HIPPS protects subsea production in HP/HT conditions

Oil is stabilized at Kristin and transferred by a 12-in. (30.48-cm) diameter pipeline to Åsgard C. The oil pipeline connects to 12-in, (30.48-cm) flexible risers at Kristin and Åsgard C. Rich gas is processed at Kristin to Åsgard transport specifications and is transported to the 42-in. (107-cm) diameter Åsgard Transport pipeline by an 18-in. (45.7-cm) diameter pipeline loop approximately 30 km (18.6 mi) long. The gas pipeline connects to Åsgard Transport pipeline with a crossover spool and to Kristin with two 15-in. (38-cm) ID flexible risers.

The shut-in pressure on Kristin is 740 bar (74 MPa), while the flowlines and risers are designed for 330 bar (33 MPa). This benefited both economics and safety, as high-pressure hydrocarbons are kept away from the topside. But the pressure introduced a need for additional safety systems to assure that production is shut down subsea each time the flow to topside is stopped. Without a pressure protection system, the flowline and risers would be overpressured and could rupture upon topside shutdown or other flow blockage.

The subsea HIPPS is an important part of the overall pressure protection system. Each HIPPS consist of four pressure sensors, a logic unit with hydraulic assembly, and two 10-in (25.4-cm) ID valves for each of the six flowlines. The HIPPS is on the manifold outlet.

Operations experience

When production began in Nov. 2005, Statoil began putting the systems into operation sequentially as the connected wells were completed. As of Aug. 2006, five HIPPS were in operation.

In addition to normal operation, one system was exposed to an initial well cleanup, as the workover system was unavailable for some time. This involved flowing completion fluid, etc. through the tree, manifold, and flowline to the production platform. Flowing other fluids through the system was not part of the design basis and exposed the system to conditions far in excess of what it was originally built to withstand.

As of Aug. 2006, the operator registered no demands on the HIPPS. This means the first barrier (subsea PSD) functioned effectively during each topside shutdown.

Functional testing has been done 36 times. No failures related to the safety functions have occurred; nor have any spurious trips. The functional test indicated efficient performance with an acceptable reduction in production.

Early on, operations information showed that if one HIPPS ran with high bore pressure and the other HIPPS on the same template was opened with low pressure, the HIPPS valves exposed to high pressure would begin to close. The valves moved to approximately 50% closed before they opened again. This was caused by a restriction in the hydraulic supply that caused a pressure drop when the second system opened. All hydraulic assemblies were modified and function now as intended. This failure did not jeopardize the safety function, but could have lead to a spurious trip.

Statoil’s acceptance criterion for overpressure of risers is a frequency of less than 10-5 per year. The criterion for the flowline is given by the pipeline code to be less than 10-4 per year. The pressure protection system must assure that none of these is jeopardized.

For a planned production stop, the operator closes the subsea chokes as a part of the shutdown sequence. This does not put any demand on the pressure protection system. However, topside shutdowns, such as process shutdown (PSD) and emergency shutdown (ESD), initiated by the safety and automation system (SAS) do require action by the pressure protections system. This was by far the most likely demand identified. Other scenarios that could cause a demand are spurious trips of valves, hydrate/sand plugs, and choke failures. The demand rate totals 25 per year.

On this basis it was concluded that pressure protection system should consists of three independent barriers:

1. Subsea PSD, shutting PMV/PWV on each tree
2. Subsea HIPPS for each flowline
3. Pressure safety valve at the top of each riser.

The subsea PSD and the subsea HIPPS are safety instrumented systems (SIS) and for the Norwegian shelf must be designed according to IEC61508 /1/. Considering what was possible to achieve and the acceptance criteria, it was decided to require SIL1 for subsea PSD and SIL3 for subsea HIPPS.

HIPPS design premises

The reservoir pressure decays rapidly when the field is producing. After four to five years, the shut-in pressure is expected to be below 300 bar (30 MPa), and the HIPPS valves can be locked open.

The performance requirement calls for a closing time of 12 seconds. This criterion results from one design scenario in the risk analysis - formation of a hydrate plug close to the HIPPS. Blockage near or on the semisubmersible is not immediately critical because it takes time for pressure to increase in the 6-km-long (3.7 mi), gas-filled flowline. For reliability, the system is designed to comply with IEC61508/SIL3. Probability of failure on demand is < 5.10-4 with a test interval of one year.

HIPPS design

Aker Kværner Subsea supplied the Kristin subsea production system and designed and delivered the subsea HIPPS. Each HIPPS consists of three parts:

• Initiator - Four pressure sensors
• Logic - TUV certified for SIL 3
• Final element - Two gate valves in series.

Because the design team was designing the system to comply with SIL 3, the whole system had to be as failsafe as possible. That meant that a component failure should not initiate shutdown, an event that can cause spurious trips and loss of production. This requirement underscored the need to select reliable components.

The sensors are conventional analogue pressure transmitters manufactured by Read Matre. The reasons for selecting this sensor were:

• Statoil’s experience with this sensor: reliability data were available, and it could be regarded as “proven in use” according to IEC61508 and suitable for SIL 3 in the selected voting
• The analogue type was selected because a digital type is used for the subsea PSD function; this reduces the probability of common cause failures between PSD and HIPPS.

A configuration with four sensors in a two to four voting was selected to comply with the SIL 3 requirement and to optimize regularity. In case of a single sensor failure, production continues, but now in one oo three voting. Failure of another sensor causes HIPPS to close, and production through that flowline stops until the sensors have been replaced. Replacing sensors is a significant operation that requires the manifold to be taken to the surface.

