Patent Application
20230142840
Typical BOP systems are hydraulic systems used to prevent blowouts from subsea oil and gas wells. Conventional BOP equipment includes a set of two or more redundant control systems with separate hydraulic pathways to operate a specified BOP function. The redundant control systems are commonly referred to as blue and yellow control pods. In known systems, a communications and power cable sends information and electrical power to an actuator with a specific address. The actuator in turn moves a hydraulic valve, thereby opening fluid to a series of other valves/piping to control a portion of the BOP.
Many conventional BOP systems are required to be safety integrity level (SIL) compliant. In addition, most BOP systems are expected to remain subsea for up to 12 Chemical Form months at a time. In order to decrease the probability of failure on demand, BOP control valves need to be tested while they are subsea without requiring extra opening and closing cycles of the BOP or requiring additional high pressure hydraulic cycles to close the bonnets solely for testing purposes. Various types of control systems can be safety rated against a family of different standards. These standards may be, for example, IEC61511 IEC61508. Safety standards typically rate the effectiveness of a system by using a safety integrity level. The SIL level of a system defines how much improvement in the probability to perform on demand the system exhibits over a similar control system without the SIL rated functions. For example, a system rated as SIL 2 would improve the probability to perform on demand over a basic system by a factor of greater than or equal to 100 times and less than 1000 times.
This summary is provided to introduce a selection of concepts that are further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in limiting the scope of the claimed subject matter.
In one aspect, embodiments disclosed herein relate to a safety integrity level rated control system having a surface control system and a subsea control system. The surface control system may include one or more remote display panels, one or more buttons operatively connected to each of the one or more remote display panels, two main controllers connected to the one or more remote display panels, two junction boxes, each junction box connected to one of the two main controllers, and a surface intervention system controller connected to the one or more buttons via a wiring bus. The subsea control system may be connected to the surface control system by one or more umbilicals extending from the two junction boxes.
In another aspect, embodiments disclosed herein relate to methods that include coupling a safety integrity level rated control system to an all-electric blowout preventer stack. Such methods may include detecting, via a remote display panel, a failure in operation of a component of the all-electric blowout preventer stack, pushing a button connected to the remote display panel, wherein pushing the button generates a command, and sending the command from a surface intervention system controller to a subsea control system. A command may be received at a remote terminal unit coupled to one section of the all-electric blowout preventer stack and transmitted from the remote terminal unit to a control pod coupled to a different section of the all-electric blowout preventer stack. Methods may further include transmitting the command to a safety integrity level network switch within the control pod, transmitting the command from the safety integrity level network switch to a safety controller via black channel communications, and actuating the component based, at least in part, on the command.
In yet another aspect, embodiments disclosed herein relate to methods that include coupling a safety integrity level rated control system to an all-electric blowout preventer stack, wherein the safety integrity level rated control system has a surface control system and a subsea control system. Methods may further include creating a communication packet addressed to a component of the all-electric blowout preventer stack and transmitting the communication packet through the surface control system and the subsea control system to the component. Using such methods, a failure of the component to actuate according to the communication packet may be detected, and a command may be generated. Methods may further include transmitting the command to a remote terminal unit coupled to one section of the all-electric blowout preventer stack, transmitting the command from the remote terminal unit to a safety integrity level network switch within a control pod coupled to a different section of the all-electric blowout preventer stack, transmitting the command from the safety integrity level network switch to a safety controller via black channel communications, and actuating the component based, at least in part, on the command.
Other aspects and advantages of the claimed subject matter will be apparent from the following description and the appended claims.
Specific embodiments of the disclosed technology will now be described in detail with reference to the accompanying figures. Like elements in the various figures are denoted by like reference numerals for consistency. The size and relative positions of elements in the drawings are not necessarily drawn to scale. For example, the shapes of various elements and angles are not necessarily drawn to scale, and some of these elements may be arbitrarily enlarged and positioned to improve drawing legibility. Further, the particular shapes of the elements as drawn are not necessarily intended to convey any information regarding the actual shape of the particular elements and have been solely selected for ease of recognition in the drawing.
In the following detailed description of embodiments of the disclosure, numerous specific details are set forth in order to provide a more thorough understanding of the disclosure. However, it will be apparent to one of ordinary skill in the art that the disclosure may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.
