MX2013004432A - Clustered wellhead trunkline protection and testing system with esp speed controller and emergency isolation valve. - Google Patents

Abstract

The systems and processes of the present invention includes ESP variable speed drive controllers that function in conjunction with a safety logic solver, pressure sensors, and an emergency isolation valve to perform a functional test of the complete wellhead trunkline protection system without interruption of production.

Description

SYSTEM OF PROTECTION AND TESTING OF A TRUNK LINE OF WELLS OF GROUPED WELLS WITH VALVE OF EMERGENCY ISOLATION AND ESPECIALLY CONTROL SPEED Field of the Invention This invention relates to a protection and testing system of a wellhead line trunk line. 1 Description of the related art A wellbore high integrity protection system (HIPS) protects flow lines connected to a wellhead against overpressure in the event of closing a downstream blocking valve. The source of pressure may be the pressure of geological oil formation. This pressure is known as the wellhead closing pressure and is based on geological parameters, it is continuous, it can not be controlled, that is, it can not be "turned off" in the conventional sense of the term. For another valve to work in case a valve leaks or does not close, multiple automated block valves are required in series downstream of the wellhead pressure source.

Although surface safety valves (SSVs) that are generally used in these applications are extremely reliable, they are considered the worst possible situation in the design of safety systems. In the i Safety instrumentation area This is considered a design that provides tolerance for dangerous failures! in the hardware. In the SSV complete closure test method, the valves will not only close, but will also provide positive closure in response to the constant pressure from the wellhead, ie, there will be no detectable losses. Two valves in series are required to perform a complete closure test and the system includes a vent valve between the two shut-off valves and an intermediate series of pressure transmitting sensors. In certain arrangements of the device and the system, all the functional components are communicated with and directed by a logical safety solver (SLS for its acronym in English). The control and data signals can be transmitted through cables or wirelessly.

Submersible electric pump systems and related technologies have been adopted to improve oil / gas recovery when reservoir production has been decreased by prevailing reservoir conditions. Submersible electric pumps (ESP by its sigljas in English) are used at the bottom of the well to extract oil and gas; to the surface where they are received by a flow line system from the wellhead for transport and distribution. The pressure of I the pipe, the flow speed and other variables! they are monitored at the wellhead to ensure, among other things, the safe operation of the pipeline and the distribution system downstream of the wellhead. In the area near the mouth of the well, conventional mechanical protection systems may include the use of thick-walled pipes with a high pressure rate suitable to withstand the high pressures that ESP can generate. In order to reduce costs, the pipeline downstream of the wellhead is manufactured with tubes with a lower defined working pressure range. Relatively thinner walled tubes are used in the flow line system.

A problem introduced by the new downhole ESP production controller is that although it provided the necessary increase in pressure to maintain the oil flow, if an intermediate block valve were closed I in the long network of flow lines and trunk lines between an offshore production platform and the oil and gas separation plant (GOSP) on the mainland, the pressure would accumulate in the pipe network until the completely blocked discharge pressure of the pump, which in some cases is much higher than the normal flow pressure of the pipe. A network of flow lines suitable for normal functions may not have a sufficiently high pressure range to withstand the fully blocked ESP pressure. Therefore, a high integrity protection system is necessary to limit the pressure to safe levels! in the i downstream pipe.

Operating pumps at the bottom of the well against a blocked discharge is not common practice, but is considered the worst possible situation when designing associated safety systems. The downhole ESPs are electrically driven and the control of the pump as a potential source of dangerous pressure is electrical.

To ensure that maximum flow line pressure is maintained within safe working limits, so-called high integrity protection systems, or HIPS, have been developed for various applications. In the prior art, the practice of conventional safety design has been to specify the flow lines that transport the oil / gas produced from the wellhead with sufficient wall thickness to contain the discharge pressure completely blocked in the theoretical conditions of the worst possible situation. However, this approach proved impractical when introducing submersible electric pumps that can produce a very high closing pressure at the wellhead, greater than 3000 psi. One approach that has been adopted is to continuously monitor the pressure of the downstream flow line and cut the power supply to the ESP before the pressure of the flow line reaches a dangerous level.

It is also known in the prior art the use of sub-surface safety valves (SSSV) in order to closing the well and testing of these types of valves has been exposed in order to ensure that the wellhead closure system functions properly, such as for example in U.S. Patent 4,771,633.

Other systems have been described that allow the submersible electric pump to continue to operate in a recirculation mode in the event of an emergency that requires the well to be closed. Such systems are described in U.S. Patent Nos. 32,343 and 4,354,554.

In addition, the systems are known for their use in the conduction of emergency shutdown tests of safety shutdown valves. For example, the United States Patent No. 7,079,021 discloses an emergency shutdown device driver and sensors for providing data to the controller, which has a processor, a memory coupled to the processor and an auxiliary input, where an emergency shutdown test is stored in the memory and the auxiliary input is stored. It adapts to receive a binary signal and sensor data. The routines are stored in the memory and adapted to be executed in the processor to allow the emergency shutdown test to be carried out in response to receiving a binary signal in the auxiliary input and to make the sensor data are recorded in the memory during the emergency shutdown test.

The problems described above and the proposed solutions refer to individual well flow lines systems. U.S. Patent Application Serial No. 11 / 977,204, which is incorporated herein in its entirety by this reference, provides a protection system for the wellhead flow line and a method using the speed controller. of downhole ESP and an SSV to ensure that dangerous pressure levels are not reached and provide conditions for the functional safety test of the wellhead system. However, in the context in which a group of wells is connected to a common trunk line, a unique problem arises. The combination of the maximum tolerances of the risk reduction criteria with the functional test needed and the maintenance of each HIPS creates both a practical and design limitation that prevents the connection of more than a predetermined amount of HIPS along a line private trunk It would be desirable to provide oil / gas operations using electric submersible pumps with a wellhead flow line protection system capable of providing a fully automated test and self-diagnostic test for a plurality of wells without the need to close several wells in order to perform the test. It is possible to carry out "on-line" tests at regular intervals, for example on a quarterly basis, combined with the complete verification of closure systems at periods when production is stopped by routine maintenance, tests and / or scheduled inspections.

Therefore provide a wellhead control system and a method for continuous monitoring and automatic testing to detect potential faults in a flow line associated with a group of wells, each pressurized by a submersible electric pump while contiguous the operation of ESP, is an object of the present invention.

A further object of the present invention is to provide an automated reliable testing and shutdown system for replacing the flow line protection systems instrumented in the prior art, which require the interruption of production and large amount of labor, and They are based on complex manual test test requirements.

Another object of the invention is to provide a safety test procedure for a group of wells of i which each one has an ESP, which can be carried out without interrupting production by shutting down ESP.

Still another object of the present invention is to eliminate the dependency on manual human intervention in the tests of í system test through the provision of a method and diagnostic system and automated functional test.

