Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 1/58

Purpose
This guide is intended to provide guidelines for Process engineers in charge of defining High Integrity Protection Systems (HIPS) during conceptual phases / preproject and/or supervising the process aspects of HIPS design performed by Contractors during project phases.

Application
These guidelines apply to all facilities or projects operated by Total or where Total is a shareholder, either offshore or onshore installations. They also apply to major modifications of existing installations, as well as to the design of HIPS retrofitted onto existing facilities as measures implemented in order to upgrade the level of protection.

Revisions

00 Rev.

09/2009 Date

First issue Notes

Approbation
Prepared by: Checked by: Authorised by:

Name: G. SITEUR Date: 09/09

Name Date:

D. LARREY de TORREBREN 09/09

Name: Ph. GERLACH Date: 09/09

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 2/58

Contents

Purpose .......................................................................................................................... 1 Application ..................................................................................................................... 1 1. Glossary...................................................................................................................6 2. Objectives ................................................................................................................9 3. Overview of the Referential ..................................................................................10 4. Process Engineer Responsibilities......................................................................11
4.1 4.2 Context ............................................................................................................................11 Different stages of design and HIPS life ..........................................................................11

5. Design Principles ..................................................................................................17
5.1 5.2 Justification and basic design for HIPS ...........................................................................17 Description of a safety system.........................................................................................21

6. HIPS design ...........................................................................................................23
6.1 6.2 6.3 6.4 6.5 The location of a HIPS.....................................................................................................23 HIPS setting.....................................................................................................................25 HIPS response time.........................................................................................................26 Preventive or reactive HIPS.............................................................................................27 HIPS adaptability throughout design life..........................................................................28

7. Process Dynamics ................................................................................................29
7.1 7.2 Dynamic simulations........................................................................................................29 Arrangement of installations & incident scenarios ...........................................................30

8. HIPS Dossier..........................................................................................................33
8.1 8.2 8.3 8.4 Objective of the HIPS dossier..........................................................................................33 Submission of the HIPS dossier ......................................................................................33 Content of the HIPS dossier ............................................................................................34 Specific requirements for process documentation...........................................................35

9. Operational Constraints .......................................................................................36
This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 3/58

10. Applications of HIPS .............................................................................................37
10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 Riser HIPS .......................................................................................................................37 Gas Plant Inlet Pressure Let-down HIPS.........................................................................43 Subsea HIPS ...................................................................................................................44 Gas Blow-by HIPS ...........................................................................................................47 Liquid Carry-over HIPS....................................................................................................49 Flare Knock-out Drum Overflow / Overload.....................................................................51 HIPS Against Overpressure by Compressor ...................................................................52 HIPS Stopping ESP’s ......................................................................................................54

Appendix 1 Appendix 2 Appendix 3

HIPS Flow Chart ...................................................................................56 Pressure Settings Diagram..................................................................57 Pressure Settings Diagram..................................................................58

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 4/58

Reference documents
Unless otherwise stipulated, the applicable version of the reference documents listed below, including relevant appendices and supplements, is the latest revision published.

Standards
Reference Not Applicable Title

Professional Documents
Reference API RP 14 C (ISO 10418) API RP 520 API RP 521 (ISO 23251) Title Recommended Practice for Analysis, Design, and Testing of Basic Surface Safety Systems for Offshore Production Platforms Sizing, Selection and Installation of Pressure Relieving Devices in Refineries Pressure-Relieving and Depressuring Systems

Regulations
Reference Not Applicable Title

Codes
Reference DNV-OS-F101 IEC 61508 IEC 61511 Title Rules for submarine pipeline systems Functional safety of electrical/electronic/programmable electronicsafety related systems Functional safety : safety instrumented systems for the process industry sector

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

Guides & Manuals

GM EP ECP 260

Process Guidelines for Designing HIPS

Exploration & Production

Rev: 00

Date: 09/2009

Page: 5/58

Other documents
Reference Not Applicable Title

Other Total documents
Reference CR EP HSE 041 CR EP HSE 042 GM EP SAF 010 GS EP ECP 103 GS EP ECP 105 GS EP SAF 260 GS EP SAF 261 GS EP SAF 262 Title Technological Risk Management Instructions for the selection, definition and operation of high integrity protection systems Safety acronyms & definitions Process sizing criteria Process documents to be prepared during engineering phase Design of High Integrity Protection System (HIPS) Emergency Shut-Down and Emergency De-Pressurisation (ESD & EDP) Pressure protection relief and hydrocarbon disposal systems

Local Regulations might be more restricting than Standards and Company referential (or propose alternative methods) and must be adhered to.

This document is the property of Total. It must not be stored, reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.

GM_EP_ECP_260_00_EN.doc

GM_EP_ECP_260_00_EN. HAZID. Risk Assessment. Maximum Operating Conditions Maximum Allowable Incidental Condition (MAIC). Hazard. Barrier. HIPS categorisation.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 6/58 1. Scenario. Risk Reduction Measure. Risk analysis. Glossary When the definition of a term is provided in any of the reference documents. This document is the official English version. Safety Integrity Level (SIL). Risk Matrix. a cross-reference to this document is made instead of copying/pasting the definition. Safety Integrity. PTR This document is the property of Total. Incident Severity level Definitions given in CR EP HSE 041 Central critical event (also named Undesirable Event in API RP 14C). Mitigation Definitions given in CR EP HSE 042 HIPS. reproduced or disclosed to others without written authorisation from the Company. HIPS committee Safety Instrumented System. Probability Risk. SPOT. OPERSAFE. Over-pressurisation. Frequency. ALARP HAZOP. Process Shut Down (PSD) Incident. Maximum Allowable Working Condition Safety Function. Prevention. Reliability Emergency Shut Down (ESD).doc . Definitions given in GS EP SAF 260 HIPS dossier Design condition Normal Operating Conditions. It must not be stored.

It must not be stored.e.01-0.001 0. In simple terms. For Safety Instrumented Functions operating in Low Demand mode (i. Demand Frequency << Test Frequency). the PFH (Probability of hazardous Failures per Hour) shall be calculated : SIL level 1 2 3 4 PFH 10-6 . See also CR EP HSE 041 Safety System A Safety System is made of several Protection Barriers A Safety System performs a Safety Function See also API RP 14C SIL (Safety Integrity Level) Safety Integrity Level (SIL) is defined as a relative level of risk-reduction provided by a safety function.0001-0.001-0.10-7 / hour 10-9 .Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 7/58 Other definitions Protection (or Safety) Barrier Part of a Safety System. This document is the official English version.1-0.10-8 / hour This document is the property of Total.10-5 / hour 10-7 .01 0.e. GM_EP_ECP_260_00_EN.0001 0.10-6 / hour 10-8 . SIL is a measurement of performance required for a Safety Instrumented Function (SIF). Demand Frequency >> Test Frequency). PFDavg (Average Probability of Failure on Demand) and RRF (Risk Reduction Factor) for different SIL Levels as defined in IEC61508 and IEC61511 are as follows: SIL level 1 2 3 4 PFDavg 0.doc . reproduced or disclosed to others without written authorisation from the Company. or to specify a target level of risk reduction.00001 RRF 10-100 100-1000 1000-10000 10000-100000 For Safety Instrumented Functions operating in High Demand (Continuous) mode (i.

reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 8/58 Abbreviations ESD ESDV ESP FPSO HIPS HIPPS HP KO drum LAH LAL LCV LSLL OPPS OCWR PAH P&ID PCS PCV PFD PID controller PSD PSS PSHH PSV PV ROV RHSIP SCSSV SDV SIS WHSIP Emergency ShutDown Emergency ShutDown Valve Electrical Submersible Pump Floating Production Storage and Offloading High Integrity Protection System High Integrity Pressure Protection System High Pressure Knock Out Drum Level Alarm High Level Alarm Low Level Control Valve Level Switch Low Low OverPressure Protection System Overall Control of Wells and Risers Pressure Alarm High Process & Instrumentation Diagram Process Control System Pressure Control Valve Process Flow Diagram Proportional Integral Differential controller Process ShutDown Process Safety System Pressure Switch High High Pressure Safety Valve Pressure Valve Remotely Operated Valve Riser Head Shut-In Pressure Surface Controlled Subsurface Safety Valve ShutDown Valve Safety Instrumented System Well Head Shut-In Pressure This document is the property of Total. It must not be stored. This document is the official English version.doc .

• Exceeding the design temperature (either high or low). • Chemical hazards (H2S etc. This document is the official English version.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 9/58 2. It must not be stored. are identified as High Integrity Protection Systems (HIPS) according to DGEP rule CR EP HSE 042 To ensure the choice of HIPS as a protection barrier is duly justified against industry standards / conventional solution To ensure that a consistent approach is applied to the process definition of High Integrity Protection Systems - >>> Following preliminary evaluation >>> Following project review (PTR. reproduced or disclosed to others without written authorisation from the Company. GAP ANALYSIS) This document is the property of Total. SPOT. Most HIPS are designed to protect against overpressure. A HIPS is never a standard system. As per CR EP HSE 042 a HIPS is an instrument-based systems of sufficient integrity (involving high reliability redundant and/or diversified instruments) so as to make the probability of exceeding the design parameters lower than a target value. Objectives This guide is intended to be used by Process engineers during conceptual design / preproject for the preparation of the Preliminary HIPS Dossier and during the Project phases for the supervision of the design work performed by the Contractor. • Exceeding the radiation criteria. HAZOP) >>> Following analysis of existing installations (OPERSAFE.). The choice of HIPS as an ultimate protection barrier is not an option given preference by COMPANY. but HIPS can also be applied to prevent from other hazards.doc . as an alternative to industry standards for the protection of production installations. Process and Safety engineers in Affiliates and Project Teams have the responsibility to state where the implementation of a HIPS: needs to be considered to achieve a given safety integrity To ensure that all design configurations involving Safety Instrumented System (SIS) of high Safety Integrity Level (SIL). GM_EP_ECP_260_00_EN. such as: • Exceeding the design flow.

Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 10/58 3. Overview of the Referential The main contents of the two documents constituting COMPANY referential dedicated to HIPS are the following: • Company Rule CR EP HSE 042: 1. HIPS Dossier 5.doc . GM_EP_ECP_260_00_EN. This document is the official English version. HIPS Applicability 2. HIPS Design principle This document is the property of Total. SOFT 3. reproduced or disclosed to others without written authorisation from the Company. HIPS Committee • General Specification GS EP SAF 260: 4. HIPS Characterisation and Categorisation: HARD vs. It must not be stored.

Process engineers are advised to liaise and coordinate with other DGEP entities. the Project or the affiliate in charge) • DGEP HIPS Committee • The Field Operations entity This document is the property of Total.1 gives the entities involved and § 4. When possible. It must not be stored.2 gives the tasks which shall be undertaken by the process engineer. Reliability and Instrumentation engineers. In doubt regarding responsibilities. To avoid disagreements between different fields of expertise.2). Consequently. the remit of Process engineers at each stage of the HIPS design are defined (see § 4. 4.doc . This document is the official English version. Process engineers must have a clear view of the overall methodology for the management of HIPS. Therefore. This guide is designed to allow Process engineers understanding the context and starting the study in a proper manner. reproduced or disclosed to others without written authorisation from the Company. During the conceptual study phase the process engineers will have to initiate studies on the choice of a HIPS and propose its initial design.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 11/58 4. § 4.1 Context The management of HIPS involves several DGEP Entities: • Safety Engineering • Instrumentation • Reliability/Operations • Process This guide is dedicated to Process engineers and does not aim to be a design guideline for Safety. Process Engineer Responsibilities This chapter sets out the responsibilities of the process engineer throughout the HIPS design process. 4. this guide not only deals with Process related information but also gathers information from reference documents governed by other Entities. cross-references to reference documents are made instead of copying/pasting information.g.2 Different stages of design and HIPS life The HIPS Flow Chart (Appendix 1) summarizes the main steps of the justification & design of a HIPS: • Applicability of HIPS • HIPS Categorization • HIPS Design and Approval • HIPS in Operation with regard to the main participants in the process: • The concerned DGEP entities (e. GM_EP_ECP_260_00_EN.

