“Everybody handles pressure differently.”  Gerry Cooney

High Integrity Pressure Protection Systems (HIPPS) are a type of Safety Instrumented System (SIS) used as an alternative to or in conjunction with pressure relief systems.  HIPPS were added to the Standards as an alternative to pressure relief valves in August of 1996 after many safety professionals realized that venting a vessels contents to the atmosphere may be just as dangerous or more dangerous than not having a relief valve at all. These systems accomplish the same goal as other pressure relief systems, but come at it from a different angle. A traditional pressure relief system looks to relieve the pressure in a vessel by venting the excess material. The goal of a HIPPS is to shutoff or isolate the vessel from a source of pressure. This prevents incoming material or heat from causing the pressure to build further. HIPPS are most applicable when venting is a personnel, community, and environmental exposure concern or when adequate venting capacity cannot be built.

Following the Standards

Since HIPPS are a specialization of a Safety Instrumented Function (SIF), it is subject to complying with IEC 61508, IEC 61511, and ISA S84.  While there is no “HIPPS standard,” there are relevant codes that constrain and regulate HIPPS. Relevant standards are American Petroleum Institute (API) Recommended Practice (RP) 521 and American Society of Mechanical Engineers (ASME) Pressure Vessel Code, Section VIII. API RP 521 recommends the use of HIPPS whenever the use of pressure relief devices is “impractical” according to the user. ASME Pressure Vessel Code Section VIII regulates for vessel safety, usually in requirements for manufacturers. In 1996, Code Case 2211 allowed the practice of HIPPS in the place of pressure relief devices on vessels.  This has since been incorporated into UG-140 in 2008. UG-140 lists the following standards regarding HIPPS:

  • The HIPPS must be as safe as or safer than a conventional relief device.
  • Vessel cannot be used solely for water, steam, or air.
  • The Maximum Allowable Working Pressure (MAWP) must be higher than what the system can “reasonably” achieve.
  • A HIPPS is the responsibility of the user, not the manufacturer of the vessel. Code stamp must cite UG-140, formerly Code Case 2211.

The ambiguity of these standards leads to many questions. Since the proposed HIPPS is to be “as safe or safer,” the standard asks how safe the current device is. A HIPPS can be used as a replacement or a supplement to a relief device. In either case, it must provide as much or more risk reduction as the whole or the part of the conventional pressure system it is replacing.  An understanding of what high pressure situations make a process vulnerable, what SIL is needed to provide sufficient protection, and how the HIPPS is to be implemented is vital.   A risk analysis should be performed to determine the needed risk reduction and reliability.

HIPPS cannot be used on air, water, or steam only systems for a couple of reasons. The first is that this standard includes boilers, and ASME does not want residential boilers to be without a pressure relief valve because a HIPPS was used unnecessarily. A HIPPS must be tested on a regular basis as part of its risk reduction, so this is more impractical than a pressure relief valve. The second reason is that air, water, and steam are not harmful if released to environment.

The allowable MAWP being higher than what the system can “reasonably” achieve also poses some ambiguity. This is basically saying that a vessel must be able to withstand the highest pressure that is typical during normal operations of that phase of the process.  This is to keep companies from installing equipment that is below what is needed because the HIPPS is protecting from the high pressure that would cause the vessel to rupture. The ambiguity comes from how much is a reasonable cushion between the pressure the system could produce and the MAWP for the vessel.

HIPPS are the responsibility of the user of the equipment, not the manufacturer.  The user must have justification of the need for a HIPPS and that it will provide adequate protection.

Justification & Documentation

Justification comes from a hazard analysis process to identify possible over-pressure scenarios and whether a HIPPS is adequate protection.  The justification process requires a knowledge of the process and situations that are possible to arise and how to apply a system to properly isolate or shutoff source of pressure. This justification process must include this documentation:

  • Piping and Instrumentation Diagrams (P&ID’s) that show all the pertinent elements of the system associated with the vessel.
  • Description of the operating and upset scenarios
  • Detailed descriptions of safety instrumentation and reliability evaluation
  • Analysis showing maximum pressure that can result from each high-pressure situation

Justification for the use and capabilities of HIPPS is the arduous part of the implementation of this SIS.  As there are many sources of overpressure, a HIPPS is not always capable of mitigating high pressure in every situation.  Conventional measures may still need to be used in tandem with the HIPPS.

