Ryan Sherman - INST 2450 - HIPPS

The Northern Alberta Institute of Technology
Edmonton, Alberta
High integrity pressure protection systems (HIPPS)
Prepared for
Mr. K. Bassett, Associate Chair
Instrumentation and Controls Engineering Technology
School of Information Communication and Engineering Technologies
Mr. H. Cartmell, Instructor
English and Communications
Prepared by
Mr. Ryan Sherman, Student
School of Information Communication and Engineering Technologies
November 25, 2015

November 25, 2015
15928-59 Street
Edmonton, Alberta
T5Y 2R5
November 25, 2015
Mr. K. Bassett, Associate Chair
Mr. H. Cartmell, Instructor
English and Communications
NAIT
11762-106 Street
Edmonton, Alberta
T5G 2R1
Dear Gentlemen:
As a mandatory requirement to pass the technical report course INST 2450, please review
the report entitled High integrity pressure protection systems (HIPP systems), attached for
your evaluation.
This report will give a detailed description of a high integrity pressure protection system.
Key factors that will be discussed in this report are the requirements to build this system,
codes, standards, regulations it must abide by, maintenance and testing, applications, and
costs. It will give the reader an understanding why this system is utilized for the protection
of the environment and most importantly the human lives working near dangerous
processes.
I would like to recognize Hailei Jiang, APC project manager from Spartan Controls, for his
unlimited knowledge about HIPP systems. I would also like to thank him for assisting me
in finding information about cost savings and reference material.
If you would like any further information about HIPP systems, please feel free to contact
me through email <rsherman11@hotmail.com> or telephone (587-589-0833).
Sincerely,
Mr. Ryan Sherman, IET 2450 Student
Enc. Two copies of technical report

Abstract
The purpose of this paper is to describe high integrity pressure protection (HIPP) systems
in the process industry. Methods employed to prepare this paper include an extensive
literature search encompassing internet sources, in addition to an interview with the
advanced process control project manager. The scope of application of HIPP systems
extends to offshore and onshore petrochemical facilities that rely heavily on HIPP
systems to prevent loss of control due to overpressure. These systems are intended to act
by reducing the risk of injury, environmental damage and significant company losses.
While conventional systems are the primary means of control, HIPP systems work in
conjunction with the convention systems to prevent overpressure safely and more
effectively, thus benefiting the environment, human interactions with the process
equipment and company revenues. Based on this review, HIPP systems were found to be
significantly more cost effective than other than conventional systems. Furthermore,
HIPP systems were found to be superior in terms of preventing overpressure and thus
reducing the need for flaring. Finally, HIPP systems were found to be better in terms of
reducing injuries, environmental damage and company production losses. In conclusion,
HIPP systems are a cost-effective method of preventing losses due to overpressure in the
offshore and onshore petrochemical industry.

Table of Contents
Abstract…………………………………………………………………..….…………..iii
List of Figures…………………………………………………………………..………..v
List of Tables…………………………………………………...………………...……...vi
1. Introduction………………………………………………………………………1
1.1 Problem………………………………………………………………………1
1.2 Purpose………………………………………………………………………1
1.3 Scope and relevance………………………………………………………….2
2. Conventional pressure relief systems…………………………………………...2
3. High integrity pressure protection systems (HIPP systems)…………………..3
3.1 Description of HIPP systems………………………………………………..3
3.2 Layers of protection…………………………………………………………4
4. Codes and standards……………………………………………………………..5
5. Purpose of safety instrumented systems (SIS)………………………………….8
5.1 Safety lifecycle (SLC)……………………………………………………….9
5.2 Hazard and operability study (HAZOP)…………………………………...10
5.3 Safety instrumented functions (SIF)……………………………………….11
5.4 Safety integrity level (SIL)………………………………………………...12
5.5 Layers of protection analysis (LOPA)……………………………………..15
5.6 Verification………………………………………………………………...16
6. HIPP system architecture………………………………………………………16
6.1 Sensor and sensor placement……………………………………………….18
6.2 Logic solver………………………………………........…………………...20
6.3 Final control elements (FCEs)..…………………………........………….....20
6.4 Testing and maintenance……………………………………………………22
7. Applications……………………………………………………………………..23
8. Conclusion………………………………………………………………………24
List of References……………………………………………..………………………..25
Bibliography……………………………………………………………………………

List of Figures
Figure Title Page
1 Layers of Protection 4
2 BPCS and SIS separation 8
3 Safety lifecycle 9
4 Safety instrumented function 11
5 HIPP system 17
6 Independent systems 18
7 High integrity manifold 19
8 Ball valve 21
9 Butterfly valve 21
10 70% closure 22

List of Tables
Figure Title Page
1 Low demand mode SIL 14
2 High demand or continuous mode SIL 14
3 Severity levels 15
4 Initiation likelihood 15