Locating the sensors between and upstream of the valves assures that testing can be effective. Placing sensors on top of the pipe reduces the probability of hydrates or sand clogging. The two upstream sensors are several meters upstream of the valves to further reduce the probability of more than two sensors failing simultaneously from a common cause.

The logic, by Yokogawa, is certified for SIL3 applications. The logic is solid state and located in the subsea control module (SCM) on the manifold. Because of its placement, it cannot be changed after installation. The status of the HIPPS and features for testing are available from a topside control room through the subsea control system, but this is separate from the system and cannot block the safety function. In case of modifications or repair of the logic, the SCM must be retrieved.

The directional control valves actuating the HIPPS valves are within the SCM. Consequently, they can be repaired by retrieving the SCM. There is one Scana Rotator DCV per HIPPS valve.

The valves are Dresser-Ringo gate valves designed to seal in both directions. Two valves in series are necessary to comply with IEC61508/SIL3. The design is as failsafe as possible; loss of hydraulic pressure causes the valves to close. The main force closing the gate is the difference between the bore pressure and the ambient pressure. Even with the significant size of the actuator, the spring force gives a marginal contribution in a real demand at 280 bar (28 MPa).

The valves were tested extensively to qualify for the extreme combinations of high pressure, high/low temperature, and sand production on Kristin. In addition, the valve/actuator was evaluated in workshops and design reviews, and was subjected to failure mode effect consequence analysis (FMECA) to improve reliability and to make the assembly failsafe.

One important result was to increase the stem diameter to provide safety margins for closing the valve completely. When the valve is closing, it starts to choke the flow and to create a delta pressure over the gate. This pressure pushes the gate toward the downstream seat and increases the friction between the gate and seat. At high production rates, the delta pressure, and consequently the friction, would be unacceptably high compared to the closing force. As the stem diameter determines the area on which the bore pressure acts, the stem diameter was increased to meet a safety margin.

Testing in operation

Testing the safety function in operation is essential for assuring reliable safety. IEC61508 requires a full functional test of the complete operation within the test interval when documenting the probability of failure on demand (PFD). In addition to the functional test, a leak test and additional testing of valves and sensors further improved HIPPS reliability.

Functional HIPPS testing is done once a year to comply with SIL3, although testing was carried out more frequently during the first year to gain experience with the system.

The test is initiated with flow in the system. The control room operator electrically isolates one PT upstream HIPPS and one PT between the HIPPS valves. When the logic is not receiving a signal from two transmitters, it initiates shutdown, and valves begin to close. The two remaining sensors monitor the pressure upstream and between the valves as they close. These pressures and the valve positions are monitored and logged in the control room to verify that the valves close as intended. A side effect of this test is that the pressure buildup upstream from the HIPPS causes the PSD to initiate closing of PWV/PMV; so the PSD function is tested at the same time.

The expected time for the valves to close depends on the bore pressure. The operating pressure can be well below the set point of 280 bar (28 MPa). The closing time must be verified against a known curve.

The next step verifies that the sensors trip the logic at 280 bar. This is done by relieving the pressure in the manifold and between the HIPPS valves before resetting the system. Once the system is reset, the upstream HIPPS valve is opened, and the pressure in the manifold is increased to more than 280 bar by injecting MEG. All four sensors should signal to trip, and the open valve should close.

The final step verifies that the valves do not leak by lowering the pressure between the valves to 70 bars (7 MPa) below manifold pressure and making sure the pressure stabilizes. Then, the pressure is increased to 70 bars above the flowline pressure and monitored. The pressure increases if there is a leak through the upstream valve. A decrease in pressure indicates a leak through the downstream valve.

FMECAs of the valve, actuator, and hydraulic assembly revealed that in the majority of dangerous failures, the valve sticks fully open. Even though every possible measure has been taken in the engineering process to eliminate such failures, it is still the most likely problem. To further reduce the probability of failure on demand, a test to verify that the valves start to move upon demand was introduced. Upon a signal from the control room, the HIPPS logic starts to close the valves. After a few seconds, the system resets automatically, and the valves open. During those seconds, the valves close approximately 20%. The position of the valves as a function of time is sent to the control room, where an operator verifies that the valves not are stuck open.

Kristin HIPPS valve with actuator.

The test has a number of positive features:

• It is performed without any production loss
• It is does not inhibit the safety function at any time
• It is performed from control room and is not time consuming.

On Kristin, this test is performed every second month, and this has been taken into account when calculating reliability.

A final failure that can be experienced is a common-cause failure that affects all of the pressure sensors. A procedure for sensor verification was introduced to verify that the sensors are “alive” and are measuring the correct pressure. The control room operator carries out this test every second month.

The test includes the following steps:

1. 1. Check that all four HIPPS sensors measure the same pressure
2. 2. Check that the pressure corresponds with the pressure measured just downstream from the choke
3. 3. Change the position of the choke somewhat to change the pressure in the manifold and verify that all sensors measure the change.

   Acknowledgement

   We thank the Kristin license stakeholders (Statoil, Petoro, Norsk Hydro, ExxonMobil, Eni Norge, and Total E&P Norge) for permission to publish this paper. The authors also acknowledge the extensive contributions made by numerous individuals and units in the Statoil organization and Aker Kværner Subsea enabling the design and installation of these systems.