This document is the official English version. vessel or pipeline engineer/specialist etc. Definition of hazards and scenarios (refer to CR EP HSE 041 which gives rules for the risk assessment method) 9. During the Operations phase (not listed in the table) the Process Engineer shall be in charge of preparing and updating any modifications of the HIPS in the HIPS dossier. the implementation of a HIPS is considered (and then followed up). from the preliminary evaluation. Conceptual Studies (the activities given are specifically applicable to a design where the HIPS is critical to the feasibility of the project. Details on all technical issues are then provided further in this guide.doc . Documentation • Activities per stage of design 11. HIPS design 8. Pre-projects 13. GM_EP_ECP_260_00_EN. in other cases it could be considered to carry out the activity in a later stage) 12. piping. Consequences assessment (refer to CR EP HSE 041 which gives rules for the risk assessment method) 10. The activities marked with a * will have to be carried out by the discipline engineers listed hereunder (but they should be followed up by the process engineer): *(1) Safety and/or reliability engineer *(2) Field operations engineer *(3) Rotating equipment. The GM provides the following information to the attention of Process engineers: 6. System design 7. reproduced or disclosed to others without written authorisation from the Company. These modifications need to be approved by the HIPS Committee. Detailed Engineering When. This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 12/58 The specific roles of the different metiers within concerned DGEP entities and DGEP HIPS Committee groups are not detailed out in this GM. Basic Engineering 14. the responsibilities of the Process engineer at each step of the design are summarized in Table 1. It must not be stored.

• Check if there is any interaction between the responses of protection barriers. reproduced or disclosed to others without written authorisation from the Company. Pre-Project • Verify the level and location of de-rating for each design condition. • Verify if the HIPS solution is acceptable (exclusions are mentioned in CR EP HSE 042) and feasible. justify the reason why. It must not be stored. GM_EP_ECP_260_00_EN. If not. If not. • Predefine the set points of protection barriers based on preliminary process dynamics. • Define the set points of protection barriers. assess their acceptability.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 13/58 SYSTEM DESIGN Conceptual Study Location and level of derating • Verify if full conditionrated mechanical design is feasible.doc . Detailed Engineering • Optimize (if required) the set points of protection barriers. See Appendix 2 and Appendix 3. If yes. Protection barriers set points • Evaluate the set points of the protection barriers of the installation. • Check set points with latest design modifications (if any). • Verify if a conventional protection system is feasible. This document is the official English version. define the level and location of derating. HIPS Justification This document is the property of Total. Basic Engineering • Elaborate the complete pressure settings diagram.

*(1) • Calculate SIL achievement in order to confirm SIL assessment. • Identify possible risk reduction measures. Pre-Project • Assess the credibility/likelin ess of the scenarios. • Calculate the process dynamics in order to determine the set points and response times of the HIPS. reproduced or disclosed to others without written authorisation from the Company.g. GM_EP_ECP_260_00_EN. • Consider all operating cases. This document is the official English version. *(2) Detailed Engineering • Define an extensive list of sensitivity cases based on worst case scenarios. HAZARDS AND SCENARIOS Conceptual Study Risk assessment • Identify main hazards and critical events. SIL assessment / achievement • Carry out the preliminary SIL requirement evaluation. • Consider the influence of existing protection barriers (if any). *(1) • Finalize SIL assessment. The HIPS should be designed on P&ID level. Pre-Project • Continue the HIPS design taking into account the preliminary process dynamics. It must not be stored. sensors) and its basic architecture. • Verify the absence / acceptability of secondary effects. *(2) • Evaluate the impact of possible future developments. *(1) • Reconfirm SIL assessment. HIPS setting • Evaluate the set points of the HIPS. • Determine required response time for the HIPS (preliminary process dynamics).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 14/58 HIPS DESIGN Conceptual Study Design of the HIPS • Define the location of the HIPS (valve. • Identify the configurations and scenarios for which a HIPS is required. (e. Basic Engineering • Continue the HIPS design. water hammer) • Optimize the set points of the HIPS (if required). Basic Engineering • (Re-) assess the likeliness / credibility of the scenarios. • Preliminary calculations on identified scenarios. Detailed Engineering • Finish the design of the HIPS. This document is the property of Total. • Reconfirm SIL achievement.doc .

• Establish a HIPS document containing the elements mentioned under the other items to be carried out during the Conceptual phase Pre-Project • Establish a preliminary HIPS dossier and submit it to HIPS committee. Basic Engineering • Update the HIPS dossier. • Compare the extreme conditions to allowable limits. Pre-Project • Identify the weak points of the installations in case design conditions are exceeded. • Update the HIPS dossier for handover to Field Operations (in compliance with Company Rules). Consequences HIPS categorization • Evaluate the category of the HIPS by carrying out a risk analysis. • Identify clearly the HIPS in Process drawings • Ensure that the HIPS is listed in the SOR and addressed in the Safety Concept and in the Operating Philosophy. This document is the property of Total. • Ensure that the HIPS is addressed in the Safety Concept and in the Operating Philosophy. Detailed Engineering • Assess the correspondence between the level of extreme conditions and consequence severities as a function of the integrity of the installations. *(3) Basic Engineering • Calculate the extreme conditions reached by the system. request derogation. • Confirm the category of the HIPS. This document is the official English version. the same approach should be followed as for new installations. It must not be stored.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 15/58 CONSEQUENCES ASSESSMENT Conceptual Study • Evaluate the extreme conditions reached by the system in case of HIPS failure. DOCUMENTATION Conceptual Study Documentation to be prepared • Describe at a conceptual level the HIPS function (in the process report). GM_EP_ECP_260_00_EN. reproduced or disclosed to others without written authorisation from the Company. Table 1: Process engineer responsibilities at different stages of the design When an existing SIS protection is identified as a HIPS (during audits for example).doc . If needed (hard HIPS). in compliance with General Specifications and Company Rules and submit to HIPS committee. Specific constraints associated to installations and protection barriers installed prior to HIPS referential should be integrated in the HIPS justification and design choices. Detailed Engineering • Elaborate the technical documentation related to process.

Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 16/58 During the operational phase of a HIPS the tasks of the process engineer working for the asset are the following: 1. 2. 3.doc . Participation to management of modifications impacting the HIPS function (this shall go through the HIPS Committee). This document is the property of Total. Making sure the HIPS dossier is updated (by the Operators in charge). Participation to management of downgraded situations impacting the HIPS function. This document is the official English version. GM_EP_ECP_260_00_EN. reproduced or disclosed to others without written authorisation from the Company. It must not be stored.

but no RP (Recommended Practice) issued yet] • When industry standards do not address a specific hazard 3.1 HIPS qualification All deviations from industry standards describing conventional protection systems (essentially API RP 14C. Chemical hazard not addressed by ISO 10418 and API RP 14C • When current industry standards CANNOT be implemented 4. the specification breaks and the PSV's (when in Conceptual Study phase). reproduced or disclosed to others without written authorisation from the Company. 5. During conceptual studies the process engineer shall use the above definition to verify if any of the protection systems shall be qualified as a HIPS.doc .1 Justification and basic design for HIPS This paragraph describes when a safety system shall be qualified as a HIPS as well as the basis for its design. An ultimate protection relying solely on Safety Instrumented Systems (SIS) is qualified as HIPS.1. This document is the official English version. 5. but should be developed to better understand the need for HIPS. • Simplified P&ID's • P&ID's • Up-to-date P&ID's (when being already in the Operations phase) • The flare study • The pipe specifications N.1. Design Principles This chapter sets out the basics for the design of a HIPS. This is the case with Subsea Production System applications (and associated flowlines and risers) [within the framework of API 17O task group.2 Justification for a HIPS As further explained in § 5. It must not be stored. GM_EP_ECP_260_00_EN. They would involve an unproven technology or a technology beyond the present stateof-the-art This document is the property of Total.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 17/58 5. irrespective of its required Safety Integrity Level (SIL). now ISO 10418) are treated as HIPS.1. For HIPS critical to the feasibility of the project the process engineer may evaluate whether it is necessary to develop the following documents in conceptual studies phase to base its conclusion on: • PFD's which show the ESDV's. This list is not exhaustive.3. the installation of a HIPS can be justified in the following cases: • When no industry standard recommendations exist for a given application 2. 5.B. the installation of HIPS must be as far as possible restricted. These specific PFD's are not normally part of the Conceptual Study. However.

Environmental considerations (avoid relief to atmosphere through relief valve) 6. reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN. etc…) • When installation of a conventional safety system would imply disproportionate costs 7. Lay-out constraints (size of relief headers and associated downstream systems: vents. Where "Disproportionate" implies the definition of a ratio of costs The impracticality of a conventional solution must be demonstrated i.e. flow. design calculations relating to the conventional solution must be provided. see GS EP SAF 262 5.) which may occur • OPTION 2: “Specification Break + Safety System” Upstream design only to the worst possible conditions which may occur The following design options can be selected for the safety system to protect the downstreampart: • OPTION 2-A: “Conventional” Safety system designed in accordance with Industry standards • OPTION 2-B: “Non conventional” Safety system not designed in accordance with Industry Standards – amongwhich HIPS conditions This document is the property of Total. The following design approaches can be selected for an installation: • OPTION 1: “Safety-by-design” Design of the whole installation to the worst possible (pressure.temperature. It must not be stored. For the case of overpressure protection systems (OPPS).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 18/58 • When installation of a conventional safety system would imply impractical design constraints 5. composition etc. The field of applicability of the HIPS solution is described in CR EP HSE 042.3 System design approaches The standard design options for the protection of an installation are given in CR EP HSE 042 and summarized below.1. flares. They shall be applied to any incident that leads to uncontrolled release of hydrocarbons or damage to the facilities.doc . This document is the official English version.

g. 5.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 19/58 The following order of preference shall be applied: 1. reproduced or disclosed to others without written authorisation from the Company. in accordance with standard recommendations of API RP 14C. full pressure-rated mechanical design) 2. It must not be stored. Design Option 1 (e. Design Option 2-B (HIPS) can be selected only if the two other options are not practicable. several suboptions can be selected and correspond to different levels of de-rating.1.doc . These sub-options are differentiated by the relative positions between the incident condition and downstream facilities characteristics: design condition / maximum allowable incidental condition / test condition / yield/ leak condition / burst / rupture condition. Design Option 2-A must be selected (conventional safety system). These two basic design options and associated sub-options are represented in Figure 1: This document is the property of Total. Within Design Option 2. If not. For option 2a specification break is introduced in the system. three main approaches are possible for pressure protection systems (in order of preference): • Full pressure-rated mechanical design • Relief systems (PSV + flare) • Over-Pressure Protection Systems (OPPS). GM_EP_ECP_260_00_EN. General Specification GS EP ECP 103 provides the definition of the Maximum Allowable Incidental Pressure (MAIP) and Incidental Pressure (IP) for Offshore pipeline systems constructed under DNV-OS-F101 code. the downstream part of the system can be subject to an incident condition exceeding its design condition.4 Level of de-rating In case of an incident scenario for option 2. Application to Over-Pressure Protection System: According to GS EP SAF 262. belonging to the HIPS category. The standard practice for the design of a safety system is reminded in CR EP HSE 042: the design of a safety system shall be made of at least two independent barriers of different nature. When the safety system can be and is designed as per Industry standards recommendations (API RP 14C). 3. it is referred to as conventional (option 2-A). requiring the consideration of a safety system. This document is the official English version. it is referred to as non conventional and is a HIPS (option 2-B). Note: For example.

