Highest safety standards in the Wadden Sea: HIMA migrates safety systems for Harbour Energy in Germany

SIMON WITT, Harbour Energy Germany; KARSTEN SCHWERIN and MICHAEL CISLER, HIMA  

Fig. 1. The Mittelplate drilling and production island is located in the Wadden Sea in Schleswig-Holstein state. Image: Harbour Energy.

On the southern edge of the Schleswig-Holstein Wadden Sea, off the Dithmarschen coast, the heart of German oil production beats—the Mittelplate drilling and production island. It  

has successfully extracted crude oil from Germany's most extensive oil deposit since 1987. More than half of Germany's oil production comes from here.   

But the rig/platform in the mudflats, which is visible from afar, is only the spearhead of the facilities operated by Harbour Energy. The oil infrastructure extends from the offshore rig/platform through the Wadden Sea to the onshore plant in Friedrichskoog and ends 43 km away at the tank farm in Brunsbüttel.  

Safety is a top priority in the operation of the plants. To protect people and the environment, oil production in this sensitive area is subject to strict conditions. It was significant to control the transport safely and reliably over the entire route. Until 2024, the safety systems along this route were based on HIMA's proven HIQuad system, which had been used for over two decades. However, after decades of safe operation, modernization of the controls became necessary to ensure operation until the planned stoppage of production at the end of 2041. Due to HIMA's positive experience and market-leading position, Harbour Energy Germany opted for the current HIQuad X system. The detailed migration concept was compelling.  

A central requirement in the migration project was that production operations should not be interrupted. Every hour of production downtime means a considerable economic loss. The downtimes for turnarounds and conversion measures are limited to a few hours per year. This is why all work is meticulously planned and prepared. There were also only narrow turnaround windows available to migrate the safety controllers. After that, operations should continue seamlessly with the new safety systems. At the same time, the migration aimed to improve safety and maintenance functions and pave the way for efficient digital functions and processes.  

Fig. 2. The Dieksand land station controls onshore oil production and processing. Image: Harbour Energy.

PROJECT PLANNING BY HIMA  

HIMA took over the complete planning and implementation of the migration project, scheduled from 2020 to 2025. During this period, five turnarounds were implеmеntеd: three for the preparation and parallel construction of the systems and two for the old systems conversion to the new technology. The migration involved the relocation of 11 HIQuad controllers distributed across various facilities in Dieksand, including outdoor and transfer stations, as well as the Mittelplate offshore rig/platform. Due to the complexity of the plant and the sensitive conveying processes, the technical challenge was notably high. A 42-km optical fiber network has been established to enhance safety-related communication. In some project phases, redundant safety-related communication between old and new systems was also necessary.   

HIMA's Emergency Shutdown Systems (ESD) play a critical role in ensuring the safe operation of pipelines. These systems continuously monitor flowrates at both the start and end of the pipelines while simultaneously measuring pressure levels to maintain safety and reliability. If the meter values deviate from each other by more than 1%, the system reliably shuts down the corresponding pipeline.  

Fig. 3. The HIQuad X system family offers reliable solutions and supports a holistic approach to functional safety digitalization. Image: HIMA Group.

MIGRATION CHALLENGES 

A particular challenge was the connection to the existing process control systems. While the control system installed on the rig/platform communicates via Modbus RTU, the Profibus DP communication with the aging system on the mainland was a sticking point with many imponderables. The Profibus system was connected to the new controllers, which communicate using modern protocols. To prevent an uncontrolled shutdown of the Profibus during the two switching phases, and to gain a thorough understanding of the legacy DOS programming, the authors conducted a week-long test of the communication system at the process control system manufacturer's facility.   

During this time, they adjusted the communication protocols, as needed. This effort likely helped avert multiple potential downtimes. The engineering station has been upgraded to the latest standards: Instead of the ELOP II systems, the configuration and programming of the new safety controllers are now carried out with the modern engineering software, SILworX.  

The 11 HIQuad X systems, including communication, were previously set up and tested at HIMA in Brühl, Germany (Factory Acceptance Test). This approach allowed the team to proactively identify potential errors and significantly reduce downtime during the implementation, as the annual turnaround window was limited to just 6 to 8 hrs. To be prepared for unforeseen problems during the switchover, HIMA developed a fall-back concept that would have made it possible to fall back on the old systems in an emergency. 

The thorough preparation, executed through close coordination between Harbour Energy Germany, HIMA, external testing institutions like TÜV Nord, and the State Office for Mining, Energy, and Geology, proved successful. Challenges that arose during the hot project phases could always be solved promptly and within the planned timeframe. The parallel commissioning of the new controls to ensure the changeover went smoothly and was particularly important. To achieve this, HIMA implemented a temporary solution that allowed the old and new systems to operate simultaneously. This approach enabled the step-by-step activation of the new controllers without requiring a complete system shutdown.  

Despite adverse circumstances, due to the contact restrictions during the Covid pandemic, the first pivot phase was realized one year earlier than planned for the third turnaround in 2022. The stations along the field line and the gateway were built, based on HIPRO-S V2 communication to the head-end for the new safety system. During the second turnaround phase (the fourth turnaround of 2023), the remaining systems between the head station and the Mittelplate rig/platform were successfully converted. Simultaneously, comprehensive documentation was prepared to meet the mining authority's stringent requirements, including the verification and functional validation of safety devices. 

