high integrity protection systems recommended practice

High Integrity Protection Systems – Recommended Practice

plan protect

FEBRUARY 2015

REPORT

443

Disclaimer

Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither IOGP nor any of its Members past, present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.

Copyright notice

The contents of these pages are © International Association of Oil & Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of IOGP and (ii) the sources are acknowledged. All other rights are reserved. Any other use requires the prior written permission of IOGP.

These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

High Integrity Protection Systems – Recommended Practice

Revision history

VERSION DATE AMENDMENTS

1.0 February 2015 First release

FEBRUARY2015

REPORT

443

4High Integrity Protection Systems RP

Acknowledgements

Standards Committee

Instrumentation & Automation Subcommittee

High Integrity Protection Systems Task Force

IOGP Instrumentation and Automation Subcommittee (IASSC) HIPS Task Force having representation from the following companies:

• BG Group• BP• Maersk Oil• Petrobras• Repsol• Siemens• Statoil• Total• Yokogawa.

Photography used with permission courtesy of © ndoeljindoel/iStockphoto and © Nostal6ie/iStockphoto (Front cover) and © Sharif El-Hamalawi/iStockphoto (Back cover).

Contents

Foreword 6

1 Scope 7

2 References 8

3 Terms and definitions 9Abbreviations 11

4 General recommendations 12

4.1 Safety Requirements Specification 124.1.1 Service conditions 134.1.2 HIPS reliability criteria 144.1.3 Reliability data 154.1.4 HIPS reaction and response time 15

4.2 Avoidance of common-mode failures 184.2.1 Sensor positioning 184.2.2 Sensor and final element selection 184.2.3 Logic solver selection 184.2.4 Maintenance and human intervention 194.2.5 Utility failure 19

4.3 Hardware considerations 204.3.1 Electrical connections 204.3.2 Heat tracing and winterization 204.3.3 Materials of construction 214.3.4 Protection enclosures 214.3.5 Cabinet 21

5 HIPS elements 22

5.1 Sensor(s) 225.1.1 Sensor selection 225.1.2 Sensor configuration and positioning 22

5.2 HIPS automation system 235.2.1 Interfaces and cyber security (Programmable Logic Solvers) 245.2.2 Interfaces and cyber security (solid state logic solvers) 25

5.3 Final element(s) 265.3.1 Valves 265.3.2 Circuit breakers 27


6 Design testing 29

6.1 Design Validation/Typical Test (DVT) 296.2 Factory Acceptance Tests (FAT) 296.3 Integrated Factory Acceptance Test (IFAT) 306.4 Yard and On-Site Tests/Pre-Commissioning Tests 306.5 Operational Testing (OT)/Site Acceptance Test (SAT) 316.6 Test administration 32

6.6.1 Preparation 326.6.2 Procedures 326.6.3 Recording 32

7 Operational testing 33

7.1 Design for test and maintenance 337.2 Operational proof testing 347.3 Valves 34

8 Safety life cycle for HIPS 35

8.1 Obsolescence management 358.2 Maintainability 358.3 Spare parts 35

9 HIPS dossier 37


Foreword

High integrity protection systems (HIPS) and especially high integrity pressure protection systems (HIPPS) are an increasingly common feature of oil and gas facilities worldwide.

They can provide an alternative to conventional mechanical protective devices (e.g. relief valves) or reduce the load upon them.

In some cases, they present the only practical option to facilitate field development and/or expansion.

The application of HIPS, and the manner in which they are implemented across IOGP Members was considered worthy of investigation by the IOGP Instrumentation and Automation Standards Subcommittee, with a view to providing commonly agreed upon guidance on the subject.

This Recommended Practice is the result of that process.

The intended audience for this RP is those involved in the definition, design, implementation or operation and maintenance of HIPS.

This RP does not provide guidance upon when, if and why a HIPS should be utilized – to this end, companies should apply their own internal methodologies.

This RP provides mainly technical recommendations.


1 Scope

The objectives of this IOGP Recommended Practice are to:• provide industry guidance in the provision, operation and

maintenance of HIPS throughout the IEC 61508 Safety Life cycle• focus upon the instrumentation aspects of that provision• support, clarify where appropriate, and not contradict or repeat

IEC 61511 and/or ISO 10418 as they apply to HIPS• make it easier for vendors to deliver consistent systems across

the industry.

This IOGP Recommended Practice is intended for global application. The following oil and gas production facility types are included:

• onshore• offshore (not including subsea1)• oil and gas transmission and transport systems.

This RP is applicable to all manner of high integrity protection systems, be they pressure, temperature, level flow or any other parameter driven.

This RP is concerned with the instrumentation elements of HIPS. The assumption is made that the dynamic requirements associated with many HIPS have been satisfied in each case via a separate design and verification exercise.

This RP is applicable to the Electrical, Electronic, Programmable Electronic HIPS related Systems.

Other HIPS based on Mechanical Technology (e.g. using direct hydraulic or pneumatic pilot valves) are not directly covered by this RP. However, much of the guidance within this RP may also assist in their definition and use.

1 API RP 17O covers subsea HIPS


2 References

The following documents, in whole or in part, are referenced in this document and are recommended for its application.

