OTC 14183

Current State of the Art in the Design of Subsea HIPPS Systems

Janardhan Davalath, FMC Kongsberg Subsea
Harold Brian Skeels, FMC Kongsberg Subsea
Sverre Corneliussen, FMC Kongsberg Subsea
Copyright 2002, Offshore Technology Conference
This paper was prepared for presentation at the 2002 Offshore Technology Conference held in
Houston, Texas U.S.A., 69 May 2002.
This paper was selected for presentation by the OTC Program Committee following review of
information contained in an abstract submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Offshore Technology Conference and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Offshore Technology Conference or its officers. Electronic reproduction,
distribution, or storage of any part of this paper for commercial purposes without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print
is restricted to an abstract of not more than 300 words; illustrations may not be copied. The
abstract must contain conspicuous acknowledgment of where and by whom the paper was
presented.

Abstract
This paper presents a state-of-the art review of the design
options for subsea flowlines and production equipment for
high-pressure service considering the High Integrity Pressure
Protection System (HIPPS). Industry is finding prospects
requiring High Pressure High Temperature (HPHT) equipment
as oil and gas development extend into deeper offshore
reservoirs. To develop these fields as subsea tiebacks, the
design of flowlines and risers for HPHT conditions often
becomes technically challenging or cost prohibitive.
One of the options is to use a HIPPS system to allow the
use of a lower-pressure rated flowline compared to the
wellhead and tree equipment. However, it may not be obvious
whether HIPPS is cost-effective, practical or operationally
acceptable. Design issues for evaluating HIPPS include: field
architecture, offset distance, line size, materials, pressure
rating of the system components, length and pressure rating of
fortified zones, type of control system, system reliability,
dynamic pressure rise resulting from a blockage and installed
cost. Another fundamental issue is Why are land-based
HIPPS systems widespread and generally accepted in the
industry, but not used as yet subsea?
For selected field architectures, the impact of using
HIPPS will be illustrated with respect to these design issues.
These design case studies will provide guidelines as to which
combination of architectures and design parameters will be
most suitable for taking advantage of the HIPPS system
capabilities. The paper will also summarize current industry
design guidelines that apply to the design of HIPPS.

Introduction
High integrity pressure protection systems (HIPPS) are the
evolution of mechanical and electronic safety devices used in
the process industry to handle production or transportation
upsets. Simply put, HIPPS is designed to protect low-rated
equipment against overpressure or abject flow accompanying
the upset condition by either isolating or diverting the upset
away from the low-rated equipment. However, HIPPS is more
commonly referred to as a high integrity pipeline protection
system, because many HIPPS design/cost studies are
associated with field layout pipeline designs.
There are two fundamental methods for maintaining a
design break between the pressure requirement associated
with conventional rated equipment and the pressure
requirement for low-rated equipment:

Maintain an effective barrier at the boundary between the

two sections (high and low pressure rating) with a safety
shut-off device, and/or

Provide a relief safety system in the low-rated system to

reduce or maintain the excess fluid flow and thereby limit
the build up of pressure in that system 1

Deciding whether to use any safety system (or what type)

depends on its overall cost and its reliability compared to a
more conventional design. The key is fool proof reliability
taken into account during risk analysis exercises. The barrier
or relief system must be both highly effective and reliable and
have a low enough failure frequency to represent an
acceptable level of risk. Without these features, HIPPS will
most assuredly not be recommended, regardless of cost,
because of possible adverse consequences to HSE or
damage repair.
A HIPPS safety systems reliability is defined as the
expected time that it can monitor process parameters and react
to process upsets by diverting or isolating on demand,
independently from any other process control. Three examples
are shown in Figure 1. Since it is independent of human or
process control, it has to sense process conditions on its own

J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN

and its reliability is subject to the safety devices relative

immunity to the process fluids environment. Situations
where scale, wax, or other solids form on wetted surfaces
could interfere with sensory actuation devices or plug monitor
ports that may lead to unwanted failure of the safety device(s).
Relief valves, rupture disc, or shut off safety devices which
are in direct contact with process fluids may seize or stick
open from deposit build up or bridge over unless they are
routinely functioned and checked. Active control valves often
avoid these problems since their actuation is independent from
contact with the process fluid. Instead active control valves
rely on separate sensors. But their sensors may succumb to
the same plugging problems unless it is frequently maintained
or of a robust/redundant design that can withstand a range of
operating environments and again frequently functioned
and checked. 1,2,3
Robust/redundant designs feature two or more voting
sensors and often two (or more) active flow control devices to
assure operation. Maintained systems may be less redundant,
using fewer independent parallel components, but achieve
high availability through vigilant maintenance. However, the
lower capital cost for less redundant systems comes at an
additional maintenance cost.
Even with a battery of performance history and risk
analysis, we are reminded of what can happen when a HIPPS
system fails to work. The Brenham explosion in 1992 is a
good example. A relief valve stuck in the bypass condition,
leading to an overfilling of an underground salt dome holding
facility and subsequently vented natural gas to the
environment. The upset condition remained undetected until a
passing car ignited a cloud of gas. The subsequent
atmospheric explosion sent a shock wave, which could be felt
throughout Houston several tens of miles away. 4
Field History
Relief valve and throttling HIPPS systems have been around
as long as pipeline systems have been in service.2 The
voting sensor version of HIPPS has been utilized in Europe
for over twenty years as an extremely reliable means to
rapidly isolate low-rated equipment used in gas distribution,
hydrocarbon treatment plants, and offshore platform
applications. 5,3
The authors are also aware of four subsea HIPPS systems;
three in the North Sea (sgard, Gullfaks and Kingfisher6), and
one in the Gulf of Mexico (Mensa7). sgard uses a pipeline
isolation HIPPS system featuring tandem quick closing valves,
HCM and topside monitoring system. The HIPPS quick
closing valve actuator is made fail safe using the valves
internal bore pressure to rapidly close; no internal springs for
closing are required. The Gullfaks system isolates one high
pressure well by dual quick closing HIPPS isolation valves
integrated into a 4-slot manifold. A separate HCM controls the
HIPPS valves. The system has been successfully land tested