Throughout the application, ordinal numbers (e.g., first, second, third, etc.) may be used as an adjective for an element (i.e., any noun in the application). The use of ordinal numbers is not to imply or create any particular ordering of the elements nor to limit any element to being only a single element unless expressly disclosed, such as using the terms “before”, “after”, “single”, and other such terminology. Rather, the use of ordinal numbers is to distinguish between the elements. By way of an example, a first element is distinct from a second element, and the first element may encompass more than one element and succeed (or precede) the second element in an ordering of elements.
In the following description of
Additionally, in accordance with various embodiments disclosed herein, any description of the components of a figure is to be interpreted as an optional embodiment which may be implemented in addition to, in conjunction with, or in place of the embodiments described with regard to a corresponding like-named component in any other figure.
Disclosed herein are embodiments of a control system for an all-electric blowout preventer system. In one or more embodiments, the control system may include a surface control system and a subsea control system. Also disclosed herein are embodiments of a safety integrated level (SIL) rated control system for an all-electric blowout preventer stack. In contrast to conventional blowout preventer systems using hydraulics, an entire all-electric blowout preventer system, including all of the blowout preventer components and the control system components, is able to be safety rated.
The surface control system 100 may include one or more remote display panels 102 which may be disposed on a surface facility, such as a drilling rig. In one or more embodiments, the remote display panels 102 may be touchscreens. The remote display panels 102 may be connected to two main controllers 106a, 106b (collectively 106), which may be part of the primary electric control system. In one or more embodiments, one of the main controllers 106 may be referred to as a “blue” main controller 106b and the second of the main controllers may be referred to as a “yellow” main controller 106a. Each main controller 106 may be connected to a junction box 108. Each junction box 108 may combine communication wiring (which may connect the remote display panels 102 and the main controllers 106)) and power wiring (not pictured) such that an umbilical 110 may extend from each junction box 108 to the subsea control system. In one or more embodiments, the umbilical 110 may form a conventional communication line within the primary electric control system.
One or more buttons 104 may be connected to each of the remote display panels 102 via a wiring bus and may be a part of the secondary electric control system. Each button 104 may be connected to a different component within the all-electric blowout preventer stack, such that there is a number of buttons 104 equal to the number of desired safety critical components. The one or more buttons 104 may serve as actuators for the safety rated control system. Each set of buttons 104 may be connected to a surface intervention system (SIS) controller 112. The SIS controller 112 may also be connected to each of the two junction boxes 108 via black channel communications lines 114. Black channel communication may refer to a conventionally used communication system used in safety rated control systems (e.g., as defined in International Electrotechnical Commission (IEC) 61508).
The control pods 118 may also include components of the secondary safety rated control system. For example, each control pod 118 may include a first safety integrity level network switch 124, which may be connected to the first network switch 122, and a safety controller 126. In one or more embodiments, the first safety integrity level network switch 124 may be connected to and may communicate with the safety controller 126 via black channel communications.
In one or more embodiments, the subsea control system 116 may also include two remote terminal units 128, which may be coupled to the lower marine riser package (LMRP) section of the all-electric blowout preventer stack or to the lower stack section of the all-electric blowout preventer. A remote terminal unit may include a microprocessor-based electronic device with hardware and software components that connect data output streams to data input streams. Each remote terminal unit 128 may include a second network switch 130, which may connect the remote terminal unit 128 to the surface control system 100 via an umbilical 110. The second network switch 130, like the first network switch 122, may form part of the primary electric control system. The remote terminal unit 128 may also include a second safety integrity level network switch 132, which may form part of the secondary safety rated control system.
Each control pod 118 and remote terminal unit 128 may be connected to various components 134 of the all-electric blowout preventer stack. In one or more embodiments, components 134 of the all-electric blowout preventer stack may refer to a blind shear ram, a casing shear ram, a LMRP connector, an annular ram, frame components, or an emergency disconnect. One skilled in the art will be aware that there are many different embodiments of components 134 of the all-electric blowout preventer stack, and that the above list of examples is not exhaustive.
For example,
Various electrical connection lines (not shown) may be provided along the all-electric BOP stack 200 and from the BOP stack to the surface. For example, electrical lines may connect the control pods 118 to one or more of the components in the all-electric BOP stack 200 and may connect the remote terminal units 128 to one or more components in the all-electric BOP stack 200.