1. Introduction
1.1 Problem
In the petrochemical industry, the movement of petrochemical through pipelines
is carried out by means of a “process” which involves all system components required to
monitor and control the movement of product through pipelines to its destination. The
most commonly found systems employed in the petrochemical industry are conventional,
however, when acting alone these systems are inadequate for controlling overpressure
and can contribute to environmental damage due to flaring or venting. Losing control of
the process can lead to a vessel or pipeline burst due to overpressure. This puts human
life, nearby equipment and the environment in danger, as well as causing severe
economic losses for the company. Specific safety instrumented systems (SIS), such as
HIPP systems, work together with the basic process control system (BPCS) to prevent
overpressure safely and more effectively, thereby preventing damage, injuries and losses.
1.2 Purpose
The purpose of this paper is to examine the utility of HIPP systems and the
appropriateness of applying such systems to prevent overpressure events in petrochemical
facilities in both offshore and onshore locations. The information and findings contained
within will benefit instrumentation students learning about process industries, as well as
occupational health and safety personnel in settings where process operations occur.

1.2 Purpose (Continued.)
Finally, the material contained in this report is expected to be of benefit to employers and
companies who are considering the installation of a HIPP system, or who must install an
HIPP system for safety and revenue purposes.
1.3 Scope and relevance
This report covers all aspects of the basic process operation, the application and
utility of HIPP systems, and a thorough discussion of codes, standards and regulations
relating to the use of HIPP systems in the petrochemical industry. This paper also covers
the overall safety rating process and the contributions that an HIPP system can make in
overpressure control, risk reduction and safety enhancement in process operations in the
petrochemical industry.
2. Conventional pressure relief systems
In the process industry, the prevention of overpressure scenarios leading to loss of
containment is an important safety consideration. Most importantly, it can lead to loss of
life, major destruction of facilities and health issues when flammable, toxic or hazardous
gases are released in the ecosystem. It can also create a loss in production for the
company and can require replacement and repair of the damaged/defective equipment
(SIS Tech, 2000).

4. Conventional pressure relief systems (Continued.)
Conventional systems used to protect against loss of containment are pressure relief
valves, flare stacks, safety valves or some sort of pressure venting. In some situations,
using these types of pressure relief techniques to eliminate the loss of containment is
impractical. Applications for which valves or flare stacks would not be practical include
chemical reactions that happen so quickly that loss of product occurs before the pressure
relief device can act (L&T Valves, n.d, pg. 3). Other outcomes of poorly applied
pressure relief techniques include internal fires and decompositions (hot spots), which
occur when exothermic reactions are happening at uncontainable rates. Conventional
systems are also inadequate where the vent location of a pressure relief device can cause
further problems either to the plant or to the environment. These applications provide
minimal risk reduction. However, overpressure can be effectively prevented and
controlled through the use of a HIPP system.
5. High integrity pressure protection systems (HIPP systems)
3.1 Description of HIPP systems
HIPP systems are a specific type of SIS system. Specific requirements of an SIS
system are set out in Section 5 below. HIPP systems are regulated under the boiler and
pressure vessel code (American Society of Mechanical Engineers ASME, Section VIII,
2015) and pressure relieving and depressuring system standards American Petroleum
Institute API Standard 521, 2014.

3.1 Description of HIPP systems (Continued.)
A company may use a SIS to protect against an overpressure or high flow rate situation.
HIPP systems are targeted to control high pressure, high flow rates and protect the
environment, which some conventional relief systems cannot do. HIPP systems achieve
this by providing tight shutoff at the source of high pressure. HIPP systems provide an
important last line of defense, without compromising the process itself.
The most important safety feature of this system is protecting human life. Using
HIPP systems ultimately reduces the risk profile of the production plant. It is a type of
SIS that must be engineered and built following strict standards, rules and regulations set
out in the International Electrotechnical Commission (IEC), documents 61508 and 61511,
the American National Standards Institute (ANSI)/International Society of Automation
(ISA), document S84.01, the API, the ASME and the Alberta Boilers Safety Association
(ABSA), standard AB-525.
3.2 Layers of protection
In the process industry, layers of protection provide an outline for safety. Figure
1 on the next page has been excerpted from PA Control (2014). Examination of Figure 1
shows the layers of protection involved in plant operation. The layers of protection
shown in Figure 1 on the next page provide different levels of protection for effective
plant control, using manual or automatic control.

3.2 Layers of protection (Continued.)
Figure 1: Layers of Protection
(Source: PAControl, 2014, http://www.pacontrol.com)
The first layer of protection, as seen in the diagram above, is the BPCS. With the
correct design, installation, and maintenance one can achieve efficient basic process
control. The second layer is activated once process alarms are set off due sensor activity,
triggering a shutdown of the process. Automated and operator controls work together to
fix the problem to bring the process back to an unalarmed state. If they are unable to do
so, trip level alarms will initiate the third level of protection.
The third level is a SIS, such as an HIPP system, that will be activated if pressure
is out of control. This is the last opportunity for prevention of overpressure events and
therefore, the SIS is the last line of defense for containment. The main function of the
SIS is safety.