Brief Description of the Invention According to one or more embodiments, the invention relates to an automated system for safety testing of an instrumented trunk line protection system connected to a plurality of pipes of flow lines of wells used for the distribution of a pipeline. flow of gas and / or oil. At least one wellhead flow line pipe of the plurality of wellhead flow line pipes is pressurized by an electric submersible pump (ESP) at the bottom of the well. Several pipes of flow lines are connected to a common header. An emergency isolation valve (ZV) is placed on a trunk line downstream of the common head. A previously programmed safety logic solver (SLS) is provided to carry out a safety test protocol and record the results in electronic form, and to emit the emergency shutdown signals. Several pressure sensors are included to measure the internal pressure of the flow line in the common head. Additionally, a valve actuator is provided to close the ZV in response to both a test start signal and an emergency shutdown signal transmitted by the SLS, and to open each ZV in response to a signal transmitted by the SLS. Each ESP includes a variable speed drive controller operatively connected there that is also connected to the SLS and varies the ESP speed according to the SLS speed reduction / increase commands, so that the fluid pressure in the SLS varies. Flow line and provides information on ESP speed during normal operation and during the SLS system test. An emergency ESP shutoff switch is provided to interrupt the flow of energy to each ESP in response to an emergency shutdown signal from the SLS.

A method for safety and failure tests of an instrumented protection system on a trunk line i connected to a plurality of wellhead flow lines that transport gas and / or oil, each pressurized by a downhole submersible electric pump (ESP), and the trunk line is equipped with an emergency isolation valve (ZV), the method comprises: to. provide a plurality of electronic sensors of I transmission of pressure in the main trunk line; above with respect to the ZV; b. Provide a variable speed controller: (VSC) Í for each ESP, to adjust the ESP speed; c. providing a programmed logic safety solver (SLS) that controls communication with ZV and, each variable speed controller for each ESP, and which receives and records the data transmitted by the plurality of pressure sensors; : d. initiate an SLS safety and failure test by transmitting a signal to ZV to initiate movement to its partially closed position, based on differential pressure measurements performed at the valve's length; and. monitor the pressure data received from the pressure sensors; F. transmitting an SLS signal to each VSC to reduce the speed of each ESP in response to a predetermined increase in internal flow line pressure; g. communicate VSD velocity information from jSP to SLS once a predefined gradual speed increase is initiated to identify any individual well ESP VSC that did not respond to the SLS during the system test; h. transmit an SLS signal to move the ZV to its fully open position and i. transmit an SLS signal to each VSC to increase the ESP speed in response to the pressure data of the flow line.

Brief Description of the Figures The invention will now be described in more detail and with reference to the accompanying figures in which reference is made to the same elements or similar elements with the same number and where: FIG. 1 is a schematic illustration of a pipeline arrangement of pressurized wellhead flow line a submersible electric pump, such arrangement includes a mode of a high integrity wellhead protection system; I FIG. 2 is a schematic illustration of a plurality of well nozzles connected to a common trunk line in which certain well nozzles include the high integrity protection system of FIG. 1; FIG. 3 is a schematic illustration of another embodiment of i a wellbore high integrity integrity protection system suitable for use with a plurality of wellhead flow line pipe arrangements, each pressurized by a submersible electric pump and FIG. 4 is a schematic illustration of a plurality of well nozzles connected to a common trunk line in which certain well nozzles include the high integrity protection system of FIG. 3.

Detailed description of the invention The systems and processes of the present invention include ESP variable speed controllers that work in conjunction with a safety logic solver (SLS), pressure sensors and an emergency isolation valve (ZV) to perform a functional test of the Complete system of protection of the wellhead flow line without interrupting production.

In the context of a high integrity protection system associated with a single well, the term "end elements" includes an ESP, a variable speed controller (VSC) and a safety shut-off valve (SSV). In the present reference is made to these final elements and the mouth and the well itself as a "wellhead subsystem" in the context of a high integrity protection system associated with a single well.

In the context of a high integrity protection system associated with a plurality of wells, the term "end elements" refers to the ESP or the VSC and the VZ. In the present reference is made to the ESP or the variable speed controller (s) and the wellhead itself, including the conventional SSV and the SSSV shutoff valve or subsurface safety, in conjunction as a "wellhead subsystem" in the context of a high integrity protection system associated with a plurality of wells.

In certain embodiments of the system and the process of the present invention, a high integrity protection system is used for a single wellhead subsystem. In additional embodiments of the system and the process of the present invention, a high integrity protection system is used for a plurality of wellhead subsystems.

The main stages of conducting a safety test in an associated high integrity protection system I I A single well that has an ESP includes: (1) close the SSV, (2) decrease the ESP with the VSC, (3) open the SSV and (4) increase the ESP to normal working speed. During the testing of the final elements, the process sensors transmit pressure data in the flow line to the safety logic solver.

The main steps of conducting a safety test in a high integrity protection system associated with a plurality of wells each having an ESP and being controlled by SLS include: (1) changing the position of ZV in the head of production from a fully open position to a partially closed position, (2) monitoring the differential pressure along the ZV until the pressure sensors upstream of the production head and at least one of the pressure sensors downstream of the head of the head. production reach a predetermined value, (3) stop the ZV ide course, since ZV is in a partially closed position, i that is, not completely closed, (4) canceling the test when a maximum ZV travel limit is reached by default if the differential pressure along ZV was not detected, (5) monitoring the pressure sensors upstream of the head of production to determine the pressure increase in the production head (ie, the high pressure trunk line upstream of ZV) with all ESPs operating at normal speed and ZV in a partially closed position, (6) measuring and recording the normal working speed of all ESPs, i (7) decrease the ESP speed for each well by Associated VSC in a predetermined amount, (8) measure and record the ESP speed for each well, (9) determine if the ESP test speed is less than the normal ESP speed and if any of the ESPs did not respond to the initial indication of SLS speed reduction (step (7)), cancel the test and indicate in an SLS control panel the identity of the ESPs that did not respond, (10) decrease the ESP speed of each well in one additional amount predetermined that the pressure sensors upstream of the production head measure a decrease in pressure in the production head, (11) check the amount of gradual reductions in ESP speed in relation to a minimum speed limit of ESP test previously established and cancel the test and indicate a fault in the control panel if the ESP speed was reduced to the value of the ESP minimum test speed limit and the current pressure sensors above the production head did not detect pressure decrease, (12) change the I ZV from the partially closed "test" position to the fully open position and maintain the speed of ESP in the I test value and indicate a ZV fault in the control panel if ZV does not begin to vary from the partial travel test position within a certain period of time, (13) returning all the ESPs to the normal working speed in case the ZV starts the travel to the fully open position, (14) ) verify that all ESPs are back to normal working speed, as recorded in SLS in stage (6), and indicate an alarm if any of the ESPs did not return to normal working speed and (15) verify that ZV returned to the fully open position and indicate a ZV failure if ZV did not move during a predetermined time period or if ZV did not reach the fully open position. During the test of the final elements, the pressure sensors upstream of ZV transmit data indicative of the pressure in the trunk line to the SLS. The pressure sensors provide updated data of the process pressure substantially continuously to the SLS both during the test functions and during normal operation, for example, it provides updated data with each scan of the SLS, typically 100 mS.

