Fault-Tolerant Pressure Relief System for Drilling

Abstract

A fault-tolerant system relieves pressure of fluid flow in a drilling system. Redundant pressure relief valves can open to relieve fluid flow from a discharge outlet of a manifold when over pressurization is detected. A hydraulic arrangement operably connected to the redundant relief valves provides hydraulic motive force in redundant hydraulic circuits respectively to the redundant relief valves. The redundant circuits are cross-connected to one another. Pressure transducers distributed in the hydraulic arrangement measures operational pressures of the hydraulic arrangement. Redundant controllers can both control the hydraulic motive force provided in the redundant circuits respectively to the redundant relief valves to open and close the relief valves in response to the pressure level measurement.

Description

BACKGROUND OF THE DISCLOSURE

Flow of formation fluids into a wellbore during drilling operations is called an influx or “kick.” By contrast, a fluid loss occurs when drilling fluid in the wellbore is lost to the formation. Both can have a number of detrimental effects. If a kick cannot be detected and controlled fast enough, it can escalate into an uncontrolled flow of formation fluids to the surface, which is called a “blow-out.” Consequences from a blow-out may vary from operational delays (non-productive time) to more severe damage to equipment.

Hydrostatic pressure is a first conventional barrier for controlling the well from a “kick,” and blow out preventers (BOP) are a second barrier. In addition to these, other equipment and techniques can detect and handle a kick during drilling operations to maintain proper hydrostatic pressure in the well.

For example, kick detection can be achieved by continuously monitoring the return flow (i.e., flow-out) in a closed-loop circulation system and comparing the flow-out to the flow-in to the closed-loop circulation system. Several controlled pressure drilling techniques have been used to drill wellbores with such closed-loop drilling systems. In general, the controlled pressure drilling techniques include managed pressure drilling (MPD), underbalanced drilling (UBD), and air drilling (AD) operations.

In the Managed Pressure Drilling (MPD) technique, for example, the drilling system uses a closed and pressurizable mud-return system, a rotating control device (RCD), and a choke manifold to control the wellbore pressure during drilling. The various MPD techniques used in the industry allow operators to drill successfully in conditions where conventional technology simply will not work by allowing operators to manage the pressure and flow in a controlled fashion during drilling.

As the bit drills through a formation, for example, pores become exposed and opened. As a result, formation fluids (i.e., gas) from an influx or kick can mix with the drilling mud. The drilling system then pumps this gas, drilling mud, and the formation cuttings back to the surface. As the gas rises up the borehole, the gas may expand, and hydrostatic pressure may decrease, meaning more gas from the formation may be able to enter the wellbore. If the hydrostatic pressure is less than the formation pressure, then even more gas can enter the wellbore.

As a primary function, managed pressure drilling attempts to control such kicks or influxes of fluid. This can be achieved using an automated choke response in the closed and pressurized circulating system made possible by the rotating control device. A control system controls the chokes with an automated response by monitoring the flow-in and the flow-out of the well, and software algorithms in the control system seek to maintain a mass flow balance. If a deviation from mass balance is identified, the control system initiates an automated choke response that changes the well's annular pressure profile and thereby changes the wellbore's equivalent mud weight. This automated capability of the control system allows the system to perform dynamic well control or constant bottom hole pressure (CBHP) techniques.

Even though pressure can be controlled during drilling operations using such controlled pressure drilling techniques discussed above, components and processes are needed to relieve overpressure to either protect the formation or to prevent damage to drilling equipment. A typical overpressure configuration uses a pressure relief valve having a control console that detects an overpressure condition and opens the pressure relief valve to relieve the pressure.

For redundancy in a drilling system, the overpressure configuration simply includes a first pressure relief valve having its control console and includes a second, separate pressure relief valve having its own control console. In such an arrangement, limited protection can be achieved even though the configuration has some redundancy. For instance, a fault of one pressure relief valve would negate its use, but the other pressure relief valve with its console could assume overpressure protection. In like manner, a fault of one console would negate use of its pressure relief valve, but the other pressure relief valve with its console could assume overpressure protection. Yet, loss of rig power, loss of rig air supply, loss of sensor inputs, loss of communications, or any other number of faults could negate use of both pressure relief valves and/or consoles so overpressure protection would be lost.

The subject matter of the present disclosure is directed to overcoming, or at least reducing the effects of, one or more of the problems set forth above.

SUMMARY OF THE DISCLOSURE

According to the present disclosure, an assembly is used for relieving pressure of fluid flow in a drilling system in response to a pressure level measurement of the drilling system. The assembly comprises: pressure relief valves, hydraulic circuits, and controllers.

The pressure relief valves are disposed in fluid communication between the fluid flow and at least one discharge outlet. Each of the pressure relief valves is operable to open and close fluid communication of the fluid flow with the at least one discharge outlet. The hydraulic circuits are cross-connected to one another and are operably connected to the pressure relief valves. The hydraulic circuits provide hydraulic motive force respectively to the pressure relief valves.

