Week of Aug. 21, 2006/US$10.

00

International Petroleum News and Technology / www.ogjonline.com

Oil Field Automation

Oil production limits mean opportunities, conservation
End of oil? No, it’s a new day dawning
ConocoPhillips revamps crude unit
Medgaz integrity management approach predicts cost savings

Copyright by PennWell Corporation

DR I L L I N G & PR O D U C T I O N

High-integrity pressure protection lowers subsea costs

Ian Ramsay-Connell world, namely the North Sea. First subsea HIPPS
Yokogawa Electric Corp.
Bedford, UK To date, five fields in the North Sea Yokogawa has supplied many HIPPS
use subsea HIPPS: Kingfisher, Scoter, with a magnetic core logic based Pro-
Juno, Penguin, and Kristin. The most re- Safe-SLS system (Fig.1), certified for
Several North Sea cent subsea HIPPS was delivered to the applications up to safety integrity level
examples illustrate the Kristin field in mid 2005, with the total (SIL) 4.
advantages of install- number of installations in excess of 20. In 1996, the Kingfisher project in
ing high-integrity pressure protection The Kristin field is notable because the UK sector of the North Sea seemed
systems (HIPPS) on subsea wells. of its high 13,000-psi initial reservoir financially questionable unless the oper-
Many published papers discuss the pressure and high
benefits of subsea HIPPS and many 329° F. reservoir

Report
studies show the potential cost-benefit temperature. Well- SPECIAL
analysis of this technology in deepwa- head pressure and
ter applications. An internet search for temperature ini-
subsea HIPPS is informative; however, tially were 10,700
Oil Field
little appears that discusses the systems psi and 324° F.,
Automation
already delivered and operating success- respectively.
fully. The subsea
The business case for these systems is HIPPS in Kristin is
well documented, with the key advan- part of the mani-
tage being the reduced cost of flowlines fold and might
due to de-rated installation specifica- be the highest
tions. Few, if any, articles published to pressure operational subsea HIPPS in ator could apply innovative techniques
date describe subsea HIPPS operations the world. The manifold is in 370 m of to reduce the capital and operating
in one of the most demanding techni- water and the production line design expenditures. One technology selected
cal and legislative environments in the pressures are 4,800 psi. was the use of HIPPS on the seabed that
All the men- would allow for de-rating the flowlines.
tioned fields have Traditionally, project designs have flow-
subsea HIPPS lines that can withstand the wellhead
systems from pressure and HIPPS installed on the
Yokogawa Elec- topsides to protect the process.
tric Corp. that are In this instance, based on earlier con-
incorporated into ceptual studies, the designers realized
a Kvaerner subsea that relocation of the HIPPS closer to
control module the wellheads would save major capital
(SCM). expenditures. This was a simple con-
This article de- cept, but the realization required tech-
scribes the subsea nology that would combine the highest
HIPPS for all these integrity with the highest reliability and
fields, although availability.
Kristin is perhaps The combination of these three fea-
the most critical tures is often a balancing act. Increased
due to the process integrity and nuisance failures reduce
temperature vs. availability. Incorporating redundancy
Many of Yokogawa HIPPS include a magnetic core logic based ProSafe-SLS materials consid- to improve availability and reliability re-
(Fig. 1). erations. quires more components that may fail.
 Oil Field Automation

Because this
was an innovative
H IPPS LOGIC FUNCTIONS
approach, the UK Position
Or
Health & Safety transmitter 1

Executive set the &

integrity level for Or
Discrepancy
the first system at = alarm 1
&
SIL 4, a very rare Output 1,
valves in series
demand, although Or
it accepted later Position
transmitter 2
systems at SIL 3. Partial
&
Suggestions at closure test 1 S
Or
first were to build Partial
> 1
closure test 2
a new system with &
P Output 2,
integrated elec- Reset valves in series
tronics; however,
the client quickly Pressure
transmitter 1
rejected this and Pressure
Or
Or
referred to its transmitter 2
experience with Pressure
&
transmitter 3
the magnetic core

No. z060821OGJsra02
logic systems used Pressure
transmitter 4
on many North
Pressure
Sea platforms. transmitter 5 Or
The client ap- Pressure
proached Yok- transmitter 6

ogawa to develop
a HIPPS prototype
solution to satisfy the constraints of
O UTPUT DRIVER POWER
2.5 x 3
SUPPLY
the subsea environment with magnetic
Inherently fail-safe
technology, followed by a system for output drivers
deploying the HIPPS. V+
PSU 1
V+
Yokogawa standardized the system V+
PSU 2 & Dual request via communications
design so that future subsea HIPPS PSU 3