In the system described herein, the pressure sensors and SLS are commercially available as devices certified by several distributors, for example, certified by TÜV Rheinland Group (Cologne, Germany) and / or TÜV SÜD Group (Munich, Germany). The VSC of the EPS and! The ZV, which include the valve, actuator and controller assembly, are not currently available as third-party certified safety devices. Therefore, the functional test is of critical importance for the safety of the operation of the wellhead subsystem, the production head, the production trunk line, and the downstream trunk line (ie, that rated at a pressure less than the maximum closing pressure).

The system and process of the present invention provides a functional test of the "in-line" system that can be carried out without interrupting production. Generally the interruption of the production for the functional test of the system is not acceptable when multiple wells with ESP contribute to a common production head and a single HIPS is used to I Protect the downstream pipe. The system and process of the present invention allows the on-line test to be carried out frequently, for example, on a monthly, bi-monthly or quarterly basis, by means of the partial travel of ZV, reduction of the ESP speed and verification of the measurement of the Pressure sensors between "complete" functional tests performed during planned tests and maintenance when production is stopped. Complete functional tests (performed with production interruption) include complete ZV closure, total ESP shutdown, and shutdown of the conventional wellhead shutdown system with additional closures of; SSV and SSSV in each well. Therefore, both the online trial and the full functional trial combine to provide the system performance verification necessary to achieve a desired risk reduction goal.

In additional embodiments of the system and method of the present invention, a security protocol known as "FF-SIF" is used. The FF-SIF standards provide the individual devices for self-diagnosis and data communication of the devices that monitor and control the process. While the adoption and application of this new security communication standard of the present invention is comprised in the skills of a person skilled in the art, the details of its implementation go beyond the scope of the present invention.

The system and method of the present invention features a self-test high integrity protection system to protect the wellhead flow lines with ESP by the use of redundant pressure sensors, a safety logic solver and various end elements. The final elements include a ZV and an ESP variable speed controller associated with each producing well. These final elements use different technology to protect the flow line piping classified as less against overpressure. In embodiments where a high integrity protection system is used to protect a trunk against potential overpressure caused by wells with multiple ESPs, an S, LS is used in combination with a plurality of redundant pressure sensors (for example, three ) located downstream of the production head and upstream of ZV. The pressure sensors are included in the production head and the full pressure trunk line. The implementation of the systems and methods of the present invention provides a security system that will comply with security and operability requirements given that devices that are not subject to standard certification procedures such as certification by TÜV Rheinland Group and / or TÜV SÜD Group are examined in control of the SLS without interrupting production (online testing) in addition to the full functional tests that are carried out during planned testing and maintenance when production is stopped.

In certain embodiments, three pressure sensing transmitters are placed upstream of ZV to detect high and low pressure in the flow line and SLS votes them in a two-thirds protocol. When using this system, a failure of one of the pressure sensors or a failure to detect internal faults will result in the signal being discarded from that sensor; the process will continue online and the remaining two sensors will continue to protect the system. The SLS is also programmed to recognize the defect or failure of a single sensor and alert the maintenance personnel by means of a suitable indicator, for example, an audible and / or visible alarm, text message to the personnel in functions and other procedures of known security. During such a time when a sensor is in known failure mode, the system is converted to a protocol voted one of two.

Regarding FIG. 1, a system 10 is represented I which includes a well cover 12 from which a production line 14 that is constructed from a high pressure pipeline that terminates in the surface safety shutoff valve 20 is installed. A downstream pipeline of SSV 20 is installed. Conventional 16 for a lower pressure compared to the maximum closing pressure of the wellhead for transport and distribution of the product.

The end of the production pipe 14 at the bottom of the well is connected to the submersible electric pump 30 which delivers the pressurized stream of gas and / or oil from the reservoir for eventual transport and distribution through the pipe network I of downstream flow line. According to the invention, a i Variable speed controller 40 is operatively connected to downhole pump 30 and also to a safety logic solver (SLS) 60.

In general, and as described in more detail below, the SLS 60 will operate in accordance with a set of diagnostic tests of the previously programmed end elements, while monitoring a plurality of sensors I of flow line pressure. The system and method of the invention provide an end-to-end functional security check of the end elements and of the plurality of sensors. In addition, the same SLS 60 can also be tested during the functional test, in which the ability of the SLS to receive information from the sensors and to order an action to the final elements is verified.

In one embodiment, a method for conducting safety tests and providing protection by emergency isolation of the system using the system 10 includes the step of using a plurality of pressure transmitters 50 to monitor the flow line pressure during normal work and during a full travel test of the safety shut-off valve 20 and adjust the speed of the downhole ESP1 30 during the test to maintain the pipe pressure within predetermined working pressure limits. These wellbore flow line protection systems and methods generally use the ESP well bottom VSC 40 and an SSV 20 to ensure that hazardous pressure levels are not reached in the downstream pipeline. complete functional safety test of the wellhead subsystem. The ESP VSC 40 is used to allow functional testing and eliminate the pressure source from the protected downstream flow line.

A plurality of pressure transmitting sensors 50 are installed in the high pressure flow line 1 and 4 and is in data communication with safety logic solver 60. In the illustrated embodiment, three pressure sensors are installed. , 54, 56 (also identified as ??,: Pt2 and PT3). Additionally, a fourth pressure sensor 70 (PT4) is installed downstream of the safety shut-off valve in the low pressure flow line 16 and in data communication with SLS 60. It should be noted that although a plurality of Pressure sensors in the high pressure flow line 14 as a preferred embodiment, it is contemplated that certain embodiments may operate with a pressure sensor. One or more pressure sensors can be provided as backrests to suit improved safety.

A valve actuator 22 is installed in the valve 20 and is in controlled communication with SLS 60. In this embodiment, the valve actuator is also equipped with a limit switch 24 for indicating the completely open and fully closed positions of the valve. SSV, which communicate to the SLS 60.

The previously programmed SLS 60s include a local shutdown switch 62, which conveniently is a pushbutton, to initiate safety shutdown when an emergency condition occurs. Pressing the button 62 will cause the actuator 22 to close the SSV 20 and stop providing power to each ESP 30 to immediately reduce the pressure in the flow line 14.

A local functional test button 64 is provided to initiate the functional and safety tests for the system in the field. It is also possible to automatically start functional tests of the system by using the programmed SLS 60 or remotely from a central control room.

A local failure indicator 66 is also illustrated which, in certain embodiments, includes a soft and audible alarm. The alarm can also be transmitted through wired circuits or wirelessly to a remote control room to determine if additional actions are necessary to continue the safe operation of the system.

During normal functions, pressure transmitters 52, 54 and 56 monitor the pressure of the flow line for unusual variations that may require a safety response; The pressure transmitter 70 that is downstream of SSV is a non-safety related transmitter that is used to monitor the pressure of the flow line during SSV tests.

It will be understood that the SLS 60 includes a pre-programmed functional test protocol without it being necessary for the personnel to be involved in the stage-to-stage modality of the test. The programmed safety test includes measured intervals of predetermined duration and the immediate start of one of the predetermined alternative actions in case the specific conditions are not met within the timed interval. As will be understood by a person skilled in the art, the modality of such tests by personnel using visual observation methods and procedures controlled by the personnel stage by stage, chronometers and others, does not compare with the punctuality and precision of a programmed protocol. . The functional tests can be initiated remotely from a control room, automatically by the predetermined periodic start of the test, for example, once a month at a specific time and date according to a program installed in the safety logic solver , or by personnel of the field that uses the button 64.