Option 2-3: "Burst Critical" . This document is the property of Total.doc . It must not be stored. There is a high risk of burst/rupture of a pipeline/equipment in case of incident. GM_EP_ECP_260_00_EN.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 20/58 UPSTREAM OPTION 1 Safety-by-Design No damage DOWNSTREAM OPTION 2 Spec Break and Safety System Yield likely Burst Critical Yield/leak Unlikely Soft HIPS Burst / Rupture Hard HIPS Test condition Design condition Burst / Rupture Test condition Design condition Test condition Burst / Rupture Burst / Rupture Incident Condition Normal Operating Condition Design condition Test condition Design condition Normal Operating Condition Figure 1: possible design options for the system Option 1: "No damage" . The serviceability of the downstream facilities is at risk in case of incident. According to CR EP HSE 042 the HIPS is categorized (as guidance) as HARD when the maximum pressure reached during an incident scenario (without the HIPS intervening) can exceed the test pressure. For pipelines already in service the actual mechanical conditions shall be established by instrumental inspections in order to re-assess the yield / leak and burst / rupture conditions. Option 2-1: "Yield / leak Unlikely" . This document is the official English version.the incident condition is under the design condition of the downstream facilities (or maximum allowable incident condition according to applicable codes).the incident condition is over the design condition of the downstream facilities but below its test condition (according to applicable codes). This corresponds with the pink and purple diagrams in Figure 1.the incident condition is over the burst/rupture condition of the downstream facilities. reproduced or disclosed to others without written authorisation from the Company. The chosen option has a strong influence on the severity of consequences in case of an incident scenario and is therefore of primary importance regarding the specifications (HIPS category and the SIL requirement) of a HIPS. Option 2-2: "Yield likely" .the incident condition is over the test condition of the downstream facilities but below its burst/rupture condition. Specific requirements from construction codes may apply in case of incident.

reproduced or disclosed to others without written authorisation from the Company.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 21/58 The responsibility of the Process engineer is to strike a balance between the level of derating of pipeline/equipment design or test pressure. 5. Note: The typical ratio between pipeline/equipment burst/rupture condition and design condition is strongly dependent on the type of line (process pipeline. umbilical. This document is the official English version. It must not be stored. the following values should be indicated: Operating parameters o Well shut-in max condition o Operating conditions Normal operating condition Maximum operating condition Start-up condition range Design choices o Design conditions Maximum allowable operating condition (pipelines) Maximum allowable working condition (process equipment) Maximum allowable incidental condition Test condition Yield / Leak condition [if known] Burst / Damage condition [if known] o Sensors set points Condition high Condition low o Pressure relieving systems set points Relief condition Accumulation condition This document is the property of Total. the expected HIPS category and the SIL requirement for the HIPS. 5.2. The choice of the design pressure of downstream facilities also involves other parameters (on which the Process engineer can play) such as pipeline diameter: the larger the diameter. flexible pipes) or equipment and can be important.2 Description of a safety system This paragraph discusses the basics of a safety system. the lower the pressure loss. piping. and its design characteristics needed in order to design a HIPS. GM_EP_ECP_260_00_EN. Examples of such diagrams are provided in Appendix 2 and Appendix 3. and the lower the design pressure required (especially for long pipeline networks). operating and protection barriers setting values (for a given condition) should be represented on a diagram. Whenever applicable. Values associated respectively to upstream and downstream parts of specification break (usually choke valve location) should be clearly distinguished.doc .1 Installation characteristics table In order to visualize the installation characteristics of a design.

Such failure would however possibly be considered in one or more incident scenario(s) (refer to CR EP HSE 041). In conjunction with the table representing the response of the safety system.of protection). A safety system is designed with several protection barriers which trip successively (different layers .or levels . the action of the protection barriers must be presented clearly.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 22/58 The set points of a protection barrier must be chosen in relation to operating and design conditions.2. but also set points of other barrier(s) of the safety system.2 Response of a safety system The normal response of the safety system is presented in this section. The response of each protection layer is described by: • the event for which the protection barrier should trip (for example: a blocked outlet).2.doc . • the actuators affected during the trip and configuration of all actuators after the trip (for example: end of valve closure). The response of a safety system can be described by the response of its protection barriers. taking no account of the potential failure of any of the safety system components. Therefore. • the initiator causing the protection barrier to trip (for example: high pressure detection). It must not be stored. This document is the official English version. GM_EP_ECP_260_00_EN. This diagram shall have a dedicated shut down bar on the shutdown logic diagram and should clearly identify: • components specifically dedicated to the HIPS • components common to the HIPS and the other barriers • components not used by the HIPS This document is the property of Total. 5. reproduced or disclosed to others without written authorisation from the Company. The response time of a safety system includes all protection layers. a shutdown logic diagram should be provided. Additional rules or guidelines concerning the setting of safety system components are provided in § 6. Each protection layer achieves a given safety function (in normal or degraded mode).

the setting and the type (preventive or reactive) of a HIPS. 6. GM_EP_ECP_260_00_EN.1.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 23/58 6. Example 1: Let's consider a pipeline arriving to a platform. • Having the least probability for causing excessive trips. it is safer for people and would have lower consequences on assets if the damaged section of the pipeline is far from the platform rather than being close to it. the risk on people and assets would be reduced if the pipeline is locally reinforced. Should this pipeline be subject to an overpressure risk.doc . It must not be stored. some pipelines (or equipment) are more critical than others. reproduced or disclosed to others without written authorisation from the Company.1. This document is the official English version. This document is the property of Total. HIPS design This chapter gives guidelines on the location.1 The location of a HIPS § 6. • For which simplified dynamic calculations can be used to ensure the required risk reduction.4 discuss and set out the criteria to be considered for the main elements normally forming part of a HIPS.2 Local reinforcement of the installation Within an installation.1 HIPS position within the installation The choice of HIPS location must be driven by the following basic design rules. In that respect. the preferred option from a process point of view is the one: • Allowing the longest reaction time before a critical event occurs. Consequently.1. 6. the design of specific sections of the installation may be locally reinforced so that these critical pipelines (or equipment) are mechanically protected against critical events. • Requiring the simplest set of components and links between them and being easily accessible for testing and maintenance. Among all possible HIPS locations and configurations. 6. The sections that are not reinforced would be damaged first: they are the "fuse" in case of incident.1.1 to 6.

1. The HIPS valves should be located as far as possible away from any potential cause of blocked outlet (in order to lengthen the allowable reaction time for the HIPS). This document is the official English version. For that case. It must not be stored. no automatic valve should be installed on the de-rated section just after a HIPS).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 24/58 Platform The event “pipeline bursting close to the platform” may have a high severity due to the presence of people nearby.1. 6. High design pressure network Low design pressure network Pipeline at risk in case of incident scenario Figure 2: place of overpressurization risk 6. In the worst case. Therefore. reproduced or disclosed to others without written authorisation from the Company. the whole production can be jeopardized if the riser needs to be replaced. Platform By comparison. we would consider that a subsea flowline is bursting instead of a riser line and/or flexible jumper. For that purpose. initiating events of incident scenarios must be considered.3 Location of HIPS valves The location of HIPS valves is of utmost importance when considering the adequacy of HIPS response with the dynamic behaviour of the effluent. the consequences on assets if a riser line is damaged may be severe (possible “side effects” and escalation of consequences with the damage of other riser lines). GM_EP_ECP_260_00_EN. If the HIPS valves (and the specification break) are located close to a source of hazard. the required response time will have to be very short and possibly too short to even allow designing the HIPS according to specifications.4 Location of HIPS sensors Hazards associated to the fluid composition The following hazards in relation with the fluid composition must be assessed: • Hydrate This document is the property of Total. Moreover. the event “section bursting far away from the platform” has a lower severity for people than the previous event.doc . the consistency of HIPS valves location within the installation must be checked versus specific points such as the location of other valves (for example.

• methanol flushing. a by-pass line may have a smaller diameter or may be fitted with a smaller choke valve (lower Cv) than the production line. design condition and other instruments setting. Requirements on dynamic response and instrument settings are included in GS EP SAF 260.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 25/58 • Paraffin / Wax • Scales / Deposit • Sand The risk is that the tapping of pressure sensors of the HIPS is blocked. Locating sensors upstream the specification break implies that more unwanted activations of the HIPS could occur than when sensors are located downstream. 6. 6. the sooner the HIPS reacts. the reaction time of HIPS valve may be too slow to prevent dynamic effects threatening the derated sections of the installation. The HIPS response time is always faster if sensors are located upstream the specification break. GM_EP_ECP_260_00_EN. the lower the consequences of dynamic effects will be. This diagram is important because the HIPS set points are chosen respectively in relation to operating condition. This section does not address inhibitions.1) allows identifying clearly the relations between the different conditions (operating. This document is the official English version. etc. considering a possible damping of peak conditions (below design conditions) on the way from upstream measurement point to the downstream de-rated section of the installation.doc . Such a HIPS may trip even if no hazard actually threatens downstream pipelines/equipments.2 HIPS setting The installation characteristics table (see § 5.). This document is the property of Total. If the sensors of the HIPS are located downstream the specification break. • selecting impulse lines with 2" minimum connection (as prescribed by GS EP SAF 260). design. • trace-heating impulse lines and installing the sensors in heated enclosures. reproduced or disclosed to others without written authorisation from the Company.2.1. In that case and if a conventional relief system is installed and designed for the maximum flow through the by-pass line or the fully open small choke. This risk can be mitigated by: • suitably locating the sensors tapping. Any by-pass shall be clearly described as such in the HIPS dossier.5 By-pass of a HIPS No by-pass of a HIPS shall be allowed at any time (neither during normal operation nor during restart) unless: • By-pass line is protected with a HIPS valve as is the production line • No critical event may occur during operation through the by-pass line (small diameter plus conventional relief system designed for the maximum flow through the by-pass line) For example. If dynamic effects are fast. instruments setting. then the by-pass line may not be equipped with a dedicated HIPS valve. The maximum Cv of the small choke valve must clearly be specified. It must not be stored.

doc .2.2. The setting of relative trip levels of all protection barriers including HIPS may be complex and vary between developments." [GS EP SAF 260] 6. in start-up & shutdown conditions and in case of incident scenarios. 6. compressibility of the fluid must be duly considered.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 26/58 6. a sufficient margin must be taken between operating condition and HIPS set points (see § 6. As a consequence. For that purpose.3 HIPS response time Dynamic simulations allow evaluating and quantifying the process dynamics in normal and abnormal operating conditions.3 HIPS setting vs.1). Example: The margin between normal operating condition and the HIPS tripping condition may need to be greater for an oil system compared to a gas system as the oil system can pack up quicker as the fluid is incompressible. GM_EP_ECP_260_00_EN.1 HIPS setting vs.2. 6.2 HIPS setting vs. reproduced or disclosed to others without written authorisation from the Company. "The design shall minimise the demand rate of the HIPS. operating conditions First. the fluctuations of operating pressure due to vicinity of a choke valve. other protection barriers setting The HIPS should trip after all other safety barriers but before pressure-relief barriers.3).2. This document is the property of Total." [GS EP SAF 260] If this cannot be achieved. It must not be stored. ESD system). For that purpose. if any. This document is the official English version.2. but at the lowest possible value compatible with operating flexibility. Example: Trip settings for gas fields can be closer to each other than oil field trip settings due to the influence of the compressibility of the product 6. The dynamic response of the system is of primary importance regarding that last issue.4 Confirmation of set points The confirmation of HIPS set points is usually made using dynamic simulations (see § 2). hence the reliability of the whole protection is impacted. the HIPS set point(s) must be set above normal operating condition (plus margin) as well as above the primary safety barriers (PSS. A possible drift in the sensor calibration should be considered (when critical). design condition "The set point of the sensor(s) activating the HIPS barrier(s) shall be such that the full isolation of the source is achieved before the conditions exceed the maximum allowable incidental conditions of the equipment. Also the margin should be sufficient to allow setting the other protection barriers (see § 6. Note that increasing the margin tends to reduce the number of spurious trips. due to the fast dynamic of the incident. slug flow in a multiphase fluid. the demand rate on the HIPS itself.2. the set point of the sensor(s) initiating each barrier shall be such that the activation of the other barriers is avoided during its operation.