One of the biggest challenges in the migration project was the communication interfaces between the HIMA safety controllers and the third-party controllers and control systems. During the step-by-step transition of the safety systems, the project team had to ensure that all connections were maintained correctly. Each change or adjustment is provided with a CRC (Cyclic Redundancy Check) code that ensures the correct configuration is loaded into the respective controller. This allows tracking changes and ensures accurate parameters and configurations are restored after a system shutdown. It plays a key role in HIMA's safety philosophy and quality assurance, particularly in large projects with numerous communication paths and control systems.  

Fig. 4. HIQuad X safety controllers at Harbour Energy Germany. Image: HIMA Group.

POTENTIAL THROUGH DIGITALIZATION  

The migration from HIQuad to HIQuad X not only ensures the continued operation of oil production but also opens up new opportunities for Harbour Energy in the digitalization and automation of the plant. With the advanced safety solution, the operator can implement remote maintenance and advanced diagnostic functions. The new solution enables the implementation of automatic tests, streamlining operations. With the power of advanced digital capabilities, numerous tasks can be carried out remotely. Dedicated support of the HIMA team throughout this process maximizes the benefits of the new systems. 

A key advantage of the HIQuad X system is the ability to make changes, such as replacing I/O cards on the fly without the need to shut down the system. It has been a major problem, as adjustments could only be made during short shutdowns or resulted in production losses. 

The planning for the project began at the end of 2018.  

The project was divided into five phases and started at the end of 2019 with a complete inventory of the sub-areas and a comprehensive concept of all necessary measures. Thanks to the precise preparation and detailed scheduling, the team completed the project on schedule without any additional unplanned shutdowns or interruptions. The parallel commissioning of the new control systems was particularly helpful. It had already been put through its paces in HIMA's test field before they were integrated into the existing infrastructure.  

A key advantage of the new safety controllers is the improved communication structure. By switching to more modern protocols, such as Modbus TCP and SafeEthernet, the controllers can communicate with each other flexibly and securely. This approach allows for faster and safer modifications, which can be implemented during operation. It is now possible to adjust logic and hardware in real time, minimizing the risk of errors and enabling the system to return to full operation more quickly after changes.  

OUTLOOK  

The migration project has made Harbour Energy Germany’s plant future-proof and created the basis for further digitalization and automation measures. Since the completion of the migration, the operator has recorded fewer disruptions at the same time, and the new safety controllers have a significantly larger range of messages and alarms, as well as extensive diagnostic options. The clear configuration in the intuitive SILworX engineering system makes it easier for the operating personnel to work on the controls. In the long term, remote maintenance and automated test procedures for safety-related sensors and actuators make operations even more efficient and safer.  

Since the already outdated distributed control system (DCS) is also to be migrated to a new technology, HIMA was commissioned as part of this project to adapt the communication to be future-proof and to design the communication channels redundantly throughout. The existing Modbus RTU coupling was converted to Modbus TCP, and the existing ProfibusDP couplings were designed redundantly to ensure a seamless transition. Safety-related communication has been converted from the aging serial HIMA HIBus to SafeEthernet. In the course of this, the HIMA programming stations were also modernized and newly connected. 

Cyber security will play an even more enhanced role in the future. With Ethernet-based protocols and the possibility of secure remote maintenance, HIMA has modern security standards, which the company is developing in strategic partnership with the IT security specialist genua, a subsidiary of the Bundesdruckerei Group. Further developments in this area are already being planned to protect critical infrastructures in the future.  

CONCLUSION  

Overall, the project has shown how important close cooperation and open communication between operator and supplier is to master the challenges of such a complex migration project. With the HIQuad X system from HIMA, Harbour Energy is ideally equipped for the next 17 years of operation and can rely on highly available safety technology.  

ABOUT HIMA GROUP 

The HIMA Group is a global independent provider of safety-related automation solutions for the process and rail industries that protect people, assets, and the environment from harm. The family-owned company, founded in 1908, is headquartered in Brühl, near Mannheim,  Germany. The HIMA Group employs approximately 1,050 employees in 22 group companies, worldwide. More information at www.hima.com 

SIMON WITT is senior operations technology engineer at Harbour Energy Germany. He is an electrical engineer and began his professional career at a small electrical company, where he worked via a contractor firm in the Holstein oil production site of RWE Dea AG. During 2007, he joined RWE Dea AG (now Harbour Energy Germany) directly, initially serving as a certified electrician with a focus on maintenance and servicing of electrical systems. From 2012 forward, he held the position of master electrician, and in 2022, he advanced to the role of senior operations technology engineer at the Holstein production site. 

KARSTEN SCHWERIN is senior service engineer at HIMA and has been with the company since January 2013. He supports clients in the oil & gas, power plant, chemical, and petrochemical industries. Mr. Schwerin’s responsibilities cover the full range of site services, local engineering, and project management. He became a certified Functional Safety Engineer in 2016 and has been qualified for offshore operations since 2020. 

MICHAEL CISLER is a sales engineer at HIMA and began his career with the company in 2007 as a Service Engineer, supporting global clients in the oil & gas, power plant, chemical, and petrochemical sectors. His work covered the full range of site services, local engineering, and project management. Mr. Cisler became a certified Offshore Specialist in 2010 and a Functional Safety Engineer in 2011. Since 2012, he has served as sales manager for the Northern Germany region, supporting both national and international customers.