The SLS 60 includes as a protocol a previously programmed set of diagnostic tests of the final elements that are carried out while monitoring the pressure sensors of the flow line. The system and method of the invention provide an endpoint functional security check of the complete system, which includes the end elements, a logical solver and a plurality of sensors.

After the start of the functional test at the wellhead site, for example, manually with a pushbutton or other switch, or electronically from a remote location, the actuator 22 receives a signal to initiate the closing of the valve. The SLS 60 starts a full SSV 20 course from the open position to the closed position. The indicator 24 transmits a signal when the valve is moved from the fully open position.

While SSV 20 travels from the open position to the closed position, the SLS 60 collects and archives the response data of the valve (position as a function of time). These data, known as the valve signature, can be used to diagnose changes in valve performance that may indicate reduced performance and potential failure. If the valve does not move or an excessive delay is indicated, the SLS 60 initiates an alarm and announces itself locally, for example, using a local fault indicator 66 to indicate that the system failed the functional test.

When the SSV 20 reaches the closed position as checked, for example, by the integral limit switch of the actuator 22, the pressure sensors 50 will indicate an increase in pressure because ESP 30 operates against the closed valve 22. In addition, the pressure is monitored by a pressure sensor 70 upstream of the closed valve 20 in search of an increase in the differential pressure (for example, between the pressure sensors 52, 54, 56 and the pressure sensor 70) for verify that the valve seat and the position of the valve stem are appropriate.

Once the "closed valve" limit is reached, the SLS 60 starts a predetermined test period during which the increase in pressure is monitored. The signals from the pressure transmitters 52, 54, 56 are monitored to detect a pressure increase. When the default value or pressure increase is detected, the SLS 60 will send a command to the i ESP 40 speed controller to reduce the speed of ESP 30.

If no increase in pressure is detected, the test is canceled and a "test failure" alarm is initiated. In this test protocol it is not necessary to verify a "complete closure" of SSV. However, the ability to completely close and develop an increase in pressure in the upstream pipe resulting in differential pressure along the valve is a sufficient functional test for the safety application of the present invention.

Once SSV 20 is completely closed and the pressure increase of the flow line is detected successfully, the SLS 60 sends a command signal to the variable speed controller of ESP 40 to decrease the speed of ESP 30. Starting with the output of the SLS 60 to the ESP speed controllers 40, a predetermined period of time is provided for detecting an increase in the pressure in the line 14 based on the data received from the pressure transmitters 52, 54 and 56. If not an increase in pressure is detected during that period of time, the SLS 60 will open the SSV 20 and initiate a "failed test" alarm. If a decrease in pressure is detected, the ESP variable speed controller 40 will be deemed to pass the functional test, including verification of the fact that the ESP variable speed controller 40 responds appropriately to the SLS 60 commands. Therefore, the test method includes the ability to decrease I the speed of the pump, detect the downstream pressure of closed SSV 20 and make the pump speed return to normal.

After detection of the pressure drop, the SLS 60 will transmit a signal to open the SSV 20 again. A predetermined time period is provided for the valve to initiate movement from the limit closed position of the switch. If the valve does not move before the end of the time period, the SLS 60 will completely close the ESP 30. If the valve 20 does not fully return to the fully opened position, a fault alarm will be initiated, but it will be returned ESP 30 at the normal default working speed and the SLS 60 will continue to monitor the flow line pressure.

When the SLS 60 receives a signal from the limit switch of the actuator 22 indicating that the SSV 20 has been moved from the closed position to the open position, a signal is transmitted to the variable speed controller 40 to increase the speed of ESP. 30 to provide the normal working pressure of the flow line as verified by the pressure transmitter 70.

Therefore, if the SLS 60 protocol is used, all the components that make up the instrumented safety system (SIS) are evaluated, which include the pressure sensors on the input side, the safety logic solver and the various outputs, for example, the surface safety shut-off valve and the ESP variable speed controller.

In certain embodiments of the systems and processes of the present invention, it is not necessary to measure the performance characteristics of the pump 30, for example, efficiency, flow rate and the like. Preferably, it is the general response of the pump 30 to the programmed signals transmitted from the SLS 60 that are determinants of the condition of the security system. The flow line pressure is detected with safety transmitters essential for safety 50 upstream of SSV 20. Signals from pressure sensors 50 are transmitted to SLS 60 to determine if pump 30 responds within acceptable limits to the SLS 60 command signals.

In case a safety demand signal is generated during the total SSV run test; or the I pump speed variation test, the emergency shutdown disconnect signal will override the test sequence protocol and will completely stop each pump 30 and will bring the SSV 20 to the fully closed position.

It will be understood that the fault indicator 60 will provide an alarm and record the fault with the time it occurred in the memory of the safety logic solver in case the i limit switch 24 does not register a fully open condition or completely closed of the safety shut-off valve 20. Faults will also be recorded and alarm will be given in the event that 52, 54 and 56 do not detect pressure increases when the SSV 20 moves to the closed position or if no increase in pressure is detected. pressure after signal was given to the variable speed controller 40 to decrease the speed of the pump. Other diagnostics include delays in the travel of the valve from open or closed positions that exceed the predefined time limit.

In case the SLS 60 receives an emergency shutdown signal, for example, as a result of the disconnection of the actuator 62, for example, personnel at the site activated the pushbutton, or from a transmission through wiring or in the form If the wireless signal of an emergency shutdown signal is not present, the safety and fault test is immediately canceled and the SLS 60 sends a signal to switch off the ESP 30 and close the emergency isolation valve 20. In certain modes, the variable speed device 40 in the emergency shutdown program so that the speed of ESP 30 is decreased before the power is interrupted. This reduces the potential for any adverse impact on the pump 30 that can occur simply by cutting off the power.

Regarding FIG. 2, a system 100 includes a plurality of wellhead subsystems 102 and 102 'that í they are usually connected to a common trunk line to transport the oil / gas to a gas and oil separation plant (GOSP) 104. The wellhead subsystems 102 i each include a HIPS 106 associated with them, for example, which includes an SLS, pressure transmitters and an SSV as shown in FIG: 1. As described with respect to FIG. 1, high-pressure pipes are used between the well and SSV of HIPS 106, and conventional pipes downstream of HPS 106 SSV are used, for a lower pressure and suitable for the transport and distribution of the product. In certain systems 100, additional wellhead subsystems 102 'that do not exhibit an associated HIPS 106 are provided, although other protection and / or safety systems may be used for these wellheads as is comprised in the skills of an operator. skilled in the art.

