High-integrity pressure protection lowers subsea costs - Oil & Gas Journal

High-integrity pressure protection lowers subsea costs

Many of Yokogawa HIPPS include a magnetic core logic based ProSafe-SLS

Ian Ramsay-Connell
Yokogawa Electric Corp.
Bedford, UK

Several North Sea examples illustrate the advantages of installing high-integrity pressure protection systems (HIPPS) on subsea wells.

Many published papers discuss the benefits of subsea HIPPS and many studies show the potential cost-benefit analysis of this technology in deepwater applications. An internet search for subsea HIPPS is informative; however, little appears that discusses the systems already delivered and operating successfully.

The business case for these systems is well documented, with the key advantage being the reduced cost of flowlines due to de-rated installation specifications. Few, if any, articles published to date describe subsea HIPPS operations in one of the most demanding technical and legislative environments in the world, namely the North Sea.

To date, five fields in the North Sea use subsea HIPPS: Kingfisher, Scoter, Juno, Penguin, and Kristin. The most recent subsea HIPPS was delivered to the Kristin field in mid 2005, with the total number of installations in excess of 20.

The Kristin field is notable because of its high 13,000-psi initial reservoir pressure and high 329°F. reservoir temperature. Wellhead pressure and temperature initially were 10,700 psi and 324°F., respectively.

Many of Yokogawa HIPPS include a magnetic core logic based ProSafe-SLS (Fig. 1).

The subsea HIPPS in Kristin is part of the manifold and might be the highest pressure operational subsea HIPPS in the world. The manifold is in 370 m of water and the production line design pressures are 4,800 psi.

All the mentioned fields have subsea HIPPS systems from Yokogawa Electric Corp. that are incorporated into a Kvaerner subsea control module (SCM).

This article describes the subsea HIPPS for all these fields, although Kristin is perhaps the most critical due to the process temperature vs. materials considerations.

First subsea HIPPS

Yokogawa has supplied many HIPPS with a magnetic core logic based Pro-Safe-SLS system (Fig.1), certified for applications up to safety integrity level (SIL) 4.

In 1996, the Kingfisher project in the UK sector of the North Sea seemed financially questionable unless the operator could apply innovative techniques to reduce the capital and operating expenditures. One technology selected was the use of HIPPS on the seabed that would allow for de-rating the flowlines. Traditionally, project designs have flowlines that can withstand the wellhead pressure and HIPPS installed on the topsides to protect the process.

In this instance, based on earlier conceptual studies, the designers realized that relocation of the HIPPS closer to the wellheads would save major capital expenditures. This was a simple concept, but the realization required technology that would combine the highest integrity with the highest reliability and availability.

The combination of these three features is often a balancing act. Increased integrity and nuisance failures reduce availability. Incorporating redundancy to improve availability and reliability requires more components that may fail.

Because this was an innovative approach, the UK Health & Safety Executive set the integrity level for the first system at SIL 4, a very rare demand, although it accepted later systems at SIL 3.

Fig. 2 Hipps Logic Functions

Suggestions at first were to build a new system with integrated electronics; however, the client quickly rejected this and referred to its experience with the magnetic core logic systems used on many North Sea platforms.

The client approached Yokogawa to develop a HIPPS prototype solution to satisfy the constraints of the subsea environment with magnetic technology, followed by a system for deploying the HIPPS.

Yokogawa standardized the system design so that future subsea HIPPS could use the same design if it were proved on Kingfisher. This basic design has been used on all subsea projects including the Kristin field in mid-2005 with some project-specific adjustments.

System design

The design constraints for all subsea HIPPS is summarised as follows:

• Diverse control functions.
• Remote communications inbuilt.
• Autonomous shutdown functions.
• Remote testability.
• Remote diagnostics.
• Additional diagnostics for transmitters and actuators.
• Space; must fit into existing SCM.
• Weight, SCM and remotely operated vehicle (ROV) friendly.
• Environmental strength.
• Power, minimum increase on standard SCM.
• No batteries.
• Guaranteed cold start-up.

Fig. 3 Output Driver Power Supply

Operation basis

Yokogawa's ProSafe-SLS HIPPS uses tiny toroidal magnetic cores (ceramic with a magnetic film). A magnetic field can magnetize each toroidal core in a clockwise or counterclockwise direction, the direction being controlled by passing current pulses through windings on the toroid.

One winding on each toroid is a clock pulse with a 1-ms period, although pulse duration is only 50 µs.

The design's combined windings on a toroid and combined toroids provide all the derived basic logic functions. A key feature is that a logic one occurs when the magnetic field is alternating, while a logic zero occurs when the field is fixed clockwise or counter clockwise. Tests have shown that it is impossible to generate an output from the system when the input is not pulsing at the required interval. No recorded incidents have been noted in which this logic system failed in an unsafe state.

For analogue inputs, the system uses a limited variability programmable trip amplifier with a library of certified applications. For HIPPS applications, this trip amplifier's configuration provides one trip output via a magnetic core, plus diagnostic outputs for over current, undercurrent, and transmitter noise levels.

Fig 4. Transmitter Faults

Design features

The typical subsea HIPPS has two banks of triplicate transmitters, each voted two out of three (2oo3), with the voted states "AND" voted such that either bank tripping will trip all outputs. The outputs comprise multiple emergency shutdown (ESD) valves, each operated by redundant solenoid valves (SOV) such that any SOV closing shuts down the flowline via the ESD valves.

The system may have more or fewer transmitters and ESD valves, but the logic functions remain the same as in Fig. 2.

Manual shutdown requires a signal via the serial communications interface to the SCM controller via redundant serial interfaces or via redundant fiber-optic interface connection to a topsides serial interface. Signals to override inputs and test outputs remotely are also via this serial interface, with provision for partial closure testing of the ESD valves.

