HIPPS Column Simulator – Understand 2oo3 Voting, Shutdown Valves and Safety Logic

In oil and gas plants, high-pressure gas can create a serious overpressure risk for process equipment. A pressure vessel or column designed for a particular operating pressure cannot safely withstand unlimited pressure from an upstream high-pressure source.

This is where a High Integrity Pressure Protection System (HIPPS) plays an important role.

HIPPS is an independent safety protection layer designed to prevent excessive pressure from reaching protected equipment. It monitors process pressure, evaluates transmitter signals through a logic solver and activates shutdown valves when the configured trip condition is reached.

The HIPPS Column Simulator provides an interactive way to understand how this protection system works. You can create process upsets, introduce transmitter failures, simulate shutdown valve problems and observe how the system responds.

What Is HIPPS?

HIPPS stands for High Integrity Pressure Protection System.

It is a safety instrumented system (SIS) used to protect process equipment against overpressure. It typically consists of three main elements:

• Pressure transmitters: Monitor the pressure in the protected process.
• Logic solver: Evaluates the pressure signals and decides when a shutdown is required.
• Shutdown valves: Isolate the high-pressure source when a trip command is generated.

In this simulator, a generic gas plant column is used as the example.

The column normally operates at 18 barg and has a design pressure of 25 barg. The upstream gas header can reach 100 barg. If the overhead outlet becomes blocked or the feed control valve fails open, pressure can increase rapidly.

The simulated HIPPS uses three pressure transmitters with 2oo3 voting logic and two shutdown valves in series to isolate the feed.

How to Use the HIPPS Column Simulator

The simulator displays a gas plant column, upstream feed header, pressure transmitters, shutdown valves, overhead pressure control valve and pressure safety valve.

You can monitor the pressure, transmitter readings, valve positions, trip status and alarm conditions while changing the operating parameters.

Start with the normal operating condition and observe how the pressure control system maintains the column pressure.

Then introduce a process upset and see whether HIPPS detects the abnormal pressure and closes the shutdown valves.

1. Understand 2oo3 Voting Logic

One of the most important features of this simulator is the 2oo3 voting arrangement.

Three pressure transmitters are installed to monitor the column pressure:

• PT-A
• PT-B
• PT-C

In 2oo3 voting, at least two out of the three transmitters must indicate a trip condition before the logic solver generates a shutdown command.

For example, if PT-A indicates high pressure while PT-B and PT-C remain normal, HIPPS does not trip under the standard 2oo3 arrangement.

If two transmitters indicate pressure above the trip setpoint, the logic solver activates the shutdown.

The simulator also allows you to select different voting configurations:

• 2oo3: Two out of three transmitters must vote for a trip.
• 1oo3: Any one of the three transmitters can initiate a trip.
• 1oo1: Only PT-A is used for the trip decision.

This helps demonstrate the relationship between voting logic, spurious trips and the risk of undetected transmitter failures.

2. Adjust HIPPS Operating Parameters

You can change the important operating settings while the simulation is running.

Available adjustments include:

• Upstream pressure from 60 to 120 barg
• HIPPS trip setpoint from 19 to 24 barg
• Shutdown valve closing time from 1 to 15 seconds
• Voting configuration
• Simulation speed

Observe how changing the trip setpoint or valve closing time affects the pressure response.

A shorter valve closing time can reduce the amount of high-pressure gas entering the protected column after a trip demand.

3. Simulate Different Process Upsets

The simulator includes three process upset scenarios that can increase column pressure.

Overhead PCV fails closed

The overhead pressure control valve closes and blocks the gas outlet. Since gas continues entering the column, pressure begins to rise.

Feed FCV fails open

The feed flow control valve fails fully open, increasing the gas entering the column.

Export header back pressure becomes high

The downstream export pressure increases, reducing the ability of the overhead system to discharge gas from the column.

Try each scenario and observe the pressure trend, transmitter readings, HIPPS trip response and shutdown valve movement.

4. Understand HIPPS Transmitter Failures

A transmitter failure can affect the reliability of the complete protection function.

The simulator allows you to introduce four different transmitter failure conditions.

Fail HIGH

The selected pressure transmitter indicates a high pressure value even when the actual process pressure is normal. This can generate an unnecessary trip depending on the voting arrangement.

Fail LOW

The transmitter reads zero barg even when actual pressure is increasing. This represents an undetected dangerous failure in the simplified simulation.

Freeze

The transmitter output remains fixed at its previous value instead of following the actual process pressure.

Wire break

The transmitter signal is lost. In this simulator, a wire break is treated as a detected failure and counts as a trip vote.

These scenarios help explain why transmitter diagnostics, proof testing, signal monitoring and maintenance are important in safety instrumented systems.

5. Shutdown Valve Failure Scenarios

Even when the pressure transmitters and logic solver operate correctly, a shutdown valve may fail to close.

The simulator allows you to test several final-element failure conditions:

• XV-A stuck open
• XV-B stuck open
• Both shutdown valves close slowly
• Logic solver output lost
• HIPPS taken out of service

The two shutdown valves are installed in series. If one valve remains open, the other valve may still isolate the feed.