Regarding FIG. 3, a high integrity protection system 206 is represented for association with a plurality of wellhead subsystems 202. The plurality of wellhead subsystems 202 is connected to a common header 208 that functions as a transition between the wells. for the combined production head in which HIPS 206 and ZV 220 are located. The wellhead subsystem 202 includes, as shown in conjunction with FIG. 1, a well cover (not shown) from which a production pipe 214a, 214b is built, which is constructed from high pressure pipe which ends in an emergency safety shutdown valve (ZV) 220, in that the pipe 214a is the production pipe upstream of the common header 208 and the pipe 214b is the production pipe downstream of the common header 208. Generally, HIPS 206 includes ZV 220, an SLS 260, a plurality of current sensors 250 above ZV | i 220 and a pressure sensor 270 downstream of ZV 220. It should be noted that although a plurality of pressure sensors upstream of ZV 220 are shown, ie, in the high pressure pipe, as a preferred embodiment, it is contemplated that certain modalities can work with a pressure sensor. One more Jo pressure sensors can be provided as backups to suit improved safety. [ As shown, the common header 208 is upstream of HIPS 206. It is installed downstream! of ZV i 220 a conventional pipe 216 for a lower pressure compared to the maximum blocked discharge pressure of the upper part of ESP for the transport and distribution of the product.

An SSV 272 is included in the line of the production line as high pressure 214a of each individual well and, optionally, a shut-off valve can be provided. i subsurface security (SSSV) 280. Each SSV 272 and SS! SV 280 communicate individually with SLS 260 through a wellhead shutdown interface 290 to reduce the impact should a line break occur. downstream flow. A pressure sensor 292 is also provided to indicate the pressure within each individual well production line. Normally this sensor is used in the wellhead shutdown system to initiate the shutdown of SSV and SSSV from the individual well when necessary without impacting the production of other wells that share an enclosure of the shutoff system of the manhole. common well. The end of the production pipe 214a from the bottom of the well is fluidly communicated with ESP 230 that delivers the pressurized stream of gas and / or oil from the reservoir for eventual transport and distribution through the network of downstream flow lines . According to the invention, a variable speed controller (VSC) 240 is operatively connected to ESP 230 from the bottom of the well and also to SLS 260.

Generally, and as described in more detail below, a set of pre-programmed diagnostic tests of the final elements of the pluralhole wellbore subsystems 202 controlled by SLS 260 is carried out while monitoring a plurality of sensors of the same. flow line pressure. The system and method of the invention provide a functional safety check of the final elements and the plurality of sensors. In addition, the same SLS 260 can also be tested during the functional test, in which the ability of the SLS to receive information from the sensors and to order an action to the final elements is verified.

In one embodiment, a method for developing safety tests and providing emergency isolation protection of the system by system 206 includes a step of using a plurality of pressure transmitters to monitor the collective pressure of flow line during normal operation and during a partial run test of ZV 220. In addition, the downhole ESP 230 speed is adjusted during the test to maintain the pipe pressure within the predetermined working pressure and safety limits. That wellhead flow line protection system and method typically utilizes the downhole ESP speed controller 240 associated with each wellhead subsystem 202 and ZV 220 to ensure that dangerous pressure levels are not reached and provides online functional safety testing using the HIPS installed to protect the downstream pipe against dangerous overpressure. The ESP drive speed control 240 associated with each wellhead subsystem 202 is used to allow functional testing and eliminate the pressure source of the protected downstream flow line.

A plurality of pressure transmitting sensors 250 are installed in the high pressure flow line pipe 214 and are in data communication with the safety logic solver 260. In the illustrated embodiment, three pressure sensors 252, 254 are installed. , 256 (also identified as PT1, PT2 and PT3). In addition, a fourth pressure sensor 270 (PT4) downstream of ZV 220 is installed in the low pressure flow line 216 and in data communication with SLS 260.

A valve actuator 222 is installed in the valve 220 and is in controlled communication with SLS 260. In certain embodiments, the valve actuator 222 is equipped with a limit switch 224 to indicate the fully open or fully closed position of the valve actuator 222. ZV, which is communicated to the SLS 260. In further embodiments, the valve actuator 222 is equipped with an intelligent valve controller and a limit switch 224 to indicate the fully open or fully closed position of ZV, control the travel of the ZV valve during the tests and characterize the performance of the valve during the on-line tests, all of which is communicated to the SLS 260. As described herein in certain embodiments, the ZV uses an intelligent electronic valve controller for provide characterization improvements of the valve path required for the partial-travel test l. The communication between SLS and the transmitters of the sensors of the process of pressure, the controllers of ESP and ZV can be wired or wireless.

In addition, a valve actuator 274 and a limit switch 276 are also installed in valve 272, and are in controlled communication with SLS 260, for example, through the wellhead shutdown interface 290. i Similarly, a valve actuator 282 and a limit switch 284 are installed in the optional valve 280, and are in controlled communication with SLS 260, for example, through the wellhead shutdown interface 290. During a safety demand initiated by SLS 260 based on data from pressure sensors 252, 254, 256 or through a panel off button, the SLS 260 closes the ZV 22¡0, carries the ESP 230 at speed of full stop and initiates a shutdown of the wellhead shutdown system. In turn, the wellhead shutdown system then closes all SSV and SSSV.

The previously programmed SLS 260s include a local shutdown switch 262, which may be a pushbutton to initiate safety shutdown when an emergency condition occurs. Pressing the button 262 will cause the actuator 222 to close to the ZV 220 and stop providing power to each ESP 230 to immediately reduce the pressure in the flow line 214.

A test pushbutton switch is provided local functional 264 to initiate the functional and safety tests for the HIPS system in the field. You can also automatically start functional tests of the HIPS system by using SLS 260 programmed or remotely from a central control room. It should be noted that functional tests of a conventional wellbore shutdown system are not included within the scope of the present invention.

I A local failure indicator 266 is also illustrated which, in certain embodiments, includes a soft and audible alarm. The alarm can also be transmitted through wired circuits or wirelessly to a remote control room to determine if additional actions are necessary to continue the safe operation of the system. As described herein, certain specific fault indicators may also be provided that may replace or supplement the local fault indicator 266. The alarms of any fault indicator described herein may also be transmitted through wired circuits or I wirelessly to a remote control room; to determine if additional actions are necessary to continue the safe operation of the associated components.

During normal operation, pressure transmitters 252, 254 and 256 monitor the pressure of the flow line for unusual variations that may require a safety response; The pressure transmitter 270 that is downstream of ZV is a non-safety related transmitter that is used to monitor the flow line pressure during the ZV 220 tests. The percentage of i closure of ZV 220 is generally based in the measured differential pressure measured between the pressure transmitter 270 and the pressure transmitters 252, 254 and 256. The partial travel of ZV 220 prevents the ZV 220 from closing completely and production to be interrupted.