API RP 14C, Analysis, Design, Installation, and Testing of Basic Surface Safety Systems for Offshore Production Platforms

API RP 17O, Recommended Practice for Subsea High Integrity Pressure Protection System (HIPPS)

API Standard 521, Pressure-relieving and Depressuring Systems

API Standard 598, Valve Inspection and Testing

EN 10204, Metallic products. Types of inspection documents

IEC 61508, Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems (E/E/PE, or E/E/PES)

IEC 61511, Functional Safety – Safety instrumented systems for the process industry sector

IEC 62442-3-3, Industrial communication networks – Network and system security – Part 3 3: System security requirements and security levels

IEC 62443, Network and system security for industrial-process measurement and control

IEC 62443-2-4, Security for industrial automation and control systems – Network and system security – Part 2-4: Requirements for IACS solution suppliers

ISO 5208, Industrial valves – Pressure testing of metallic valves

ISO 10418, Petroleum and natural gas industries – Offshore production installations – Analysis, design, installation and testing of basic surface process safety systems

ISO 23251, Petroleum, petrochemical and natural gas industries – Pressure-relieving and depressuring systems

ISO/TR 12489, Petroleum, petrochemical and natural gas industries – Reliability modelling and calculation of safety systems


3 Terms and definitions

For the purpose of this document the following definitions apply.

bypass

Bypass (including overriding and inhibiting) input/output: action or facility to prevent all or parts of the SIS functionality from being executed (refer to IEC 61511).

common-mode failure (CMF)

According to UKAEA SRD R 196 (1981): “A common-mode failure (CMF) is the result of an event(s) which because of dependencies, causes a coincidence of failure states of components in two or more separate channels of a redundancy system, leading to the defined system failing to perform its intended function”.

For the purpose of this document, CMF is taken to include common cause and dependent failures.

HIPS

Within the oil and gas industry, there are various company-specific definitions as to what constitutes a HIPS. It is not the purpose of this RP to define what constitutes a HIPS.

According to the ISO/TR 12489 definition, a non-conventional2 autonomous safety instrumented system with sufficiently high safety integrity to protect equipment against exceeding the design parameters is considered a HIPS.

One or more of the following may also be considered a HIPS:• a final protection layer comprising a combination of partial

mechanical and instrumented protective function• an instrumented protection layer having an integrity requirement of

SIL 3 or more• an instrumented protection layer where the consequence of non-

operation is major to catastrophic or disastrous.

2 Deviations from industry standards describing mechanical protection systems (e.g. ISO 23251 = API Standard 521, ISO 10418, API RP 14C) are treated as HIPS. An ultimate protection relying principally, but not necessary solely, on Safety Instrumented Systems (SIS) is qualified as HIPS, irrespective of its required Safety Integrity Level (SIL).


HIPPS

ISO/TR 12489 also defines HIPPS or OPPS as, “a HIPS exclusively devoted to protection against overpressure”.

HIPS reaction time

The maximum allowable time in which the HIPS should prevent a hazardous operational condition. It is thus the time between the process threshold value occurring and the occurrence of the hazardous event.

HIPS response time

The time between the process threshold value occurring until the final element has reached its safe state.


AbbreviationsBPCS Basic Process Control System

BR Base Requirement

CMF Common-Mode Failure

DVT Design Validation Test

FAT Factory Acceptance Test

HIPS High Integrity Protection Systems

HIPPS High Integrity Pressure Protection Systems

HMI Human Machine Interface

ICSS Integrated Control and Safety System

IFAT Integrated Factory Acceptance Test

IS Intrinsically Safe

ITP Installation and Test Plan

LOPA Layer of Protection Analysis

MCC Motor Control Centre

MTTR Mean Time to Repair

OPPS Overpressure Protection System

OT Operational Test

PFD Probability of Failure on Demand

RE Requirement Enhancement

SAT Site Acceptance Test

SIF Safety Instrumented Function

SIL Safety Integrity Level

SIS Safety Instrumented System

SOE Sequence of Events

SP Security Program

SRS Safety Requirements Specification


4 General recommendations

A HIPS is normally the last in a series of process protection layers. The others typically comprise the process control, alarm (with manual response) and process shutdown layers.

The HIPS function should thus be seen in the context of these other protection layers and potential process deviations, and any changes to such should not occur without considering the potential impact upon the HIPS function.

For an over pressure HIPS (for instance), the following should be clearly defined:

• sources of HIPS demand, and assumptions regarding how quickly they will cause that demand

• process conditions • other protection layer set points assumed in design of the HIPS.

All HIPS should be developed and implemented in accordance with the requirements of IEC 61508 and 61511. Competency assurance through the design, implementation and operational phases is a key requirement.

A single HIPS Integrator should be utilized to ensure that the combination of the sensing elements, logic solver and final elements meet the integrity, operability and maintainability targets.

4.1 Safety Requirements SpecificationHIPS functions should be defined independently of other safety systems in a specific HIPS Safety Requirements Specification (SRS), normally produced by the end user. This should consider the complete system comprising sensing element(s), logic solver and final element(s). The HIPS should be developed and implemented in a similarly complete system manner.

In addition to the requirements of IEC 61511 part 1 (SIS SRS which includes performance requirements relating to Functionality, Availability, Survivability and Interdependencies), the following should feature in a HIPS SRS.

• The HIPS should execute all safety functions in automatic mode.• The HIPS should be autonomous, with dedicated sensors, logic and

final elements.• The HIPS should be a physically segregated system, interfaced

with the facility automation system for monitoring only. Any communications with HIPS should not be able to impede or override the safety function(s).


• The HIPS should be designed according to fail-to-safe principles.• HIPS resetting should not be possible without a clear understanding

of the initiating cause and/or fault.• Signals between sensors, logic solver and final elements should

be hardwired.• The HIPS design should define and include allowance for test and

maintenance activities. Nonetheless, HIPS sensor, logic or final element bypass functions should be avoided. When required, bypass functions should be subject to a thorough assessment of the risk and consequences for system integrity.