6. When the HIPS prevents a certain scenario to start off. the architecture of the whole safety system should be further optimized in order to attain an acceptable required reaction time. shall be three times shorter than the calculated time for the upset condition to reach the maximum allowable incidental conditions of the equipments. the main output of the simulations is the time for the upset condition to reach the maximum allowable incidental conditions of the equipments. When fast-acting barriers are required.1. then the configuration (or even the implementation) of the HIPS must be reconsidered.4 Preventive or reactive HIPS Depending on the way the HIPS protects against an hazard. In case of overpressure this HIPS normally consists of pressure sensors closing isolation valve at a certain pressure level. When the HIPS reacts on a certain scenario which has already started off (often detected as an increase of pressure) and protects by isolating/stopping the source of hazard. reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN. This document is the official English version. from safety initiation to total completion of isolation. both HIPS can be implemented to protect against the same hazard." [GS EP SAF 260] If the HIPS response time is found to be unachievable. (preventing the initiating event to occur) the HIPS is referred to as a preventive HIPS. which may have worse consequences than the primary critical event. Mokveld). Depending on the required reliability of the HIPS.1). pressure surge or water hammer). This document is the property of Total.g. the HIPS is referred to as a "reactive HIPS". Two main drivers must be considered for the choice of the type of HIPS: • The dynamics of the system and associated HIPS required response time • The production availability and excessive trips of the HIPS The main driver for the choice of the type of HIPS is the HIPS required response time (refer to the safety specifications defined in § 2). It is clear that in the case of a "reactive HIPS" dynamics (reaction time) of the HIPS play an important role. when certain conditions (pressure level) are not satisfied.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 27/58 For the determination of required HIPS reaction time. This type of HIPS is often combined with an interlock preventing the opening of the HIPS valve(s) when another isolation valve is open. such as axial valves (e. If not. It must not be stored. the HIPS can be classified as a "preventive" or a "reactive" HIPS. the dynamic analysis must confirm that a HIPS with the adequate reaction time is feasible. closely associated with the HIPS position within the installation (see § 6. Normally this consists of sensors upstream of a specification break preventing an isolation (HIPS) valve to be opened.g. The closure time of the HIPS valve(s) is a major contributor to the overall response time: • Typical closure time of standard valves: between 1 and 2 seconds per inch • Better closure times can be achieved by using fast acting valves. One should be aware that these are not piggable and that no partial stroking tests can be done. In any case. due consideration must be given to possible "secondary" effects (e.doc . A specific requirement on dynamic response of the HIPS is included in GS EP SAF 260: "HIPS overall response time.

5. mechanical adaptation is preferred respectively to software limitations and procedural adaptations. low injection) until the system design is back to: • A "Safe-by-design" configuration • Within the capacity of the conventional safety system (e.2. This document is the property of Total. the condition of the source of hazard (e.g. either the HIPS should be designed to the future conditions or an upgrade of the HIPS or the installations should be planned (if expected to be required). 6.doc . To cope with the change of the conditions during field life.2) shall be taken into account.1) as well as changing reservoir conditions (see § 6. If it is planned to connect a more stringent source than the actual ones. a complete re-assessment of the risks must be carried out (the HIPS dossier must be updated).1 Accounting for future developments When designing a HIPS. This document is the official English version. Before any modification is applied on the HIPS (or when the HIPS is decommissioned). 6.5. refer to the case of the adaptation of the Cv of a choke valve to inlet flow rate (see § 7.1).g.5 HIPS adaptability throughout design life When designing a HIPS the adaptability to future developments (see § 6. This adaptation shall be indicated on the P&ID's. reservoir pressure) may decrease with time (natural depletion. TDO/EXP/SRI entity should be consulted on that matter. 6. It must not be stored.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 28/58 Note: The choice of reactive or preventive HIPS has noticeable consequences on reliability calculations. possible future well tie-ins / extensions or flow rate increases requiring higher design conditions must be taken into account. reproduced or disclosed to others without written authorisation from the Company.5. ESD + PSV) In such case.2 Modification of the characteristics of the source of hazard In the case of a reservoir.5. Dynamic studies must be updated before each new tie-in or flow rate increase and adequacy of HIPS sizing verified. the HIPS might not be required any more. GM_EP_ECP_260_00_EN. For example.

The calculation cases related to the HIPS are then only particular cases of these simulations. In case insufficient (or not reliable) well data is available the wells shut in time.1 Dynamic simulations Before the HIPS is designed. to confirm the performance of the safety system including the HIPS 5. etc. initial pressure…). GM_EP_ECP_260_00_EN.both possibly being not consistent with each other). Simulations shall be carried out on the basis of pre defined scenarios. the required HIPS response time) . More details on scenarios can be found in 10. optimization (if required) of all other settings (SDV closure time. multiphase and process dynamic simulations should be coupled. Calculations must be performed not only during shut-down events but also during start-up or restart of the installations. If not. 7. Attention must be paid to the fact that the model and parameters for the HIPS related simulations are consistent with those of the initial simulations (the typical unwanted situation is when the HIPS design is fully contracted and when the contractor builds a new model instead of using the existing one . to define on a preliminary level the HIPS specifications (incl. to set the different protection barriers • During basic and detailed engineering: 4.2 Choice of the dynamic simulator If applicable.1. or otherwise during project basic engineering): 2. conservative data must be selected for input parameters and system conditions of each separate dynamic simulation (for example: liquid hold up. reproduced or disclosed to others without written authorisation from the Company.prior to HIPS installation 3.doc . 7.) 7. In some (very simple) cases a spreadsheet calculation with conservative assumptions tuned against a steady state dynamic calculation can be fit for purpose. Process Dynamics This chapter describes the components impacting the process dynamics and the subsequent simulations.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 29/58 7.1. This document is the property of Total. PSV settings.1 Purpose of dynamic simulations The purpose of the dynamic simulations during the different phases of a project is: • At pre-project stage using typical assumptions for critical equipment (if deemed necessary. behaviour and riser pressure should be kept constant (well to be modelled as infinite source with constant molar flow rate). steady state and dynamic simulations have generally already been performed for standard equipment design and flow assurance purposes. These scenarios shall be established by the process engineer and field operations engineer based on credible configurations. optimization (if required) of the set points of the HIPS barrier 6. This document is the official English version. It must not be stored.

the Cv of the choke is critical because it determines the maximum relief rate. In this way the HIPS is to protect against exceeding the radiation criteria (or apply a less stringent category of the radiation criteria.2.doc . In that case. 7.2 Arrangement of installations & incident scenarios A pressure-relieving system is designed for a given flow rate. It shall be clear that (as is with all HIPS) such a HIPS (as all HIPS) is not an option given preference by COMPANY and a Project aiming to implement such a HIPS shall justify with strong arguments its choice. A HIPS is then implemented to avoid exceeding the relief flow of the flare in terms of radiation. see GS EP SAF 262) of the flare and not against over pressurizing the installation. In some cases (especially when there is a large gas flow) the required relief capacity cannot be installed since it would require a very high flare to satisfy the radiation criteria (see GS EP SAF 262). consequences are expected (see § 7.1. the HIPS could then be classified as a SOFT HIPS instead of a HARD HIPS. as soon as the relief flow rate exceeds this capacity (while the pressure of the protected equipment being above the relief pressure). depending on the outcome of the hazard assessment as per CR EP HSE 041. It must not be stored. As long as the required relief flow rate remains within the pressure-relieving system capacity. This document is the property of Total. One should be aware that results obtained from simulation programs are not always reliable (water hammer for example is known as a phenomenon that is often not well calculated). This document is the official English version. Since the consequences of a failure on demand of the HIPS are not the same in these two cases.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 30/58 The time interval (step) taken in thermodynamic calculations shall be sufficiently small in order to not miss the peak (maximum) in the results of the simulation. • Maximum liquid hold-up in pipeline. GM_EP_ECP_260_00_EN.2. 7. 7. However.3 Choice of the operating parameters The operating conditions used in the simulation shall be chosen with a conservative approach. A 100 percent gas flow gives other dynamics results than mixed flow. reproduced or disclosed to others without written authorisation from the Company. typically: • Maximum operating pressure (at PAH) • Maximum liquid level in separator (at LAH) for the blocked outlet or gas blow-by from the upstream section case.1 Influence of choke characteristics A common incident scenario involves the full opening of a choke valve when there is no pressure-relieving system or the pressure-relieving system is not sized for full flow.3 for detailed considerations on dynamics). If deemed necessary both cases shall be studied. and differences of up to a factor 3 have been found between results obtained with different software programs. • Minimum liquid level in separator (at LAL) for the gas blow-by to the downstream section case. In this case one could investigate the possibility to satisfy the flow criteria of the flare for the maximum relief capacity needed without completely satisfying the radiation criteria. no consequences are expected.

the maximum relief rate is modified (see § 6.5). If during field life. The conventional sizing of a relief system shall be made in accordance with the failure cases addressed in GS EP SAF 262 and GS EP ECP 103 (fire.1. Indeed. The following measures can be taken to suppress the hazard: 1. Operational procedures limiting the risk of wrong setting of the choke valve opening 7. the opening/closure time of the ESDV/SDV is critical. a reassessment of the installations design must be done so that the hazardous event "Overflow" is prevented. This may be achieved by implementing 2 choke valves (of different size.2. other protection layers (including HIPS) may be activated improperly. if the opening time of an ESDV/SDV is too quick. initial calculations must be updated: • Confirm choke valve sizing philosophy ("try to reduce choke valve Cv's"). Adequate re-sizing of the choke valve with regard to the maximum capacity of the relief system. 2. An ESDV/SDV interlocking logic can often be used in order to avoid problems due to opening dynamics. It must not be stored. 7. the characteristics (in particular opening/closure time) of all other valves which are part of the safety system have to be set so that the dynamic response is optimized (see § 2). • Revise choke valve sizing and high pressure trip settings based on updated production profiles.2 Influence of SDV characteristics In other scenarios involving the spurious closure/opening of an ESDV/SDV. etc. In addition. One of the chokes being isolated in case of process upset conditions and the other one being sized such that it cannot overpressure the downstream part of the installation. As the design of the system becomes more detailed.5).1. an opening time higher than usual may be specified for the ESDV/SDV. if necessary) in parallel to cover the whole range of operating conditions. A throughput close to the maximum valve capacity is reached when the valve is only opened at a few percent. if the closure time of a SDV/ESDV (part of a protection layer) is too long.).doc .2. In such case. reproduced or disclosed to others without written authorisation from the Company. multiple wells relief.3 Influence of pressure-relieving devices The combination of an instrumented barrier (typically PSS/ESD system) and a mechanical barrier (typically a PSV) constitutes the conventional design of a safety system (see § 5. This document is the property of Total.3).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 31/58 A good design practice is to specify a maximum Cv of the choke so that the maximum relief rate remains within the capacity of the pressure-relieving system (if any). Software limitation of the allowable opening of the choke valve 2. GM_EP_ECP_260_00_EN. Installation of a mechanical stop on the choke valve or a restriction orifice (fixed choke). This document is the official English version. the HIPS may not have the time to react before the maximum allowable incidental conditions are reached. In most cases this is difficult to achieve since the flow when opening is not linear with the time. For example. failure of control valves. (See also Figure 3 in § 10. Note that the following measures are not approved by the HIPS Committee: 1.

incident scenarios (due to design constraints or for example the connection of a new network to an existing flare). such as: • The fire case. opening of a PSV during the HIPS barrier activation).Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 32/58 The design requirements from GS EP SAF 262 and GS EP ECP 103 regarding normal and peak flow rates to the flare shall also be followed. yet remote.g. As a base case.e. initial calculations must be updated: • Update Separator and Piping Volumes (line sizing and improved piping layout) • PSV sizing • PV sizing calculations (try to reduce PV size to reduce flaring rate) If eventually no solution is found acceptable (required HIPS reaction time too short.3): the set pressure should then be adjusted in order to ensure that the pressure peak in the separator remains below PSV accumulation pressure. This document is the property of Total. The allowable HIPS reaction time is consequently increased. against which a solely instrumented protection is not sufficient. If required.2. some interactions could be accepted (e. However. Moreover. PSV must be sized for full flow gas and liquids). all interaction should be avoided (see § 6. the PSV may lift while the HIPS valves are not fully closed). As part of the above design optimisation. against which HIPS protection are generally not accepted by the HIPS Committee (i.g. If a pressure-relieving device can be installed but can not be sized for some realistic. As the design of the system becomes more detailed. then the installation of a HIPS in addition to the flare could be considered. other measures must be implemented. This document is the official English version. As a HIPS shall be designed only for protection against a single incident. • The liquid over case. GM_EP_ECP_260_00_EN. the installation of conventional safety barriers (such as PSVs) might be required for others scenarios. flaring rate too high). HIPS and the PSV/PV are activated simultaneously. an increase of downstream facilities design pressure should be considered to allow setting trip points in order to avoid interaction. The possible interactions between different protection barriers must be carefully studied (e. Even if not sufficient to protect against some critical events. the HIPS reaction time should be minimised to limit the duration of the relief to the flare. the action of pressure-relieving devices is beneficial in terms of process dynamics as they slow down the rate of pressure surge. the increase of the equipment design pressure could eventually be considered if not leading to detrimental impact on downstream equipment gas blow-by protection or on overall EDP flow rate. additional load on topsides may not be feasible. pending on dynamic simulation results. The opening of spill off PV's (not a safety system) to the flare system can not be counted on when calculating the needed HIPS reaction time. Therefore the influence of pressure-relieving devices must be duly taken into account in calculations. It must not be stored. reproduced or disclosed to others without written authorisation from the Company.e.doc . In such a case i.