It will be understood that the SLS 260 includes a pre-programmed functional test protocol that makes it unnecessary for personnel to be involved in the stage-to-stage modality of the test. The scheduled safety test includes measured intervals of predetermined length and the immediate start of one of the predetermined alternative actions in case the specific conditions within the timed interval are not met. As will be understood by a person skilled in the art, the performance of such tests by personnel using visual observation methods and procedures controlled by stage-by-stage personnel, chronometers and so forth are not compared with the timeliness and precision of a scheduled protocol. The functional tests can be initiated remotely from a control room, automatically by the predetermined periodic start of the test, for example, once a month at a specific time and date according to a program installed in I the safety logic solver, or by personnel of the field using the button 264.! The SLS 260 includes as a protocol a group of previously programmed diagnostic tests that are carried out in line with all the final elements used for the protection of the flow line that includes all the ESP 230 and the associated VSC 240, and the ZV 220 in the production head. The system and i The method of the invention provides a comprehensive functional safety check of the complete system, which includes the? ß? 230 with each wellhead subsystem 202, the ZV 220 in the common production head, a plurality of sensors 252, 254 and 256 upstream of ZV 220 and sensor 270 downstream of ZV 220. In addition, the same SLS 260 as well; can i checked during the functional test, in which the ability of the SLS to receive information from the sensors is verified and for j order actions to the final elements.

After the start of the functional test at the wellhead site, for example, manually with a button! or another switch, or electronically from a place oto, the actuator 222 receives a signal to initiate the ci of the valve 220. The SLS 260 starts a controlled partial stroke of ZV 220 from the open position to a test position. The i Test position is verified by the differential pressure measured along ZV 220. A signal is transmitted by switch 224 as soon as the valve is moved from the fully open position.

While ZV 220 travels from the open position to the test position, the SLS 260 collects and stores the response data of the valve (position versus time). These; Data, known as the valve signature, can be used to diagnose changes in valve performance that may indicate reduced performance and potential failure. If the valve does not move or an excessive delay is indicated, the SLS 260 initiates an alarm and announces itself locally, for example, using a local fault indicator 266 and the ZV fault indicator light to indicate that the system failed the test functional.

When the ZV 220 approaches the test position as verified by the development of the differential pressure measured within the SLS 260, for example, by the difference in pressure measured between the pressure sensors 250 and the pressure sensor 270 , the pressure sensors 250 will indicate an increase in pressure in the production head since each ESP 230 is now operating against ZV 220 partially closed. In addition, the pressure is monitored using a pressure sensor 270 downstream of the partially closed valve 220 in search of an increase in differential pressure along ZV 220 to verify that the valve seat and the position of the valve stem be appropriate Once the "end" stroke valve is reached, the SLS 260 starts a predetermined test period during which the pressure increase is monitored. The signals from the pressure transmitters 252, 254, 256 are monitored to detect an increase in pressure. ' When the default value or pressure increase is detected, the SLS 260 will send a command to the VSC 240 to reduce the ESP 230 speed within each well. Note that the normal operating pressure of each ESP 230 within the SLS 260 before starting the ESP speed reduction sequence. Once the first gradual ESP speed reduction command is given, a verification signal is transmitted indicating that each ESP VSC of well 230 responded. In the event that any ESP VSC in well 230 does not respond, the test is canceled and the well ESP is identified as one of the fault indicators 231 included in the SLS 260 panel. If no decrease in pressure is detected in the the production head, the test is canceled and the "test failure" alarm begins to sound. In this test protocol it is not necessary to verify a "complete closure" of ZV. However, the ability to act in the process and develop an increase in pressure in the upstream pipe is a sufficient functional test for the application of the safety of the present invention.

Once ZV 220 reaches the "test" position, and the pressure increase of the flow line is: detected successfully, the SLS 260 sends a command signal to each of the ESP 240 variable speed controllers for decrease the speed of ESP 230. In certain modalities, this command signal is sent at the same time and specifies the same decrease rate of increase for each VSC 240. Each response of the VSC 240 is verified by increasing the initial decrease of the SLS. 260 before continuing to reduce the speed of ESP 230. Starting with the output of the SLS 260 to the ESP 240 VSCs, the gradual speed reductions are performed for a predetermined period of time to detect a decrease in the pressure on line 214 based on in the data received from the pressure transmitters 252, 254 and 256. If a decrease in pressure is not detected during the allotted time or when the minimum speed limit of ESP is reached, the SLS 260 will carry VSC 240 at normal working speed, open ZV 220 and initiate a "test failure" alarm. By using diagnostic protocols for each VSC 240 and fault indicators mounted on panel 231, a field technician can determine which VSC 240 did not respond during a failed system test and take corrective action.

If a decrease in pressure that reaches or exceeds the predefined target is detected, the VSC 240 will be considered to have passed the functional test, which includes verification of the fact that the VSC 240 responds appropriately to the SLS 260 commands. , the test method includes the ability to decrease the pump speed, detect the downstream pressure drop of ZV 220 partially closed and cause the pump speed to return to normal for each ESP 230.

After verification of a pressure drop in the production head in excess of the predefined target, the SLS 260 will transmit a signal to make the partially closed ZV 220 return to the fully open position, j It is given a predetermined period of time to ZV 220 to initiate movement from the partially closed test position. If ZV 220 does not move before the time period elapses, the SLS 260 will issue a fault alarm, for example, through a fault indicator ZV 221, and all ESP 230 will remain at the reduced test speed.

When SLS 260 receives a signal from the limit switch 222 and / or the intelligent ZV valve controller indicating that ZV 220 has moved from the partially closed test position to the open position, a signal is transmitted to the variable speed controllers 240 to increase the speed of ESP 230 to provide the desired normal working pressure i of the flow line as verified by the pressure transmitter 270. All VSC 240s are inspected for Verify that each controller returned to the normal working speed recorded at the beginning of the test sequence.

Therefore, when using the SLS 260 protocol, all the components that make up the safety instrumented system (SIS) are checked, which includes the pressure sensors and the various outputs, for example, ZV 220 and the VSC 240. In addition, the same SLS 260 can also be tested during the functional test, in which the ability of the SLS to receive information from the sensors and to order actions to the final elements is verified.

In certain embodiments of the systems and processes of the present invention, it is not necessary to measure the performance characteristics of ESP 230, for example, efficiency, flow rate and the like. Rather, it is the general response of ESP 230 to the programmed signals transmitted from the SLS 260, for example, pressure detected within the production head, which are determinants of the condition of the safety system. The individual velocity response of the ESP VSC is preferably used only as a "safety-related" diagnostic parameter within the online functional test sequence. The pressure of the flow line is detected with "safety essential" pressure transmitters 250 upstream of ZV 220. The signals from the pressure sensors 250 are transmitted to the SLS 260 to determine if the pumps 230 are responding within the acceptable limits to the SLS 260 command signals.

In case a demand signal is generated from I safety during the ZV partial travel test or the pump speed variation test, the emergency shutdown switch-off signal will override the test sequence protocol and stop each pump 230 completely and bring ZV 220 to the completely open position.

It will be understood that the fault indicators in the local control panel will give an alarm and record a fault with the time it occurred in the memory of the safety logic solver in the event that the associated device does not function correctly during the sequence of functional test. The diagnosed and displayed faults will include the individual well ESP VSC (not responding to SLS demands), lack of pressure increase detected by 252, 254 and 256 while ZV 220 moves to the "test" position or lack of pressure decrease detected after it has been indicated to each of the VSD 240 that the deceleration of the pump speed. Other diagnostics include delays in the valve travel from open or partially closed test positions that exceed the predefined time limit.

