a HIPS (as all HIPS) is not an option given preference by COMPANY and a Project aiming to implement such a HIPS shall justify with strong arguments its choice. If deemed necessary both cases shall be studied. reproduced or disclosed to others without written authorisation from the Company.2 Arrangement of installations & incident scenarios A pressure-relieving system is designed for a given flow rate. In this way the HIPS is to protect against exceeding the radiation criteria (or apply a less stringent category of the radiation criteria.2.3 Choice of the operating parameters The operating conditions used in the simulation shall be chosen with a conservative approach. This document is the official English version. depending on the outcome of the hazard assessment as per CR EP HSE 041. • Minimum liquid level in separator (at LAL) for the gas blow-by to the downstream section case. the HIPS could then be classified as a SOFT HIPS instead of a HARD HIPS.1.1 Influence of choke characteristics A common incident scenario involves the full opening of a choke valve when there is no pressure-relieving system or the pressure-relieving system is not sized for full flow. consequences are expected (see § 7.

failure of control valves. As the design of the system becomes more detailed. In such case. A throughput close to the maximum valve capacity is reached when the valve is only opened at a few percent. reproduced or disclosed to others without written authorisation from the Company. An ESDV/SDV interlocking logic can often be used in order to avoid problems due to opening dynamics.5). In addition. multiple wells relief. an opening time higher than usual may be specified for the ESDV/SDV. • Revise choke valve sizing and high pressure trip settings based on updated production profiles.3 Influence of pressure-relieving devices The combination of an instrumented barrier (typically PSS/ESD system) and a mechanical barrier (typically a PSV) constitutes the conventional design of a safety system (see § 5. (See also Figure 3 in § 10. if the opening time of an ESDV/SDV is too quick.2. 7. This document is the property of Total. the opening/closure time of the ESDV/SDV is critical.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 31/58 A good design practice is to specify a maximum Cv of the choke so that the maximum relief rate remains within the capacity of the pressure-relieving system (if any).1. if necessary) in parallel to cover the whole range of operating conditions. If during field life. This may be achieved by implementing 2 choke valves (of different size. In most cases this is difficult to achieve since the flow when opening is not linear with the time. the characteristics (in particular opening/closure time) of all other valves which are part of the safety system have to be set so that the dynamic response is optimized (see § 2). Note that the following measures are not approved by the HIPS Committee: 1.5). Indeed. The conventional sizing of a relief system shall be made in accordance with the failure cases addressed in GS EP SAF 262 and GS EP ECP 103 (fire.2. Installation of a mechanical stop on the choke valve or a restriction orifice (fixed choke). the maximum relief rate is modified (see § 6. The following measures can be taken to suppress the hazard: 1. GM_EP_ECP_260_00_EN. Adequate re-sizing of the choke valve with regard to the maximum capacity of the relief system. if the closure time of a SDV/ESDV (part of a protection layer) is too long. etc. This document is the official English version. other protection layers (including HIPS) may be activated improperly.3).doc .1. For example. Operational procedures limiting the risk of wrong setting of the choke valve opening 7. initial calculations must be updated: • Confirm choke valve sizing philosophy ("try to reduce choke valve Cv's"). It must not be stored.2 Influence of SDV characteristics In other scenarios involving the spurious closure/opening of an ESDV/SDV. 2.). One of the chokes being isolated in case of process upset conditions and the other one being sized such that it cannot overpressure the downstream part of the installation. Software limitation of the allowable opening of the choke valve 2. a reassessment of the installations design must be done so that the hazardous event "Overflow" is prevented. the HIPS may not have the time to react before the maximum allowable incidental conditions are reached.

It must not be stored.3): the set pressure should then be adjusted in order to ensure that the pressure peak in the separator remains below PSV accumulation pressure.doc . such as: • The fire case.g. Moreover. flaring rate too high). reproduced or disclosed to others without written authorisation from the Company. additional load on topsides may not be feasible. As a base case. As part of the above design optimisation. However. pending on dynamic simulation results.e. all interaction should be avoided (see § 6. then the installation of a HIPS in addition to the flare could be considered. If a pressure-relieving device can be installed but can not be sized for some realistic. GM_EP_ECP_260_00_EN. against which a solely instrumented protection is not sufficient.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 32/58 The design requirements from GS EP SAF 262 and GS EP ECP 103 regarding normal and peak flow rates to the flare shall also be followed. the HIPS reaction time should be minimised to limit the duration of the relief to the flare. against which HIPS protection are generally not accepted by the HIPS Committee (i. the action of pressure-relieving devices is beneficial in terms of process dynamics as they slow down the rate of pressure surge. some interactions could be accepted (e. As a HIPS shall be designed only for protection against a single incident. This document is the official English version. The possible interactions between different protection barriers must be carefully studied (e. an increase of downstream facilities design pressure should be considered to allow setting trip points in order to avoid interaction. the PSV may lift while the HIPS valves are not fully closed). PSV must be sized for full flow gas and liquids). the installation of conventional safety barriers (such as PSVs) might be required for others scenarios. As the design of the system becomes more detailed. If required.g. incident scenarios (due to design constraints or for example the connection of a new network to an existing flare). initial calculations must be updated: • Update Separator and Piping Volumes (line sizing and improved piping layout) • PSV sizing • PV sizing calculations (try to reduce PV size to reduce flaring rate) If eventually no solution is found acceptable (required HIPS reaction time too short. the increase of the equipment design pressure could eventually be considered if not leading to detrimental impact on downstream equipment gas blow-by protection or on overall EDP flow rate. other measures must be implemented. This document is the property of Total. • The liquid over case. Therefore the influence of pressure-relieving devices must be duly taken into account in calculations. The opening of spill off PV's (not a safety system) to the flare system can not be counted on when calculating the needed HIPS reaction time. opening of a PSV during the HIPS barrier activation).2. The allowable HIPS reaction time is consequently increased. HIPS and the PSV/PV are activated simultaneously.e. Even if not sufficient to protect against some critical events. In such a case i. yet remote.