OTC 14183

and installed subsea. Commissioning is planned for the

summer of 2002.
The Mensa subsea development has 68-mile long flowline
system7. The Mensa flowlines have a design pressure that is
less than the shut-in tubing pressure of the wells. This was
acceptable because the long flowline has a large volume so
that in the event of a blockage, the subsea valves at the trees
and the manifold can be closed before the flowline may be
overpressured.
Furthermore, redundant and retrievable
pressure gauges are installed at the tree and the manifold.7
Surface vs. Subsea HIPPS
So why are surface applications for HIPPS widely accepted
and not Subsea? Surface HIPPS safety systems are widely
used in many land-based pipeline transmission and offshore
platform operations, with established equipment and system
performance history. 3,4 These systems may be as simple as a
spring-loaded relief valve all the way up to sophisticated
feedback loop control systems that throttle flow or provide
automatic shut-off.
In most designs, surface HIPPS
configurations also have a means to divert upset flow into a
holding chamber where it later can be processed in a
controlled manner or flared off. The volume of the holding
facility is usually determined by the estimated flow rate and
pressure of the processed fluid times the closing time of the
safety valve that diverts the flow to the holding area. A flare or
vent is added to a holding facility as an added safety device
should the upset exceed the holding facilitys capacity. Relief
valve or throttling valve HIPPS designs must have the holding
chamber since they cannot isolate flow. Automatic shut-off
valves designs may not require a holding facility, but
including a holding facility adds a second safety device,
increasing the overall reliability by being able to handle
excess capacity should the shut-off valve leak or operate
less efficiently.
A subsea HIPPS system schematically appears to be
simpler, but is in fact more sophisticated than its surface
counterpart.8 First, instead of a holding facility, a subsea
HIPPS system features one or more fortified zones. 3,5 The
length of these zones are determined through flow assurance
modeling of how far an upset can travel within the process
system before the safety devices have enough time to sense
and isolate the low-rated equipment from any more upset
flow. In a sense, the fortified zone(s) act as an accumulator,
able to withstand an intermediate pressure and fluid volume
until the process flow further downstream can absorb the
excess. Second, subsea HIPPS designs so far rely solely on
shut-off valve designs trading on this type of valves immunity
to process fluids and its relative ease to build a marinized
version. The subsea HIPPS system is similar to surface HIPPS
shut-off valve devices in that both feature two or more
voting sensors and often two (or more) shut-off valves.
It is believed that there are three reasons why subsea
HIPPS are not more widely used.

OTC 14183

CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS

First, the lack of a holding facility limits available options

for bleeding down the upstream side of the process piping.
If upstream process fluids remain trapped for an extended
period of time, they will become subject to hydrate plugging
and difficult to remedy. Reopening the HIPPS valve(s) in an
uncontrolled fashion to vent the upstream may result in a
prolonged differential pressure across the valve, which could
lead to adverse erosional wear in the shut-off valve(s). The
problem could be circumvented by adding a dedicated relief
line, or adding a special bypass relief choke. Unfortunately,
these modifications add expense and are subject to plugging as
well, making them less reliable.
Second, inspection and replacement of a subsea HIPPS
system is difficult and expensive. If replacement is ruled out,
then the inherent reliability of the entire HIPPS package must
approach 1 to be as dependable as a conventional pipe
system. This may get prohibitively complex and/or expensive
either of which could scuttle its selection.
Third, to keep reliability confidence high, the HIPPS
system must be functioned and tested on a regular basis;
resulting in an interruption of production, which is difficult to
start and stop subsea because of the adverse cool down effects,
associated with seawater cooling in deepwater and over long
offset distances.
Installed Cost
As mentioned, deciding whether to use HIPPS boils down to a
cost vs. risk analysis; comparing the overall cost and
reliability of a HIPPS plus a low-rated design against a the
cost of a conventional high-rated design. In high-pressure and
deepwater fields, the use of thick-walled flowlines designed
for shut-in tubing pressure is expensive and extraordinarily
heavy. In some situations this is exacerbated by the presence
of corrosive elements, which may limit material strength
and/or dictate the use of corrosion resistant alloys (CRA). Use
of HIPPS reduces the flowline wall thickness and possibly
allows the use of more conventional materials by reclassifying
the pipeline to a lower (less corrosive) material class. This
results in large savings based on flowline materials, including
size and weight. Installation of thinner wall piping is
considerably cheaper because it may:

Lower onshore and/or offshore welding and

fabrication costs
Lower handling and transportation costs
Lower installation reaction loads (tension) during pipe lay
work, reducing demand on the installation vessels and
possibly increase the choice and type of
installation vessels
Allow for increased capacity of pipe on the installation
vessel due to lower pipe weight

In spite of the risk limitations, HIPPS may be an

economically attractive solution in HPHT field developments.
Otherwise, use of high-pressure pipelines for high temperature

and/or corrosive service could be prohibitively expensive or

technically unfeasible.
Field Architecture
Typical HIPPS scenarios are shown in Figures 2-4. Figure 2
illustrates subsea trees leading to a gathering
manifold/pipeline or a well flowline, then on to a host surface
facility. In order to benefit from the use of a HIPPS control
system, the majority of the flowline length can be rated to a
pressure lower than the maximum shut-in tubing pressure of
the wells connected to the gathering manifold. The manifold
or the flowline sleds may contain fast-closing HIPPS valve
with local or remote control. A short section of the flowline is
fortified with a pressure rating that is at least the same as the
shut-in tubing pressure (SITP) of the well. If a bridge or plug
forms in the flowline, the control system reaction time and
HIPPS valve closure time must be fast enough to avoid
overpressure. Therefore, a short section near the manifold is
fortified in case of a bridge or hydrate plug forming in the
flowline near the manifold. The riser piping and the flowline
pipe near the riser base is also fortified in case of an
unplanned valve closure, plug or blockage combined with
catastrophic failure of the HIPPS control system. The purpose
is to protect the operating personnel at the platform.1
Application of the HIPPS scenario for a specific project
depends on the subsea field architecture. Following are some
examples of typical tieback scenarios and the impact of using
subsea HIPPS in these field architectures.

Single well tieback

Daisy chain tieback

In all cases, the type of flowline (bare, insulated, pipe-inpipe) and type of riser affects the design of the HIPPS system
and the benefits of using HIPPS.
Single Well Tieback. Figure 3 is typical of a single well
tieback to a host platform. A common configuration is a
subsea Christmas tree with a single well jumper, one or two
flowline sleds with dual flowlines. Dual flowlines are most
common for deepwater tiebacks for flow management. As
shown in this figure, the Christmas tree, well jumper, sled
piping and valves would be rated to shut-in tubing pressure. A
HIPPS valve installed at the tree or the flowline sled would be
designed to shut-off flow in case of a high-pressure event.
Furthermore, both the flowlines will require a fortified zone
near the tree and a fortified riser and flowline pipe near the
host facility.
Manifold Tieback. Figure 4 illustrates an example of a
manifold tieback to a host platform. This configuration shows
off-template wells with well jumpers, a manifold, flowline
jumpers, and dual flowlines to a host platform. In this case,
two options are available for the HIPPS architecture:

J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN

Pipeline HIPPS. Install HIPPS valves downstream of the

manifold. All subsea hardware upstream of the HIPPS valves
(Christmas trees, well jumpers, manifolds, sleds) will be rated
to the full shut-in pressure. The flowline would be fortified
for some calculated distance downstream of the HIPPS valves.
The riser and the flowline near the riser base would also be
fortified. However, one of the disadvantages of this option
is that large-bore valves in the manifold and/or flowline sled
would have to be rated to the full-shut in pressure. The
industry has limited field experience in providing large-bore
valves rated to 15,000 psi or even 10,000 psi. Furthermore,
reliability of the system may be impaired by the large stroke
associated with the performance of the HIPPS system largebore high-pressure valves.
Simple HIPPS. Install HIPPS valves further upstream, in
the Christmas tree. The trees wing valve is reconfigured into
a quick closing HIPPS valve and the master valves would be
designated as somewhat slower acting back-up valve(s). HCM
control would be a separate control system, yet housed in the
same canister with the trees SCM. Added sensors are placed
on the tree to complete the two-out-of-three sensor-voting
configuration. The gathering and manifold equipment would
be spared the high pressure design requirement, following the
somewhat lower requirement for the fortified zone and taking
advantage of more conventional hardware.
Daisy Chain or Ring Tiebacks. In daisy chain or ring
tiebacks, the interconnecting segments of the flowline between
the wells have to be fortified if Pipeline HIPPS is used. In
addition the riser and flowline near the riser base would also
have to be fortified. If Simple HIPPS is used, the sled
piping and interconnecting flowline segments do not have to
be fortified to the full-design pressure. In this case,
significant cost reductions from reducing flowline wall
thickness can be achieved.
Length of Fortified Zone / Dynamic Pressure Rise from
Sudden Blockage. The length of the fortified zone near the
subsea well or manifold is determined from dynamic analysis
of pressure build-up in upset events. Under normal flowing
conditions, a subsea choke at the well is used to reduce the
flowing wellhead pressure to a lower level at the manifold
headers. Possible upset events can cause pressure to build up
in the flowline:

OTC 14183

in tubing pressure. The length is selected so that a blockage

forming anywhere inside the fortified section will not result
in damage. The length is defined by the maximum possible
response time needed for the control system to respond, close
the HIPPS valves and avoid overpressure.
Key Design Issues
HIPPS is commonly brought up in subsea field design studies
whenever an equipment design boundary is identified. The
most common occurrence is when a high pressure subsea well
or field has its pipeline terminate at a delivery platform with a
lower pressure or capacity rating. But the proper use of HIPPS
is more complicated than just looking up hardware solutions
for the barrier at the boundary point. Subsea HIPPS should be
looked at in the larger context of a fields flow assurance
designs in concert with the terrain of the field and its offset
distance. Pressure ratings of the well and its performance over
time should also play key parts in the decision process.
Offset Distance. An important parameter is the offset
distance. By using HIPPS system, the wall thickness of the
flowline can be reduced in all sections except the fortified
section. The length of the thin-walled flowline section is a
direct function of the offset distance. Therefore, HIPPS
results in the greatest cost benefits for long-offset tiebacks.
Line Size. The wall thickness for a given design flowline
pressure is directly proportional to the line size (t=PD/(2)),
where t = wall thickness, P = design pressure, D = line outside
diameter, and = maximum allowable hoop stress, based on
thin-walled pressure vessel theory. The wall thickness savings
is directly proportional to line size. By lowering the design
pressure, HIPPS will save on pipe material by reducing wall
thickness as a function of line diameter.
Materials. The cost savings from using HIPPS is also a direct
function of type of materials. Oil field material use is
governed by the partial pressure of corrosive elements;
primarily H2S and CO2. The partial pressure is a product of the
mole percentage of these agents in the process fluid times the
operating pressure of the process fluid. Using HIPPS, the
operating pressure can be greatly reduced, thereby reducing
the partial pressure of the corrosive agents and minimizing the
need for expensive high-strength or CRA materials. 9

Unplanned shut down of boarding valves at host platform

Blockage formation (i.e. hydrates) anywhere in the subsea
system production flow path
Choke failure resulting in high flow rate and increased
manifold pressure

Pressure Ratings. Another aspect to consider when looking

at the need for HIPPS is the maximum shut-in pressure at
various points in the field, including: the wells, gathering
points, processing points, and the delivery pipeline. Use of
pipeline pressure protection systems have been categorized in
three different pressure ranges:

Of all the above events, the most severe case is a sudden

or instantaneous hydrate blockage occurring near the subsea
well or manifold. To protect against a blockage near the
subsea manifold, the flowline is generally designed with a
certain length of fortified section, which is rated to the shut-

0 to 10,000 psi. In this pressure range, current industry

practice is to use traditional methods for flowline design, i.e.
rate to full shut-in tubing pressure. This practice has been
used economically for all projects using carbon steel
flowlines. Furthermore, field-proven technology exists for

OTC 14183

CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS

subsea Christmas trees, large-bore isolation valves, connectors

and other required hardware to build the field.
10,000 psi to 12,500 psi. Recently, a number of
applications have surfaced which require shut-in tubing
pressure slightly exceeding 10,000 psi. In these applications,
use of HIPPS has been carefully considered against other
options. In some cases, HIPPS was not used based on detailed
investigation of the project parameters and by considering the
following options (alone or in combination):

The shut-in tubing pressure is slightly lower than

initial estimates
The shut-in tubing pressure declines very rapidly, i.e.
depletion drive reservoir. In these cases, the flowline
may have sufficient design pressure capacity
considering non-corroded pipe early in field life
The flowline pipe is retested to qualify for slightly
higher design pressure
The Christmas tree, flowline connectors and valves in
subsea system are re-rated to higher pressure based
on thorough review of qualification tests,
process tolerance tightening and special use of
hardfacing techniques; i.e. only minor hardware
component changes - no major body or pressure
containment changes 9
Control system software is modified for faster local
control, thereby improving response time to
upset conditions
Adjust the design pressure requirement for all subsea
hardware considering the external hydrostatic head
of seawater

12,500 psi or Greater. For shut-in pressures exceeding

12,500 psi, it becomes increasingly difficult to qualify 10,000
psi equipment using process or material hardface
substitutions.9 In these cases, 15,000 psi hardware will be
needed for the subsea tree, jumpers, manifolds, etc. Flowlines
have to be rated to the full shut-in pressure or a HIPPS system
will be needed. Where HIPPS is place can be crucial to the
overall field design and hardware cost. Usually HIPPS is
located some distance downstream, to better detect and have
time to react to upsets. However, all equipment and piping
upstream of HIPPS will need to be rated for full shut-in
pressure. This places a huge premium on the large bore
gathering and manifold equipment, which has to be
redesigned in larger packages to withstand the increased
pressure requirements.
If HIPPS were made to react faster and moved further
upstream, say up to the Christmas trees, then gathering and
manifold equipment would be spared the increased pressure
requirement, and designers could take advantage of more
conventional large bore hardware.
HIPPS Control Systems
A HIPPS operating philosophy is based on monitoring and