• The required performance of the HIPS will be based on the process and facility conditions (e.g. production rates, plant line up) known/assumed at the time of the system design and procurement. These should be clearly identified such that the HIPS can be readily assessed or re-validated against changing assumptions, conditions (i.e. design basis) etc. during the plant life cycle.

• HIPS packages should be designated as ‘high’ focus with respect to quality management.

4.1.1 Service conditionsA HIPS SRS should clearly identify and describe all credible process and ambient service conditions, such as:

• process fluid compositions (all possible production scenarios)• possibility of slugging flow• fluids with plugging potential (e.g. wax, hydrates)• rate of change in process pressure, temperatures, flows• presence and worst case concentrations of H2S, CO2, solids, sand,

paraffin, etc.• high and low extreme process pressure, temperatures, flows• change of process fluid composition and properties over the facility’s

lifetime• presence and worst case concentrations of injected chemical

products• high and low extreme ambient outdoor and indoor conditions• hazardous area classification• EMC requirements.


The predicted or known occurrence and impact of each condition should be clearly defined for each operational situation, e.g. shut-in, cool-down, start-up, normal production.

This analysis will assist in defining material requirements of sensors and final elements and the needs (if any) for heating and winterization of HIPS components.

The HIPS should be suitable for any given situation/condition regardless its duration (including temporary conditions such as methanol injection or cool-down).

4.1.2 HIPS reliability criteriaHIPS components, including sensors, logic solver and final elements should each be designed as fail-safe (i.e. failure of any component/sensor/logic solver/power supply/motive fluids moves final elements to the safe state).

According to IEC 61511, a HIPS integrity (SIL) assessment will be performed and the integrity target (PFDavg or failure rate, whichever applies according to the demand rate) included in the HIPS SRS. HIPS components or sub-systems are then selected such that the overall integrity (SIL) target of the HIPS Safety Instrumented Function (SIF) is achieved.

This HIPS integrity demonstration should include a sensitivity study to test the robustness of the HIPS integrity prediction against variances in reliability data, the proof test period (e.g. min and max derived from an analysis of the PFD as a function of time, as opposed to PFDavg) and component MTTR.

The HIPS design should take into account the process availability target, allowing for testing and maintenance activities (with or without disturbing the process – e.g. partial stroke testing requirement) and the predicted/allowable frequency of spurious trips, and reflect these within the HIPS SRS.

Prototype or non-proven in-use components should not be used for a HIPS.


4.1.3 Reliability dataThe HIPS operator should approve the reliability data utilized to demonstrate the integrity achieved by the HIPS.

Reliability data sources include, in order of preference:

1. Reliability data collected and verified on the facilities (field data) – but only where the quantity collected is sufficient to be considered statistically significant

2. Databases/reference handbooks

Data should primarily be selected from Oil and Gas applications, e.g. Offshore Reliability Data (OREDA3), PDS Data Handbook4, and Stiftelsen for industriell og teknisk forskning (The Foundation for Scientific and Industrial Research), (SINTEF5).

The data selection process should consider similar service and environmental conditions, and maintenance regimes.

3. Failure Mode and Effect Analysis (FMEA) reports

This data needs to be suitably factored to account for potential failures occurring due to process/operating conditions. The intended use and stated failure modes should match the application.

4. Vendor data

The reliability data used should be adequately documented to allow validation, including:

• source of the data• assumptions underlying selection.

4.1.4 HIPS reaction and response timeThe process safety time, HIPS reaction time and HIPS response time should be defined in the HIPS SRS.

3 www.oreda.no 4 www.sintef.no/projectweb/PDS-main-page 5 www.sintef.no


Process or BPCS failure

SIS trip initiation

HIPS initiation

HIPS Response Time

HIPS Reaction Time

Process Safety Time (refer IEC 61511-2)

Hazardous event occurrence

Figure 1: Process safety, reaction and response times (showing typical protection layers)

The HIPS response time should be determined with reference to the process safety time and HIPS reaction time. The HIPS SRS should require:

HIPS response time < х(HIPS reaction time)

(Where ‘х’ is less than 1, and specified with reference to the system dynamics and practicality, design uncertainties and equipment wear and tear)

The HIPS response time is a summation of the following:• sensor response time• logic solver response time, including input cards• final element response time, up to final safe state.

4.1.4.1 Sensor response time

The sensor response time is defined by summation of the following parts:• lag time of the process tapping, e.g. thermal inertia of a thermowell• lag time of the sensing element• processing (cycle) time of electronic instrument/transmitter• signal conditioning, e.g. dampening or filtering.


4.1.4.2 Logic solver response time

The logic solver response time is defined by the summation of the following parts:

• worst (longest) processing (cycle) time of any input card• processing time of the logic part and output.

In general, the processing time of the logic part and output is considered negligible for solid state technology.

For a programmable logic solver, the response time will depend on the processing (cycle) time of all the components.

4.1.4.3 Final element response time

The final element response time is defined by the summation of the following:

Actuated valves case:• the response time of all control circuit components

(e.g. solenoid valves, pilot valves, and quick exhaust valves) of the motive fluid feeding the actuator

• the time required to depressurize the motive fluid before the actuator starts to move

• the inertia and mechanical slack of the moving parts in the actuator and valve (i.e. stroking time), until the valve has reached its safety position.

Electrical equipment case:• the response time of all control circuit components

(e.g. interposing relay, switchgear, relay and switchgear drawer)• the inertia of the machinery, until it has reached safe state

(e.g. fully stopped).