4. Depending on the status of the project and the HIPS dossier. HARD or SOFT. including the HIPS. Confirm the HIPS category.1 Objective of the HIPS dossier The aim of the HIPS dossier is to: 1. All deviations from the HIPS design specification (GS EP SAF 260) are identified and derogations requested. 8. reproduced or disclosed to others without written authorisation from the Company. describe the HIPS system and the operating philosophy. Perform Detailed and quantified analysis of risks & SIL achievement (by Instrumentation Engineer) 10. Update preliminary risk assessment & SIL assessment (by Safety Engineer) 9. (in co-operation with Safety Engineer) This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 33/58 8. and issue the derogation request. HIPS justification and preliminary design 3. • Basic engineering: 5. It must not be stored.2 Submission of the HIPS dossier A tentative planning for the submission of the HIPS dossier must be followed: • Pre-project: 2. evaluation (by Safety Engineer) 4. GM_EP_ECP_260_00_EN. keep a record of the design features and choices. demonstrate the overall probability of incidents evaluated in taking into account all relevant protection layers. 7. Perform hazard identification and preliminary risk assessment (this should include a consequence analysis as well as a preliminary HIPS category. is acceptable. This document is the official English version. HIPS Dossier This chapter describes the HIPS dossier. and aims to complete (from a process engineering point of view). Update hazard identification and preliminary risk assessment (by Safety Engineer) 6. demonstrate that the HIPS alone meets the safety targets. • Detailed engineering: 8.doc . Perform SIL assessment (by Safety and/or reliability Engineer) The HIPS dossier shall be issued. Estimate SIL requirement (by Safety Engineer) The preliminary HIPS dossier shall be issued to the HIPS Committee. the HIPS Committee might decide that no further HIPS Committee meetings are needed. the information already given in GS EP SAF 260 and CR EP HSE 042. 3. 8. 2. The HIPS requirement shall be identified in the SOR. in case of a HARD HIPS (refer to CR EP HSE 042).

• The pressure settings diagram (See Appendix 2 and Appendix 3). • The process dynamics study.3 Content of the HIPS dossier The content of the HIPS dossier is prescribed in GS EP SAF 260 as well as CR EP HSE 042. GM_EP_ECP_260_00_EN. This document is the official English version. This document is the property of Total. the PFD (Probability of Failure on Demand) of the (regular) safety system components prior to HIPS installation. • HIPS detailed specification for the engineering and construction phases.PSS. (see § 6. including the demonstration of : 11. the PFD (corresponding to a SIL) of the whole safety system prior to HIPS installation. • Update of the consequence analysis. protection selected for management of the hazard. demonstrating that the reaction time of the HIPS is sufficient. ESD. HIPS demand rate evaluation (preliminary evaluation of the frequency of occurrence of the hazard scenario triggering the whole protection system . reproduced or disclosed to others without written authorisation from the Company.1 Preliminary dossier The preliminary HIPS dossier shall be submitted during the pre project phase and shall contain: • HIPS justification against industry standard. the preliminary set points of the protection barriers including the preliminary set points of the HIPS • HIPS Design and OPERATING PHILOSOPHY. 8.3. the PFD (corresponding to a SIL) of the whole safety installation after HIPS installation. and the Probability of Failure on Demand (PFD) required for the (regular) safety system and the applied HIPS components. and shall contain the following: 8. the PFD of the applied HIPS components. It must not be stored. • Safety Integrity Level (SIL) required of the whole protection system (corresponding to a required PFD and vice versa). 14. HIPS). dynamic studies if applicable. • The Hazard assessment: identification of sources of hazard (hazard scenarios). 13. • Update of the hazard assessment.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 34/58 The final HIPS dossier shall be issued to the HIPS Committee. • HIPS design principles. 12.2 HIPS dossier The HIPS dossier shall be submitted during the basic engineering phase and shall contain: • Update of HIPS justification against industry standard.3). 8.3. associated ESD logic. • Consequence analysis: evaluation of the consequences of the hazard.doc . • The locations of de-rating of the installation.

The HIPS shall have a dedicated shut down bar on the shutdown logic diagram. including: 15. 22. • Dedicated HIPS Maintenance. Testing and Repair policy with a frequency to be defined based on availability calculations. Calculation notes (as for example dynamic calculations when required to demonstrate that the response time target is reached). • The restart procedure after a trip of the HIPS. 17. All valves characteristics which are key elements of the protection by a HIPS are documented as such in the instrument data sheets: this includes the Cv's of chokes. Diagnostic coverage of failures.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 35/58 • Reliability and availability calculations (SIL achievement). This document is the official English version. at detailed design phase when the HIPS components • (sensors. Process and Safety Diagrams (as defined in GS EP ECP 105) must be provided. 21. Piping & Instrumentation Diagrams (P&IDs). vendor curves. reproduced or disclosed to others without written authorisation from the Company. 20. ESD Logic Diagram.4 Specific requirements for process documentation HIPS components must be clearly identified as parts of HIPS on P&ID's and Shutdown Logic Diagrams. Material selection (instrument data-sheet. 23. Detailed common cause/ mode failure analysis. logic solvers. closure times of the fast acting valves and the opening time of the chokes and SDV's. an exact graphical scheme of the HIPS. Cause & Effect Charts. 8. This document is the property of Total. final control elements) have been selected. (see § 6. GM_EP_ECP_260_00_EN. 19. when applicable. Effect of spurious failures on the availability of the production installation. The dynamic studies shall demonstrate that the reaction time of the HIPS is sufficient. It must not be stored. • Engineering documentation including : 18.doc . 16.3). …).

etc. start up. It must not be stored. temperature etc. This document is the official English version. • The design of the HIPS shall be such as to avoid a very high testing frequency of its components (more than once every six months) needed to maintain its required SIL. slug management. This document is the property of Total. carry out maintenance on HIPS. Operational Constraints The following operational constraints shall be checked when designing a HIPS: • A rigorous operations organisation must be put in place particularly defining qualifications/competences required to adjust HIPS related settings.doc . by design. the start-up shall not require a by-pass or inhibition of the HIPS. • The maintenance and test programme shall ensure the needed reaction time is guaranteed throughout the life of the HIPS. • The Operating Philosophy shall describe all operations necessary to operate the HIPS (including but not limited to the test and maintenance policy). the dynamic calculations • After a trip of the HIPS. • Dead oil circulation. GM_EP_ECP_260_00_EN.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 36/58 9. • Verification if a HIPS valve needs to be pigged (and in that case can be pigged). reproduced or disclosed to others without written authorisation from the Company. to be considered for the setting of sensors / valves.