keep a record of the design features and choices. reproduced or disclosed to others without written authorisation from the Company. 7.doc . 4. • Detailed engineering: 8. Depending on the status of the project and the HIPS dossier. 2. (in co-operation with Safety Engineer) This document is the property of Total. It must not be stored. The HIPS requirement shall be identified in the SOR. demonstrate that the HIPS alone meets the safety targets. Perform Detailed and quantified analysis of risks & SIL achievement (by Instrumentation Engineer) 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 33/58 8. Update preliminary risk assessment & SIL assessment (by Safety Engineer) 9. 3. Confirm the HIPS category. This document is the official English version.1 Objective of the HIPS dossier The aim of the HIPS dossier is to: 1. including the HIPS. All deviations from the HIPS design specification (GS EP SAF 260) are identified and derogations requested. Estimate SIL requirement (by Safety Engineer) The preliminary HIPS dossier shall be issued to the HIPS Committee. 8. in case of a HARD HIPS (refer to CR EP HSE 042). the HIPS Committee might decide that no further HIPS Committee meetings are needed. and issue the derogation request. describe the HIPS system and the operating philosophy. and aims to complete (from a process engineering point of view). HARD or SOFT. is acceptable. HIPS Dossier This chapter describes the HIPS dossier. HIPS justification and preliminary design 3.2 Submission of the HIPS dossier A tentative planning for the submission of the HIPS dossier must be followed: • Pre-project: 2. GM_EP_ECP_260_00_EN. the information already given in GS EP SAF 260 and CR EP HSE 042. Perform SIL assessment (by Safety and/or reliability Engineer) The HIPS dossier shall be issued. evaluation (by Safety Engineer) 4. demonstrate the overall probability of incidents evaluated in taking into account all relevant protection layers. Perform hazard identification and preliminary risk assessment (this should include a consequence analysis as well as a preliminary HIPS category. • Basic engineering: 5. Update hazard identification and preliminary risk assessment (by Safety Engineer) 6. 8.

2 HIPS dossier The HIPS dossier shall be submitted during the basic engineering phase and shall contain: • Update of HIPS justification against industry standard. the preliminary set points of the protection barriers including the preliminary set points of the HIPS • HIPS Design and OPERATING PHILOSOPHY.PSS. the PFD (corresponding to a SIL) of the whole safety installation after HIPS installation. demonstrating that the reaction time of the HIPS is sufficient. • Safety Integrity Level (SIL) required of the whole protection system (corresponding to a required PFD and vice versa). • The locations of de-rating of the installation. the PFD of the applied HIPS components. • The process dynamics study. 8. the PFD (Probability of Failure on Demand) of the (regular) safety system components prior to HIPS installation. dynamic studies if applicable. This document is the property of Total. and shall contain the following: 8. 13. protection selected for management of the hazard. GM_EP_ECP_260_00_EN.1 Preliminary dossier The preliminary HIPS dossier shall be submitted during the pre project phase and shall contain: • HIPS justification against industry standard.doc . • Update of the consequence analysis. associated ESD logic. 8. • Update of the hazard assessment. • Consequence analysis: evaluation of the consequences of the hazard. This document is the official English version. the PFD (corresponding to a SIL) of the whole safety system prior to HIPS installation. reproduced or disclosed to others without written authorisation from the Company.3). It must not be stored. • HIPS design principles. 12. HIPS). including the demonstration of : 11.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 34/58 The final HIPS dossier shall be issued to the HIPS Committee. and the Probability of Failure on Demand (PFD) required for the (regular) safety system and the applied HIPS components. • The Hazard assessment: identification of sources of hazard (hazard scenarios).3. ESD.3. • HIPS detailed specification for the engineering and construction phases. (see § 6. 14. HIPS demand rate evaluation (preliminary evaluation of the frequency of occurrence of the hazard scenario triggering the whole protection system .3 Content of the HIPS dossier The content of the HIPS dossier is prescribed in GS EP SAF 260 as well as CR EP HSE 042. • The pressure settings diagram (See Appendix 2 and Appendix 3).

Testing and Repair policy with a frequency to be defined based on availability calculations. Calculation notes (as for example dynamic calculations when required to demonstrate that the response time target is reached). • The restart procedure after a trip of the HIPS. 22. including: 15. Cause & Effect Charts. It must not be stored. logic solvers. (see § 6. 21. Diagnostic coverage of failures. This document is the official English version. 8. Material selection (instrument data-sheet. final control elements) have been selected. GM_EP_ECP_260_00_EN. 17. The dynamic studies shall demonstrate that the reaction time of the HIPS is sufficient. 20. 19. 16. Piping & Instrumentation Diagrams (P&IDs). Process and Safety Diagrams (as defined in GS EP ECP 105) must be provided. • Dedicated HIPS Maintenance. • Engineering documentation including : 18. The HIPS shall have a dedicated shut down bar on the shutdown logic diagram.doc . Detailed common cause/ mode failure analysis. …). All valves characteristics which are key elements of the protection by a HIPS are documented as such in the instrument data sheets: this includes the Cv's of chokes. This document is the property of Total.4 Specific requirements for process documentation HIPS components must be clearly identified as parts of HIPS on P&ID's and Shutdown Logic Diagrams. an exact graphical scheme of the HIPS. at detailed design phase when the HIPS components • (sensors. Effect of spurious failures on the availability of the production installation. when applicable. closure times of the fast acting valves and the opening time of the chokes and SDV's.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 35/58 • Reliability and availability calculations (SIL achievement). reproduced or disclosed to others without written authorisation from the Company. vendor curves.3). ESD Logic Diagram. 23.

by design. carry out maintenance on HIPS. temperature etc. • The design of the HIPS shall be such as to avoid a very high testing frequency of its components (more than once every six months) needed to maintain its required SIL. • Dead oil circulation. This document is the property of Total. reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN. the start-up shall not require a by-pass or inhibition of the HIPS.doc . to be considered for the setting of sensors / valves. etc. start up. It must not be stored. • The Operating Philosophy shall describe all operations necessary to operate the HIPS (including but not limited to the test and maintenance policy). slug management. Operational Constraints The following operational constraints shall be checked when designing a HIPS: • A rigorous operations organisation must be put in place particularly defining qualifications/competences required to adjust HIPS related settings. • Verification if a HIPS valve needs to be pigged (and in that case can be pigged). • The maintenance and test programme shall ensure the needed reaction time is guaranteed throughout the life of the HIPS. This document is the official English version.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 36/58 9. the dynamic calculations • After a trip of the HIPS.

Examples: • AKPO.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 37/58 10. "safe by design") would be too costly and would have a significant weight impact on the installations. Normally a flare system is in place.1 Typical riser HIPS scenarios This paragraph lists the scenarios to be considered to design a riser HIPS upon.1. This document is the official English version. but using feedback of already designed HIPS can improve and ease the preliminary process design. It must not be stored. adequately sized PSV's are provided on the test and 1st stage separator (as per API RP 14C) to ensure overpressure protection for the following scenarios: This document is the property of Total. the de-packing flow rate could exceed the flare network design capacity.k. 10. The central critical event associated to this scenario is over-pressurisation of topsides equipment (both first stage and test separators) and piping (production and test headers. The de-packing scenario requiring sometimes a relief capacity of up to 5 times the blocked outlet scenario (the second most restricting relief flow scenario). Rosa. CLOV. depending on the location of the pressure break) due to the presence of a high pressure source at the top of riser and in case of uncontrolled opening of a choke valve or unwanted opening of a (E)SDV. Forvie. Dalia. but it can not be sized in a practical way for all incident scenarios. reproduced or disclosed to others without written authorisation from the Company. making the installations unfeasible. Additionally there is a risk of over-loading of the flare system. Pazflor. In addition. This scenario involves the packing of the upstream lines up to the Topsides (Maximum Riser Head Shut In Pressure) at high pressure (above downstream design pressure). De-packing case The de-packing case is the most common design case for a riser HIPS. L4G The riser HIPS (especially on FPSO's) is generally justified by the following: • A full pressure (at WHSIP) rating (a. Egina. It shall be clear that each HIPS design is unique for each case. Usan.5) is used to protect a derated part of an installation after a specification break at the arrival on FPSO / platform.1 Riser HIPS The riser HIPS (an example with schematic overview is given in 10. Applications of HIPS This chapter provides the various applications of HIPS and some practical examples. from all PSV's both on the headers (when applicable) and on the separator(s) plus the separator(s) PV relieving simultaneously in case of the incident scenario.1. GM_EP_ECP_260_00_EN. Moho-Bilondo.a. Glenelg. 10. In case of incident. • A conventional overpressure protection system relying on a primary protection provided by a PSHH which isolates all high pressure feeds and a secondary protection provided by a relief valve would be unpractical for the de-packing scenario.doc . Therefore the HIPS may have to ensure both over-pressure protection and flare system overloading protection and be designed accordingly. thus requiring a very large flaring capacity.

Opening of a SDV upstream of the large choke Case Scenario Opening of a large choke valve or PCV 1. a de-packing scenario associated to a blocked outlet on test or first stage separator would be the most onerous scenario in terms of process dynamics. the flare must be sized for a blocked outlet on test or first stage separator with maximum operating flow. Restart of the fully packed riser after a shutdown 2. This is the most restricting scenario.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 38/58 • Full blocked Outlet (liquids and gas) at facilities design flow rate. credible packed conditions (with some sub-sea choking at the wells) and gas-lifted operations. This document is the property of Total. reproduced or disclosed to others without written authorisation from the Company. when applicable Case Scenario Opening of a SDV 1. a review of the flowing pressure conditions during normal operation. Opening of one Riser ESDV *: or at gas lift circulation pressure. Upstream pressure at PSHH trip pressure 3. Depacking with blocked outlet As a base case. simultaneously with a packed riser is to be evaluated in order to assess its credibility. Restart of the fully packed riser after a shutdown 2. However. Upstream pressure at PSHH trip pressure 3. In addition. GM_EP_ECP_260_00_EN. • Fire The first scenario discussed is the opening of riser ESDV at maximum packing pressure. Packing of the Riser at RHSIP * 2. It must not be stored. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open 3. the causes and common mode of the spurious opening case on the various risers. but less probable than the other scenarios to occur. This document is the official English version.doc . Failure open or spurious opening of one (or more) of the large choke valves The spurious opening of a number of chokes. Case Scenario Opening of the Riser ESDV of a packed riser 1. A fault-tree analysis of the operating scenarios should be developed in order to determine their probability of occurrence. consistent with the production profiles should be carried out.

Blocked outlet on test or first stage separator 4. Table 2: Scenarios studied for CLOV riser HIPS 10. find the following table listing the scenarios studied for the riser HIPS of the CLOV FPSO. Spurious opening of SDV1 Lirio through both chokes (flowline packed at 43 barg) with 3 other flowlines producing in packed conditions (100 barg).doc . ¹These choke valve failure cases are assumed to occur during normal (multiphase) production and thus the chokes handle both liquids and gas in these scenarios. Choke failure cases¹ 1 2 Main choke Lirio failure (flowline producing at 43 barg) with 3 other flowlines producing in packed conditions (100 barg). reproduced or disclosed to others without written authorisation from the Company. Spurious opening of SDV1 Lirio through start up choke (flowline packed at 100 barg) with 3 other flowlines producing in packed conditions (100 barg). Blocked outlet on test or first stage separator 3. Upstream pressure at PSHH trip pressure 2. The failure case considered is damage to the choke valve trim due to a large solid item passing through the choke. This document is the official English version. This document is the property of Total. It must not be stored. A solution can be to use one (E)SDV for two shutdown actions by using one dedicated solenoid for each action (see GS EP SAF 260).1. GM_EP_ECP_260_00_EN. Start up choke Lirio failure (flowline producing at 100 barg) with 3 other flowlines producing in packed conditions (100 barg).2 HIPS location & architecture The conceptual design of a HIPS must take into account piping layout issues in congested areas: one should not install too many valves in serie. Packing of the Riser at RHSIP * 2. Route through SDVs / Choke Valves / ROVs up to downstream piping and separator is open 3.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 39/58 Case Scenario Opening of one Riser ESDV 1. Depacking cases 1 2 3 Spurious opening of ESDV Lirio (flowline packed at 240 barg) with 3 other flowlines producing in packed conditions (100 barg). Opening of a SDV upstream of the large choke For an example of a list of scenarios studied for a HIPS design. In this instance the downstream valves are OPEN. Opening of one Riser ESDV *: or at gas lift circulation pressure Case Scenario Opening of a SDV 1.