4.2 Avoidance of common-mode failuresIn order to achieve the necessary levels of integrity, HIPS typically utilize redundancy in the sensing and final element groups. Whilst increasing system dependability, this also introduces the potential for common-mode failure (CMF). The HIPS should be designed to minimize CMF between HIPS subsystems, hardware or application software.

This should be managed with reference to IEC 61511-1:2003, 9.4 and the following recommendations.

4.2.1 Sensor positioningSensors should be separated as far as reasonably practicable to reduce the likelihood of external (environmental) and/or internal (process e.g. wax/hydrates) factors affecting more than one simultaneously.

4.2.2 Sensor and final element selectionWithin HIPS: the use of identical sensors/final elements in a voting (e.g. two out of three/2oo3) configuration has the advantage of simplifying procurement and maintenance activities, but will increase the potential for CMF.

For SIL 3 (and below) HIPS, it is usually acceptable to utilize identical sensing/final element devices, but for higher integrity service diverse (i.e. make/model) sensing and final element devices should be deployed. At SIL 3, the potential benefits of diverse sensing and final element devices verses the potential detriment to system maintenance should be considered.

Within other protection layers: if identical make and model of sensing and/or final element is utilized for both the HIPS and other protection layers, the potential for CMF between the HIPS and other protection layers should be addressed.

4.2.3 Logic solver selection A HIPS logic solver should be of programmable or Solid State type.

For SIL 3 (and below) HIPS, it is generally acceptable to employ the same logic solver type as that used for other protection layers (not including BPCS). However, it should be fully independent of them in every respect (I/O, PSU, CPU where applicable, etc.).


For higher integrity than SIL 3, the HIPS logic solver type should differ from those used in other protection layers

Programmable Logic Solver: development, implementation, maintenance and modification of the HIPS application program should be by competent individuals who have not been involved in the application development for other protective layers.

Logic Solver Input: Where a SIF has more than one sensor, each sensor should be routed through a different logic solver input card.

Logic Solver Output: Where a SIF has more than one final element, each final element output should be routed through a different logic solver output card.

4.2.4 Maintenance and human interventionCMF should be considered in the development of HIPS maintenance routines. Particular attention should be paid where multiple simultaneous process isolations are required, e.g. when testing a sensor voting system.

As a minimum, procedures should be defined to cover the management of HIPS sensor line isolations. However, car seal or interlocking of sensor line isolations is preferred.

Regular inspections to verify correct position of HIPS sensor isolation valves are recommended.

4.2.5 Utility failureHIPS will often need to share utilities (e.g. instrument air drying system) with other protection layers. Where this is the case, the shared utility should be analysed for potential common faults and where these are considered significant diverse utilities for HIPS and other protection layers should be deployed.

HIPS power should be from two diverse supplies, e.g. one UPS sourced, the other from a critical systems/emergency bus.

DC power supplies can be either floating, or have positive or negative referenced to earth. The merits of these two approaches should be considered. In the former, the system will be less susceptible to tripping on earth fault, but an earth fault detection system would be required. Consistency with other facility DC earthing arrangements should also be considered.


4.3 Hardware considerations

4.3.1 Electrical connectionsAll HIPS field devices should be hard-wired directly into the HIPS cabinet via individual armoured instrument cables, without intermediate junction boxes or intermediate marshalling facilities. This also applies to cables run from the HIPS cabinet to MCC switchgear.

An exception to the direct-cable rule is given to particular field devices which have by design a short length of cable encapsulated into the device, such as limit switches or heater blocks. In those cases, multiple devices of the same type might be hooked-up to a local junction box.

Junction box and cabinet terminals should be of the spring-loaded type for both signal and power cabling. Screw type terminals should only be permitted inside final field devices (e.g. sensors, solenoids), earth bars, and for the power feeders and distribution inside the HIPS system cabinet.

4.3.2 Heat tracing and winterizationIn colder climates, heat tracing and/or winterization of the HIPS may be required:

• heat tracing ensures that the process fluid inside the HIPS sensor assembly and process tapping (and standpipe if any) remain adequately fluid, i.e. avoiding potential clogging due to fluid cool-down

• winterization ensures that electronic devices remain above a certain minimum temperature.

An assessment of the expected ambient conditions and process fluid should be made to determine which, if any, of these is required and the HIPS SRS should include such requirement.

The heating element for each sensor should have its own dedicated circuit breaker.

Where heat tracing of HIPS sensor assembly, process tapping, standpipe/bridle is required, self-regulating resistive block heaters, self-regulating heat tracing wire under thermal insulation around quarter-turn ball valves, process tappings, level sensor chambers (and standpipe if any), including liquid drain lines as well as the sensors/transmitters should be provided.


Temperature and feeder monitoring and alarms facilities should also be provided and transmitted to the operator interface. The HIPS SRS should clearly state the action to be taken upon failure of a heating element, ranging from manual intervention to automated HIPS activation after a set time delay.

4.3.3 Materials of constructionAll outdoor HIPS equipment, including sensors, manifolds, associated mounting accessories and protection equipment, should be suited to the environment. Where required, protection against mechanical damage (e.g. dropped objects) should be provided.

Process wetted parts (e.g. valves, sensors, manifolds) should be as per applicable piping class, including material certificates (e.g. EN 10204).

4.3.4 Protection enclosuresAll HIPS sensors, including the process isolation valves/manifold, should be protected against impact and environment. Therefore, enclosures should be considered for HIPS sensor assemblies. All connections should be bottom-mounted with the relevant cable gland assembly.

4.3.5 CabinetWhere a cabinet is required for part of the HIPS system (typically the logic solver), this should be separate from other equipment cabinets and dedicated to the HIPS function only. It should preferably be located in an acclimatized room.