3.2 Layers of protection (Continued.)
In the unlikely event that an HIPP system failed, a fourth layer composed of some sort of
relief mechanism (eg. flaring) acts to prevent a rupture in the pipe, since containment
losses in this layer could result in a fire or explosion. Not all companies have this active
protection fourth layer beyond the function of the SIS.
If the SIS fails, the plant moves into a passive protection layer where the
containment of a fire is the primary concern. The energy from an explosion must be
minimized so the spread of the damage is limited to one area. In the final layer, the
emergency response layer, the main goal is to contain the spread of ongoing damage.
Evacuation plans may in place at this point, and onsite firefighters would be involved. If
all these safety layers work together properly, a plant can control or prevent against a
catastrophic event.
4 Codes and standards
HIPP systems must meet many codes and standards. The codes and standards that
HIPP systems must be in compliance with have been described in Section 2 above.
The ASME and API codes and standards outline the proper design for pressure
relief systems to protect against an overpressure situation. The HIPP system provides an
alternative to pressure relief techniques, such as a flare. The ASME code outlines the
requirements to design, test, certify and inspect a pressure vessel exceeding 15 pounds
per square inch (psi) (ASME, 2015, pg. 1).

4. Codes and standards (Continued.)
Section VIII, Divisions 1 and 2 of the ASME code also specifies the requirements
for materials used in the construction of the pressure vessel, as well as fabrication
methods that include forging, welding and blazing (ASME, 2015, pg. 1). API Standard
521 provides guidelines for depressurizing systems and for the selection of components,
including piping and vessels. ASME and API codes must be met when designing an
HIPP system. If these codes are not met, the system and its components will fail and the
process cannot commence.
SIS have been performing safety instrumented functions in the process industry
for many years. A SIS must contain the appropriate instrumentation to achieve proper
operation of the safety functions. An SIS will include all components essential to carry
out the safety functions, from sensors to logic solvers to final control elements and any
subsystems it may require. To achieve the proper instrumentation, there are certain
standards and performance levels that must be met and a safety lifecycle method
described by ANSI/ISA Standard 84.01-1996 in the USA or IEC 61511 at the
international level. IEC 61511 refers to SIS engineering; SIS implementation needs to
follow IEC61511 guidelines.
IEC 61508 addresses the “Functional Safety of Electrical, Electronic and
Programmable Electronic Safety” related systems and contains basic functional safety
standards that apply to all industries and the certification of hardware; IEC 61511 has
been developed to focus on SIS in the process sector.

4. Codes and standards (Continued.)
There is a “grandfather clause” (Summers, 2005, pg. 1) pertaining to existing process
systems looking to upgrade their systems. Prior to the adoption of ANSI/ISA S84.01-
1996, existing SIS were constructed according to standards of the day. In order to
upgrade, a grandfather clause states that company owners must provide evidence of safe
operation, design and inspections before modifications can occur, the owner shall provide
evidence the equipment is operating in a safe manner.
The three standards: IEC 61508, IEC 61511 and ANSI/ISA S84.01-1996 contain
all of the necessary information for the design, construction, assessment,
decommissioning, documentation and validation of an SIS system within any process
industry (CCI, High Integrity Pressure Protection System, 2007, pg. 3).
5. Purpose of safety instrumented systems (SIS)
The main purpose of a SIS is to condense the risk from a hazardous process to an
allowable level. This is accomplished by assigning each safety instrumented function
(SIF) with a safety integrity level (SIL). Selecting the SIL is a vital step to designing a
safety system, but the organization or company must also put effort in supporting safety
actions, i.e. staffing, safety equipment in case of a fire, etc.

5. Purpose of safety instrumented systems (SIS) (Continued.)
When designing a SIS the requirements must be examined carefully. A SIS is based
on a target SIL that is obtained through a time consuming process. IEC 61508 specifies
the risk assessment and the measures that will be taken in the design of SIFs that include
the sensors, logic solvers and the final control elements that will control the SIF. A key
function of the SIS is to control a process by returning it to a safe state when programmed
set points are surpassed. SIS works alongside the BPCS as pictured in Figure 2 below.
It is vital to keep the protection system (SIS) and the BPCS independent of each other for
safety purposes. The protection system must be capable of containing a situation that the
BPCS cannot.
Figure 2 – BPCS and SIS separation
(Source: Gillespie, n.d., pg. 3)