could use the same design if it were Inherently fail-safe logic

proved on Kingfisher. This basic design
Trip
has been used on all subsea projects Tx amp &
including the Kristin field in mid-2005
with some project-specific adjustments. Trip
Tx & ≥1
amp
System design
No. z060821OGJsra03
The design constraints for all subsea Tx
Trip
&
amp
HIPPS is summarised as follows:
• Diverse control functions.
Input Voter Output
• Remote communications inbuilt.
• Autonomous shutdown functions.
• Remote testability.
• Remote diagnostics. • Power, minimum increase on 2 tiny
x 2toroidal magnetic cores (ceramic
• Additional diagnostics for trans- standard SCM. with a magnetic film). A magnetic field
mitters and actuators. • No batteries. can magnetize each toroidal core in a
• Space; must fit into existing SCM. • Guaranteed cold start-up. clockwise or counterclockwise direc-
• Weight, SCM and remotely oper- tion, the direction being controlled by
ated vehicle (ROV) friendly. Operation basis passing current pulses through wind-
• Environmental strength. Yokogawa’s ProSafe-SLS HIPPS uses ings on the toroid.
DR I L L I N G & PR O D U C T I O N
trol the power via the serial interface,
T RANSMITTER FAULTS guaranteeing that the input loop goes to
Tx faults:
Over/under current a trip on that input. The output-driver
Tx stuck Discrepancy
Process noise power supply modules are inherently
1 1 fail-safe certified by TuV to Class AK7
One out of three
Trip voted (alarm) (up to SIL 4) so that it is virtually im-
Tx & possible for the output to be on when
amp
the input request is for off (Fig. 3).
2 2
Two out of three This design addresses the problem of
voted (trip)
Tx
Trip
& ≥1 fallback voting and predictable fail-
amp
ure modes; however, the transmitters
3 3 require other diagnostics to satisfy SIL 3
Trip
and 4. The devices selected are SMART

No. z060821sra04
Tx
amp & with some programmable failure modes
based on internal diagnostics, which are
supplemented by additional diagnostics
Input Voter Output
in the HIPPS system.
The problem with analogue sig-
nals is that the only way to verify the
One winding on each toroid is a 2 (SOV)
x 2 such that any SOV closing shuts reported value is by comparing it with
clock pulse with a 1-ms period, al- down the flowline via the ESD valves. a reference or other measurements
though pulse duration is only 50 μs. The system may have more or fewer from the same source. Repetition of the
The design’s combined windings on transmitters and ESD valves, but the analogue input values to the SCM allow
a toroid and combined toroids provide logic functions remain the same as in for relative comparisons to be made.
all the derived basic logic functions. A Fig. 2. Although HIPPS technology can do this,
key feature is that a logic one occurs Manual shutdown requires a signal space constraints precluded it.
when the magnetic field is alternating, via the serial communications interface HIPPS has an isolated input circuit
while a logic zero occurs when the field to the SCM controller via redundant se- so that it was not practically possible
is fixed clockwise or counter clockwise. rial interfaces or via redundant fiber-op- to transfer analogue values between
Tests have shown that it is impossible tic interface connection to a topsides se- circuits. If the analogue value is below
to generate an output from the system rial interface. Signals to override inputs the trip level, the HIPPS presumes each
when the input is not pulsing at the and test outputs remotely are also via analogue value is correct.
required interval. No recorded incidents this serial interface, with provision for To enhance the diagnostics, each
have been noted in which this logic sys- partial closure testing of the ESD valves. HIPPS analogue input is programmed to
tem failed in an unsafe state. detect process noise within a threshold
For analogue inputs, the system uses Transmitter loops range. Should the noise level fall below
a limited variability programmable trip On a topsides HIPPS, field power the threshold for a specified duration,
amplifier with a library of certified ap- supply feeds power to the transmitters the HIPPS would declare that input
plications. For HIPPS applications, this and the input to the HIPPS has fuses. faulty and trip that channel.
trip amplifier’s configuration provides Failure of a transmitter causes the vot- Due to a latent problem in the trans-
one trip output via a magnetic core, ing to fallback to 1oo2. For subsea, mitters selected for an early system,
plus diagnostic outputs for over current, however, with a SIL 3 or 4 integrity several years of operation yielded faults
undercurrent, and transmitter noise requirement, this is insufficient. The that froze the transmitter outputs,
levels. system cannot have fuses for obvious which were only detected by this fea-
reasons and it must guarantee failure ture. Ultimately the transmitters had to
Design features modes. be replaced (Fig. 4).
The typical subsea HIPPS has two To address this, the subsea HIPPS
banks of triplicate transmitters, each has two-wire transmitters with current Transmitters, actuator
voted two out of three (2oo3), with the limiting resistors for preventing damage diagnostics
voted states “AND” voted such that ei- to the input circuits on over current. The weaknesses in any high-integ-
ther bank tripping will trip all outputs. The power for each transmitter loop rity system are primarily the process
The outputs comprise multiple emer- comes from inherently fail-safe output valve and secondly the input transmit-
gency shutdown (ESD) valves, each drivers from the HIPPS system so that ters. These devices are in the process
operated by redundant solenoid valves the devices in the topsides can con- line and most prone to failures caused
 Oil Field Automation

by the process. To compen-

sate for this, HIPPS has test
M ETHANOL INJECTION out the concept, with Yok-
ogawa providing a solution
features for allowing online to enhance the capability of
periodic testing in between the subsea control systems
longer interval full function supplier. After 5 years of
testing. successful operation, more
Tx Tx Tx
For transmitters, this test- systems finally followed in
ing is linked to the facility the North Sea, culminating