adequately sized PSV's are provided on the test and 1st stage separator (as per API RP 14C) to ensure overpressure protection for the following scenarios: This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 37/58 10.a. 10. reproduced or disclosed to others without written authorisation from the Company. but it can not be sized in a practical way for all incident scenarios. Normally a flare system is in place. CLOV. Pazflor. It must not be stored.1. Egina. In case of incident.doc . the de-packing flow rate could exceed the flare network design capacity. It shall be clear that each HIPS design is unique for each case. making the installations unfeasible. The central critical event associated to this scenario is over-pressurisation of topsides equipment (both first stage and test separators) and piping (production and test headers.1 Riser HIPS The riser HIPS (an example with schematic overview is given in 10. In addition.k. Examples: • AKPO. depending on the location of the pressure break) due to the presence of a high pressure source at the top of riser and in case of uncontrolled opening of a choke valve or unwanted opening of a (E)SDV. Applications of HIPS This chapter provides the various applications of HIPS and some practical examples.5) is used to protect a derated part of an installation after a specification break at the arrival on FPSO / platform.1. Usan. L4G The riser HIPS (especially on FPSO's) is generally justified by the following: • A full pressure (at WHSIP) rating (a.1 Typical riser HIPS scenarios This paragraph lists the scenarios to be considered to design a riser HIPS upon. from all PSV's both on the headers (when applicable) and on the separator(s) plus the separator(s) PV relieving simultaneously in case of the incident scenario. GM_EP_ECP_260_00_EN. Dalia. • A conventional overpressure protection system relying on a primary protection provided by a PSHH which isolates all high pressure feeds and a secondary protection provided by a relief valve would be unpractical for the de-packing scenario. 10. Glenelg. Therefore the HIPS may have to ensure both over-pressure protection and flare system overloading protection and be designed accordingly. Additionally there is a risk of over-loading of the flare system. Moho-Bilondo. This scenario involves the packing of the upstream lines up to the Topsides (Maximum Riser Head Shut In Pressure) at high pressure (above downstream design pressure). The de-packing scenario requiring sometimes a relief capacity of up to 5 times the blocked outlet scenario (the second most restricting relief flow scenario). "safe by design") would be too costly and would have a significant weight impact on the installations. Rosa. De-packing case The de-packing case is the most common design case for a riser HIPS. but using feedback of already designed HIPS can improve and ease the preliminary process design. thus requiring a very large flaring capacity. This document is the official English version. Forvie.

Upstream pressure at PSHH trip pressure 3. It must not be stored. credible packed conditions (with some sub-sea choking at the wells) and gas-lifted operations. Restart of the fully packed riser after a shutdown 2. but less probable than the other scenarios to occur. reproduced or disclosed to others without written authorisation from the Company. a de-packing scenario associated to a blocked outlet on test or first stage separator would be the most onerous scenario in terms of process dynamics. Upstream pressure at PSHH trip pressure 3. Case Scenario Opening of the Riser ESDV of a packed riser 1. Packing of the Riser at RHSIP * 2. the flare must be sized for a blocked outlet on test or first stage separator with maximum operating flow. This document is the official English version. consistent with the production profiles should be carried out. In addition. Depacking with blocked outlet As a base case. Opening of a SDV upstream of the large choke Case Scenario Opening of a large choke valve or PCV 1. the causes and common mode of the spurious opening case on the various risers. Opening of one Riser ESDV *: or at gas lift circulation pressure. a review of the flowing pressure conditions during normal operation. This document is the property of Total. A fault-tree analysis of the operating scenarios should be developed in order to determine their probability of occurrence. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open 3.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 38/58 • Full blocked Outlet (liquids and gas) at facilities design flow rate. Restart of the fully packed riser after a shutdown 2. when applicable Case Scenario Opening of a SDV 1. However. GM_EP_ECP_260_00_EN. • Fire The first scenario discussed is the opening of riser ESDV at maximum packing pressure. simultaneously with a packed riser is to be evaluated in order to assess its credibility.doc . Failure open or spurious opening of one (or more) of the large choke valves The spurious opening of a number of chokes. This is the most restricting scenario.

reproduced or disclosed to others without written authorisation from the Company. Blocked outlet on test or first stage separator 4.1.doc . Spurious opening of SDV1 Lirio through both chokes (flowline packed at 43 barg) with 3 other flowlines producing in packed conditions (100 barg). This document is the property of Total. find the following table listing the scenarios studied for the riser HIPS of the CLOV FPSO. GM_EP_ECP_260_00_EN. Opening of a SDV upstream of the large choke For an example of a list of scenarios studied for a HIPS design.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 39/58 Case Scenario Opening of one Riser ESDV 1. Spurious opening of SDV1 Lirio through start up choke (flowline packed at 100 barg) with 3 other flowlines producing in packed conditions (100 barg). Packing of the Riser at RHSIP * 2. In this instance the downstream valves are OPEN. Blocked outlet on test or first stage separator 3. A solution can be to use one (E)SDV for two shutdown actions by using one dedicated solenoid for each action (see GS EP SAF 260). Depacking cases 1 2 3 Spurious opening of ESDV Lirio (flowline packed at 240 barg) with 3 other flowlines producing in packed conditions (100 barg).2 HIPS location & architecture The conceptual design of a HIPS must take into account piping layout issues in congested areas: one should not install too many valves in serie. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open 3. Opening of one Riser ESDV *: or at gas lift circulation pressure Case Scenario Opening of a SDV 1. Table 2: Scenarios studied for CLOV riser HIPS 10. Start up choke Lirio failure (flowline producing at 100 barg) with 3 other flowlines producing in packed conditions (100 barg). ¹These choke valve failure cases are assumed to occur during normal (multiphase) production and thus the chokes handle both liquids and gas in these scenarios. Upstream pressure at PSHH trip pressure 2. This document is the official English version. Choke failure cases¹ 1 2 Main choke Lirio failure (flowline producing at 43 barg) with 3 other flowlines producing in packed conditions (100 barg). The failure case considered is damage to the choke valve trim due to a large solid item passing through the choke. It must not be stored.

From a general point of view. the location of piping class rating break should be as close as possible to the separators. This will reduce the risk of confusion. Location of sensors: The installation of preventive HIPS barriers upstream of the riser chokes is recommended in order to limit maximum upstream pressure during packed operation. It must not be stored. during field life operation.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 40/58 The installation of a spool for the implementation of one or more dedicated HIPS valve(s) may be considered during the detailed design in order to attain the required SIL. it is recommended to install one dedicated logic solver for these preventive HIPS barriers per production loop. The HIPS architecture is selected with due consideration of the pressure rating breaks and of the normal and start-up pressure range (as defined by the flow assurance study and plotted on the pressure settings diagram. see Appendix 2). The following shall be taken into account for the dynamic simulator model: • Actual volumes calculated from line isometrics and vessel data sheets • Actual pressure profile from inlet ESDV's to Separators calculated from line isometrics This document is the property of Total.3 Dynamic simulations Dynamic simulations shall be performed to determine / confirm the required HIPS reaction time and set points. Production manifold fully rated after choke valve: The specification break should be after the SDV just upstream of the production/test separator. It is recommended to specify it at the vessel flange. Interlocks: To minimize the risk of over pressurization due to spurious opening of valves having a packed pipeline upstream. The interlock can also be implemented or reinforced by using mechanical interlocks. one could apply the following interlock: • An interlock preventing ESDV opening while downstream SDV's and choke valves are not closed Interlocks which are not part of the HIPS function can be programmed into the PCS or ESD system. or • one logic solver per production loop treating the preventive HIPS and one common logic solver for the reactive HIPS (in case of common set of PSHH on each manifold). GM_EP_ECP_260_00_EN. Both first stage and test separators (with control loops. 10.doc . The following could be implemented: • one logic solver per production loop treating the preventive HIPS and reactive HIPS barriers (in case of one PSHH set per branch).1. However in case the interlock is part of the HIPS function. This document is the official English version. if applicable) shall be considered. reproduced or disclosed to others without written authorisation from the Company. The location of piping class rating break downstream of the manifolds is recommended. Several production loops: Given the probable difference in preventive HIPS set points. it shall be incorporated in the dedicated HIPS logic solver.

Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 41/58 • Maximum liquid level in the separator / maximum operating pressure in the separator • Actual ON/OFF valve characteristic (Cv as function of % of opening) and actuator law on opening and closing (stroke versus time) • Actual size and characteristic (e. This document is the property of Total. • The use of a dedicated HIPS valve should be considered. reproduced or disclosed to others without written authorisation from the Company.doc . GM_EP_ECP_260_00_EN. 10.1. unless it is demonstrated that the implementation of dedicated HIPS valves does not yield a significant improvement of the SIL of the whole protection.1. The HIPS valves shall thus come in addition to the (outboard) riser ESDV. the HIPS function shall have dedicated solenoids actuating these valves (refer to GS EP SAF 260). • When HIPS valves are shared with the PCS and/or ESD system. representing the riser HIPS proposed for the CLOV FPSO. 10. It must not be stored. The following risk mitigation measures should be taken into account when designing a HIPS: • The (outboard) riser ESDV shall not be used as a shared HIPS valve (except for the reopening interlock). pilot type) of PSV's • Actual HP flare network volume and pressure profile calculated from line isometrics and HP flare tip characteristic • the choke valve's Cv and opening curve (vendor data).4 Risk mitigation measures The purpose of this paragraph is to identify additional mitigation measures that could be considered to prevent the cause of an accidental scenario from happening (reduction of the risk). This document is the official English version.5 Riser HIPS example An example of a riser HIPS is given in Figure 3.g.

and the pressure measured by PSHH10102A/B/C has not decreased below 100 barg. and SDV10102.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 42/58 Set @ 26. xx: 01 or 04 HIPPS INTERLOCK Figure 3: CLOV riser HIPS schematic . interlock logic is triggered to prevent re-opening of this ESDV if SDV10101A/B (B is the by-pass) are not closed. The small choke valve is designed to handle operating scenarios above 43 barg. The logic is hard wired. 4. valve limit switch and pressure sensors on air supply). If the operating pressure downstream of the choke valves rises to 28 barg. 3.5 barg Set @ 29barg Production Manifold PSS4 1500# 300# PSS4 PSS4 Set @ 25barg HP Flare PSHH 101xx PV PSS HIPPS1/2 1/2/3/4 HIPPS3 From Cravo / Lirio Right From O11 / OV Central Left From O11 / OV Central Right PSHH PSHH PSHH 10103A 10103B 10103C SDV10103 HP Compression SDV10102 Set @ 28 barg 2oo3 VOTING First Stage Separator HIPPS3 M M Pig Launcher / Receiver Set @ 43 barg PSS PSHH 101xx Set @ 27 barg To fulfil the SIL requirement this riser HIPS consists of a preventive protection system (HIPPS 1 and HIPPS 2). SDV10yxxA provided with a bypass line (C/W SDV10yxxB plus globe ) not shown for clarity purpose . and SDV10102 upstream of the large and small choke valves. for example during start-up. This document is the property of Total. 2. GM_EP_ECP_260_00_EN. HIPPS2 PSHH10102A/B/C will initiate closure of SDV10101A/B.doc HIPPS3 HIPPS2 HIPPS INTER LOC K Set @ 100 barg SDV10101A HIPPS1 (Note 1) HIPPS2 Set @ 40 barg Set @ 92 barg ESD PSS 2/3/4 ESD 2oo3 VOTING 2oo3 VOTING PSS1 PSS2 PSHH PSHH PSHH 10101A 10101B 10101C PSHH PSHH PSHH 10102A 10102B 10102C PSHH 101xx PSHH 101xx HP Flare (Flowline Depressurisation ) ESDV10101 Note: 1. reproduced or disclosed to others without written authorisation from the Company. HIPPS3 PSHH10103A/B/C will initiate the closure of SDV10101A/B. HIPPS1 PSHH10101A/B/C will initiate closure of SDV10102 upstream of the large choke valve. The working of the HIPS systems (which comes in addition to PCS and ESD protection) is as follows: 1. a reactive protection system (HIPPS 3) and a preventive interlock system. It must not be stored. If the operating pressure rises to 100 barg upstream of the choke valves. This interlock function includes three detection means (2oo3 between smart valve position transmitter. This document is the official English version. Upon any closure of ESDV10101 (via ESD. If the operating pressure rises to 43 barg upstream of the choke valves. manual or spurious action).

doc . It must not be stored. 10.2. 10. 10.4.1. 10.2 Gas Plant Inlet Pressure Let-down HIPS The pressure let-down HIPS is very similar to the riser HIPS (see § 10. GM_EP_ECP_260_00_EN.5 Pressure let-down example An example of a pressure let-down HIPS is the HIPS design proposed for South Pars Phase 11 (not been constructed though). reproduced or disclosed to others without written authorisation from the Company. but is not installed on a flow line arrival but on a pipeline.1. A pressure let-down protection is often installed at the inlet of a plant.2.1.2.2.2 HIPS location & architecture The location constraints and recommendations for a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10. This document is the property of Total.1. 10.3.1).1 Typical pressure let-down HIPS scenarios The scenarios to be considered when designing a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10. 10.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the riser HIPS which are given in § 10.4 Risk mitigation measures The risk mitigation measures which could be taken into consideration for the pressure let-down HIPS are the same as for the riser HIPS which are given in § 10.1.2. see Figure 4.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 43/58 The SIL this HIPS reaches against the most onerous scenario (depacking with flowline packed at 240 barg and choke valves completely opened) is a continuous SIL3. This document is the official English version. A Venturi pipe could be studied as an alternative to prevent the flow from exceeding the flare capacity. but could also be applied to protect a downstream pipeline with a lower pressure rating.2.