5.1 Safety lifecycle (SLC)
As set out in the IEC and ANSI/ISA standards, a safety lifecycle (SLC) is an
engineered process intended to increase safety and improve the design of the SIS.
Referring to Figure 3 below, the safety lifecycle can be broken down into three
phases. The analysis phase includes a hazard and operational study or investigation that
can determine if an SIS is needed and if the tolerable risks are beyond the capabilities of
the BPCS. Once an engineering/procurement/construction (EPC) company decides,
based on evidence that an SIS is required, they will assign a SIL rating to each SIF.
Everything done in these stages will be documented in a safety requirement specification
(SRS) to fulfill the requirements set out in IEC 61511.
The second phase focuses on SIS implementation (design, fabrication,
installation, testing of the loop, and design verification by a third party). The final phase
is the operational phase, including start-up, operation, maintenance, decommissioning
and necessary modifications of the SIS (Ali, 2007, pg. 3).
Figure 3 –Safety lifecycle
(Source: Emerson, 2015, www2.emersonprocess.com)

5.2 Hazard and operability study (HAZOP)
The first step to determine if SIS is needed is a very detailed hazard and risk
investigation that addresses the level of risk of each SIF if it fails, as well as the impact of
failure. Depending on the severity of the risks involved and the complexity of the
operation, a qualitative investigation referred to as HAZOP is performed by electrical,
instrument, process and mechanical engineers alongside safety specialists. The study
summarizes all the risks including those with equipment, and the potential effects if the
BPCS cannot contain the risks. Once the investigation is complete, the team works
together to assign a SIL rating for each SIF based off the HAZOP study. The team of
engineers and safety personnel then decide whether or not a SIS is required in addition to
the BPCS.
In a process where overpressure of the system can result in major damage to the
equipment, environment, and human life, there is definitely a need for SIS, such as a
HIPP system. With HIIPS dealing only with one safety instrumented function
(overpressure), a SIL rating will be assigned to the overall system as well as the
individual components (sensors, solver, and final control element - FCE) (Gillespie, n.d,
pg.2).

5.3 Safety instrumented function (SIF)
Within a process there can be many possible sources of error that can lead to an
incident. If these errors are not controlled properly they can lead to destruction of
equipment, loss of product or loss of life. Safety instrumented functions deal with “life-
and-limb protection” (Mostia, 2003, pg. 2) from injuries arising from errors leading to
overpressure in a vessel, high furnace temperatures, flow rates, etc. In Figure 4 below,
each of these possible sources of error is identified, monitored and controlled by a safety
instrumented function (SIF). Each SIF will have corresponding sensors, a logic solver,
and FCEs to bring the process back to a safe state for that function. Each SIF must be
assigned a SIL rating based on how much it will contribute to overall risk reduction in
returning or maintaining the risk at a tolerable or acceptable level. HIPP systems have
only one SIF, which controls for overpressure that can lead to a rupture in a vessel or
pipeline.
Figure 4 - Safety instrumented function
(Source: Mostia, 2003, pg. 2)

5.4 Safety integrity level (SIL)
“The safety integrity level is the amount of defined risk reduction to be provided
by the SIF” (Mostia, 2003, pg. 1). The risk is made up of the hazards involved in a
process and how often the hazard is expected to arise. SIL is a quantitative target for
gauging the performance level of the SIF in safely bringing the process to a tolerable
state. It is the primary function of the SIS to improve the safety of the process by
reducing the risk factors, accomplished by reducing the probability of failure on demand
(PFD). A safer system can be achieved with a higher SIL.
Safety integrity is divided into two areas: a) hardware safety integrity and b)
systematic safety integrity (ISA, 2002, pg. 13). Hardware safety integrity detects or
estimates random errors expected in the hardware, whereas systematic failure refers to
undetected errors or faults in the overall process. To help determine the SIL, a process
hazard analysis (PHA) is conducted, similar to HAZOP. The PHA includes a)
identification of all process hazards, b) an estimation of the risk level associated with
each hazard and c) a determination as to whether or not the risk is tolerable.
The SIL is a measure of system performance in regards to the chance of a PFD. If
a company’s goal is to reduce the risk, understanding the risk is key. Risk of loss can be
defined or quantified by application of the following equation:
Risk = probability X consequence

5.4 Safety integrity level (SIL) (Continued.)
Probability is stated as a hazard frequency and the consequence refers to damages
(costs, losses, etc.) that occur to the processing plant, environment, employees, etc., if the
hazard is not brought back to a safe state. As stated earlier, the HAZOP study determines
the impact of failure. In Tables 1 and 2 below, the SIL levels are expressed in terms of
the average PFD depending on if the process is in low or high demand mode, and thus,
the SIL can be determined for different processing rates. The most common analysis
when dealing with HIPP systems is a layers of protection analysis (LOPA).
A risk reduction factor (RRF) is also obtained through a process hazard analysis
(PHA). This procedure determines the functional (operational) safety and establishes a
tolerable risk level (risk tolerance). The PHA is directed at risk reduction and mitigation
on the BPCS and other layers of protection. If there is still an unacceptable level of risk
after comparing the residual risk to their risk tolerance levels, the RRF is than
determined, which is the inverse of the PFD. The risk tolerance is defined by the
owner/operator. The owner/operator determines the acceptable risk level with regard to
the risks to employees, equipment, the environment and many other factors (General
Monitors, 2008, pg. 1).