No. z060821OGJsra05
for clearing impulse lines. Methanol
with the unit for the Kristin
Methanol injection into im- injection field in mid 2005.
pulse lines clears the orifice The design of the Kris-
and causes an instantaneous tin system clearly relates
high pressure within the im- to the original Kingfisher
pulse line. This high pressure system, although it has
generates a trip condition on minor adaptations to the
the HIPPS input that produces an alarm inclusion of 1.5 x 1.5
a locking compound on all process requirements. The system has
but no trip, as it is only one channel. A screws. All subsea HIPPS racks are sub- an enhanced and smaller communica-
full input test requires the cleaning of jected to shock and vibration testing. tions element and an unchanged logic
impulse lines individually (Fig. 5). system.
For the ESD valve, periodic partial Power To date, operators have recovered
closure testing provides justification for Each complete subsea HIPPS logic, two SCM’s with subsea HIPPS that have
extending the full closure test inter- including the powering of transmitters, had equipment problems. In neither
val. The test request is a pulse that is solenoid valves, and the communica- case were the problems with the subsea
processed as a one-shot function, which tions interface typically requires 4 amps HIPPS.
is latched. This results in the output to at 24 v DC. The Yokogawa ProSafe-SLS Industry has shown interest in the
the ESD valve solenoid deenergizing, logic system has magnetic core technol- using of subsea HIPPS in the Gulf of
thereby causing the valve to close. ogy with dynamic current pulses on Mexico and in South America. The tech-
The one-shot function ensures that a 1-ms clock frequency as previously nology and the solution are now well
a test request is not held on if the stated. proven (no system failures recorded on
incoming request pulse fails to a steady The current pulses are 0.5 amps in operating systems to date) so that all
on position due to a communications amplitude to provide extremely high other factors permitting, subsea HIPPS
fault or a control system fault. A valve immunity, but they are only 50-μs in should be a first consideration rather
position indicator (VPI) connected to duration, which results in the very low than an alternative. ✦
an analogue trip amplifier monitors the overall consumption and low heat dis-
valve position. When the valve reaches a sipation.
set position, the trip amplifier trips and Some systems included additional
the test latch is reset. If the VPI feedback digital input loops that are typically 12
does not occur in a set time, an inher- ma so that they have minimal additional
ently fail safe timer cancels the test. loading.
Genuine trip demands are not disabled The author
during the test cycle. Operational issues Ian Ramsay-Connell (ramcon
The Kingfisher project went on line @ntlworld.com) is a consul-
tant for Yokogawa Electric Corp.
Environmental issues in late 1997 and received much notice in Bedford, UK. He has more
Initially, it was not certain whether a as the world’s first subsea HIPPS instal- than 30 years’ experience in
subsea HIPPS could meet the environ- lation. The system operated without automation and is responsible
mental requirements, specifically shock problems until the HIPPS reported a for developing the world’s first
and vibration but also temperature and series of transmitter faults. subsea HIPPS. He previously
worked for Shell UK and with
humidity. The original design required a Despite the subsea HIPPS attracting companies in such industries as pharmaceutical
24-in. rack for the complete HIPPS logic much attention for saving several mil- research automation, guidance systems, and steel
and input-output processing, although lion dollars and the fact that the project manufacturing. Ramsay-Connell has a control
some later systems used two racks. was brought on stream early and under engineering degree from Teesside University.
The only enhancement in the subsea budget, the next subsea HIPPS was
unit to the standard HIPPS rack is the installed 5 years later.
The Kingfisher project was to prove
 " Is your plant
ready for the future? "

Enable agility of business

Making critical plant information fully visible is just the beginning of the vigilant
cycle. Seeing clearly gives you the knowledge necessary to anticipate the
changes required in your process. Knowing in advance brings you the speed and
flexibility to optimize your plant in real time. And by acting with agility, you are able
to adapt to the ups and downs of your business environment. VigilantPlant excels
at bringing out the best in your plant and your people - keeping them fully aware,
well informed, and ready to face the next challenge.

- Scalable SCADA from 50 to more than

one million I/O points
- Online configuration with no down time
Improve visibility of information - Links business system with field information

Secure predictability of process

- Intelligent RTU
- Autonomous remote operation
- Digital multi-sensing devices - Fieldbus integrated solutions
- Advanced diagnostics
- Standard-model SIL2/3 transmitters

Find out more about Yokogawa and its process automation solutions at :