However, if both valves remain open or the logic output is lost, the high-pressure source may continue feeding the column.

This demonstrates why shutdown valve testing, actuator maintenance and final-element reliability are essential parts of HIPPS maintenance.

6. Partial Stroke Testing

Partial Stroke Testing (PST) is an important maintenance activity for shutdown valves.

A full-stroke test may require the process to be shut down or the valve to be isolated. Partial stroke testing allows a limited movement of the valve while it remains in service, subject to an approved testing procedure and suitable process conditions.

In this simulator, you can perform a partial stroke test on:

• XV-101A
• XV-101B

The simulated valve moves approximately 20% from its normal position and then returns.

The test provides a simple demonstration of how partial movement can help identify a valve that may be stuck.

You can also observe the test status and whether the simulated valve completes the required movement.

7. Manual Trip and HIPPS Reset

The simulator includes a manual trip function to demonstrate how an operator can initiate a shutdown.

After the trip, observe the shutdown valve positions and column pressure.

The reset function has specific conditions. The trip votes must be cleared, the manual trip must be released and the column pressure must be at least 1.5 barg below the configured trip setpoint.

This prevents the simulated system from resetting while the trip demand is still present or pressure remains too high.

8. Failure Drill – Compare HIPPS Reliability

The failure drill is especially useful for instrumentation and reliability engineers.

It compares the response of the HIPPS under different failure conditions when a process upset occurs.

The available scenarios include:

• Healthy HIPPS with 2oo3 voting
• One transmitter failing low
• Two transmitters failing low
• Transmitter wire break
• One or two transmitters failing high
• Single-transmitter 1oo1 arrangement
• Transmitter bypass during maintenance
• One shutdown valve stuck open
• Both shutdown valves stuck open
• Slow shutdown valve operation
• Logic solver output failure
• HIPPS out of service

The simulator runs each selected case for a simulated period and reports peak pressure, trip response and whether the column reaches the simulated loss-of-containment condition.

This helps demonstrate that a safety system must be considered as a complete loop, including sensors, logic solver and final control elements.

9. Understand PSV Operation and Overpressure Consequences

A Pressure Safety Valve (PSV) provides mechanical overpressure protection.

In this teaching model, the PSV opens at 25 barg. Its simulated capacity is limited to 40 t/h, so it may not be able to handle every high-pressure feed scenario.

If the pressure exceeds the design pressure, the simulator highlights the abnormal condition. It also represents loss of containment when pressure reaches 37.5 barg, which is 1.5 times the simulated design pressure.

The pressure trend helps you understand why relying only on a PSV may not be sufficient for every overpressure scenario.

In an actual plant, PSV sizing, HIPPS design, pressure limits and protection-layer independence must be established through proper engineering studies.

Who Should Use This Simulator?

This interactive training tool is useful for:

• Instrumentation and control engineers
• SIS and safety system engineers
• DCS and ESD engineers
• Instrumentation maintenance engineers
• Oil and gas commissioning engineers
• Reliability engineers
• Process safety professionals
• Engineering students and trainees

It is particularly useful for engineers preparing for discussions about 2oo3 voting, transmitter failure modes, shutdown valve testing, SIS maintenance and HIPPS operation.

Frequently Asked Questions

What does HIPPS stand for?

HIPPS stands for High Integrity Pressure Protection System. It is a safety instrumented system designed to protect process equipment against overpressure.

What is 2oo3 voting in HIPPS?

It means two out of three pressure transmitters must indicate a trip condition before the logic solver initiates a shutdown.

Why are two shutdown valves used?

Two valves in series provide an additional final-element isolation arrangement. In the simulator, either valve can isolate the feed if it closes successfully.

What is a partial stroke test?

It is a limited movement test used to check whether a shutdown valve can move from its normal position without performing a full shutdown stroke.

What happens if a HIPPS transmitter fails low?

It may fail to detect increasing pressure. In a 2oo3 arrangement, one failed-low transmitter can leave the voting function operating, but multiple dangerous failures can prevent a required trip.

Can I test different trip setpoints?

Yes. You can adjust the HIPPS trip setpoint between 19 and 24 barg and observe how the system responds.

Conclusion

HIPPS is an important safety protection system in high-pressure gas processing facilities.

Understanding the complete protection loop requires knowledge of pressure transmitters, voting logic, logic solvers, shutdown valves, partial stroke testing and proof testing.

This HIPPS Column Simulator provides a practical way to explore these concepts. Create different process upsets, introduce instrument failures, test shutdown valve scenarios and observe how the protection system responds.

Try the simulator and improve your understanding of HIPPS operation, 2oo3 voting and safety instrumented system maintenance.

Engineering note: This is a simplified educational simulation using illustrative process conditions and failure models. It is not a validated HIPPS design or safety calculation tool. Actual HIPPS design, SIL verification, setpoints, response times, proof-test intervals and operating procedures must follow the approved project design, IEC 61511 requirements, OEM documentation and plant safety studies.