5.4 Safety integrity level (SIL) (Continued.)
The PFD rates for two modes (low demand and high demand) of operation have
been determined and presented in Tables 1 and 2 below, with regard to the SIL levels
identified. An example of a system in low demand mode would be the ABS braking
system in a vehicle, which is not routinely utilized. An example of continuous mode or
high demand system would be the normal braking system, which is used all the time.
Table 1: Low demand mode SIL
SIL PFDavg RRF
4 ≥10-5
to ˂10-4
˃10,000 to ≤ 100,000
3 ≥10-4
to ˂10-3
˃1,000 to ≤ 10,000
2 ≥10-3
to ˂10-2
˃100 to ≤ 1,000
1 ≥10-2
to ˂10-1
˃10 to ≤ 100
(Source: Exida, 2015, www.exida.com)
Table 2: High demand or continuous mode SIL
SIL PFDavg
4 ≥10-9
to ˂10-8
3 ≥10-8
to ˂10-7
2 ≥10-7
to ˂10-6
1 ≥10-6
to ˂10-5
(Source: Exida, 2015, www.exida.com)

5.5 Layers of protection analysis (LOPA)
LOPA, as set out by the IEC and ANSI/ISA, is a semi-quantitative risk
investigation practice. It consists of identifying all process hazards contained in the
HAZOP study, except “the hazards are analyzed in terms of: consequence description,
severity level, initiating causes, and initiation likelihood” (Gulland, 2004, pg. 12). In
Table 3 below, the severity level is expressed with intended frequency ranges.
Table 3: Severity levels
Severity Level Consequence Target Mitigated Event
Likelihood
Minor Serious injury at worst No specific requirement
Serious Serious permanent injury
or up to 3 fatalities
˂3E-6 per year or 1 in
˃330,000 years
Extensive 4 or 5 fatalities ˂2E-6 per year or 1 in
˃500,000 years
Catastrophic ˃ 5 fatalities Use F-N curve
(Source: Gulland, 2004, www.wildeanalysis.co.uk)
In Table 4 below, the initiation likelihood is expressed.
Table 4: Initiation likelihood
Initiation Likelihood Frequency Range
Low ˂ 1 in 10,000 years
Medium 1 in ˃ 100 to 10,000 years
High 1 in ≤ 100 years
(Source: Gulland, 2004, www.wildeanalysis.co.uk)

5.5 Layers of protection analysis (LOPA) (Continued.)
“The strength of the LOPA method is that it recognizes that in the process
industries there are usually several layers of protection against an initiating cause leading
to an impact event” (Gulland, 2004, pg. 13). LOPA identifies all layers of protection in
the process: general design, BPCS, alarms, additional modifications to reduce a
catastrophic event and any independent layers of protection (IPLs). A RRF can be
attained based on the frequency of the initiation likelihood and the PFD, yielding an
intermediate likelihood for an error. This procedure is completed on all initiating events.
The RRF can be converted into an SIL rating using this method.
5.6 Verification
Once the design of the HIPP system has been complete and the SIF has been assigned
a SIL rating, it must be verified by a third party verification company. The verification
company is to make sure all the hardware selected are truly able to achieve the SIL target.
SIL verification finalizes the SIF design and the project can proceed further. This
includes cabinet design and build, control system design and configuration, physical
building of the process and site construction.

6. HIPP system architecture
When designing a HIPP system for pressure protection, a large body of
knowledge is required. HIPP systems should be completely independent of the basic
process control system (BPCS). Referring to Figure 5 below, the main components of
HIPP systems are: three sensors (initiators), a logic solver, and final control elements that
include solenoids, actuators, and two valves. For safety purposes the construction of
these elements must be hardwired.
Figure 5 – HIPP system
(Source: Pietro Fiorentini, n.d., https://www.fiorentini.com)

6. HIPP system architecture (Continued.)
“HIPP systems should be designed according to fail-to-safe principles” (Oil &
Gas Producers, 2015, p. 15). This is an essential aspect to the system because if an
overpressure scenario occurred, the valves would close, so no damage can occur to the
system and surrounding area. HIPP systems should have an interface such as a human
machine interface (HMI) for monitoring only. The HMI can also be used for diagnostics.
The foundation of this SIS system is dependent on the SIL, which ranges from 1 to 4,
with 1 being the lowest integrity and 4 being the highest. In the event of a system failure,
the power supply and communications should be redundant and also independent of the
BPCS. Pictured below in Figure 6, the yellow unit (SIS) on the right is independent of
the black unit on the left (BPCS).
Figure 6 – Independent systems
(Source: Instrumentation Lab, Northern Alberta Institute of Technology)