In the event that the SLS 260 receives an emergency shutdown signal, for example, as a result of on-site personnel disconnecting the pushbutton 262, or from a transmission via wiring or wirelessly a power-off signal In the event of an emergency, the safety test is immediately canceled and the SLS 260 sends a signal to reduce the speed of each ESP 230 until it is completely stopped and to completely close the ZV 220. In certain modes, a shutdown switch is provided. ESP emergency to cut the power to ESP 230.

In additional modes, the ESP 240 frequency inverters are included in the emergency shutdown program so that the speed of each ESP 230 is reduced to the point of stopping them completely instead of cutting off the power to the ESP and the VSC . This reduces the potential for any adverse impact on the pumps 230 that can occur by simply cutting off the power.

In addition, during an emergency shutdown situation, the safety logic solver 260 provides an output to the conventional wellhead shutdown system that provides positive isolation of the individual well through the valve actuator 274 of the SSV and the SSSV actuator 282 installed. at each wellhead.

The SLS 260 is also programmed to recognize the defect or failure of the single sensor 252, 254, 256 or 270 and alert the maintenance personnel through one of the pressure sensor indicators 251 or a pressure sensor indicator 271, for example. example, an audible and / or visible alarm, text message to the personnel in functions or other known security procedures. During such a time when a sensor is in a known failure mode, the system passes to a voted one of two prbtocolo.

In addition, the SLS 260 is programmed to receive and record data on predetermined performance characteristics of one or more of the selected components of ZV, pressure sensors, each ESP and each VSC during the functional safety test. The SLS 260 compares the performance characteristics of one or more components with existing standards. The comparative data can be displayed and / or transmitted to a! central control room.

Regarding FIG. 4, a system 200 includes a plurality of wellhead subsystems 202, 102 and 102 'which are normally connected to a trunk line: common for transporting the oil / gas to a gas and oil separation plant (GOSP) 104 The wellhead subsystems 202 are connected to a common header 208, for example, as described with reference to FIG. 3. The high integrity protection system 206, which includes an SLS, pressure transmitters and ZV, is positioned downstream of the common header 208.

As described with respect to FIG. 3, high-pressure piping between the wells and ZV of HIPS 206 is used, and conventional piping downstream of ZV of the HIPS 206, which are rated for a pressure less than the pressure i Maximum blocked maximum ESP and are suitable for transport and distribution of the product.

In addition, wellhead subsystems 102 can also be provided where each includes associated therewith a HIPS 106, for example, which includes an SLS, pressure transmitters and an SSV as shown in FIG. 1. In certain systems 200, additional downhole subsystems 102 'are provided that do not show an associated HIPS 106, although other protection and / or safety systems may be used for these wells as contemplated by the ability of a skilled in the art.

The various protocols and pre-programmed sets I of diagnostic tests carried out by the security logic solvers described herein may be implemented as modules in a programmed computer medium. An example block diagram of a computer system 300 by which the modules of the present invention can be implemented is shown in FIG. 5. The computer system 300 includes a processor 302, such as a central processing unit, an input / output interface 304 and a support circuit 306. In certain embodiments, where the computer 300 requires a direct human interface, it is also they provide a screen 308 and an input device 310 such as a keyboard, mouse or pointer. The screen 308, input device 310, processor 302 and isolate circuit 306 are shown connected to a bus 312 which also connects to the memory 314. Memory 314 includes the storage memory of the program 316 and the data storage memory 318. Note that while computer 300 is described with a direct human interface component screen 308 and input device 310, module programming and data export can alternatively be achieved on interface 304, for example, where the computer 300 is connected to a network and the programming and display operations occur in another associated computer, or through a removable input device as is known with respect to connected programmable logic controllers.

The storage memory of the program 316 and the data storage memory 318 may each comprise both volatile (RAM) and non-volatile (ROM) memory units and may also comprise hard disk and backup storage capacity, and memory program storage 316 and data storage memory 318 may be incorporated into a single memory device or may be separated into various memory devices. The storage memory of the program 316 stores modules for carrying out the protocols and diagnostic test groups described herein. The data storage memory 318 stores, for example, data generated during the functional tests such as valve signature data and fault data with the information of the moment in which they occurred generated by one or more modules of the present invention. .

It should be appreciated that the computer system 300, can be any computer such as a personal computer, minicomputer, workstation, central computer, a dedicated controller such as a programmable logic controller or a combination thereof. While the computer system 300 is shown for illustrative purposes as a single computer unit, the system can comprise a group / farm of servers that can be weighted depending on the processing load and size of the database.

The computer device 300 normally supports an operating system, for example stored in the storage memory of the program 316 and executed by the processor 302 from volatile memory. According to one embodiment of the invention, the operating system interacts with one or more modules containing instructions for interacting the device 300 with the pressure sensors, the emergency isolation valve or the safety shut-off valve (SSV), and final elements.

In the systems and processes of the present invention, it is not necessary to measure the performance characteristics of the pump, for example, efficiency, flow rate and the like. Rather, it is the general response of the pump to the programmed signals transmitted from the safety logic solver that are determinants of the condition of the safety system. The The individual velocity response of the ESP VSC is used only as a "safety-related" diagnostic parameter within the functional test sequence. The pressure of the flow line is detected with pressure transmitters essential for safety, either upstream of SSV in systems in which a high integrity protection system is associated with a single well that has an ESP, or current is detected above ZV in the production head in a high integrity integrity protection system that is associated with a plurality of wells each having an ESP. The signals from the sensors are transmitted I pressure to the safety logic solver to determine if the pump or pumps are responding within acceptable limits to the command signals of the safety logic solver.

It will be understood from the previous description that the system verifies the operation of the sensors to detect changes in the pressure of the flow line, the logical solver monitors those signals, the ESP variable speed controller; reduces the speed of the pump, and the SSV or ZV isolates the oil / gas flow from the downstream flow line network. In the system of the invention, one embodiment of the ZV actuator is a fail-safe electrical device with an opposing spring. The operation of the safety logic solver is verified by the proper operation of the final elements and by monitoring the pressure changes through the i dedicated sensors.

If a fault is detected with the valve, the pump speed controller or the sensors, the personnel is alerted so that they can take the appropriate measures to perform the required maintenance without causing an adverse impact on safety or operations. In the application of wells with multiple ESPs, the VSC observations of the individual ESP wells provide verification that each ESP VSC responded during the online functional test. Most importantly, the invention provides a safety instrument (SIS) system for a HIPS that can be fully tested online without interrupting oil / gas production through the flow line during the protocol. and that they can respond immediately to close the ESP and SSV or the ZV if necessary.

In certain embodiments, the inventive system created and tested in a factory, and may be mounted on a base with flange connections at the inlet and outlet of the pipeline system for flow to facilitate modular installation in the field. The consistent use of the same design also has the advantage of reducing the load on the operations and on the maintenance personnel as regards carrying out the safety tests of the routine system throughout the life of the modular units installed.