Dampening systems may be provided in case of presence of vibration or tilt effects.

Forced ventilation should be avoided. Where required, this typically consists of redundant air extraction on the top with redundant air inlet filters on the bottom of the front doors.

Ingress protection requirements should be defined in the SRS and maintained throughout the HIPS life cycle.


5 HIPS elements

5.1 Sensor(s)

5.1.1 Sensor selectionSensor models specifically designed for safety service are preferred. The failure modes of concern should be identified and failure rates pertaining to those considered in the sensor selection process, as should the availability or otherwise of auto-diagnostic capabilities.

Process transmitters are preferred over switches.

Interfaces with other systems (e.g. asset management systems) should be ‘read-only’. Adjustment of HIPS sensor parameters (e.g. calibration and configuration) should be possible only from the HIPS logic solver cabinet or locally at the sensor, requiring either password input or ‘dip’ switch adjustment.

HART or other fieldbus communication protocols should be used for diagnostic purposes only.

Wireless sensors are not considered suitable for HIPS application.

5.1.2 Sensor configuration and positioning For SIL 3 systems, three sensor elements with a two out of three (2oo3) trip logic are normally selected, each sensor being configured to go to ‘trip state’ after a detected failure occurs. This 2oo3 voting should revert to a 1oo2 voting during a single sensor maintenance or fault detected.

The HIPS should be fitted with the necessary equipment to facilitate sensor tests as required by the SRS, and defined within the test procedure.

Each sensor should have a dedicated process tapping.

Discrepancy HIPS sensors alarms may be configured in the HIPS, SIS or BPCS.

HIPS sensor positioning should take into account other protection layers (e.g. BPCS) sensor positioning.


5.2 HIPS automation systemThe HIPS automation system consists of the complete engineered and tested cabinet, from input terminals to output terminals, typically including:

• signal converters, isolators, IS barriers and anti-surge devices• logic solver • HMI devices• engineering and maintenance workstations.

The HIPS automation system should be dedicated to HIPS safety functions and physically segregated from other safety or control systems. Any non-essential functionality should be removed.

The HIPS automation system should include a capability to record Sequence Of Event (SOE) data, diagnostic information and logic solver status for post-incident data analysis.

A HIPS logic solver containing more than one HIPS SIF should be avoided. If necessary, more than one SIF can be deployed in the same logic solver, but only where it can be demonstrated that each of these is fully independent of the others. That is, the failure of any HIPS SIF, and/or the occurrence of the hazard it is designed to prevent, could not cause one or more of the other hazards, or compromise one of the other SIFs.

In addition, each HIPS logic solver should have the capability to be verified independently of other HIPS logic solvers dedicated to another safety functions.

Since the final elements normally consume the majority of the PFD budget, the HIPS logic solver should typically not consume more than 15% of the PFD budget.

Response speed of the HIPS automation system, including electrical propagation time of the I/O channels and signal convertors, should be assessed for each application as part of the overall process safety time.

Programmable HIPS logic solvers should have at least 60% spare CPU load and memory capacity.

Trip thresholds (set points) should be protected/locked to prevent adjustment through human error.


5.2.1 Interfaces and cyber security (Programmable Logic Solvers)

Interfaces between HIPS and other systems should be minimized.

HIPS cyber security should conform to IEC 62443.

HIPS programmable components capabilities type should as a minimum be SL-3 (see IEC 62442-3-3).

HIPS Asset Owner should specify the Security Program (SP) capabilities requirements (see IEC 62443-2-4) to the HIPS Integrator in the Safety Requirement Specification. The SP requirements are composed of the base requirements (BRs) and requirement enhancements (REs).

For example:• For SIL 2 and below HIPS the security requirement may be made of all

the BRs and all the REs(1)• For SIL 3 and above HIPS security requirement may be made of all the

BRs, all REs(1), all REs(2), all REs(3) and all REs(4).

In particular, the following steps are recommended:• Malware prevention: Ensure malware cannot transit between HIPS

and other protection layers by restricting communications between these layers.

• Any monitoring interface between HIPS and facility automation systems should be either hardwired or dedicated serial.

• Remote access (off-facility) connections should not be permitted.• Temporary engineering machines (e.g. supplier laptops) should

not be connected to the HIPS logic solver until it has been verified that anti-virus software is installed and fully updated and that a full system scan has been performed showing the system to be free from malware/infection.

• The HIPS logic solver and associated workstations should be subject to access control:

• Physical – by key-locked cabinets• Software – by means of strong password.


5.2.2 Interfaces and cyber security (solid state logic solvers)Despite the use of solid state technology, cyber threats can still pose a direct or indirect threat to the integrity of a HIPS package.

The following design requirements should therefore be applied.• The HIPS may only be interfaced with BPCS or SIS through hard-

wired or ModBus links.• Remote maintenance/engineering and associated networks should

not be permitted.• The SOE function should be embedded inside the HIPS. Hard-wired

signals to BPCS/SIS input cards should be used for time-critical events.• Data storage is generally not required. Main data, alarms and trips

should be registered by via the BPCS through serial bus and/or hard-wired links.

• The Solid State Logic Solver should not be interfaced with any support system (e.g. Plant Information, Real Time Data Base and Instrumentation Management Systems).

The use of IT-based technology for the HIPS HMI and/or communication links is generally not permitted. HIPS HMI should be solid state mimic panel type.


5.3 Final element(s) Final element selection should be done taking into account the particular application, process conditions and the suitability for use in safety applications. Final elements with a demonstrable, trusted and proven track record in safety service should be selected over lesser alternatives. A high and continual focus should be placed upon quality control during the final element manufacturing and test process.