safely controlling possible over-pressurization by rapidly

closing the HIPPS valve, isolating the upset environment from
low-rated equipment (usually a flowline or pipeline).
Under normal operating conditions flowline pressure is
maintained by adjusting a flow control device such as a choke.
Sensors connected to the HIPPS Control Module (HCM)
measure the flowline pressure and transmit the data to the
Master Control Station (MCS). The MCS interprets the
pressure data from all of the sensors and transmits commands
to a separate Subsea Control Module (SCM) to adjust the
choke setting to maintain the process pressure within safe
limits. If the MCS detects a developing upset or out-of-limit
condition, logic available to the topside system might be
implemented to shut-in the equipment in a predetermined
Process Shut Down (PSD) sequence. If either the HCM or
MCS detect a rapidly developing upset, commands can be sent
to much faster reacting quick shut-in valves (QSV) from either
from the MCS to the HCM, or from the HCM
acting independently.
Trigger System. At the heart of any HIPPS featuring a shutoff device is its trigger system. The trigger system is designed
to provide ultra high reliability through redundant functions,
redundant sensors, use of voting logic, and periodic testing.
Hydraulic sensing such as level and float devices interact
with the process fluids directly and limiting arms are pre-set to
allow relief valves to open when limits are exceeded.
Pneumatic or hydraulic sensors may be coupled to tubing
circuits, which interact with logic valves to operate actuators
for larger relief and shut-off valves.
Electrical trigger systems often comprise of two
independent microprocessor based systems that receive signal
input from three pressure transmitters (PT), is a functional part
of a Subsea Electronic Module (SEM) and its operating
software inside the HCM. Three PTs are often located
between the HIPPS QSV valve and a second Emergency Shut
Down Valve (ESDV). Each PT is equipped with dual
electronic measurement circuits and sensor transducers to
achieve total separation between the two SEM systems,
providing total redundancy in both sensors and sensing
circuits. One or both of these valves is activated if one or both
of the SEMs detect an upset condition (usually overpressure)
using a voting scheme. The trigger outputs are connected to
the directional control valve solenoids in a hydraulic circuit
and pressure source to activate the fast closing actuator on
the QSV.
The trigger system can be tested by applying overpressure to the sensors using the tree chemical injection line
and activating the relevant tree valves. The 2 out of 3 (2oo3)
voting scheme automatically degrades to a 1 out of 2 (1oo2)
voting scheme upon detection of a transmitter failure, which
is defined as output current falling outside of the
operational range.

J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN

Each trigger circuit and SEM receives electrical power

through electrical power and signal circuits via control
umbilical conductors. Therefore, triggers can communicate
with the surface facility and receive required commands
during manual valve operation and periodic system tests.
In addition to the redundant hardware, the overall purpose of
the trigger function philosophy is based on layers of control
and safety to add redundancy. If one layer fails to perform its
intended function the next layer shall maintain the core safety
of the system. When progressing from layer to the next the
complexity of the functionality is reduced and the reliability
is increased.
Primary Trigger. The primary trigger function is
activated if HCM connected sensors detect an upset condition
above the pre-set limit. Three independent pressure sensors,
utilizing a 2 out of 3 voting scheme to detect potential overpressure, ensure reliability. Each HCM independently
monitors the process fluid using input from its sensors and
reacts to indicated upset conditions by activating the
rapid closing QSV valve(s) to isolate the upset from
low-rated equipment.
Secondary Trigger. The secondary trigger function is
activated in the unlikely event of a primary trigger failure. The
primary trigger might fail because of two simultaneously
failing SEMs or two simultaneously failing PTs. The topsides
MCS, which is also monitoring process limits receives upset
condition values from the three PT sensors and disconnects the
umbilical electrical supply to the HCM and SCM if upset
conditions continue to be detected via the voting scheme for
the sensor data from the entire field. Electrical power loss
closes an SCM control valve and all valves, including the
HIPPS valve, are immediately closed.
Trigger Rate. Now that Trigger Logic has been established,
the next task is to establish the upset limits that it must
perform within. Upset limits set very close to normal
operating conditions require very fast response QSVs and
trigger circuits. They are often associated with a HIPPS being
located close to where expected upsets may occur in the
process stream. Upset limits that apart from normal conditions
can react much more slowly and may be located further from
upset points since the HIPPS has more time to sense and react
to an upset and may be able to utilize more conventional shutoff valves to isolate process fluids.
Fast Acting. This system reaction time is less than two
seconds with all HCM logic on the seabed. This is the
traditional HIPPS system with all trigger decisions made
subsea. The topside only acts a support and monitoring system
during operation and test. QSVs are designed with fast closing
actuators and valve bore pressure assist to close within a
few seconds.

