HIGH INTEGRITY PROTECTIVE

SYSTEMS-CONCLUSION: QatarGas'
plant reflects typical HIPS
applications
Unconventional designs using high-integrity protective systems (HIPS) are increasingly used to lower the investment
cost of new oil and gas production developments or to minimize the cost of debottlenecking existing plants.
This article concludes a series of two articles on HIPS that focus on the importance of a comprehensive design as
well as maintenance, without which system reliability and integrity of protection would suffer.
The first article (OGJ, Apr. 17, 2000, p. 53) provided guidelines, based on the experience of Total, for the design of
HIPS. Total was among the first oil companies to develop HIPS in the 1980s.
This conclusion describes typical applications of HIPS as installed on QatarGas' facilities at Ras Laffan, Qatar. Total
is one of the shareholders of QatarGas, and the QatarGas development illustrates the variety of HIPS applications.
North field development
QatarGas was the first operating company set up for the development of the offshore part of the North field and the
production of LNG at Ras Laffan, Qatar (OGJ, Apr. 27, 1998, p. 33).
QatarGas is a joint venture of the state company Qatar General Petroleum Co. (QGPC; 65%) with Total SA (10%),
Mobil Qatar Gas Inc. (10%), Marubeni Corp. (7.5%), and Mitsui & Co. Ltd. (7.5%).
The development was split in two parts:
Offshore development, effluent transportation to shore, and onshore gas and NGL terminal project led by
Total.
LNG plant project led by Mobil.
The production was developed in two steps:
An offshore central complex with two wellhead platforms and a production platform, a 32-in. sealine to
transport the effluents ashore, an onshore terminal with NGL separation, and two LNG trains each with
capacity of 2.2 million tonnes/year (tpy). First production of condensate occurred in August 1996, and LNG
was delivered to Japan early January 1997.
Addition of a third wellhead platform not normally manned 6 km from the central complex, a new production
platform, extension of the onshore terminal, and installation of a third LNG plant that came online in May
1998.
The offshore part of the second phase started production in January 1999.
Total capacity of QatarGas' facilities is 6.6 million tpy of LNG and 60,000 b/d of NGL for about 1.3 bcfd of gas
produced.
QatarGas' HIPS
The QatarGas investment cost was reduced by use of unconventional design with HIPS on seven separate
applications, two offshore, two at the onshore receiving terminal, and three within the LNG plant.
Offshore gathering and processing. The 20-in. trunkline between the third wellhead platform and the central
complex was designed for 226.5 barg when the maximum shut-in pressure of the wellheads is 301 barg.
No full flow-relief valve is provided. Consequently a high-integrity protective system had to be installed at the
wellhead platform departure to avoid the risk of overpressuring the trunkline in case of closure of a valve at the
central complex arrival.
The inlet facilities at the new processing platform were designed to the same pressure as the trunkline, while the
slugcatcher and subsequent processing facilities and the 32-in. export pipeline to shore were designed to 154 barg.
Although full flow pressure-relief valves were installed at the slugcatcher according to requirements of the ASME
Pressure Vessel Code, a HIPS was also provided upstream of the slugcatcher to minimize the risk of lifting the relief
valves and to limit the load on the flare system.
Onshore receiving. The slug catcher at onshore arrival is designed for 147 barg (the limit of the flange rating
900 lb at the operating temperature), whereas the offshore installation and the 32-in. sealine are designed
for 154 barg. To reduce risk of overpressuring the slug catcher, a HIPS had to be installed.
At the onshore terminal, the process section downstream of the pressure-letdown station is designed for 88 barg
when the design pressure of the upstream equipment is 147 barg.
A HIPS was installed to prevent the risk of overpressurization in case of an accidental full opening of the control
valves. A full-flow relief valve would have hardly been feasible because of the very high flow rate anticipated.
In the LNG plant, the refrigeration duty to cool and further liquefy the feed gas is provided by two closed-loop
refrigerant circuits (propane and multiple-component refrigerant).
The flow in both loops is much higher than the feed-gas flow, and the case in which the refrigeration compressors run
with blocked outlet would be the sizing case for the flare systems.
Hence, to reduce the probability of overloading the high-pressure dry flare network in case of common cooling media
shutdown, HIPS were installed at the discharges of the propane compressors and the high-pressure multiple
refrigerant compressors for all three trains.
Similarly, to reduce the probability of overloading the low-pressure, sour-gas flare system in case of seawater-cooling
failure, HIPS were designed safely to shut in the steam feeding amine-regenerator boilers on all three trains.
Offshore design
As noted earlier, two HIPS were installed on the offshore platforms (Fig. 1):
The first is on the remote wellhead platform and protects the trunkline to the processing platform.
The second is on the processing platform downstream of the inlet facilities and protects the slugcatcher, the
processing facilities, and the export pipeline to shore.
At each location, the HIPS employs two sets of sensors, each to activate the two emergency shutdown valves
installed in series.
Each set of sensors consists of three pressure switches with a two-out-of-three ("2oo3") voting logic to ensure the
required reliability while at the same time minimizing the risk of accidental trips.
The conceptual design for the HIPS was developed for QatarGas by Total as part of the offshore project basic
design. This included preparation of HIPS design guidelines specifying the required reliability of the system.
The contractor responsible for detailed design of the HIPS was McDermott Engineering, Houston, which retained
Risk, Reliability & Safety Engineering, Seabrook, Tex., as specialist consultant responsible for the performance of the
system reliability analysis.