6.1 Sensors and sensor placement
The process variable being measured in HIPP systems is pressure; therefore,
pressure sensors are required. The main focus of these sensors is to detect high pressures.
Analog sensors and transmitters continuously monitor pressure to decrease the risk of
failure. For most HIPP systems applications, there is a requirement of three pressure
transmitters for safety purposes. The three sensors use a two-out-of-three (2 out of 3)
based voting system; if two of the three transmitters sense high pressure, a signal is sent
to the logic solver telling the valves to close. The 2 out of 3 voting system can change to
a one-out-of-two (1 out of 2) based system when a single transmitter is due for servicing
or is in a fault condition (Oil & Gas Producers, 2015, pg. 24).
A 2 out of 3 voting system is beneficial when only one sensor is initiated, since
this sensor will only send an alarm to the interface (HMI) and will neither activate HIPP
systems nor shut the process down. These transmitters must operate in a 2 out of 3 voting
system to succeed in getting a safety integrity rating of 3 (SIL-3), which is mandatory
according to IEC 61508 and ANSI/ISA S84.01. In Figure 7 below, sensors are located
directly on the process’s main line using a double block and bleed valve or alternatively,
on a high integrity manifold block (L&T Valves, n.d., pg. 5). These mounting techniques
enable the sensors to be serviced.
The transmitters should be located as far away from each other as possible to
reduce the chance of external or internal factors affecting more than one transmitter at the
same time (Oil & Gas Producers, 2015, pg. 20).

6.1 Sensors and sensor placement (Continued.)
Figure 7 - High integrity manifold
(Source: Yokogawa System Center Europe, 2010, http://www.gain.nl)
6.2 Logic solver
According to IEC 61508, the selected logic solver should have at minimum a
SIL3 rating. The type of the logic solver should match the other protection layers and
should be either solid state or a programmable type (Oil & Gas Producers, 2015, pg. 20).
The logic solver’s purpose is to accept input signals from the pressure transmitters and
control the FCE’s (final control elements) based on the input reading. Logic solvers are
also based on a 2 out of 3 voting system. If the solver receives a high signal from two out
of the three transmitters it closes the FCE to protect against high pressures.

6.3 Final control elements (FCEs)
Final control elements are usually fail-safe valves used to segregate a fault by
using spring loaded or pneumatic solenoids and actuators. These elements can also be
relays that shut off the motor operating the valves. These relays would be located in a
variable frequency drive (VFD) cabinet. Solenoids using a 1 out of 2 voting system must
have a specific SIL rating, as well as the two valves, each having a 1 out of 2 voting
system also (CCI, High Integrity Pressure Protection System, 2011, pg. 3).
When selecting the appropriate valve for a specific process, process conditions
must be considered. A benefit of these fail-safe valves is that they have almost zero
pressure loss when fully opened (CCI, 2011, pg. 4). In Figures 8 and 9 below, the valves
typically used are ball (Figure 8), gate, globe or butterfly (Figure 9) valves in series with
each other. Such valves are used because they have been proven to provide tight shut-
off, low operating torque and high reliability (Duncan, 2014, pg.1).
Figure 8 - Ball valve Figure 9 - Butterfly valve
(Source: L&T Valves, n.d., http://www.lntvalves.com)

6.3 Final control elements (FCEs) (Continued.)
The FCEs are considered to have the highest importance and account for 50% of
loop failures (L&T Valves, n.d., pg. 6). Double block and bleed valves used in HIPP
systems close within two seconds once a fault is detected (Mokveld, n.d., pg. 6). Since
these valves will go long periods of time without any movement through them,
maintenance and testing plays a vital role in their function.
6.4 Testing and maintenance
“92% of all SIS failures occur in field devices such as final control elements and
sensors” (Ali, 2007, pg. 4). HIPP systems can go long periods of time without any
movement of shutoff valves because of the 2 out of 3 voting system. Partial stroke tests
may be undertaken on the HIPP system to ensure proper operation of all components,
especially the shut off valves. Testing and maintenance must be completed every three
months to a year.
The partial stroke test is a technique to make the operator aware of undetected
failures. When performing a partial stroke test, the valve is only closed 70%, as shown in
Figure 10 on the next page. By closing the valve only 70% and not 100%, the process
does not need to be shutdown and therefore, production will not stop and profitability
will not be affected. This process also allows a company to gain confidence that safety
valves are working properly.