OTC 14183

Slow Acting. With this system, reaction time may be

greater than ten seconds with all logic on the surface. This is
an alternative HIPPS system with all trigger decision made
topside. A separate and independent part of the topside system
acts a support and monitoring system during operation and
test. Slower, more conventional valves may be used, even
subsea tree valves, to serve as QSVs.
The choice between Fast and Slow Acting often turns into
an iterative design process. Trigger points usually are spaced
as far from normal conditions as possible to avoid false
alarm tripping of the HIPPS caused by anomalous fluid flow
behavior, such as slugging. However, HIPPS equipment is
preferred to be located as close to predicted upset locations to
minimize the use of high-rated equipment and piping. As
previously stated, closely located HIPPS requires much faster
reacting equipment. Therefore, careful dynamic flow
assurance analyses are needed to optimize field architecture,
predict where upset points could occur (hydrate or wax plugs)
and understand flow characteristics.
Reliability Assessment
Once a HIPPS control system architecture is defined, a
comprehensive reliability assessment is necessary to
demonstrate it has the same or better reliability than other field
architecture options, including a full rated system. This
section should be regarded as more of a description of the
analysis approach.
For a safety system like HIPPS, there are two important
performance factors:
Safety Performance. This is defined as the probability of
the system failing to operate upon demand, i.e., the
probability that the system will not respond to a manifold
pressure higher than a pre-set level and fails to close the
HIPPS valves. The probability of failure to operate on demand
is denoted as Critical Safety Unavailability (CSU).
Production Regularity Performance. This is defined as an
assessment of unintended production shutdowns due to the
HIPPS. Referred to as the Spurious Operation Rate (SOR),
this term also includes procedural shutdowns due to loss of the
safety function.
The two requirements are, to some extent, contradictory
and the design has to balance them. Due to the relatively slow
build up of pressure in the flowline, two levels of shut down
functions are implemented. The Safety Performance of the
subsea HIPPS can be relaxed somewhat. In the case of a
subsea HIPPS failure, there is time enough for the topside
HIPPS to activate a complete field shut down.
Reliability analysis based on reliability block diagrams
and modeling dependent failures are governed by several
Industry guidelines and recommended practices. Established

OTC 14183

CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS

values for CSU and SOR within these guidelines help set the
reliability levels a HIPPS design must meet.
Dependent failures (i.e. common cause failures), which
may cause redundant systems to break down simultaneously,
dominate the reliability calculations. Although there are
several models for quantifying dependent failures, most
analyses are done using either a Beta Factor Model or
Multiplicity Distribution.
However, finding enough relevant data to determine the share
of dependent failures compared to the total failure rate can be
a problem. In systems with short histories, such as HIPPS,
these methods will only contribute rough estimates. Therefore,
estimates should be reviewed under established engineering
judgment.
Design Parametric Study
A series of deepwater field development cases have been
prepared and analyzed to illustrate the impact and benefits of
using HIPPS. Each case study in the parametric study
illustrates the combination of parameters that will be most
suitable for taking advantage of the HIPPS system capabilities.
Base Case Assumptions.
No of wells
Offset Distance
Flow Rate
Water Cut
SITP
FWHP
Flowing Manifold Pressure
Max FWHT
Water Depth
Oil API Gravity
Gas Oil Ratio
Bubble Point Pressure
Water Cut

1 to 4
30 miles
20,000 BPD/well
50%
13,000 psi
9,000 psi
less than 5,000 psi
300 deg F
5,000 ft at the subsea field
600 ft at host platform
38
1200
4,000 psi
50%

Flowline Sizing. For the above case, the flowlines have

been sized for various configurations and number of well.
See Table 1.
In each case, the wall thickness has been estimated based
on the thin-wall equation (as stated in 30 CFR 250 guidelines).
The table also reports the net savings in carbon steel materials
by using HIPPS for the 30-mile tieback case. If a different
class of materials is used, the savings will be greater.
Dynamic Analysis of Pressure Build Up. To determine the
optimum length of the fortified length in the flowlines, a
dynamic analysis of multiphase flow was performed to
estimate how quickly the flowline pressure would build up in
case of a hydrate blockage at the end of the fortified section.
Hydrate blockage is assumed to occur within ten seconds from
the start of the event. Sensitivity to fortified length of 1 and

5 miles was investigated. The dynamic simulation considers a

sudden blockage formation, which causes the flowing
wellhead pressure to rise. As the flowing wellhead pressure
rises, the flow declines until the tubing-head rises to 13,000
psi. Figure 5 illustrates the dynamic response of a single well
flow in a single 8.625 OD flowline with a fortified length
of 5 miles. Trigger pressure is set to 5,200 psi (4,700 psi
FWHP plus 500 psi margin). Time to reach the flowline
design pressure of 7,500 psi is estimated to be 32 seconds.
For the cases in which dual flowlines are present, these
results are conservative. The flow is assumed to be equally
split between flowlines. The blockage is assumed to occur
simultaneously and within ten seconds. There is no back flow
from one flowline to the other from blockage formation. If
plugs form at different time periods, the pressure rise from the
higher friction will be detected by the control system and the
system will be shut down safely.
Table 2 summarizes the pressure build-up times for the
five cases evaluated.
Currently available HIPPS systems are adequately
designed to meet the dynamic pressure build-up times listed in
Table 2. The HIPPS control system can respond within 20
seconds and close the subsea HIPPS valves to isolate the high
pressure from the flowline sections, which are designed to
lower pressures. The length of the fortified section can be
adjusted depending on the flow rates, water cut and fluid
properties to meet project requirements. Example results are
shown in Table 2.
Industry Guidelines
There are no direct guidelines for subsea HIPPS systems.
However, the concepts and principles of surface systems can
be applied.
The main guidelines and standards relevant for subsea HIPPS
systems are:
API RP 14C