This document is the property of Total.O nshore: 135 km BXV CLO SE PV toFlare PSH H PC O FFSHO RE SEA LINE INSTA TIO ESDVs LLA Offshore ESDVs Incom ing Slugcatchers SDV-1 ESDV ESDV -025 -026 ESDVs Export is CLO SED LNG PLA NT DesignPressure: 139 barg Design Pressure: 75 barg Figure 4: South Pars Phase 11 pressure let-down HIPS The main principle of this HIPS (pipeline diameter is 30") is based on installing preventive barriers upstream of 3X33% PCVs in order to: • isolate the low pressure rated unit (separators. due to the limited buffer volume (330 m3) upstream export ESDV to LNG Plant. No downstream reactive barrier is considered due to the extremely fast pressure surge dynamics which would lead to unrealistic valve closure time (circa 1s). Since the study on South Pars Phase 11 did not come to a very detailed phase. It must not be stored. sealine) is packed above 110 barg. This document is the official English version. • close two inlet PCVs (by action on upstream SDV's on each branch) according to upstream pressure rise. This HIPS will normally only be used when having a subsea production system without satellite well platforms. gas heater) from the high pressure source when the upstream system (slugcatcher. FPSO or onshore. the SIL obtained by the architecture shown in Figure 4 has not been calculated. The installation cannot be overpressured by depacking at 110 barg through one PCV only. GM_EP_ECP_260_00_EN. build and maintain than a normal pressure letdown HIPS.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 44/58 Fire Zone Battery Lim it PSHHu/s Set @110 barg PSH H SP11 O NSHO RE PSHH Set @71 barg PSVFull Flow (1 BSCFD) ToFlare PSHu/s Set @90barg PIC ToFlare PSHH : 133 bara O ffshore . A subsea HIPS is a lot more difficult to design. To protect a flow line downstream production wells.3 Subsea HIPS The subsea HIPS is generally an overpressure protection HIPS but with the difference that it is operating underwater and not on a platform.doc . 10. reproduced or disclosed to others without written authorisation from the Company. The reason to use a pressure let-down subsea HIPS could be to allow production flow lines or pipelines to have a lower design pressure than the MIP (Maximum Incidental Pressure. when the flow line has a lower pressure rating than the WHSIP. There are two general cases where a subsea HIPS could be applied: 1. as defined in DNV-OS-F101).

reproduced or disclosed to others without written authorisation from the Company. the system's design pressure should be set above the WHSIP to ensure that the hydrate inhibitor can be injected into the system. hydrate formation. This document is the official English version. Hence the HIPS system (valves etc. could be used for testing. thus requiring a lot of effort during the design phase (especially during basic engineering). it is very important to define a clear Operating Philosophy in an early stage of the HIPS design. This must be carefully considered when specifying and qualifying the system components. This document is the property of Total.3. paraffin formation etc. When hydrate inhibition system is foreseen. One should also think about the possibility to test the system.2.2 HIPS location & architecture The location of a subsea HIPS gives its main architectural difficulty.3. GM_EP_ECP_260_00_EN. depending a lot on inspection and/or testing and more particularly on maintenance and repair.doc . When designing a subsea HIPS it shall be clear that a lot of attention must be paid to the reliability and maintainability of the system as well as its impact on production availability. and the impact on the overall availability of the installations. 10. Depending on the kind of tests to be carried out a methanol injection system which might already be considered against hydrate formation.3. Since the subsea HIPS gives a lot of operating (maintenance) constraints. including logistics. To protect a pipeline downstream a pressure let down station from a higher pressure rated tie-back.1 Typical subsea HIPS scenarios Typical scenarios to be considered when designing a subsea HIPS are the following: Case Scenario Blocked outlet downstream of derating Blocked outlet downstream (blocked outlet due to pig stuck. Case Scenario Opening of a PCV (or choke) or (E)SDV with pipeline upstream packed Pressure upstream of derating higher than pressure rating downstream Blocked outlet downstream of derating Opening of a SDV upstream of the Specification break 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 45/58 2.) should be designed at the maximum hydrate inhibitor pressure which is a higher pressure than the WHSIP. 10. The subsea HIPS is a very recent development in the oil and gas industry. which for accessibility reasons is a lot more difficult to carry out on a subsea system than on a system above the waterline. valve closed.3. It must not be stored. when applied. since the reliability of a HIPS is of utmost importance.) Pressure increasing due to failing PCS and PSS.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the pressure let-down HIPS which are given in § 10.

3. It must not be stored.5 Subsea HIPS examples At the time of writing.doc .4 Risk mitigation measures The risk mitigation measures as given for the pressure let-down HIPS in § 10.9km R Injection point upstream chokes PT8 0449 FC NO FV80451 FC NC 2" Pig launcher HV80432 FV80448 R FC NC ESV80432 ZT ESV80439 R FC NC R FC NC ESV80433 From FC PCS FC NO R FC NC R From PCS R FC NC ESV80437 R FC NC ESV80435 From PCS ESV80431 ESV80436 R R Injection point at xmas tree FC NC ESV80434 ROV80440 MeOH 690 barg 600 520 barg barg Figure 5: Jura subsea HIPS This document is the property of Total.3. 600 barg.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 46/58 10. 10. reproduced or disclosed to others without written authorisation from the Company.2. This HIPS is represented in Figure 5: JURA HIPPS Redundant fiber & communication SCM SLS 2oo3 SV1A SV1B SV2A 1oo2 SV2B 1oo2 1oo2 SCMMB 1 2 3 4 5 6 1 Interlock to prevent HV1 or HV2 opening as long as XV2 is open ZT8 0440 PT8 044 1 2 3 4 5 6 R PT8 044 2 PT8 044 3 PT8 044 4 R R PT8 0450 HH H TT8 L 0442 LL HH H TT8 L 0443 LL ZT 1 R NO FO R NO FC ESV80440 HV1 PT8 0451 ZT 2 R FC PT8 044 5 PT8 044 6 PT8 0452 ZT R NO FO NO FO R NO FO ZT R NO FO ZT R TT8 044 4 XV80410 XV1 NO FC ESV80441 HV2 L LL TT8 044 5 R L LL FO NO XV80406 XV3 R XV80411 XV2 2" ESV-80420 8".4 could be considered but one should take into account the impact these could have on the maintainability and thus the reliability of the system. the only subsea HIPS designed is the JURA (UK) subsea HIPS. GM_EP_ECP_260_00_EN. This document is the official English version. 2.

Depending on the chosen test frequency of the HIPS elements. It must not be stored. reproduced or disclosed to others without written authorisation from the Company. This document is the official English version. An interlock preventing the two HIPS valves HV1/2 to open when the ESDV XV2 is open (restart must be done through ESDV XV2 bypass). This may be required depending on the shut in pressure of individual section of the HIPPS. 2. but is not recommended due to the questionable reliability of level detection instrumentation. GM_EP_ECP_260_00_EN. used also by HIPS function (this depends on SIL requirement) **: Triplicated (if necessary for the reliability) Separator 2 Figure 6: Gas blow-by HIPS schematic This document is the property of Total. The HIPS will close a valve upstream of vessel 2 in order to protect it against overpressure when the PSV's downstream cannot relieve the gas flow. The methanol is also required for HIPPS transmitter flushing and testing (calibration cannot be done automatically though). a HIPS could be considered.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 47/58 The sources of overpressure are the subsea production wells (WHSIP of 600 barg). but in case this is not practical.doc . 10. For information the Jura HIPS is only foreseen to be operational for a few years.4 Gas Blow-by HIPS A gas blow-by HIPS could be applied when a separator has a risk of gas blow-by and the relief system (PSV's) on a second vessel downstream of the liquid exit of the first separator cannot handle the gas flow. The two HIPS valves HV1/2 close when pressure at HIPS sensors reaches 250 barg. HP flare Gas LP Flare LC Separator 1 LSLL SDV LSLL** HIPS Oil SDV* HIPS LCV *: SDV. until the WHSIP has decreased below the design pressure of the pipeline. Normally the second vessel should be protected against gas blow-by by mechanical means (PSV's). The HIPS is installed in a subsea well head template located 2 km upstream of the lower rated section to be protected. One should also note that methanol injection facilities are provided throughout the HIPPS to allow inhibition of the production fluids following a HIPPS trip and also to provide the facility to equalise across the HIPS valves prior to depressurisation. The working principle of this HIPS is not very complicated and consists of the following: 1. this HIPS architecture can either be SIL2 or SIL3.