6.4 Testing and maintenance (Continued.)
Figure 10 - 70% closure
(Source: Leusch, 2015, http://www.leusch.de)
Depending upon the specifications set out by individual companies, a partial
stroke test may not be enough to ensure proper working of the valves. If the company
requires a 100% stroke test, the company must perform a process shutdown once a year
to accomplish it, resulting in process downtime and a decrease in profit.
7. Applications
The most common practice for a HIPP system is protection against high pressures
and large flow rates. The system is used in the petrochemical industry to ensure the
safety of vessels, pipelines, piping, and process packages. In applications where
chemical reactions are happening, it may be hard to size a relief device/system due to
many factors.

7. Applications (Continued.)
Factors that can affect sizing include how fast reactions are happening. If flaring is the
relief system used with chemical reactions, the flare must be controlled. Location of the
flare must be taken into consideration and how it is going to be controlled. Due to some
of these factors, many companies may tend to go with a HIPP system to avoid difficulties
in the design and sizing of relief devices/systems for their operation. HIPP systems are
often used on offshore processes as well as onshore projects. Other applications for HIPP
systems are in liquefied natural gas (LNG) processing, chemical plants, petroleum
refineries, and transport and storage facilities.
8. Conclusion
This paper examines the utility of high pressure protection (HIPP) systems in
processing applications in the petrochemical industries. A form of safety integration
system (SIS) HIPP systems act in conjunction with the basic process control system
(BPCS) to prevent overpressure safely and more effectively than applications without a
HIPP system. As such, HIPP systems are stated to prevent overpressure incidents, thus
preventing damage to the processing plant, the environment and human personnel in
proximity to the incident. Based on the review conducted for this paper, HIPP systems
act to improve the overall safety integrity level (SIL) and reduce the overall risk of an
overpressure incident. In conclusion, HIPP systems act to prevent overpressure incidents,
thus benefitting the overall profitability and productivity of the company, while at the
same time, reducing or eliminating costs arising from an incident.

References
Ali, R. (2007). How to implement a safety life-cycle. Retrieved 1 November 2015 from
http://www.documentation.emersonprocess.com/groups/public/documents/articles
_articlesreprints/how_to_safety_life_cycle.pdf
American Society of Mechanical Engineers (ASME) (2015). Pressure vessels. Retrieved
1 November 2015 from https://www.asme.org/shop/standards/new-
releases/boiler-pressure-vessel-code/pressure-vessels
CCI (2007). CCI Innovative solutions for HIPPS systems. Retrieved 1 November 2015
from http://www.ccivalve.com/~/media/files/c/cci/pdf/879.pdf
CCI (2011). CCI High Integrity Pressure Protection System. Retrieved 1 November 2015
from http://www.ccivalve.com/~/media/Files/C/CCI/pdf/hipps-brochure-879-
final.pdf
Duncan, P. (no date). (personal communication 1 November 2015). What are some of the
components of a HIPPS? Retrieved from
https://www.linkedin.com/pulse/20140616211422-56566200-what-are-some-of-
the-components-of-hipps

References (Continued.)
Emerson Process Management (2015). Smart SIS services: TUV certified service and
support. Retrieved 1 November 2015 from http://www2.emersonprocess.com/en-
us/plantweb/sis/sis_services/pages/sis_services.aspx
Exida (2015). SIL: Safety integrity level. Retrieved 1 November 2015 from
http://www.exida.com/Resources/Term/SIL-Safety-Integrity-Level
General Motors (2008). SIL information. Retrieved 1 November 2015 from
http://www.gmigasandflame.com/sil_info_101.html
Gillespie, S. (no date). Safety instrumented systems. Retrieved 1 November 2015 from
https://www.idc-
online.com/technical_references/pdfs/instrumentation/Safety_Instrumented_Syste
ms.pdf
Gulland, W. (2004). Methods of determining safety integrity level (SIL) requirements:
Pros and cons. Retrieved 1 November 2015 from
http://wildeanalysis.co.uk/casestudies/sil

International Association of Oil & Gas Producers (2015). High integrity protection
systems: Recommended practice. Retrieved 1 November 2015 from
http://www.iogp.org/pubs/443.pdf
International Standards Association (ISA) (2002). Safety Instrumented Functions (SIF)-
Safety Integrity Level (SIL) Evaluation Techniques Part 2: Determining the SIL
of a SIF via Simplified Equations. Retrieved 1 November 2015 from
https://www.isa.org/pdfs/microsites195/tr-8402p2/
L & T Valves (no date). HIPPS: High integrity pressure protection system. Retrieved 1
November 2015 from http://www.lntvalves.com/download/final/L&T-High-
Integrity-Pressure-Protection-System-HIPPS.pdf
Leusch (2015). Triple eccentric control and shut-off butterfly valve. Retrieved 1
November 2015 from http://www.leusch.de/en/butterfly-valves
Mokveld (no date). First in safety: Safety instrumented system (HIPPS). Retrieved 1
November 2015 from
http://www.mokveld.com/upload/product_document/Mokveld-
HIPPS_application_leaflet.pdf