Recommended practice for Analysis,

Design, Installation and Testing of Basic
Surface Safety Systems on Offshore
Production Platforms
API RP 521
Guidelines for Pressure- Relieving and
Depressuring Systems
NORSOK P 001 Process Design
IEC 61508
Functional Safety of
Electrical/Electronic/Programmable
Electronic Safety Related Systems
IEC 61511
Functional safety: Safety Instrumented
Systems for the process industry sector
Recommended Guidelines for the
application of IEC 61508 and IEC 61511 in
the petroleum activities on the Norwegian
Continental Shelf

J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN

API RP 14C does not have a specific description of a

HIPPS system. Overpressure protection in by a Pressure
Safety Valve (PSV) venting to flare. NORSOK P 001
describes how surface HIPPS valves can replace the PSV for
pressure protection.
The standards IEC 61509/511 describe the requirements
for electronic software based safety systems. The IEC
standards set requirements for all phases in the life of a safety
system from concept design to de-commissioning.
The IEC standards introduce the concept of Safety
Integrity Level (SIL). The SIL level number is basically the
probability for the safety system not to perform its intended
function when called upon. See Table 3.
Basically the systems SIL level is defined by a
combination of equipment configuration including
redundancy, design process activities, initial system testing,
operational testing and maintenance.
Conclusions
The current state of the art of HIPPS has been reviewed. The
following are key conclusions from this review:
Subsea and surface HIPPS systems are briefly
compared to understand the similarities and
differences. While reliability is critical in all HIPPS
systems, achieving the required level of reliability
in subsea HIPPS requires a higher level of
sophistication.
Subsea HIPPS is a cost-effective alternative in
developing HPHT fields to reduce the installed cost
of flowlines. Key design parameters include the
offset distance, line size, material requirements and
pressure rating. A design parametric study has been
completed to illustrate the effect of some of these
key parameters.
Reliable HIPPS systems are available and have been
installed in two field developments located in the
North Sea.
Applicable industry guidelines relevant to HIPPS are
briefly described for reference to designers.
Abbreviations
API
American Petroleum Institute
APS
Abandon Platform Shut Down
BPD
Barrels per Day (0.159 m3/day)
CCR
Central Control Room (or Master Control
Station (MCS) )
CRA
Corrosion Resistant Alloy
CSU
Critical Safety Unavailability
ESD
Emergency Shut Down
ESDV Emergency Shut Down Valve
FWHP Flowing Wellhead Pressure
FWHT Flowing Wellhead Temperature
HCM HIPPS Control Module
HIPPS High Integrity Pressure (Pipeline) Protection System

HTEM
HPHT
IEC
MMS
NPD
NooX
OD
PSD
PMV
PSI
PSV
PWV
PT
QSV
RP
SCM
SEM
SIL
SITP
SOR

OTC 14183

HIPPS Trigger Electronic Module

High Pressure / High Temperature
International Electrotechnical Commission
(United States Govt.) Minerals Management Service
(Norwegian Govt.) Norwegian Petroleum Directorate
N out of X Voting Logic
Outside Diameter (or Line Outside Diameter (D) )
Process (Production) Shut Down
Production Master Valve
Pounds per Square Inch (0.069 bar)
Pressure Safety Valve
Production Wing Valve
Pressure Transmitter (Transducer)
Quick Shut-In Valve
Recommended Practice
Subsea Control Module (Control Pod)
Subsea Electronic Module
Safety Integrity Level
Shut In Tubing Pressure
Spurious Operation Rate

Acknowledgement
The authors would like to thank the management and technical
staff of FMC Kongsberg Subsea for permission to publish
this paper.
References
1. Bayly, D.B., Loth, W.D., Pressure Specification Break
Pipelines, paper presented at the Society of for
Underwater Technology conference Aspect 94 Advances in Subsea Pipeline Engineering and
Technology, Aberdeen, Scotland, May 1994. 5.
2. Hiatt, D.C., Holtman, D.E., Overpressure Devices Vary
in Design to Meet Different Needs, Pipe Line & Gas
Industry Magazine, Gulf Publishing Co., Vol. 81, No. 10,
October, 1998.
3. Onshus, T., Aar, R., Lund, B.F., HIPPS Applications
and Acceptance Criteria, #7828, Offshore Technology
Conference, May 1995.
4. National Transportation Safety Board, Highly Volatile
Release from Underground Storage Cavern and Explosion
Mapco Natural Gas Liquids, Inc. Brenham, Texas April 7,
1992,
NTSB Report Number: PAR-93-01, adopted on
November 4, 1993, NTIS Report Number: PB93-916502
5. Internet sites:
www.iceweb.com.au/valve/hipps.htm
www.mokveld.nl/hipps2.htm
www.mokveld.nl/hipps3.htm
www.mokveld.nl/hipps4.htm
www.mokveld.nl/hipps5.htm
www.sintef.no/units/indman/sipaa/prosjekt/hipps.html
6.
Beckman, J., Subesa Production: Shell Hurdles High
Pressures and Temperatures for North Sea Tiebacks,
Offshore Magazine, Pennwell Publishing Co.,
December, 1996.