reproduced or disclosed to others without written authorisation from the Company. this HIPS can be qualified as a preventive HIPS (see § 6.3 Dynamic simulations Since the pressure during a gas blow-by can increase very quickly.4. 10.4. This document is the official English version. Case Scenario Failure of the level control and first safety barrier (LSHH or (E)SDV) which should prevent from blow-by Pressure in first separator at PSV opening pressure Maximum incoming flow rate (slug) which can be expected LCV to be modelled as being completely open 10. By increasing the design pressure of the LP separator from 6 to 10 barg.4. Since a reactive HIPS based on closing a valve upstream of the second vessel when reaching PSHH in vessel 2 is almost impossible to implement due to the fast dynamics with a blow-by.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 48/58 10.1. GM_EP_ECP_260_00_EN. One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level. An example of a solution avoiding the need of a gas blow-by HIPS is the Ofon 2 project.5. The HP flare is designed for the gas blow-by relief flow whereas the LP flare was not.4. the most important aim of the dynamic simulations is to determine whether the reaction time of the designed HIPS would be sufficient. When This document is the property of Total. A solution avoiding the need of a gas blow-by HIPS is given in § 10.1 Typical gas blow-by HIPS scenarios The typical gas blow-by scenario is based on a failure of the first safety barrier which should close (E)SDV's downstream of the first separator after a LSLL signal.4).5 Gas blow-by HIPS examples Examples of projects where HIPS against overpressure due to blow-by are used are Girassol and ROSA. Since the HIPS sensors upstream of the part of the installation to be protected against a possible overpressure.doc .4. 10. It must not be stored.4. 10.4 Risk mitigation measures One could try to optimize the LCV in between the first separator and the second vessel in such a way that its Cv would not allow a gas blow-by to exceed the relief capacity of the PSV's of the second vessel (or at least slow down the blow down dynamics).2 HIPS location & architecture The principle of this HIPS aims at preventing a blow-by by avoiding the level in the first separator to come below LSLL. the PSV's of the LP separator can be set at 10 barg thus allowing them to relief to the HP instead of the LP flare. the only possible prevention is a preventive HIPS based on LSLL closing a valve upstream of vessel 2.

reproduced or disclosed to others without written authorisation from the Company.5 barg Note (1) 28VS2040 Pop = 0. one shall ensure that there is no possibility to over pressurize the LP separator through an interconnection between the HP flare and the LP separator (for example through a manually operated depressurization by-pass). It must not be stored. See Figure 7 for the OFON 2 schematic. When applying this solution.0 barg 28PV/AB204004 TO LP FLARE 28SDV202505 28ESDV202508 28LV/AB202002 PSHH TO LP COMPRESSOR ~ 2.4 barg Pdes = 10 barg TO WATER TREATMENT TO OIL EXPORT Note (1): PSHH set point driven by downstream compressors SOP (settle-out pressure) Figure 7: Solution to avoid gas blow-by HIPS 10. This document is the property of Total. a dedicated inlet nozzle) • An assessment of the probability of a simultaneous occurrence of gas blow-by and emergency depressurization.doc . BLOCKED OUTLET 15 28PSV202014-15-16-17 WELLHEADS PRODUCTION TO HP FLARE ~ 8 barg 28PV/AB202004 TO MP/HP COMPRESSORS ~ 13.5 barg Note (1) PSHH 28VS2020 Pop = 6 barg Pdes = 17 barg LC PSVs SIZED FOR GAS BLOW-BY – PILOT TYPE 10 28PSV204014-15-16 TO HP FLARE 2° LSLL TO WATER TREATMENT 1° LSLL (2oo3 VOTING) ~ 2. • A dedicated flare line from the second vessel up to the flare (incl. This solution is only possible if the pressure of the HP flare KO drum during emergency relief is compatible with the maximum back-pressure. one shall take care not to move the overpressure problem from an upstream part of the installation to a downstream part. This document is the official English version.7– 1.5 Liquid Carry-over HIPS A liquid carry-over HIPS should be applied when the relief system is only sized for the gas relief flow during a blocked-outlet and not for the complete blocked-outlet case (gas + liquids). GM_EP_ECP_260_00_EN. and requires: • Pilot type PSV's on the LP separator. This can be the case with older installations where different design practices were applied during the design as the ones which are currently used.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 49/58 applying such a design. thus allowing the functioning of the PSV('s) (set at a low pressure) on the LP separator.

When the level in the separator comes above a certain level the HIPS valves at the inlet close in order to avoid more liquids and gas coming into the separator.doc . This document is the property of Total. This document is the official English version. Case Scenario Relief system (PSV’s) not sized for full flow (liquids + gas) at blocked outlet Blocked outlet downstream of separator Maximum incoming liquid flow rate which can be expected Gas relief through PSV’s while liquid level increasing Liquid + gas relief through PSV’s 10. which could cause a liquid carry over and a subsequent exceeding of the relief capacity of the relief system (hence overpressure in the vessel).2 HIPS location & architecture The working principle of this HIPS is aimed at preventing a liquid carry-over by avoiding the liquid level in the separator to come above LSHH.5.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 50/58 In this case a liquid carry-over HIPS should be implemented to prevent from multiphase flow relief. One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level.1 Typical liquid carry-over HIPS scenarios The typical liquid carry-over scenario is based on a failure of the first safety barrier which should close (E)SDV's upstream of the separator after a LSHH signal.5. GM_EP_ECP_260_00_EN. HP flare Gas LSHH** HIPS Separator LSHH SDV* HIPS valve Oil SDV *: SDV. It must not be stored. used also by the HIPS function (depending on the SIL requirement) *: Triplicated (if necessary for the reliability) LC LCV Figure 8: Liquid carry-over HIPS example 10. reproduced or disclosed to others without written authorisation from the Company.