10. during field life operation. see Appendix 2). This will reduce the risk of confusion. The HIPS architecture is selected with due consideration of the pressure rating breaks and of the normal and start-up pressure range (as defined by the flow assurance study and plotted on the pressure settings diagram. The interlock can also be implemented or reinforced by using mechanical interlocks. The following could be implemented: • one logic solver per production loop treating the preventive HIPS and reactive HIPS barriers (in case of one PSHH set per branch). reproduced or disclosed to others without written authorisation from the Company. or • one logic solver per production loop treating the preventive HIPS and one common logic solver for the reactive HIPS (in case of common set of PSHH on each manifold).1. the location of piping class rating break should be as close as possible to the separators. However in case the interlock is part of the HIPS function. The following shall be taken into account for the dynamic simulator model: • Actual volumes calculated from line isometrics and vessel data sheets • Actual pressure profile from inlet ESDV's to Separators calculated from line isometrics This document is the property of Total. Both first stage and test separators (with control loops. it shall be incorporated in the dedicated HIPS logic solver. if applicable) shall be considered. The location of piping class rating break downstream of the manifolds is recommended. one could apply the following interlock: • An interlock preventing ESDV opening while downstream SDV's and choke valves are not closed Interlocks which are not part of the HIPS function can be programmed into the PCS or ESD system.doc . Several production loops: Given the probable difference in preventive HIPS set points.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 40/58 The installation of a spool for the implementation of one or more dedicated HIPS valve(s) may be considered during the detailed design in order to attain the required SIL. Production manifold fully rated after choke valve: The specification break should be after the SDV just upstream of the production/test separator. it is recommended to install one dedicated logic solver for these preventive HIPS barriers per production loop. From a general point of view. It is recommended to specify it at the vessel flange. Location of sensors: The installation of preventive HIPS barriers upstream of the riser chokes is recommended in order to limit maximum upstream pressure during packed operation. GM_EP_ECP_260_00_EN. It must not be stored. This document is the official English version. Interlocks: To minimize the risk of over pressurization due to spurious opening of valves having a packed pipeline upstream.3 Dynamic simulations Dynamic simulations shall be performed to determine / confirm the required HIPS reaction time and set points.

4 Risk mitigation measures The purpose of this paragraph is to identify additional mitigation measures that could be considered to prevent the cause of an accidental scenario from happening (reduction of the risk). The HIPS valves shall thus come in addition to the (outboard) riser ESDV. • When HIPS valves are shared with the PCS and/or ESD system. reproduced or disclosed to others without written authorisation from the Company. pilot type) of PSV's • Actual HP flare network volume and pressure profile calculated from line isometrics and HP flare tip characteristic • the choke valve's Cv and opening curve (vendor data). This document is the official English version.1. • The use of a dedicated HIPS valve should be considered. This document is the property of Total. GM_EP_ECP_260_00_EN. representing the riser HIPS proposed for the CLOV FPSO. the HIPS function shall have dedicated solenoids actuating these valves (refer to GS EP SAF 260). 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 41/58 • Maximum liquid level in the separator / maximum operating pressure in the separator • Actual ON/OFF valve characteristic (Cv as function of % of opening) and actuator law on opening and closing (stroke versus time) • Actual size and characteristic (e.g. unless it is demonstrated that the implementation of dedicated HIPS valves does not yield a significant improvement of the SIL of the whole protection.5 Riser HIPS example An example of a riser HIPS is given in Figure 3. 10. The following risk mitigation measures should be taken into account when designing a HIPS: • The (outboard) riser ESDV shall not be used as a shared HIPS valve (except for the reopening interlock). It must not be stored.doc .1.

This document is the official English version. manual or spurious action). HIPPS1 PSHH10101A/B/C will initiate closure of SDV10102 upstream of the large choke valve. interlock logic is triggered to prevent re-opening of this ESDV if SDV10101A/B (B is the by-pass) are not closed. This document is the property of Total.5 barg Set @ 29barg Production Manifold PSS4 1500# 300# PSS4 PSS4 Set @ 25barg HP Flare PSHH 101xx PV PSS HIPPS1/2 1/2/3/4 HIPPS3 From Cravo / Lirio Right From O11 / OV Central Left From O11 / OV Central Right PSHH PSHH PSHH 10103A 10103B 10103C SDV10103 HP Compression SDV10102 Set @ 28 barg 2oo3 VOTING First Stage Separator HIPPS3 M M Pig Launcher / Receiver Set @ 43 barg PSS PSHH 101xx Set @ 27 barg To fulfil the SIL requirement this riser HIPS consists of a preventive protection system (HIPPS 1 and HIPPS 2). a reactive protection system (HIPPS 3) and a preventive interlock system. GM_EP_ECP_260_00_EN.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 42/58 Set @ 26. The small choke valve is designed to handle operating scenarios above 43 barg. and SDV10102. and SDV10102 upstream of the large and small choke valves. 4. This interlock function includes three detection means (2oo3 between smart valve position transmitter. HIPPS3 PSHH10103A/B/C will initiate the closure of SDV10101A/B. If the operating pressure rises to 43 barg upstream of the choke valves.doc HIPPS3 HIPPS2 HIPPS INTER LOC K Set @ 100 barg SDV10101A HIPPS1 (Note 1) HIPPS2 Set @ 40 barg Set @ 92 barg ESD PSS 2/3/4 ESD 2oo3 VOTING 2oo3 VOTING PSS1 PSS2 PSHH PSHH PSHH 10101A 10101B 10101C PSHH PSHH PSHH 10102A 10102B 10102C PSHH 101xx PSHH 101xx HP Flare (Flowline Depressurisation ) ESDV10101 Note: 1. for example during start-up. reproduced or disclosed to others without written authorisation from the Company. Upon any closure of ESDV10101 (via ESD. 3. xx: 01 or 04 HIPPS INTERLOCK Figure 3: CLOV riser HIPS schematic . 2. It must not be stored. If the operating pressure rises to 100 barg upstream of the choke valves. and the pressure measured by PSHH10102A/B/C has not decreased below 100 barg. The working of the HIPS systems (which comes in addition to PCS and ESD protection) is as follows: 1. HIPPS2 PSHH10102A/B/C will initiate closure of SDV10101A/B. If the operating pressure downstream of the choke valves rises to 28 barg. valve limit switch and pressure sensors on air supply). The logic is hard wired. SDV10yxxA provided with a bypass line (C/W SDV10yxxB plus globe ) not shown for clarity purpose .

This document is the official English version. A Venturi pipe could be studied as an alternative to prevent the flow from exceeding the flare capacity.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the riser HIPS which are given in § 10. It must not be stored.1. This document is the property of Total. but is not installed on a flow line arrival but on a pipeline.2.1). 10. 10.4. reproduced or disclosed to others without written authorisation from the Company.doc .2.5 Pressure let-down example An example of a pressure let-down HIPS is the HIPS design proposed for South Pars Phase 11 (not been constructed though).1.2. see Figure 4.2 Gas Plant Inlet Pressure Let-down HIPS The pressure let-down HIPS is very similar to the riser HIPS (see § 10.1 Typical pressure let-down HIPS scenarios The scenarios to be considered when designing a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10. GM_EP_ECP_260_00_EN. but could also be applied to protect a downstream pipeline with a lower pressure rating. 10.1.2. A pressure let-down protection is often installed at the inlet of a plant.1.2.4 Risk mitigation measures The risk mitigation measures which could be taken into consideration for the pressure let-down HIPS are the same as for the riser HIPS which are given in § 10. 10.2.3.1.2 HIPS location & architecture The location constraints and recommendations for a pressure let-down HIPS are the same as for the riser HIPS which are given in § 10. 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 43/58 The SIL this HIPS reaches against the most onerous scenario (depacking with flowline packed at 240 barg and choke valves completely opened) is a continuous SIL3. 10.

the SIL obtained by the architecture shown in Figure 4 has not been calculated. To protect a flow line downstream production wells.3 Subsea HIPS The subsea HIPS is generally an overpressure protection HIPS but with the difference that it is operating underwater and not on a platform. sealine) is packed above 110 barg. This document is the property of Total. as defined in DNV-OS-F101). when the flow line has a lower pressure rating than the WHSIP.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 44/58 Fire Zone Battery Lim it PSHHu/s Set @110 barg PSH H SP11 O NSHO RE PSHH Set @71 barg PSVFull Flow (1 BSCFD) ToFlare PSHu/s Set @90barg PIC ToFlare PSHH : 133 bara O ffshore . GM_EP_ECP_260_00_EN. No downstream reactive barrier is considered due to the extremely fast pressure surge dynamics which would lead to unrealistic valve closure time (circa 1s).O nshore: 135 km BXV CLO SE PV toFlare PSH H PC O FFSHO RE SEA LINE INSTA TIO ESDVs LLA Offshore ESDVs Incom ing Slugcatchers SDV-1 ESDV ESDV -025 -026 ESDVs Export is CLO SED LNG PLA NT DesignPressure: 139 barg Design Pressure: 75 barg Figure 4: South Pars Phase 11 pressure let-down HIPS The main principle of this HIPS (pipeline diameter is 30") is based on installing preventive barriers upstream of 3X33% PCVs in order to: • isolate the low pressure rated unit (separators. This document is the official English version. Since the study on South Pars Phase 11 did not come to a very detailed phase. The reason to use a pressure let-down subsea HIPS could be to allow production flow lines or pipelines to have a lower design pressure than the MIP (Maximum Incidental Pressure. A subsea HIPS is a lot more difficult to design. FPSO or onshore. reproduced or disclosed to others without written authorisation from the Company. The installation cannot be overpressured by depacking at 110 barg through one PCV only. It must not be stored. This HIPS will normally only be used when having a subsea production system without satellite well platforms. 10.doc . gas heater) from the high pressure source when the upstream system (slugcatcher. • close two inlet PCVs (by action on upstream SDV's on each branch) according to upstream pressure rise. There are two general cases where a subsea HIPS could be applied: 1. due to the limited buffer volume (330 m3) upstream export ESDV to LNG Plant. build and maintain than a normal pressure letdown HIPS.

One should also think about the possibility to test the system. 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 45/58 2.3 Dynamic simulations The recommendations to be taken into account for the dynamic simulations to be carried out are the same as for the pressure let-down HIPS which are given in § 10. This must be carefully considered when specifying and qualifying the system components. This document is the official English version. When designing a subsea HIPS it shall be clear that a lot of attention must be paid to the reliability and maintainability of the system as well as its impact on production availability. thus requiring a lot of effort during the design phase (especially during basic engineering). Depending on the kind of tests to be carried out a methanol injection system which might already be considered against hydrate formation. paraffin formation etc.3. Since the subsea HIPS gives a lot of operating (maintenance) constraints. the system's design pressure should be set above the WHSIP to ensure that the hydrate inhibitor can be injected into the system. 10. To protect a pipeline downstream a pressure let down station from a higher pressure rated tie-back. including logistics. when applied. When hydrate inhibition system is foreseen. hydrate formation. and the impact on the overall availability of the installations.1 Typical subsea HIPS scenarios Typical scenarios to be considered when designing a subsea HIPS are the following: Case Scenario Blocked outlet downstream of derating Blocked outlet downstream (blocked outlet due to pig stuck.3.) should be designed at the maximum hydrate inhibitor pressure which is a higher pressure than the WHSIP.) Pressure increasing due to failing PCS and PSS. This document is the property of Total.2 HIPS location & architecture The location of a subsea HIPS gives its main architectural difficulty. which for accessibility reasons is a lot more difficult to carry out on a subsea system than on a system above the waterline. reproduced or disclosed to others without written authorisation from the Company. GM_EP_ECP_260_00_EN. The subsea HIPS is a very recent development in the oil and gas industry. Hence the HIPS system (valves etc. since the reliability of a HIPS is of utmost importance.3. Case Scenario Opening of a PCV (or choke) or (E)SDV with pipeline upstream packed Pressure upstream of derating higher than pressure rating downstream Blocked outlet downstream of derating Opening of a SDV upstream of the Specification break 10. depending a lot on inspection and/or testing and more particularly on maintenance and repair. It must not be stored.2. valve closed. it is very important to define a clear Operating Philosophy in an early stage of the HIPS design.doc .3. could be used for testing.