In the embodiment shown, the control pods 118 may be connected to the frame of the LMRP 210, and the RTUs 128 may be connected to the frame of the lower stack 220. In other embodiments, the all-electric BOP stack 200 may have control pods 118 mounted in the lower stack 220. In such embodiments, RTUs 128 and associated batteries 225 may be mounted in the LMRP 210, and power may be sent to the control pods 118 via the RTUs 128. Alternatively, in embodiments having control pods 118 provided in the lower stack 220, RTUs 128 may be omitted from the BOP stack 200, and the control pods 118 may be hard wired to the surface (e.g., via umbilical 110 in
The subsea control system 116 may be assembled by coupling one remote terminal unit 128 and one control pod 118 to the “yellow” communication system, which may originate from the “yellow” main controller 106a. The second remote terminal unit 128 and the second control pod 118 may be coupled to the “blue” communication system, which may originate from the “blue” main controller 106b.
The control pods 118 may include two or more SEMs 120, a first network switch 122, a first safety integrity level network switch 124, and a safety controller 126. The remote terminal units 128 may include a second network switch 130 and a second safety integrity level network switch 132. Further, in the embodiment shown in
In the same way that the main controllers 106 may be referred to as the “blue” main controller 106b and the “yellow” main controller 106a, there may be two uninterruptible power supplies (UPSs) 148 which may be referred to as the “blue” UPS 148b and the “yellow” UPS 148a. In one or more embodiments, the UPSs 148 may be connected to rig power. The main controllers 106 may be connected to one or more transformers 150, which may feed into the two junction boxes 108. In one or more embodiments, the transformers 150 may step up the voltage through the system from 120V before the transformers 150 to 600V after the transformers 150.
Turning now to
In one or more embodiments, the LMRP battery packs 152 and the lower stack battery packs 154 may be configured to power one or more motor(s) attached to the all-electric blowout preventer stack such that each component 134 in the all-electric blowout preventer may be closed without power from the surface. In one or more embodiments, a motor may produce 180 horsepower and may enable component 134 closure within 45 seconds. As such, the lower stack battery packs 154 and the LMRP battery packs 152 may store enough power to perform component 134 closure multiple times without needing to be recharged.
A battery management system (BMS), in accordance with one or more embodiments, may be integrated into the LMRP battery packs 152 and the lower stack battery packs 154. The BMS may be configured to connect to the first network switch 122 and the second network switch 130, such that the network switches 122, 130 can access and query the status of every battery in the LMRP battery pack 152 or the lower stack battery pack 154. As a result, battery failures within the packs 152, 154 may be detected and reported to the surface, specifically to the remote display panels 102, so that an operator can flag those batteries for replacement at the next available opportunity.
A deadman and autoshear (DM/AS) battery pack 156 may also be connected to the circuit 153, where the DM/AS battery pack 156 includes one or more batteries and a battery management system. The DM/AS battery pack 156 may be located in the lower stack section. In one or more embodiments, the DM/AS battery pack 156 may be used exclusively to power deadman operations or autoshear operations in emergency situations where an additional reserve store of power is required. For example, in emergency situations in which there is a failure to provide power to the all-electric blowout preventer and control systems from the surface, a deadman operation may be required. Further, in emergency situations where the LMRP section of the all-electric blowout preventer disconnects from the lower stack section and there are components 134 in open configurations, an autoshear operation in the lower stack section may be required. In one or more embodiments, if either emergency situation is detected, the DM/AS battery pack 156 may store enough energy to power all motor(s) connected to the various components 134 such that the DM/AS battery pack 156 may assist in actuating the various components 134 in the lower stack section.
In one or more embodiments, an acoustic pod 158 may also be connected to the circuit 153. An acoustic pod 158, in accordance with one or more embodiments, may refer to a device which may be dropped into the ocean from the surface facility, and which may be secured to the all-electric blowout preventer stack. The acoustic pod 158 may send acoustic signals through the water surrounding the all-electric blowout preventer, allowing it to access the blowout preventer through the safety rated control system, specifically through the first and second safety integrity level network switches 124, 132, in order to close components 134 in emergency situations. For example, in one or more embodiments, an acoustic pod 158 may be provided in the lower stack section of an all-electric BOP stack, where the acoustic pod 158 may be used to close components 134 in the lower stack section.