An exception alarm should be generated if a HIPS final element (e.g. valve) is not in the required position. The necessary response to such an alarm should be defined in the SRS.

HIPS final element assembly should be considered as a whole. This should be taken into account in the design, the fabrication and the testing. The relevant documentation should be managed by the same principle.

5.3.1 ValvesWhere a valve is the final element, this should be considered, designed and tested as a complete assembly including the valve body, the actuator and the associated actuator controls.

In pressure protection, HIPPS the valve should be specified to account for the capacity of the downstream system to absorb valve leakage when closed. Although valves may be specified as zero, or close to zero leakage (e.g. ISO 5208 or API Standard 598), in reality it should be assumed that some leakage in service will always occur. As such, the downstream process system should be able to handle a degree of leakage.

The leakage rate to be designed should be determined in conjunction with Process design Engineers and will typically be based upon the greatest of:

• 100% Flow through a valve bypass (if installed) when open• that experienced following total collapse of soft seats (where fitted)• a percentage of design flow (assessed in discussion with valve

manufacturer) for metal seated valves.


Where a HIPS bypass is required (e.g. for pressure equalization post HIPPS activation), this should not compromise the HIPS integrity. For example the bypass should be locked closed or similar (e.g. interlocked) to prevent being left in the open position. Leak tightness specification for the bypass should be equivalent to that of the main HIPPS valves.

HIPPS re-open inhibits may also be required either to protect the valves from damage due to opening against high differential pressure, or to prevent a rapid pressure rise scenario should the HIPPS be re-opened onto a blocked downstream system.

As the integrity of these inhibit functions are also high, they should be part of the HIPPS.

5.3.1.1 Fail-safe function

The valve fail-safe function should be achieved by spring return actuators. Other solutions such as operating pressure inside the valve or double acting piston actuators should only be considered if there are justifiable reasons not to use the spring return option.

5.3.1.2 Actuator force and drive train

For ball valves, the actuator output torque should be at least 1.3×, and preferably 2.0×, the required valve torque throughout all stages of the opening and closing strokes as determined by workshop tests which should simulate or otherwise be representative of:

• actual service in which the valve will be employed, i.e. gas service or liquid service• maximum design differential pressures across the valve• actual valve configurations i.e. seat type, stem extensions, etc.• closure within specified time (speed of closure affects torque required).

5.3.2 Circuit breakersCircuit breakers and control relays are generally accepted as final elements for specific applications due to extensive operating experience and their mature technology, but such devices should be carefully selected considering characteristics and available track record (proven for the application).

It should be ensured that any failure data provided covers the full breaker function, both electrical and mechanical.


Failure rate data pertaining to the ‘fail to disconnect mode’ should be available and, where possible, safe fail fraction and hardware fault tolerance data should be sought.

Circuit breakers and control relays should be fail-to-safe, i.e. contacts are de-energized to open. Note in some cases (e.g. certain HV breakers) energize to break is the only option.

Circuit breakers and control relays should be specified according to following criteria:

• coil provided with gravity dropout or dual springs• provision should be made for preventing HIPS relay contacts from

welding closed (e.g. energy limiting load resistance, contact arc suppression) when dealing with high power and /or inductive loads at the interface with breakers.


Testing activities should be performed during several design and development phases such as:

• Design Validation/Typical Test (DVT)• Factory Acceptance Tests (FAT) of each HIPS component• Integrated Factory Acceptance Test (IFAT)• Yard and On-Site Tests/Pre-commissioning • Operational Testing (OT)/Site Acceptance Test (SAT)• HIPS Performance Tests.

The aim of these tests is to demonstrate that the HIPS supply and configuration meet the HIPS SRS at each one of the above stages.

A HIPS testing plan should document which of these tests will take place, and address the items listed in the remainder of this section.

6.1 Design Validation/Typical Test (DVT)Design validation testing may apply to the logic solver(s) and smart valve testing systems only. It is a validation test of the interface principles and technologies between the HIPS logic solver and other systems including smart valve testing systems.

The purpose is to define and test how HIPS data are transferred to other Systems as well as the SL-3 requirement level (IEC 62442-3-3) and the Security Program (SP) requirements BRs and (REs) (IEC 62443-2-4).

6.2 Factory Acceptance Tests (FAT)Separate factory acceptance tests (FAT) should be conducted for all HIPS components. All test and measurement equipment should have valid calibration certificates and labels from a certified laboratory.

The purpose of the FAT is to ensure that the HIPS sensors assembly, the HIPS Logic Solver and the HIPS Final elements function as per the HIPS SRS. The FAT should also consider the interface with other systems testing.

6 Design testing


6.3 Integrated Factory Acceptance Test (IFAT)An IFAT should be performed after successful completion of the individual components FATs. The HIPS arrangement during IFAT should reflect the final HIPS configuration on-site. All HIPS components should be hooked-up and connected together. Interfaces with other systems (dummy systems during the IFAT) should be part of the IFAT.

Simulation of physical measurement for actuating some sensors (e.g. pressure and level) should be included in the IFAT.

During the IFAT, ‘black-out’ (after which the HIPS will fail safe) and ‘black-start’ (after which the HIPS will remain in the fail safe state) tests should be performed.

6.4 Yard and On-Site Tests/Pre-Commissioning TestsOnce the HIPS components have arrived in the yard or site after IFAT, the HIPS should be unpacked, installed and the HIPS components should be hooked-up.