Transmitter loops

On a topsides HIPPS, field power supply feeds power to the transmitters and the input to the HIPPS has fuses. Failure of a transmitter causes the voting to fallback to 1oo2. For subsea, however, with a SIL 3 or 4 integrity requirement, this is insufficient. The system cannot have fuses for obvious reasons and it must guarantee failure modes.

To address this, the subsea HIPPS has two-wire transmitters with current limiting resistors for preventing damage to the input circuits on over current.

The power for each transmitter loop comes from inherently fail-safe output drivers from the HIPPS system so that the devices in the topsides can control the power via the serial interface, guaranteeing that the input loop goes to a trip on that input. The output-driver power supply modules are inherently fail-safe certified by TuV to Class AK7 (up to SIL 4) so that it is virtually impossible for the output to be on when the input request is for off (Fig. 3).

This design addresses the problem of fallback voting and predictable failure modes; however, the transmitters require other diagnostics to satisfy SIL 3 and 4. The devices selected are SMART with some programmable failure modes based on internal diagnostics, which are supplemented by additional diagnostics in the HIPPS system.

The problem with analogue signals is that the only way to verify the reported value is by comparing it with a reference or other measurements from the same source. Repetition of the analogue input values to the SCM allow for relative comparisons to be made. Although HIPPS technology can do this, space constraints precluded it.

HIPPS has an isolated input circuit so that it was not practically possible to transfer analogue values between circuits. If the analogue value is below the trip level, the HIPPS presumes each analogue value is correct.

To enhance the diagnostics, each HIPPS analogue input is programmed to detect process noise within a threshold range. Should the noise level fall below the threshold for a specified duration, the HIPPS would declare that input faulty and trip that channel.

Due to a latent problem in the transmitters selected for an early system, several years of operation yielded faults that froze the transmitter outputs, which were only detected by this feature. Ultimately the transmitters had to be replaced (Fig. 4).

Transmitters, actuator diagnostics

The weaknesses in any high-integrity system are primarily the process valve and secondly the input transmitters. These devices are in the process line and most prone to failures caused by the process. To compensate for this, HIPPS has test features for allowing online periodic testing in between longer interval full function testing.

Fig 5. Methanol Injection

For transmitters, this testing is linked to the facility for clearing impulse lines. Methanol injection into impulse lines clears the orifice and causes an instantaneous high pressure within the impulse line. This high pressure generates a trip condition on the HIPPS input that produces an alarm but no trip, as it is only one channel. A full input test requires the cleaning of impulse lines individually (Fig. 5).

For the ESD valve, periodic partial closure testing provides justification for extending the full closure test interval. The test request is a pulse that is processed as a one-shot function, which is latched. This results in the output to the ESD valve solenoid deenergizing, thereby causing the valve to close.

The one-shot function ensures that a test request is not held on if the incoming request pulse fails to a steady on position due to a communications fault or a control system fault. A valve position indicator (VPI) connected to an analogue trip amplifier monitors the valve position. When the valve reaches a set position, the trip amplifier trips and the test latch is reset. If the VPI feedback does not occur in a set time, an inherently fail safe timer cancels the test. Genuine trip demands are not disabled during the test cycle.

Environmental issues

Initially, it was not certain whether a subsea HIPPS could meet the environmental requirements, specifically shock and vibration but also temperature and humidity. The original design required a 24-in. rack for the complete HIPPS logic and input-output processing, although some later systems used two racks.

The only enhancement in the subsea unit to the standard HIPPS rack is the inclusion of a locking compound on all screws. All subsea HIPPS racks are subjected to shock and vibration testing.

Power

Each complete subsea HIPPS logic, including the powering of transmitters, solenoid valves, and the communications interface typically requires 4 amps at 24 v DC. The Yokogawa ProSafe-SLS logic system has magnetic core technology with dynamic current pulses on a 1-ms clock frequency as previously stated.

The current pulses are 0.5 amps in amplitude to provide extremely high immunity, but they are only 50-µs in duration, which results in the very low overall consumption and low heat dissipation. Some systems included additional digital input loops that are typically 12 ma so that they have minimal additional loading.

Operational issues

The Kingfisher project went on line in late 1997 and received much notice as the world's first subsea HIPPS installation. The system operated without problems until the HIPPS reported a series of transmitter faults.

Despite the subsea HIPPS attracting much attention for saving several million dollars and the fact that the project was brought on stream early and under budget, the next subsea HIPPS was installed 5 years later.

The Kingfisher project was to prove out the concept, with Yokogawa providing a solution to enhance the capability of the subsea control systems supplier. After 5 years of successful operation, more systems finally followed in the North Sea, culminating with the unit for the Kristin field in mid 2005.

The design of the Kristin system clearly relates to the original Kingfisher system, although it has minor adaptations to the process requirements. The system has an enhanced and smaller communications element and an unchanged logic system.

To date, operators have recovered two SCM's with subsea HIPPS that have had equipment problems. In neither case were the problems with the subsea HIPPS.

Industry has shown interest in the using of subsea HIPPS in the Gulf of Mexico and in South America. The technology and the solution are now well proven (no system failures recorded on operating systems to date) so that all other factors permitting, subsea HIPPS should be a first consideration rather than an alternative.

The author Ian Ramsay-Connell (ramcon@ntlworld.com) is a consultant for Yokogawa Electric Corp. in Bedford, UK. He has more than 30 years' experience in automation and is responsible for developing the world's first subsea HIPPS. He previously worked for Shell UK and with companies in such industries as pharmaceutical research automation, guidance systems, and steel manufacturing. Ramsay-Connell has a control engineering degree from Teesside University.