This last configuration will be used in particular when the PSV's installed on the protection vessel are not sized for the liquid flow rate. In general this mean the HIPS consists of a level switch (LSHH) working in 2oo3 voting mode (depending on required SIL). would require major modifications and in this case (only) a HIPS could be considered. But in case the above defined flare knock out drum volumes cannot be achieved.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 51/58 Since the HIPS reacts on a certain scenario which has already started off (the pressure has already risen) and protects by isolating the separator from the inlet in order to protect it against a possible overpressure.1 Typical flare knock-out drum overflow HIPS scenarios The base scenarios for the sizing of the flare knock out drum. 10. especially in grass root installations. the LSHH can either be placed on the knock-out drum or on the upstream separators. Depending on the dynamics of the system.4). this HIPS can be qualified as a reactive HIPS (see § 6.e. This document is the property of Total.doc . This document is the official English version. 10. and closing HIPS valves upstream of all equipment protected by the relief system equipped with the concerned flare knock-out drum.6 Flare Knock-out Drum Overflow / Overload One of the liquid carry-over HIPS (see § 10. GM_EP_ECP_260_00_EN. and thus a HIPS (when applied). failure of all protection upstream of the PSV protected part of the installation) Upstream pressure at PSV opening pressure 10.2 HIPS location & architecture The knock-out drum HIPS is normally based on a system as described in GS EP SAF 262 but with a higher reliability level (SIL).5. the installation of a HIPS could reduce the overflow risk. having a dedicated logic solver. 10. and concerning the sizing of the liquid side it shall be based on the sum of the liquid volume of 90 seconds of full flow production AND 15 minutes of production of the well (or the trunk line in the case of a riser platform receiving remote wellhead effluent) producing the largest flow rate. 10. reproduced or disclosed to others without written authorisation from the Company. Installations shall be developed to respect (at least) the above interpretation of API RP 521.5) which can be applied is the flare knock-out drum overflow HIPS.3 Dynamic simulations It is important to study the dynamics of the system during a blocked-outlet in order to determine the safe liquid level to be taken as normal LSHH and HIPS LSHH.6.6. It must not be stored. According to GS EP SAF 260 the sizing criteria shall be based on API RP 521. are the following: Direct cause Blocked outlet on PSV protected part of installation Scenario Full flow (gas and liquids) from all sources through flare knock out drum (i. According to GS EP SAF 262 a flare knock out drum shall be fitted with a LSHH initiating a shutdown without depressurisation (SD-2) of all units attached to the disposal system. but in the case of an upgrade it can happen that respecting this.4 Risk mitigation measures The implementation of the liquid carry-over HIPS shall be avoided.5.1.

Angola).6. 10.3 Dynamic simulations The dynamic simulations shall be based on scenarios given in § 10. One should well take into account the backpressure of the disposal system.4 Risk mitigation measures The risk of overflowing the flare knock out drum can be mitigated by allowing a good monitoring and quick intervention by the operators from the control room (in case of manned facilities).doc . It must not be stored. 10.6.7.1 as well as any other possible scenarios. for example when having several compression trains in parallel.7 HIPS Against Overpressure by Compressor A HIPS against overpressure by compressor can be used to protect an installation against the possibility of compressors running out of control and over pressurizing the part of the installation downstream. 10.5 Example A knock-out drum HIPS has been studied (but not applied) for Buffalo (block 3. because the fact that the HIPS would trip will often be caused due to a failure causing non-closure of these same valves.6. the simultaneous relief flow when several compression trains run out of control while having blocked outlet is not possible/practical and a HIPS could be considered. A knock-out drum HIPS shall normally not be applied.7. increasing the outlet pressure (this could be part of the scenario) 10. especially when using (E)SDV's also used by the first protection barrier as HIPS valves. This means that it should only be applied in exceptional cases.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 52/58 It shall be noted that. Normally each compression train is protected against an overpressurization by compressors running out of control with blocked outlet by having PSV's and a flare system designed to relief the maximum flow of all trains. GM_EP_ECP_260_00_EN.6.1 Typical compressor HIPS scenario Case Scenario Compressor overspeed with blocked outlet downstream Blocked outlet downstream compressor train(s) Compressor running on maximum speed Compressor’s control logic and safety system not functioning Inlet pressure of the compressor above normal pressure. In some cases. 10. for example in the case of upgrading existing installations. reproduced or disclosed to others without written authorisation from the Company.2 HIPS location & architecture The compressor train shall have to be equipped in any case with PSV's and a relief system which can handle the full relief flow of one compression train. one should study common failure mode. 10. This document is the official English version. The flare shall mechanically and hydraulically be designed to handle the full relief flow of all compression trains together while the radiation criteria might be exceeded. A compressor HIPS will in general consist of a pressure sensor (normally in 2oo3 voting mode in order to have a higher availability/reliability) with a dedicated logic solver shutting off the This document is the property of Total.

GM_EP_ECP_260_00_EN. A possible compressor HIPS is currently being studied (not yet approved) for the Shtokman project and a schematic of this HIPS is given in Figure 9. This document is the property of Total. This document is the official English version.e. By-Pass SDV and the compressor inlet SDV's. the HIPS PAHH pressure trip will be initiated when the pressure reaches 171.g. Therefore. There will be three compression trains.3 barg.4).7. time to stop when fuel supply is cut off) to be expected when shutting off the fuel gas supply. It must not be stored. 10. the compressor HIPS will trigger the riser top HIPS to protect the topsides in case of depacking.doc . the full flow PSV will relieve to the HP flare system at 198.6 barg. a HIPS has to be implemented. This trip will close dedicated HIPS valves located on the gas turbine fuel gas supply line. 2. The usage of pilot operated with modulating action type relief valves already permits to reduce the accumulation pressure percentage from 16% to 10%.7.5 Example At the time of writing. 3. The key characteristics of the HIPS design per compression train are the following: 1.3 barg (i.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 53/58 compressor in case of an overpressure downstream of the compressor. If the HIPS PAHH fails to detect the compressor discharge high pressure. reproduced or disclosed to others without written authorisation from the Company. Moreover.7. Since the HIPS reacts on a certain scenario already being initiated.1. The PSV's and the flare system are sized for full blocked outlet of one compression train.3 barg). PSS PAHH will trip the compressor and initiate closure of discharge cooler SDV. 10. The normal operating pressure at compressor discharge will be 153. but from a radiation point of view the flare cannot accommodate the relief for more than one train at the same time (mechanically and hydraulically it can).4 Risk mitigation measures It shall be clear that a fully pressure rated piping downstream the compressor is the best solution and avoids the need of a pressure protection system (PSV and/or HIPS). 10. A reliable way to shut down the compressor can be to shut off the fuel supply by closing two HIPS valves on the fuel gas line. If the operating pressure rises to 169. a compressor overpressure / overflow protection qualified as HIPS has never been applied at Total. If PSS PAHH fails to detect the compressor discharge high pressure. this HIPS can be qualified as a reactive HIPS (see § 6. When dimensioning the protection system one shall well take into account the compression curve of the compressor and take into consideration that the highest pressure occurs at zero flow and thus not at maximum flow.3 Dynamic simulations The dynamic simulations shall take into account the compressor dynamics (e.3 barg. 10% above set pressure of 180.