OTC 14183

7.
8.

9.

CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS

Gilchrist, R.T. and Kluwen, F.A., Mensa Project:

Flowlines, #8628, Offshore Technology Conference,
May 4-7, 1998.
Frafjord, P. and Adriaansen, L.A., The development of a
subsea High Integrity Pipeline Protection System
(HIPPS), #7833, Offshore Technology Conference, May
1-4, 1995.
Skeels, H.B., Lauvli, ., Couto, P., Williams, M.W.,
Design and Operational Practices of HPHT Subsea
Equipment and Systems, Deep Offshore Technology
Conference, Rio de Janeiro, Brazil, October, 2001.

10

J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN

Table 1. Flowline Sizing and Pipe Material Savings from Using HIPPS
No of
wells

No of
Flowlines

Flowline
O.D./Grade

1
1
2
3
4

Single
Dual
Dual
Dual
Dual

8.625/X70
6.625/X70
8.625/X70
10.75/X65
10.75/X70

Wall Thickness [1]

No HIPPS
1.14
0.896
1.14
1.5
1.392

With HIPPS
0.623
0.502
0.623
0.802
0.752

Pipe Materials
Savings from using
HIPPS
%
$M
40
4
38
4.6
40
8
41
12.8
41
12.4

Table 2. Pressure Build-Up Times from Blockage in Flowlines in Seconds

No of wells

No of Flowlines

1
1
2
3
4

Single 8.625 OD
Dual 6.625 OD
Dual 8.625 OD
Dual 10.75 OD
Dual 10.75 OD

SAFETY
INTEGRITY
LEVEL (SIL)
4
3
2
1

Fortified Length, miles

1 mile
5 miles
32
133
26
137
32
133
33
127
27
115

Table 3. Safety Integrity Levels (SIL)

DEMAND MODE OF
CONTINOUS/HIGH DEMAND MODE OF
OPERATION
OPERATION
(Probability of failure to
(Probability of a dangerous failure per year)
perform its design function on
demand)
> = 10 5 to < 10-4
> = 10 5 to < 10-4
4
-3
> = 10 to < 10
> = 10 4 to < 10-3
3
-2
> = 10 to < 10
> = 10 3 to < 10-2
2
-1
> = 10 to < 10
> = 10 2 to < 10-1

OTC 14183

ESDV

Representative Safety
Shut-in Systems

Figure 1

PSV

PWV

Pump
2oo3

Holding
Chamber

PLATFORM PSD SCHEME

QSV

PSD = Production Shut Down

PWV = Production Wing Valve
QSV = Quick Shut in Valve
ESDV = Emergency Shut Down Valve
PSV = Pressure Safety Valve

PWV

PSD

Flare

HIPPS

PWV
PSV

QSV

FORTIFIED ZONE

QSV

2oo3

SUBSEA HIPPS SCHEME

RELIEF VALVE SCHEME

Holding
Chamber

Flare

Pump

OTC 14183
CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS
11

Subsea
Manifold

Flowline
Sled

Fortified Section

Riser and
Riser Base
Fortified

Figure 2. Typical Subsea HIPPS Scenario

12
J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN
OTC 14183

Single
Well
Subsea
Sled
Fortified
Section

Fortified
Section

Host
Platform

Figure 3. Subsea HIPPS Architecture for Single Well Tieback

OTC 14183
CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS
13

Subsea
Manifold

HIPPS Valves

HIPPS Valves

Fortified

Simple HIPPS Option

Fortified

Pipeline HIPPS Option

Fortified

Fortified

Figure 4. Subsea HIPPS Architectures for a Manifold Tieback

Host
Platform

14
J. DAVALATH, H.B. SKEELS, S. CORNELIUSSEN
OTC 14183

Pressure, psi

4000

5000

6000

7000

8000

9000

10000

11000

12000

13000

14000

20

40

60

100

120

140

Trigger Pressure = 5,200 psi

Design Pressure = 7,500 psi

160

180

Upstream of choke
Downstream of Choke

Shut-in Tubing Pressure = 13,000 psi

Time after Plug Forms, seconds

80

One Well,
Single 8-5/8" OD Flowline
30 mile offset, Fortified Length = 1 mile
20,000 BPD, 50% Water Cut

Figure 5. Flowline Dynamic Pressure Build-up Analysis Example

200

OTC 14183
CURRENT STATE OF THE ART IN THE DESIGN OF SUBSEA HIPPS SYSTEMS
15