The pre-commissioning should consist a series of tests to demonstrate that:

• the integrity of HIPS components has not been affected in transport• the components are installed in the correct way, segregated from

other systems, etc.• field components are adequately protected against impact, flooding, etc.• interconnections between actuators and control panels are adequate

(length, protection, etc.)• power supply to cabinets and heat tracing are adequately installed,

segregated, etc.• heat tracing and thermal insulation are adequately applied, etc.• interfaces with other systems (e.g. BPCS) are fully operational• cabling of installed sensors and final elements is adequately

installed and functions.


6.5 Operational Testing (OT)/Site Acceptance Test (SAT)Once the HIPS pre-commissioning and facility commissioning has been completed, an OT/SAT should be performed prior to facility start-up.

The purpose of the OT/SAT is to verify and test the following: • HIPS installation and pre-commissioning successful• linking with other systems (e.g. ICSS)• safety and Interlocking logic• energizing the sensors and the final elements by the HIPS• interacting between HIPS and BPCS and other systems (if any)• integration of the HIPS mimics in the BPCS (if required)• storage of HIPS data in the relevant SOE• HIPS trip functions (sensors – including combinations of voted

components)• HIPS performance test (end to end, including full closure where the

final elements are valves)• HIPS SOE recording.

The HIPS performance test should demonstrate that the achieved HIPS response time is equal to or better than target. As far as practical, the OT/SAT should be performed by creating real process conditions. In addition a confirmation that valves are sealing adequately should be sought.


6.6 Test administration

6.6.1 PreparationPrior to each test phase, a comprehensive Inspection & Test Plan (ITP) should be prepared covering the following:

• full set of test procedures (see below)• testing schedule, including Manufacturer’s internal tests• resources and equipment list• predefined test report and correction (punch) list for each test• HIPS test log (see below).

6.6.2 ProceduresDedicated test procedures should be issued for each test phase, covering individual HIPS components and overall HIP system as required:

• sensors, including isolation valves, heating and protective enclosures• logic solvers• valve control panels, including smart valve testing systems• valve actuator• HIPS valves• electrical switchgear• end-to-end HIPS.

Test procedures should clearly indicate the test criteria (values) which are to be met, referencing the appropriate (e.g. company) standard from which the criteria are derived.

6.6.3 RecordingAfter each test, a test log should be issued. It should include the following as a minimum:

• test procedure• test results/report• correction/punch/exception lists.


The appropriate testing of HIPS is fundamental to ensuring that the integrity requirements for the safety function are satisfied6. The required proof test interval for the HIPS function should have been established via reliability analysis.

Any proposed changes in test frequency throughout a HIPS life should be validated via an update to such analysis (this should in any case be covered by facility management of change procedures).

Unrealistically short test intervals (e.g. less than three months) should be avoided. (The more frequent testing becomes, the greater the impact on production availability for components that cannot be tested off-line.)

One potential downside of increased test frequency is increased intervention, given that each intervention may present opportunities to compromise the HIPS (e.g. by not returning the system to operation state following test).

Whilst the operation of individual HIPS loop components may be tested separately, an overall system performance test should be conducted in line with the test interval embedded in the SRS. This test should verify both the ‘end to end’ HIPS function and its response time (sensing to completed trip/closure).

7.1 Design for test and maintenanceHIPS should be designed to facilitate the required testing, of the complete HIP function, with minimal operational impact. Description of required tests (including high level procedures) should form part of the SRS.

Proof test procedures should be produced by the system designer in conjunction with the Operator as part of the design deliverables package. These should be completed early enough in the system design life cycle to enable any additional testing facilities to be provided.

Similarly maintenance procedures should be developed as part of the design package and implications for facility operation (e.g. shutdown requirements, access requirements) should be communicated to the Operator by the system designer to enable appropriate facilities to be provided in the wider facility design and operational plan.

7 Operational testing

6 A performance standard should be provided for every HIPS, which should capture test interval, trip setting, maximum allowed response time, underlying assumptions (e.g. on flowrate, process conditions, plant line-up). Any proposed change in any parameter in the performance standard should only occur with full management of change applied.


7.2 Operational proof testingHIPS typically comprise redundant elements (e.g. 2oo3 sensors and 1oo2 solenoids). HIPS testing should be planned and procedures produced such that the correct function of each and every redundant element is verified at each proof test and the outcome recorded.

7.3 ValvesWhere the final element is a valve a leakage test may be required, typically carried out by means of pressure build up. Where required, this is unlikely to be able to detect small volume leaks (such as can be found in factory acceptance testing) and should be designed with a view to detect gross leakage (albeit within the capacity of the downstream relief device) only.

If the ability to detect very small leaks is required, consideration may be given to acoustic valve leak detection techniques.

Partial stroke testing can provide a benefit in terms of improved HIPS PFD, and/or increased interval between full proof tests. The downside is the provision of partial stroke capability increases the complexity of an otherwise simple system. And partial stroke means partial coverage – a significant portion of the HIPS (particularly the valve stroke) remains untested and should eventually be covered via full stroke testing.

Valve signatures can be obtained via monitoring and recording of the valve closure characteristic. These can then be used to provide timely indication of impending valve problems. This typically requires actuator pressure monitoring and valve position indication (via transmitter) and may be supplied as part of a partial test system.


8 Safety life cycle for HIPS

HIPS should be designed, constructed, tested, operated and maintained according to the IEC 61511 and IEC 61508.

• Integrity targeting for the overall HIPS function should be performed according to IEC 61511 part 3 utilizing either the LOPA or quantified analysis methodologies.

• HIPS verification should be managed by the Operator and not deferred to the system provider, ensuring adequate levels of independence.

Table 1 takes the IEC 61511 safety life cycle and suggests the key elements required at each of the normal HIPS development phases.