reproduced or disclosed to others without written authorisation from the Company. First safety barrier failing to close ESDV’s SCSSV’s and stopping ESP’s upstream of a pressure specification break. 10.8. this HIPS shall protect against over pressurization by stopping the ESP's by using circuit breakers while (if necessary according to the reliability calculations) at the same time closing HIPS valve. The ESP stopping function should not be the only safety function of this HIPS. Typically.2 HIPS location & architecture The working principle of this HIPS is based on shutting down the ESP's upon PSHH detection. Pressure increasing due to blocked outlet. This document is the property of Total.8 HIPS Stopping ESP’s A HIPS stopping the ESP('s) can be applied when the source of possible over pressurization is an Electric Submersible Pump installed to activate well production. This document is the official English version. It must not be stored. Case Scenario Blocked outlet somewhere in the system.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 54/58 Figure 9: Shtokman compressor HIPS 10. GM_EP_ECP_260_00_EN.1 Typical HIPS stopping ESP’s scenarios The typical HIPS stopping ESP's scenario is based on a failure of the first safety barrier which should close (E)SDV's and SCSSV's as well as stopping the ESP's upon PSHH detection. 10.doc .8.

The ESP's for each well of the platform are stopped by means of a stop signal to the pump (via the hydraulic control pannel).3 Dynamic simulations Dynamics simulations simulating the closure of the HIPS valves protecting the downstream part shall be carried out. The architecture has been applied at several platforms of the Al Khalij field.8. The circuit breakers are opened to ensure stopping the ESP's. Hydraulic Control Pannel SSV 1oo2 ESD/ESS SD2 Incomer breaker ESP's breakers SD3 PSD/PSS 1oo2 PSD/PSS HIPS 2oo3 SCSSV ESDV Figure 10: AL Khalij HIPS stopping ESP’s This document is the property of Total. This ESP HIPS has not (yet) been approved by the HIPS Committee. The pressure derating should be placed as far away as possible from the well. and several improvements (such as having a completely segregated dedicated HIPS hydraulic control panel) should be considered. 10. It must not be stored.doc . reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN. This document is the official English version. Action 2 and 3 can not be considered as real HIPS actions since they are through the hydraulic control pannel which is not an HIPS element.5 HIPS stopping ESP’s example An ESP stopping function as part of a HIPS has been applied at Al Khalij in Qatar. The architecture of the HIPS is shown in Figure 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 55/58 10. In case the protection is not sufficient (because they do not close in time) dynamic simulation showing the ESP's stopping shall be carried out.4 Risk mitigation measures The flowline and production/test manifold shall be fully pressure rated at maximum ESP discharge pressure (unless protected by PSV). 10. 4.8. The protection is based on the following actions taken by the HIPS system upon its activation which is caused by a high pressure detection (on a 2oo3 voting basis): 1. So in case of a well platform with ESP wells the derating should be downstream of the outboard ESDV of the pipeline departure of the platform. The SCSSV's of each well are closed via the hydraulic control pannel. 2.8. The ESDV on the outlet pipeline from the upstream platforms is closed. 3.

proper equipment design and .maintain and test the system .protection system design Consider installation of a HIPS Review : .doc .Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 56/58 Appendix 1 Company rules Industry standards Guidewords HIPS Flow Chart TDO / SE Field Operation entity Concerned DGEP entity DGEP HIPS Committee New project or Major modifications Identify pre-existing HIPS Industry standards can be implemented no Field Operations entity to review existing facilities for deviation from Industry standards yes Proper equipment design or protection system are feasible no Applicability of HIPS yes Implement Industry standards Apply : . Review reliability and detailed design Approval by TDO / SE HIPS in operation Agree on HIPS installation Field Operation Entity to .record and review HIPS failures This document is the property of Total. This document is the official English version.Material code . reproduced or disclosed to others without written authorisation from the Company.update the HIPS dossier .Compliance with ISO 10418 and API RP 14 C .Overall hazard assessment Identify deviations from industry standards Notify HIPS committee Document an as-built dossier Establish a Preliminary HIPS Dossier and submit it to HIPS committee Review and comment upon the Preliminary HIPS Dossier Decide on applicability Submit the as-built dossier to HIPS committee Record decision in the Statement of Requirement (SOR) and in the Project Safety Concept Preliminary acceptance Preliminary acceptance and design recommandation HIPS categorisation Categorise HIPS : "soft" or "hard" HIPS approved HIPS design and approval Update the HIPS dossier. It must not be stored. Comply with Company Rules Approve HIPS Quantitative Risk Assessment is used to support request for derogation HIPS installation Submit request for derogation from Company Rules Advise on request for derogation from C. GM_EP_ECP_260_00_EN.R.

11 barg) Dalia Riser HIPS This document is the property of Total. GM_EP_ECP_260_00_EN.8 barg) 30 barg Header PSV Set Pressure (30 barg) OPERATING / START-UP PRESSURE (14-97 barg) 25 barg Separator Test Pressure (25 barg) Normal operating pressure (*) 76.doc .5 = 1.5 = 17 .10% 20 barg Separator Accumulation (116%) Pressure (19.5 barg (**)) 14 barg 10 barg Normal Operating Pressure (9 .7 barg) PSHH HIPS (18.5 barg) PSHH Separator (15.5 barg (*)) Header PSV Accumulation (116%) Pressure (34.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 57/58 Appendix 2 UPSTREAM CHOKE VALVE Pressure Settings Diagram DOWNSTREAM CHOKE VALVE PIPING DESIGN PRESSURE 220 barg SHUT-IN MAX PRESSURE 200 barg GAS LIFT MAX PRESSURE PSHH HIPS (120 barg) PSHH SSS (113 barg) PSHH PSS (105 barg) 150 barg 97 barg Header Test Pressure (76. This document is the official English version.5 barg) PSHH PSS downstream choke (17 barg) Separator PSV Set Pressure (17 barg) PSHH Header (16. reproduced or disclosed to others without written authorisation from the Company.5 x 51 (Piping class C513 pressure limit) (**) 15. It must not be stored.

It must not be stored. This document is the official English version. reproduced or disclosed to others without written authorisation from the Company.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 58/58 Appendix 3 Pressure Settings Diagram AKPO Gas Line Tie-in on AMP2 This document is the property of Total. GM_EP_ECP_260_00_EN.doc .

Sign up to vote on this title
UsefulNot useful