The present invention therefore provides a high-integrity wellbore protection system that protects flow lines connected to a wellhead: against overpressure in the event of closure of a downstream blocking valve. In the system of the present invention, the source of pressure is the downhole submersible electric pump, or ESP, which is used when the pressure of the top (surface) of a well decreases to a point where the well no longer "free flowing" or top pressures are not adequate to transport the oil / gas to the gas and oil separation plant (GOSP) located away from the location of the production wellhead.

The method and system of the present invention have been I described above and in the appended figures; however, the modifications will be apparent to the person skilled in the art and the scope of protection for the invention will be defined by the claims below.

Claims (16)

CLAIMS 1 An automated system for conducting safety tests on an instrumented trunk line protection system connected to a plurality of wellhead flow line pipes used for the distribution of a gas and / or oil flow stream, at least A wellhead flow line pipe of the plurality of wellhead flow line pipes is pressurized by a downhole submersible electric pump (ESP), the system comprising: to. a common head for the plurality of flow line tubers at the wellhead; b. an emergency isolation valve (ZV) located on a trunk line downstream of the common head; c. a logical safety solver (SLS) previously programmed to carry out a safety test protocol and record the results in electronic form, and to emit the emergency shutdown signals; d. at least one pressure sensor for measuring the internal trunk line pressure in the common head upstream of ZV and at least one pressure sensor for measuring the internal trunk pressure downstream of ZV; and. a valve actuator to partially close the ZV in response to a test start signal and to close the ZV in response to an emergency shutdown signal transmitted by the SLS, and to open the ZV in response to a signal transmitted by the SLS; Y
1. F. a variable speed drive controller operatively connected to each ESP and the SLS to vary the ESP speed according to the SLS speed reduction / increase commands, so that the fluid pressure in the flow line varies and provides information on ESP speed during normal operation and during system tests to the SLS.
2. The system of claim 1, further comprising a limit switch of the valve actuator transmitting a signal or an intelligent valve controller operatively connected to the ZV and in communication with it SLS; and an alarm that is triggered if the actuator limit switch or the intelligent valve controller does not emit a signal after a predetermined period of time elapses after the transmission of a signal by the SLS to the ZV to initiate the opening or closing.
3. The system of claim 1, wherein the ZV is provided with a fail-safe actuator operated electrically with a positive opposing spring.
4. The system of claim 1, wherein the variable speed drive controller for each ESP is adapted to reduce the associated ESP speed to a stopping point in response to an emergency shutdown signal by the SLS.
5. The system of claim 1, further comprising an ESP emergency shutdown switch to interrupt the power at each ESP in response to an emergency shutdown signal by the SLS.
6. The system of claim 1, wherein the pipes of the flow lines of the wellhead and the trunk lines up to and including the common head are considered suitable for a maximum operating pressure corresponding to the maximum closed pressure. from wellhead.
7. The system of claim 1, which includes three pressure transmitting sensors operatively connected to the SLS, where the pressure in the common head is determined by voting the values of the sensor signal in a protocol of two out of three.
8. The system of claim 6, which includes an alarm that is activated if the values of the signals of the pressure sensors processed by the SLS vary by more than a predetermined value.
9. The system of claim 1, which includes a means for independently transmitting an emergency shutdown signal to each ESP that takes precedence over any active security test that is in process, in which each ESP is turned off in response to the shutdown signal i emergency.
10. The system of claim 1, wherein the SLS is programmed to output control signals to the ZV and each variable speed controller based on the pressure of the flow line such i how it is transmitted from the transmitters that detects the pressure.
11. The system of claim 2, including means for driving the alarm when no change in pressure is transmitted from the plurality of wellhead flow line pipes by the plurality of sensors within one period of time. predetermined time followed by the transmission of an SLS signal to the ZV to initiate a closing or opening cycle.
12. The system of claim 1, wherein the SLS uses the information of individual variable speed controllers for purposes of indicating the fault diagnosis during the performance of system tests. 13 A method for performing safety and failure tests of an instrumented protection system on a trunk line connected to a plurality of wellhead flow lines that transport gas and / or oil, each pressurized by a submersible electric pump ( ESP) downhole, and the trunk line is equipped with an emergency isolation valve (ZV), the method comprises: to. providing at least one pressure sensor on the trunk line upstream of ZV and at least one pressure sensor on the trunk line downstream of ZV; b. provide a variable speed controller (VSC) for each ESP, to adjust the ESP speed; c. provide a programmed logical safety solver (SLS) that is in controlled communication with the ZV and with each variable speed controller for each ESP, and that receives and records the data transmitted by the pressure sensors; d. initiate a SLS safety and failure test by transmitting a signal to ZV to initiate movement to its partially closed position, based on differential pressure measurements performed along the valve; and. monitor the pressure data received from the pressure sensors;
13. F. transmitting an SLS signal to each VSC to reduce the speed of each ESP in response to a predetermined increase in internal trunk line pressure; g. communicate information about the ESP VSD speed to the SLS once it initiates a predefined gradual speed reduction to identify any individual well ESP VSC that did not respond to the SLS during the tests performed on the system; h. transmit an SLS signal to move the ZV to its fully open position and i. transmit an SLS signal to each VSC to increase ESP speed in response to trunk line pressure data.
14. The method of claim 13, wherein a plurality of pressure sensors upstream of ZV are provided.
15. The method of claim 14, wherein the information of the plurality of pressure sensors upstream of ZV is voted on by the SLS.
16. 16. The method of claim 13, further comprising; receive and record information of predetermined performance characteristics of one or more of the selected components of ZV, pressure sensors, each ESP and each VSC during the safety test, compare the performance characteristics of the respective components with existing standards, and provide a sample of the comparative information and / or transmit the comparative information to a central control room. The method of claim 13, which includes completing the safety and failure test in response to an emergency signal received by the SLS, and transmitting signals simultaneously to move the ZV to its fully closed position and to close each ESP. The method of claim 13, which includes starting 58 a test alarm failed in case the trunk line pressure does not increase after the transmission of the SLS signal to partially close the ZV. The method of claim 13, which includes initiating a test failure alarm if the trunk line pressure does not decrease after the transmission of the SLS signal to reduce the speed of each ESP in step (f) and initiate a failure indicator on the local control panel that identifies any individual ESP VSC that did not respond to the prescribed demands of the safety logic solver during the tests performed on the system. The method of claim 13, which includes transmitting a shutdown signal from the SLS to each ESP if no reduction in trunk line pressure is detected after signal transmission to open the ZV. The method of claim 13, further comprising: provide to ZV a limit switch of the valve actuator that transmits a signal and intelligent valve controller that transmits a fully open, fully closed signal and the position of the valve continues to the SLS; start a time clock in the SLS when a signal is transmitted to close and / or open the ZV e initiate a test failure alarm and ZV failure if the limit switch does not signal movement after moving for a predetermined period of time from the open position or from the partially closed test position. The method of claim 14, which includes monitoring the variance in the pressure data received by the SLS and initiating a fault alarm if the difference in data of one of the pressure sensors exceeds a predetermined value when compared to the of the other pressure sensors upstream of ZV. The system of claim 6, wherein the downhole flow line piping downstream of the automated system is rated for a lower pressure compared to the maximum downhole closing pressure.