Designing a High Integrity Pressure Protection System (HIPPS)

Once a scenario has been determined to be a justified use of HIPPS, the design of the system can start to be considered. Since a HIPPS is a specialized SIS, designing one follows a similar process. As a SIS, a Safety Requirement Specification (SRS) is required for a HIPPS.  This is used to document what conditions the HIPPS acts under and how it is to respond to prevent or mitigate a high-pressure event. The SRS also addresses the target Safety Integrity Level (SIL) and the configuration of the devices to reach this goal. Factors that contribute to the decision of configuration are device integrity, redundancy, fault tolerance, diagnostic requirements, and test interval. A SRS provides the justification for the use of HIPPS.

A HIPPS consists of sensors, logic solvers, and final control elements.  Sensors are usually analog transmitters instead of switches as problems are easier to spot when they occur. An issue with a switch would not be discovered until the system is needed and it is too late. The logic solver has to be separate from the BPCS as per IEC 61511. The logic solver hardware must meet the target SIL. Where practical, it is best for the output function to be de-energize to trip. FCEs are valves or relays to trip motor control circuits. Actuator needs to be able to open or shut a valve in a high-pressure situation. At least one valve needs to be solely dedicated to the HIPPS no matter the SIL.

As with any SIF, the architecture is determined by the level of risk reduction paired with the availability. As pressure relief valves and rupture discs typically provide a SIL of 2 or 3, the HIPPS will have to be able to provide at least that same amount of protection. Many will recommend 2oo3 sensors and 1oo2 FCEs for a HIPPS. But architecture only needs to be what is necessary and what the process calls for. Most HIPPS will require either 1oo2 or 2oo3 sensors. FCEs can be 1oo1, 1oo2, or 2oo2. Logic solvers will typically be SIL 3 certified.

An important aspect when designing the HIPPS is the response time. A conventional pressure relief valve will act when needed without delay.  A HIPPS must be able to detect, decide, and act quickly in response to a high-pressure situation. The response time may be a reason to use a HIPPS in conjunction with a conventional measure like a pressure relief valve. As some systems can build pressure quickly, a HIPPS may not be applicable to taking the full responsibility of pressure relief but can take part of the load so the relief valve or rupture disc does not have to be as big. The HIPPS has to be proven to handle the excess pressure before a smaller device is implemented.

Test intervals are another important factor in the calculation of a SIL, so it is imperative that HIPPS are tested as often as their SIL demands. Regular testing reduces the probability to fail on demand.

Advantages & Disadvantages

The reason HIPPS are becoming more and more prevalent is because they offer some advantages over the traditional pressure relief systems. The first is that HIPPS reduce or eliminate emissions completely depending on how it is designed. Capital for installing a HIPPS is low relative to the cost of upgrading the piping and the traditional relief systems and flares.  It is also a shorter downtime to install which also saves money. When used in conjunction with a conventional pressure relief system, it allows the device to be rated for lower pressures. HIPPS also are a viable option when conventional relief systems are not practical for the situation such as rapidly occurring runaway reactions.

As with any choice, there are disadvantages to choosing a HIPPS. Justification must show that a HIPPS can address all the foreseeable scenarios of over-pressure adequately and is documented through hazard analysis. Effectiveness of the HIPPS is strongly dependent on the field design, device testing, and maintenance program. If a HIPPS is put in place without a conventional relief device, the HIPPS is the last line of defense in keeping a vessel or line from rupturing. This means that device testing and maintenance must be kept to date, making operations a major contributor to meeting the target SIL in comparison to traditional pressure relief devices.  This would add more job functions to facility management, instrumentation and process personnel, operations, and maintenance. This means that these groups need to understand how a HIPPS works and additional training would be necessary for performance of duties. Extensive documentation of design, operation, maintenance, and testing to ensure that it meets the SIL needed. Local authority and regulations may have more restrictions on HIPPS or may not even allow them.


As chemical plants grow and innovate, and environment regulations continue to put more constrains on emissions, the need for HIPPS will grow. The main benefits of HIPPS is the minimization of venting to reduce the risk to personnel, the community, and the environment and the ability to reduce pressure when sufficient venting capacity is impractical to build. Justification to design and implement a HIPPS as well as the maintenance of the HIPPS are the biggest hurdles to implementing this type of SIS, but provided a HIPPS is justified they are an excellent choice when needing to prevent pressure while working with toxic chemicals.