Initially, a safety integrity level rated control system may be coupled to an all-electric blowout preventer stack, S602. In one or more embodiments, the safety integrity level control system may include a surface control system 100 and a subsea control system 116, 136, 140. A failure in operation of a component 134 of the all-electric blowout preventer may be detected via a remote display panel 102, S604. Once alerted to the component 134 failure, a user may push a button 104 connected to the remote display panel 102, where the button 104 corresponds to the failed component 134 and where pushing the button generates a command at the surface intervention system (SIS) controller 112, S606.
The command may be sent from the SIS controller 112 to the subsea control system 116, 136, 140, S608. In one or more embodiments, the command may be received at a remote terminal unit 128 coupled to one section of the all-electric blowout preventer, S610, e.g., a lower marine riser package (LMRP) section. Further, the command may be transmitted from the remote terminal unit 128 to a control pod 118 coupled to the other section of the all-electric blowout preventer, S612, e.g., a lower stack section. Specifically, the command may be transmitted to a safety integrity level network switch, such as the first safety integrity level network switch 124, within the control pod 118, S614. In one or more embodiments, the first safety integrity level network switch 124 may form a part of the safety rated control system. The command may then be transmitted from the first safety integrity level network switch 124 to a safety controller 126 via black channel communications, S616. The safety controller 126, according to one or more embodiments, may communicate with the failed component 134 via black channel communications.
As a result, the failed component 134 may be actuated based, at least in part, on the command, S618. In one or more embodiments, actuating the component 134 may include, for example, closing an open component 134, such as an open connector section, of the lower stack section of the all-electric blowout preventer. In one or more embodiments, actuating the component 134 may also involve overriding the failure in operation of the component 134.
Initially, a safety integrity level rated control system may be coupled to an all-electric blowout preventer stack, S702. In one or more embodiments, the safety integrity level rated control system comprises a surface control system 100 and a subsea control system 116, 136, 140. A communication packet addressed to a component of the all-electric blowout preventer may be created, S704. In one or more embodiments, the communication packet may include instructions for actuation of a component 134. The communication packet may be transmitted through the surface control system 100 and the subsea control system 116, 136, 140 to the component 134, S706.
In one or more embodiments, a failure of the component 134 to actuate according to the communication packet may be detected, S708. In one or more embodiments, the failure may be detected at a computer processing unit included in the two main controllers 106. In other embodiments, the failure may be detected at the remote display panels 102.
A command may be transmitted to a remote terminal unit 128 coupled to a section of the all-electric blowout preventer stack, S710, e.g., a lower marine riser package (LMRP) section or a lower stack section of the BOP stack. In one or more embodiments, the command may contain instructions for overriding the failure of the component 134 to actuate according to the communication packet. In one or more embodiments, the command may be transmitted from the remote terminal unit 128 to a safety integrity level network switch 124 within a control pod 118 coupled to a different section of the all-electric blowout preventer stack, S712, e.g., the lower stack section or the LMRP section. In other embodiments, the command may be routed to a second safety integrity level network switch 132 within the remote terminal unit 128.
The command may further be transmitted from the safety integrity level network switch, such as the first safety integrity network switch 124 and the second safety integrity network switch 132, to a safety controller 126 via black channel communications, S714. In one or more embodiments, the safety controller 126 may be located in either the control pod 118 or the remote terminal unit 128. The component 134 may be actuated based, at least in part, on the command, 5716. In one or more embodiments, actuating the component 134 may include, for example, closing an open component 134, such as an open connector section, of the lower stack section of the all-electric blowout preventer.
Embodiments of the present disclosure may provide at least one of the following advantages. In currently commercially available blowout preventer systems, a safety rated control system may require hydraulic equipment in addition to electrical equipment in order. Further, since hydraulic equipment is installed in conventional blowout preventer systems, the blowout preventer, which may be referred to as the end device, is not able to be safety rated since it is outside of the electrical system. With an all-electric blowout preventer system, the entire system, including all of the blowout preventer components and the control system components, are able to be safety rated. An all-electric blowout preventer system and an all-electric control system eliminates the need for hydraulic equipment, reducing the complexity of the blowout preventer system. Accordingly, all-electric blowout preventer systems according to embodiments of the present disclosure may be lighter, smaller, and more energy efficient when compared with conventional blowout preventer systems.
Although only a few example embodiments have been described in detail above, those skilled in the art will readily appreciate that many modifications are possible in the example embodiments without materially departing from this invention. Accordingly, all such modifications are intended to be included within the scope of this disclosure as defined in the following claims.
| Number | Date | Country | |
|---|---|---|---|
| 63277053 | Nov 2021 | US |