8.1 Obsolescence managementA dedicated obsolescence management plan should be established for the HIPS. The HIPS supplier should provide an inventory list with all lifetime statuses.

As part of the obsolescence management strategy, local (e.g. in-country) support from the HIPS supplier or agent should be considered.

8.2 MaintainabilityA maintenance management plan should be prepared for each HIPS detailing maintenance procedures and intervals, and listing required equipment. This should be developed by the HIPS Integrator, reviewed and approved by the operator.

8.3 Spare partsCommissioning and operational spares should be identified, procured and stored commensurate firstly with the maintenance plan, and secondly allowing for unexpected failures.

Reference should be made to each HIPS component MTTR when determining spares quantities and storage locations.

Stored items should be subject to a preservation plan.


Safety Life cycle Phase Objectives Inputs Outputs

1. Process Hazard analysis (PHA)

Identification, description and evaluation of hazardous events and scenarios

PFDs, P&IDs, Layouts, Operating philosophy, Manning Philosophy, ESD and Blowdown Philosophy, safety targets

HAZID and HAZOP reports

Identify SIFs requiring HIPS

2. Safety Integrity (SIL) Targeting

To assign a numerical (RRF) and Integrity (SIL) target to each SIF

HAZID and HAZOP reports and all inputs detailed above

Integrity (SIL) Targeting Report (detail targets for each HIPS)

3. HIPS Specification (User)

To specify the user requirements pertaining to each HIPS such that an equipment provider can generate a specification specific to their equipment offering

Integrity (SIL) Targeting Report

Relevant Philosophies

HIPS Safety Requirements Specification

4. HIPS Specification (Supplier)

To generate an equipment specific specification that meets the requirements of the HIPS SRS


Dynamic analysis

Functional Design Specification (FDS) for each HIPS

Comprises hardware (including System Architecture) and software requirements

Verify Phase 4 with 3

5. HIPS Design To generate a hardware and software HIPS design that meets the FDS requirements

HIPS SRS and FDS System diagrams AFC (e.g. Hook up drawings, panel layouts)

Software algorithms (e.g. flow charts, C&E)

Verify Phase 5 with 3

6. HIPS Engineering To engineer the HIPS in compliance with the design

To verify the design against the numerical (RRF) and integrity target

FDS

System diagrams AFC

Software algorithms

Physical hardware

Software code

SIL Verification report

Operation and Test procedures

Verify Phase 6 with 5 (FAT)

7. HIPS installation, commissioning and validation

To integrate and test the HIPS. To validate that the HIPS meets the SRS

To install and commission the HIPS


HIPS FDS

Test and Validation Plan

Commissioning and handover Workpacks

Fully functioning HIPS in conformance with the SRS

Verify Phase 7 with 5 (SAT)

FSA Report

As-built documentation

8. HIPS Operation and Maintenance

To ensure the integrity of the HIPS is maintained during operation and maintenance


Proof testing and routine maintenance procedures

Spares listing

Maintenance plan

Maintenance records

Maintenance schedule updates

9. HIPS Modification To make corrections, enhancements or adaptations to the HIPS, ensuring that the required safety integrity level is achieved and maintained


Management of Change (MOC) Procedures (including software change control)

FSA Report

MOC approvals

Documentation (Philosophy/SRS/FDS/drawings etc.) updates as required to maintain alignment with installed system

FSA Report update

10. Decommissioning To ensure proper planning for decommissioning

To remove HIPS from service without compromising the safety integrity of the facility

MOC Procedures HIPS placed out of service

Table 1: Key elements in the IEC 61511 safety life cycle


9 HIPS dossier

Whilst the HIPS performance standard (within the SRS) provides a summary of the key elements and basis for each HIPS, it is also important to develop and retain concise documentation covering all aspects of the design for each HIPS, both as a record of the work done and a basis for life cycle maintenance and update of the HIPS.

A HIPS Dossier should therefore be compiled and maintained for each HIPS by the operator and should include as a minimum the following elements from the safety and instrumentation perspective:

• justification for HIPS selection, design and configuration• HIPS SRS – Performance standards (Response time, Integrity

requirement etc.)• dynamic analysis• HIPS drawings (e.g. P&IDs, architecture, wiring, hook-ups, system

schematic, block diagrams)• hazard and consequence analysis studies/reports – Assumptions

pertinent to the Hazard analysis and integrity target• quantified/reliability analysis supporting selection of PFD/SIL targets

and relevant test intervals, capturing assessment of diagnostic coverage of failures and common cause failure analysis

• pertinent cause and effect charts• HIPS maintenance, testing and repair plans/procedures and records• HIPS operating and re-start procedures (including bypass etc.)• FSA report (according to IEC 61511)• HIPS Obsolescence plan.

All HIPS should be added to the facility safety critical systems/items register.

Registered OfficeLevel 5209–215 Blackfriars RdLondon SE1 8NLUnited Kingdom

Brussels OfficeBd du Souverain,1654th FloorB-1160 BrusselsBelgium

T +44 (0)20 3763 9700F +44 (0)20 3763 [email protected]

T +32 (0)2 566 9150 F +32 (0)2 566 9159

www.iogp.org

High integrity protection systems (HIPS) and especially high integrity pressure protection systems (HIPPS) are an increasingly common feature of oil and gas facilities worldwide.

They can provide an alternative to conventional mechanical protective devices (e.g. relief valves) or reduce the load upon them.

In some cases, they present the only practical option to facilitate field development and/or expansion.

This RP provides mainly technical recommendations for those involved in the definition, design, implementation or operation and maintenance of HIPS.

high integrity protection systems recommended practice

Documents