Click here to enlarge image

In accordance with the requirements of the HIPS design guidelines, the companies' reliability analysis documented
that the adopted HIPS provides a reliability greater that the reliability for a conventional two-barrier shut-off/relief
system as required by API RP 14C.
The analysis further documented that the frequency rate of serious overpressure in the trunkline and the processing-
equipment hazard rate are less than the required target value of 1.0 x 10
5
/year.
A dynamic pressure build-up analysis was carried out to verify that the HIPS will protect the downstream facilities
based on its reaction time, including the shutoff valves that were specified and tested for a closure time of less than 5
sec.
The reliability analysis was based on published component data and required a proof testing interval for the HIPS of
1month or less.
Receiving terminal design
Two HIPS were installed on the onshore terminal at Ras Laffan: The first protects the slug-catcher; the second is
downstream of the pressure-letdown station (Fig. 2).
The HIPS protecting the slug catcher consists of one set of three pressure transmitters with a 2oo3 voting logic. The
HIPS activates an emergency shutdown valve on the sealine and another emergency shutdown valve at the inlet of
the slug catcher.

Click here to enlarge image

The HIPS protecting the downstream section consists of one set of three pressure transmitters with a 2oo3 voting
logic activating one emergency shutdown valve on each of the two pressure-letdown station as well as the upstream
HIPS on the slug catcher.
Bearing in mind that the design phase of this HIPS was launched before the issuance of International Electrotechnical
Commission (IEC) 61508, the main steps of the reliability calculations were:
1. Establishment of the fault trees, taking into account all the elements of the HIPS instrument loops.
2. Definition of the demand rate, which implies a part of arbitrary choice by a specialist.
3. Selection of the individual failure rate of the different components since significant discrepancies exist in the
databases available. Previous experience of the QatarGas project specialists was very helpful on this
point.
For the pressure-letdown station, Toyo Engineering Co. had to check the response time of the system because the
pressure increase in the downstream section can be very quick in case of sudden full opening of the pressure-
letdown valves.
A dynamic simulation of the system was performed to calculate the maximum pressure reached in the worst scenario.
Toyo performed a calculation of the reliability of the system and took the theoretical approach from the AIChE CCPS
guidelines which require a hazard probability of less than 1 x 10
-4
/year. (CCPS = Center for Chemical Process Safety)
As explained in Part 1 of this series, it is worthy of note that this is different from the SIL 4 target required by the draft
of the international standard IEC 61508. (SIL = safe integrity level)
Toyo found that the target on hazard probability could be reached with a test interval of 12 months (emergency
shutdown valve's stroke test and solenoid valves' function test) for both HIPS.
LNG plant
Two HIPS were installed on the refrigerant circuits and one in the regeneration section of the acid-gas removal of
each train.
Propane circuit. Process dynamic simulations showed that in case of a shutdown of the seawater (used as
cooling medium in QatarGas' design), the discharge pressure of the propane compressor would surge
within seconds and lead to a major release of propane through pressure-relief valves (at the discharge of
the propane compressor upstream of the de-superheater condensers) in the case the process-shutdown
system fails to detect such high pressure.
The selected HIPS system features (Fig. 3 ) as input:
1. A signal from the two solid-state undervoltage relays voting 2oo2 (bus bar feeding the seawater cooling
pumps).
When initiated, the HIPS triggers the interlocked process-shutdown system and shutdown of the turbine
driving the propane compressor through the associated control command.
o Refrigerant circuit. Similarly, in case of cooling-medium shutdown, the high-pressure multiple-
component-refrigerant compressor's discharge pressure would increase and reach the set
pressure of pressure-relief valves within minutes.

Click here to enlarge image

A HIPS similar to the propane HIPS was installed with similar inputs from the 2oo2 under-voltage relays
and from a 2oo3 pressure-transmitter (PT) system at the discharge of the high-pressure multiple-
refrigerant compressor (Fig. 4).
A HIPS signal would induce a process shutdown, trip directly all the multiple-refrigerant compressors
through their associated control command cabinets, and close various process-control valves in the
liquefaction process.

Click here to enlarge image

o Gas flare. The main source feeding the low-pressure sour-gas flare in an emergency is the
overhead of the acid-gas removal regenerators (Fig. 5).
In case of cooling-medium shutdown, the hot stream leaving the regenerator overhead is no longer cooled
and the pressure in the reflux drum increases. Extra vapor generated is released to the low-pressure sour
flare though a pressure control valve.
The cooling medium being common to all three trains, potential of overloading the low-pressure sour-gas
flare during a cooling-medium outage is real.
Most of the equipment connected to this low-pressure flare network has a low design pressure; hence, the
admissible back pressure of the low-pressure sour-gas flare is around 3.5 barg.
Relying only on process safety shutdown system to shutdown the three acid-gas removal regenerators
was unreliabile. It was decided to implement a HIPS to enhance the reliability of the shutdown system.
This HIPS features as input:

Click here to enlarge image

3. A signal from the two solid-state undervoltage relay voting 2oo2 (bus bar feeding the seawater
cooling pumps).
4. The signal from three pressure transmitters at the overhead of the acid-gas removal regenerator
HIPS signal would trigger the closing of the master valve feeding steam to the regenerator reboilers and
the individual steam valves to each reboiler.
Reliability studies
Table 1 presents the main results from the contractors' reliability studies.
During the project, all items of the HIPS systems were handled with special care during procurement,
shipment, and installation.
Moreover, all risk analyses were up-dated before commissioning to confirm the design reliability figures for
the as-built HIPS systems.
For the future operating team, piping and instrumentation diagrams as well as operating manuals have
been provided with specific entries.
In the field, HIPS systems have been provided with specific cabinet or color tagging further to enhance the
awareness of the operating team. For maintenance, the project was provided a specific testing method
and procedure together with required frequencies of the tests to maintain the target reliability.


Click here to enlarge image