3.9km R Injection point upstream chokes PT8 0449 FC NO FV80451 FC NC 2" Pig launcher HV80432 FV80448 R FC NC ESV80432 ZT ESV80439 R FC NC R FC NC ESV80433 From FC PCS FC NO R FC NC R From PCS R FC NC ESV80437 R FC NC ESV80435 From PCS ESV80431 ESV80436 R R Injection point at xmas tree FC NC ESV80434 ROV80440 MeOH 690 barg 600 520 barg barg Figure 5: Jura subsea HIPS This document is the property of Total. 10.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 46/58 10.5 Subsea HIPS examples At the time of writing.4 could be considered but one should take into account the impact these could have on the maintainability and thus the reliability of the system. This document is the official English version.doc . GM_EP_ECP_260_00_EN. It must not be stored.4 Risk mitigation measures The risk mitigation measures as given for the pressure let-down HIPS in § 10. 2. the only subsea HIPS designed is the JURA (UK) subsea HIPS. This HIPS is represented in Figure 5: JURA HIPPS Redundant fiber & communication SCM SLS 2oo3 SV1A SV1B SV2A 1oo2 SV2B 1oo2 1oo2 SCMMB 1 2 3 4 5 6 1 Interlock to prevent HV1 or HV2 opening as long as XV2 is open ZT8 0440 PT8 044 1 2 3 4 5 6 R PT8 044 2 PT8 044 3 PT8 044 4 R R PT8 0450 HH H TT8 L 0442 LL HH H TT8 L 0443 LL ZT 1 R NO FO R NO FC ESV80440 HV1 PT8 0451 ZT 2 R FC PT8 044 5 PT8 044 6 PT8 0452 ZT R NO FO NO FO R NO FO ZT R NO FO ZT R TT8 044 4 XV80410 XV1 NO FC ESV80441 HV2 L LL TT8 044 5 R L LL FO NO XV80406 XV3 R XV80411 XV2 2" ESV-80420 8".3.2. reproduced or disclosed to others without written authorisation from the Company. 600 barg.

The working principle of this HIPS is not very complicated and consists of the following: 1. reproduced or disclosed to others without written authorisation from the Company. One should also note that methanol injection facilities are provided throughout the HIPPS to allow inhibition of the production fluids following a HIPPS trip and also to provide the facility to equalise across the HIPS valves prior to depressurisation. this HIPS architecture can either be SIL2 or SIL3. HP flare Gas LP Flare LC Separator 1 LSLL SDV LSLL** HIPS Oil SDV* HIPS LCV *: SDV. a HIPS could be considered. but in case this is not practical. This document is the official English version. This may be required depending on the shut in pressure of individual section of the HIPPS. 2. The methanol is also required for HIPPS transmitter flushing and testing (calibration cannot be done automatically though).doc . until the WHSIP has decreased below the design pressure of the pipeline. The two HIPS valves HV1/2 close when pressure at HIPS sensors reaches 250 barg. The HIPS will close a valve upstream of vessel 2 in order to protect it against overpressure when the PSV's downstream cannot relieve the gas flow.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 47/58 The sources of overpressure are the subsea production wells (WHSIP of 600 barg). GM_EP_ECP_260_00_EN. For information the Jura HIPS is only foreseen to be operational for a few years. The HIPS is installed in a subsea well head template located 2 km upstream of the lower rated section to be protected. Normally the second vessel should be protected against gas blow-by by mechanical means (PSV's). Depending on the chosen test frequency of the HIPS elements.4 Gas Blow-by HIPS A gas blow-by HIPS could be applied when a separator has a risk of gas blow-by and the relief system (PSV's) on a second vessel downstream of the liquid exit of the first separator cannot handle the gas flow. used also by HIPS function (this depends on SIL requirement) **: Triplicated (if necessary for the reliability) Separator 2 Figure 6: Gas blow-by HIPS schematic This document is the property of Total. but is not recommended due to the questionable reliability of level detection instrumentation. It must not be stored. An interlock preventing the two HIPS valves HV1/2 to open when the ESDV XV2 is open (restart must be done through ESDV XV2 bypass). 10.

doc .4.4).4. It must not be stored. the most important aim of the dynamic simulations is to determine whether the reaction time of the designed HIPS would be sufficient.1. 10. GM_EP_ECP_260_00_EN. Since a reactive HIPS based on closing a valve upstream of the second vessel when reaching PSHH in vessel 2 is almost impossible to implement due to the fast dynamics with a blow-by. 10.2 HIPS location & architecture The principle of this HIPS aims at preventing a blow-by by avoiding the level in the first separator to come below LSLL.4. the only possible prevention is a preventive HIPS based on LSLL closing a valve upstream of vessel 2. When This document is the property of Total.4 Risk mitigation measures One could try to optimize the LCV in between the first separator and the second vessel in such a way that its Cv would not allow a gas blow-by to exceed the relief capacity of the PSV's of the second vessel (or at least slow down the blow down dynamics). A solution avoiding the need of a gas blow-by HIPS is given in § 10. reproduced or disclosed to others without written authorisation from the Company. Since the HIPS sensors upstream of the part of the installation to be protected against a possible overpressure.4. An example of a solution avoiding the need of a gas blow-by HIPS is the Ofon 2 project.3 Dynamic simulations Since the pressure during a gas blow-by can increase very quickly. By increasing the design pressure of the LP separator from 6 to 10 barg. Case Scenario Failure of the level control and first safety barrier (LSHH or (E)SDV) which should prevent from blow-by Pressure in first separator at PSV opening pressure Maximum incoming flow rate (slug) which can be expected LCV to be modelled as being completely open 10.5.4. One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level.5 Gas blow-by HIPS examples Examples of projects where HIPS against overpressure due to blow-by are used are Girassol and ROSA.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 48/58 10. 10.1 Typical gas blow-by HIPS scenarios The typical gas blow-by scenario is based on a failure of the first safety barrier which should close (E)SDV's downstream of the first separator after a LSLL signal. This document is the official English version. this HIPS can be qualified as a preventive HIPS (see § 6.4. The HP flare is designed for the gas blow-by relief flow whereas the LP flare was not. the PSV's of the LP separator can be set at 10 barg thus allowing them to relief to the HP instead of the LP flare.

It must not be stored.5 Liquid Carry-over HIPS A liquid carry-over HIPS should be applied when the relief system is only sized for the gas relief flow during a blocked-outlet and not for the complete blocked-outlet case (gas + liquids).doc . one shall take care not to move the overpressure problem from an upstream part of the installation to a downstream part.0 barg 28PV/AB204004 TO LP FLARE 28SDV202505 28ESDV202508 28LV/AB202002 PSHH TO LP COMPRESSOR ~ 2. When applying this solution. GM_EP_ECP_260_00_EN.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 49/58 applying such a design. This document is the official English version.5 barg Note (1) PSHH 28VS2020 Pop = 6 barg Pdes = 17 barg LC PSVs SIZED FOR GAS BLOW-BY – PILOT TYPE 10 28PSV204014-15-16 TO HP FLARE 2° LSLL TO WATER TREATMENT 1° LSLL (2oo3 VOTING) ~ 2. • A dedicated flare line from the second vessel up to the flare (incl. a dedicated inlet nozzle) • An assessment of the probability of a simultaneous occurrence of gas blow-by and emergency depressurization.4 barg Pdes = 10 barg TO WATER TREATMENT TO OIL EXPORT Note (1): PSHH set point driven by downstream compressors SOP (settle-out pressure) Figure 7: Solution to avoid gas blow-by HIPS 10.5 barg Note (1) 28VS2040 Pop = 0. one shall ensure that there is no possibility to over pressurize the LP separator through an interconnection between the HP flare and the LP separator (for example through a manually operated depressurization by-pass). See Figure 7 for the OFON 2 schematic. This document is the property of Total. thus allowing the functioning of the PSV('s) (set at a low pressure) on the LP separator. This solution is only possible if the pressure of the HP flare KO drum during emergency relief is compatible with the maximum back-pressure. This can be the case with older installations where different design practices were applied during the design as the ones which are currently used. and requires: • Pilot type PSV's on the LP separator. BLOCKED OUTLET 15 28PSV202014-15-16-17 WELLHEADS PRODUCTION TO HP FLARE ~ 8 barg 28PV/AB202004 TO MP/HP COMPRESSORS ~ 13. reproduced or disclosed to others without written authorisation from the Company.7– 1.

1 Typical liquid carry-over HIPS scenarios The typical liquid carry-over scenario is based on a failure of the first safety barrier which should close (E)SDV's upstream of the separator after a LSHH signal. It must not be stored.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 50/58 In this case a liquid carry-over HIPS should be implemented to prevent from multiphase flow relief. Case Scenario Relief system (PSV’s) not sized for full flow (liquids + gas) at blocked outlet Blocked outlet downstream of separator Maximum incoming liquid flow rate which can be expected Gas relief through PSV’s while liquid level increasing Liquid + gas relief through PSV’s 10. reproduced or disclosed to others without written authorisation from the Company. When the level in the separator comes above a certain level the HIPS valves at the inlet close in order to avoid more liquids and gas coming into the separator.doc . used also by the HIPS function (depending on the SIL requirement) *: Triplicated (if necessary for the reliability) LC LCV Figure 8: Liquid carry-over HIPS example 10. One should pay special attention and consult an instrumentation specialist for the choice of the level transmitter instrumentation to avoid malfunctioning due to emulsion or foam at the liquid / gas separation level. This document is the official English version.5. which could cause a liquid carry over and a subsequent exceeding of the relief capacity of the relief system (hence overpressure in the vessel).5. This document is the property of Total. HP flare Gas LSHH** HIPS Separator LSHH SDV* HIPS valve Oil SDV *: SDV. GM_EP_ECP_260_00_EN.2 HIPS location & architecture The working principle of this HIPS is aimed at preventing a liquid carry-over by avoiding the liquid level in the separator to come above LSHH.

10. 10. failure of all protection upstream of the PSV protected part of the installation) Upstream pressure at PSV opening pressure 10. and closing HIPS valves upstream of all equipment protected by the relief system equipped with the concerned flare knock-out drum.1 Typical flare knock-out drum overflow HIPS scenarios The base scenarios for the sizing of the flare knock out drum. this HIPS can be qualified as a reactive HIPS (see § 6.5) which can be applied is the flare knock-out drum overflow HIPS. Installations shall be developed to respect (at least) the above interpretation of API RP 521.1. This document is the property of Total. But in case the above defined flare knock out drum volumes cannot be achieved. would require major modifications and in this case (only) a HIPS could be considered.6. 10.6 Flare Knock-out Drum Overflow / Overload One of the liquid carry-over HIPS (see § 10.4 Risk mitigation measures The implementation of the liquid carry-over HIPS shall be avoided. but in the case of an upgrade it can happen that respecting this. having a dedicated logic solver. According to GS EP SAF 260 the sizing criteria shall be based on API RP 521. are the following: Direct cause Blocked outlet on PSV protected part of installation Scenario Full flow (gas and liquids) from all sources through flare knock out drum (i. GM_EP_ECP_260_00_EN. This document is the official English version.5.6.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 51/58 Since the HIPS reacts on a certain scenario which has already started off (the pressure has already risen) and protects by isolating the separator from the inlet in order to protect it against a possible overpressure.doc . reproduced or disclosed to others without written authorisation from the Company. Depending on the dynamics of the system. This last configuration will be used in particular when the PSV's installed on the protection vessel are not sized for the liquid flow rate. the installation of a HIPS could reduce the overflow risk.e. and concerning the sizing of the liquid side it shall be based on the sum of the liquid volume of 90 seconds of full flow production AND 15 minutes of production of the well (or the trunk line in the case of a riser platform receiving remote wellhead effluent) producing the largest flow rate. especially in grass root installations. 10. It must not be stored. According to GS EP SAF 262 a flare knock out drum shall be fitted with a LSHH initiating a shutdown without depressurisation (SD-2) of all units attached to the disposal system. and thus a HIPS (when applied).4).2 HIPS location & architecture The knock-out drum HIPS is normally based on a system as described in GS EP SAF 262 but with a higher reliability level (SIL).3 Dynamic simulations It is important to study the dynamics of the system during a blocked-outlet in order to determine the safe liquid level to be taken as normal LSHH and HIPS LSHH.5. In general this mean the HIPS consists of a level switch (LSHH) working in 2oo3 voting mode (depending on required SIL). the LSHH can either be placed on the knock-out drum or on the upstream separators.