Mostia, B. (2003). The safety instrumented function: An s-word worth knowing.
Retrieved 1 November 2015 from
http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Document
s/Articles/ControlMagazine/The-Safety-Instrumented-Function-An-S-Word-
Worth-Knowing.pdf
PA Controls (2014). Basic fundamentals of safety integrated systems (SIS). Retrieved 1
November 2015 from http://www.pacontrol.com/safetysystems.html
Pietro Fiorentini (no date). HIPPS High integrity pressure protection. Retrieved 1
November 2015 from https://www.fiorentini.com/media/files/143_344_hipps-
ct224-e_february_10_x_stampa.pdf
SIS Tech Solutions (2000). High integrity pressure protection systems (HIPPS).
http://people.clarkson.edu/~wwilcox/Design/hipps.pdf - information
Summers, A. (2004). ANSI/ISA 84.00.01-2004. Retrieved from 1 November 2015 from
http://sis-tech.com/wp-content/uploads/2011/05/ANSIISA_84.00.01-
2004_and_Existing_Safety_Instrumented_Systems.pdf

Yokagawa (2010). Partial stroke testing. Retrieved 1 November 2015 from
http://www.gain.nl/fileadmin/filelist/downloads/Botlek_Studiegroep/Presentaties/
2010/20100408_SIL_Partial_Stroke_Test_Yokogawa_Prins.pdf

Bibliography
American Petroleum Institute(API) (2014). API RP Standard 521: Guide for pressure
relieving and depressuring systems. Retrieved 1 November 2015 from
http://www.api.org/publications-standards-and-
statistics/standards/whatsnew/publication-updates/new-refining-
publications/api_standard_521
American Society of Mechanical Engineers (ASME) (2013). ASME Boiler and pressure
vessel code: Section VIII – Pressure vessels. Retrieved 1 November 2015 from
https://www.asme.org/getmedia/1adfc3df-7dab-44bf-a078-
8b1c7d/60bf0dASME_BPVC_2013-Brochure.aspx
Ecisgroup (2009). 091201 - IEC61508 to reduce maintenance of SIL3 HIPPS. Retrieved
1 November 2015 from http://www.scribd.com/doc/23668165/091201-IEC61508-
to-reduce-maintenance-of-SIL3-HIPPS#scribd
Exida (2015). IEC 61508. Retrieved 1 November 2015 from
http://exida.com/Resources/Term/iec-61508

Bibliography (Continued.)
Hedburg, J. (2005). Process industry IEC 61511: Safety requirements specification
guideline. Retrieved 1 November 2015 from
http://www.sp.se/sv/index/services/functionalsafety/Documents/Safety%20require
ments%20specification%20guideline.pdf
Instrumentation (2015). High integrity pressure protection system (HIPPS). Retrieved 1
November 2015 from http://perfecttechnician.blogspot.ca/2015/03/high-integrity-
pressure-protection.html

Instrumentation, Systems, and Automation Society (ISA) (1996). ANSI/ISA S84.01-
1996: Application of safety instrumented systems (SIS) for the process
industry. Research Triangle Park, NC.

International Electrotechnical Commission (IEC) (2010). IEC 61508: Functional
safety of electrical/electronic/programmable electronic safety related
systems. Geneva, Switzerland.

International Electrotechnical Commission (IEC), IEC 61511: Functional safety:
safety instrumented systems for the process sector. Geneva, Switzerland.

Bibliography (Continued.)
Marszal, E. & Mitchell, P. (2004). Justifying the use of high pressure protection systems
(HIPPS). https://www.kenexis.com/wp-content/uploads/2014/05/ASME2004.pdf
Mathur, G. (2013). Understanding safety integrity levels (SIL) and its effects for field
instruments. Retrieved 1 November 2015 from
http://www.automation.com/pdf_articles/Understanding_SIL_and_effects.pdf
Solberg, W. (2012). E-clusive: How to validate and verify a safety system design.
Retrieved 1 November 2015 from http://pm-mn.com/2012/03/e-clusive-how-to-
validate-and-verify-a-safety-system-design/
Torres-Echeverria, A. (2014). On the use of LOPA and risk graphs for SIL determination.
http://www.risktec.co.uk/media/294135/on%20the%20use%20of%20lopa%20and
%20risk%20graphs%20for%20sil%20determination%20-
%20as%20published%20mkopsc%202014.pdf

Ryan Sherman - INST 2450 - HIPPS

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (19)

Similar to Ryan Sherman - INST 2450 - HIPPS

Similar to Ryan Sherman - INST 2450 - HIPPS (20)

Ryan Sherman - INST 2450 - HIPPS