6.2 HIPS location & architecture The compressor train shall have to be equipped in any case with PSV's and a relief system which can handle the full relief flow of one compression train. GM_EP_ECP_260_00_EN.4 Risk mitigation measures The risk of overflowing the flare knock out drum can be mitigated by allowing a good monitoring and quick intervention by the operators from the control room (in case of manned facilities). the simultaneous relief flow when several compression trains run out of control while having blocked outlet is not possible/practical and a HIPS could be considered. Angola). A compressor HIPS will in general consist of a pressure sensor (normally in 2oo3 voting mode in order to have a higher availability/reliability) with a dedicated logic solver shutting off the This document is the property of Total. This means that it should only be applied in exceptional cases.1 Typical compressor HIPS scenario Case Scenario Compressor overspeed with blocked outlet downstream Blocked outlet downstream compressor train(s) Compressor running on maximum speed Compressor’s control logic and safety system not functioning Inlet pressure of the compressor above normal pressure. because the fact that the HIPS would trip will often be caused due to a failure causing non-closure of these same valves.7. This document is the official English version.6.6. The flare shall mechanically and hydraulically be designed to handle the full relief flow of all compression trains together while the radiation criteria might be exceeded. 10.3 Dynamic simulations The dynamic simulations shall be based on scenarios given in § 10.7.doc . 10. for example when having several compression trains in parallel. for example in the case of upgrading existing installations. A knock-out drum HIPS shall normally not be applied. reproduced or disclosed to others without written authorisation from the Company.6. 10. especially when using (E)SDV's also used by the first protection barrier as HIPS valves. increasing the outlet pressure (this could be part of the scenario) 10.5 Example A knock-out drum HIPS has been studied (but not applied) for Buffalo (block 3. 10. Normally each compression train is protected against an overpressurization by compressors running out of control with blocked outlet by having PSV's and a flare system designed to relief the maximum flow of all trains. one should study common failure mode. It must not be stored.7 HIPS Against Overpressure by Compressor A HIPS against overpressure by compressor can be used to protect an installation against the possibility of compressors running out of control and over pressurizing the part of the installation downstream. 10.1 as well as any other possible scenarios.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 52/58 It shall be noted that. One should well take into account the backpressure of the disposal system. In some cases.

This trip will close dedicated HIPS valves located on the gas turbine fuel gas supply line.doc .4 Risk mitigation measures It shall be clear that a fully pressure rated piping downstream the compressor is the best solution and avoids the need of a pressure protection system (PSV and/or HIPS). If the operating pressure rises to 169. A reliable way to shut down the compressor can be to shut off the fuel supply by closing two HIPS valves on the fuel gas line. The PSV's and the flare system are sized for full blocked outlet of one compression train.3 barg. but from a radiation point of view the flare cannot accommodate the relief for more than one train at the same time (mechanically and hydraulically it can).1. Moreover.3 barg). a HIPS has to be implemented.4). Therefore. the full flow PSV will relieve to the HP flare system at 198. If PSS PAHH fails to detect the compressor discharge high pressure. By-Pass SDV and the compressor inlet SDV's. the HIPS PAHH pressure trip will be initiated when the pressure reaches 171. 3. 10. 10. GM_EP_ECP_260_00_EN. This document is the official English version.7. If the HIPS PAHH fails to detect the compressor discharge high pressure. this HIPS can be qualified as a reactive HIPS (see § 6. the compressor HIPS will trigger the riser top HIPS to protect the topsides in case of depacking.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 53/58 compressor in case of an overpressure downstream of the compressor.5 Example At the time of writing. 10% above set pressure of 180. reproduced or disclosed to others without written authorisation from the Company. time to stop when fuel supply is cut off) to be expected when shutting off the fuel gas supply.3 barg (i. 2. PSS PAHH will trip the compressor and initiate closure of discharge cooler SDV.g. 10. A possible compressor HIPS is currently being studied (not yet approved) for the Shtokman project and a schematic of this HIPS is given in Figure 9. It must not be stored.3 barg. The usage of pilot operated with modulating action type relief valves already permits to reduce the accumulation pressure percentage from 16% to 10%. The normal operating pressure at compressor discharge will be 153. This document is the property of Total. Since the HIPS reacts on a certain scenario already being initiated. When dimensioning the protection system one shall well take into account the compression curve of the compressor and take into consideration that the highest pressure occurs at zero flow and thus not at maximum flow. The key characteristics of the HIPS design per compression train are the following: 1.7. a compressor overpressure / overflow protection qualified as HIPS has never been applied at Total.e. There will be three compression trains.7.3 Dynamic simulations The dynamic simulations shall take into account the compressor dynamics (e.6 barg.

Typically. 10. First safety barrier failing to close ESDV’s SCSSV’s and stopping ESP’s upstream of a pressure specification break. It must not be stored.1 Typical HIPS stopping ESP’s scenarios The typical HIPS stopping ESP's scenario is based on a failure of the first safety barrier which should close (E)SDV's and SCSSV's as well as stopping the ESP's upon PSHH detection. reproduced or disclosed to others without written authorisation from the Company.2 HIPS location & architecture The working principle of this HIPS is based on shutting down the ESP's upon PSHH detection.doc .8. 10. Pressure increasing due to blocked outlet.8. this HIPS shall protect against over pressurization by stopping the ESP's by using circuit breakers while (if necessary according to the reliability calculations) at the same time closing HIPS valve. This document is the official English version. The ESP stopping function should not be the only safety function of this HIPS.8 HIPS Stopping ESP’s A HIPS stopping the ESP('s) can be applied when the source of possible over pressurization is an Electric Submersible Pump installed to activate well production. GM_EP_ECP_260_00_EN. Case Scenario Blocked outlet somewhere in the system.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 54/58 Figure 9: Shtokman compressor HIPS 10. This document is the property of Total.

The circuit breakers are opened to ensure stopping the ESP's.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 55/58 10. 10. The SCSSV's of each well are closed via the hydraulic control pannel. This ESP HIPS has not (yet) been approved by the HIPS Committee. 4. Hydraulic Control Pannel SSV 1oo2 ESD/ESS SD2 Incomer breaker ESP's breakers SD3 PSD/PSS 1oo2 PSD/PSS HIPS 2oo3 SCSSV ESDV Figure 10: AL Khalij HIPS stopping ESP’s This document is the property of Total. In case the protection is not sufficient (because they do not close in time) dynamic simulation showing the ESP's stopping shall be carried out. The pressure derating should be placed as far away as possible from the well. The ESP's for each well of the platform are stopped by means of a stop signal to the pump (via the hydraulic control pannel).3 Dynamic simulations Dynamics simulations simulating the closure of the HIPS valves protecting the downstream part shall be carried out. 10. This document is the official English version. Action 2 and 3 can not be considered as real HIPS actions since they are through the hydraulic control pannel which is not an HIPS element.doc . So in case of a well platform with ESP wells the derating should be downstream of the outboard ESDV of the pipeline departure of the platform. and several improvements (such as having a completely segregated dedicated HIPS hydraulic control panel) should be considered.4 Risk mitigation measures The flowline and production/test manifold shall be fully pressure rated at maximum ESP discharge pressure (unless protected by PSV).8. The architecture of the HIPS is shown in Figure 10. The ESDV on the outlet pipeline from the upstream platforms is closed. reproduced or disclosed to others without written authorisation from the Company. The protection is based on the following actions taken by the HIPS system upon its activation which is caused by a high pressure detection (on a 2oo3 voting basis): 1. It must not be stored.5 HIPS stopping ESP’s example An ESP stopping function as part of a HIPS has been applied at Al Khalij in Qatar.8. 3. GM_EP_ECP_260_00_EN. 2. The architecture has been applied at several platforms of the Al Khalij field.8.

GM_EP_ECP_260_00_EN. It must not be stored.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 56/58 Appendix 1 Company rules Industry standards Guidewords HIPS Flow Chart TDO / SE Field Operation entity Concerned DGEP entity DGEP HIPS Committee New project or Major modifications Identify pre-existing HIPS Industry standards can be implemented no Field Operations entity to review existing facilities for deviation from Industry standards yes Proper equipment design or protection system are feasible no Applicability of HIPS yes Implement Industry standards Apply : . reproduced or disclosed to others without written authorisation from the Company.update the HIPS dossier . This document is the official English version.Overall hazard assessment Identify deviations from industry standards Notify HIPS committee Document an as-built dossier Establish a Preliminary HIPS Dossier and submit it to HIPS committee Review and comment upon the Preliminary HIPS Dossier Decide on applicability Submit the as-built dossier to HIPS committee Record decision in the Statement of Requirement (SOR) and in the Project Safety Concept Preliminary acceptance Preliminary acceptance and design recommandation HIPS categorisation Categorise HIPS : "soft" or "hard" HIPS approved HIPS design and approval Update the HIPS dossier.proper equipment design and .protection system design Consider installation of a HIPS Review : .doc . Review reliability and detailed design Approval by TDO / SE HIPS in operation Agree on HIPS installation Field Operation Entity to .R. Comply with Company Rules Approve HIPS Quantitative Risk Assessment is used to support request for derogation HIPS installation Submit request for derogation from Company Rules Advise on request for derogation from C.maintain and test the system .record and review HIPS failures This document is the property of Total.Compliance with ISO 10418 and API RP 14 C .Material code .

5 = 17 .5 barg (**)) 14 barg 10 barg Normal Operating Pressure (9 .8 barg) 30 barg Header PSV Set Pressure (30 barg) OPERATING / START-UP PRESSURE (14-97 barg) 25 barg Separator Test Pressure (25 barg) Normal operating pressure (*) 76. GM_EP_ECP_260_00_EN.7 barg) PSHH HIPS (18.5 barg) PSHH PSS downstream choke (17 barg) Separator PSV Set Pressure (17 barg) PSHH Header (16.5 x 51 (Piping class C513 pressure limit) (**) 15.5 = 1.10% 20 barg Separator Accumulation (116%) Pressure (19.5 barg (*)) Header PSV Accumulation (116%) Pressure (34.Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 57/58 Appendix 2 UPSTREAM CHOKE VALVE Pressure Settings Diagram DOWNSTREAM CHOKE VALVE PIPING DESIGN PRESSURE 220 barg SHUT-IN MAX PRESSURE 200 barg GAS LIFT MAX PRESSURE PSHH HIPS (120 barg) PSHH SSS (113 barg) PSHH PSS (105 barg) 150 barg 97 barg Header Test Pressure (76.5 barg) PSHH Separator (15. It must not be stored.doc . reproduced or disclosed to others without written authorisation from the Company. This document is the official English version.11 barg) Dalia Riser HIPS This document is the property of Total.

Guides & Manuals GM EP ECP 260 Process Guidelines for Designing HIPS Exploration & Production Rev: 00 Date: 09/2009 Page: 58/58 Appendix 3 Pressure Settings Diagram AKPO Gas Line Tie-in on AMP2 This document is the property of Total. reproduced or disclosed to others without written authorisation from the Company. It must not be stored.doc . This document is the official English version. GM_EP_ECP_260_00_EN.

Sign up to vote on this title
UsefulNot useful