The controllers are operably connected to the hydraulic circuits. Each of the controllers receives the pressure level measurement of the drilling system. Both of the controllers in a standard condition simultaneously control the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to independently open and close the respective pressure relief valve in response to the pressure level measurement. In response to a first failure condition of either one of the controllers, the other one of the controllers independently controls the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to simultaneously open and close the respective pressure relief valves in response to the pressure level measurement.

In response to a second failure condition of either one of the hydraulic circuits, either one of the pressure relief valves can automatically fault closed regardless of the pressure level measurement.

In one configuration, the assembly can comprise a manifold having the one or more flow inlets and having one or more flow outlets. The one or more flow inlets can be disposed in fluid communication with an upstream portion of the drilling system and can receive the fluid flow therefrom. The one or more flow outlets can be disposed in fluid communication with a downstream portion of the drilling system and can deliver the fluid flow thereto.

In one configuration, the assembly can further comprise sensors communicatively connected to the controllers and providing readings for the pressure level measurement of the drilling system.

In one configuration, the assembly can further comprise a plurality of sensors distributed in the hydraulic circuits and measuring a plurality of operational parameters. Both of the controllers can receive the operational parameters. Either one of the controllers can detect a second failure condition associated with the operational parameters from one of the hydraulic circuits and can automatically fault the respective pressure relief valve closed in response to the second failure.

For this configuration, the hydraulic circuits can comprise pumps connected to a pneumatic supply and pumping the hydraulic motive force. A first of the sensors can comprise a first pressure transducer measuring pressure of the pneumatic supply as one of the operational parameters. The pumps connected to the pneumatic supply can pump the hydraulic motive force to a common hydraulic input for the hydraulic circuits, and a second of the sensors can comprise a second pressure transducer measuring the common hydraulic input as one of the operational parameters. One or more accumulators can be connected to the common hydraulic input. The hydraulic circuits can provide the hydraulic motive force in the event of failure of either one of the pumps.

For this configuration having the sensors, a third of the sensors can comprise a third pressure transducer measuring pressure of the hydraulic motive force to a first the pressure relief valves as one of the operational parameters. Either one of the controllers can detect the measured pressure below a first threshold as the second failure condition and can automatically fault the first pressure relief valve closed in response thereto. Further, a fourth of the sensors can comprise a fourth pressure transducer measuring pressure of the hydraulic motive force to a second the pressure relief valves as one of the operational parameters. Either one of the controllers can detect the measured pressure below a second threshold as the second failure condition and can automatically fault the second pressure relief valve closed in response thereto.

In one configuration, each of the controllers is communicatively connected to a position sensor of each of the pressure relief valves. Either one of the controllers can detect either one of the pressure relief valves failing to open as the second failure condition.

In one configuration, each of the hydraulic circuits can comprise an electrically-driven directional control valve having a default no-flow state and an active flow state. Both of the electrically-driven directional control valves are connected to a common hydraulic input.

In this configuration, each of the controllers can be communicatively connected to the electrically-driven directional control valves of both of the hydraulic circuits to provide a control signal thereto. In the second failure condition, either of the controllers can be configured to automatically fault a respective one of the pressure relief valves closed in response to a failure of the respective electrically-driven directional control valve; and/or the hydraulic motive force can be provided in the open circuit of a first of the hydraulic circuits in the event of a failure of the electrically-driven directional control valve in a second of the hydraulic circuits, where the pressure relief valve of the second hydraulic circuit defaults to a closed condition.

In this configuration comprising electrically-driven directional control valves, each of the hydraulic circuits can comprise a pair of open and close hydraulically-driven directional control valves connected to the common hydraulic input. The open hydraulically-driven directional control valve can have a default closed state and an active opened state. The close hydraulically-driven directional control valve can have a default opened state and an active closed state. The active opened state can provide an open output of the hydraulic motive force to open the respective pressure relief valve. The default opened state can provide a close output of the hydraulic motive force to close the respective pressure relief valve. The open and close hydraulically-driven directional control valves can each have the respective default state in response to the electrically-driven directional control valve having the default no-flow state, and each can have the respective active state in response to the electrically-driven directional control valve having the active flow state.

In this configuration comprising electrically-driven directional control valves, each of the hydraulic circuits can comprise a pair of discharge hydraulically-driven directional control valves. A first of discharge hydraulically-driven directional control valves can be connected to the open output and can have a default open state and an active close state. The default open state can communicate with a discharge. A second of the discharge hydraulically-driven directional control valves can be connected to the close output of the close hydraulically-driven directional control valve and can have a default closed state and an active opened state. The active opened state can communicate with the discharge. The discharge hydraulically-driven directional control valves can each have the respective default state in response to the electrically-driven directional control valve having the default no-flow state, and each can have the respective active state in response to the electrically-driven directional control valve having the active flow state. Each close output can comprise a pilot-operated check valve piloted by the respective open output.

According to the present disclosure, an assembly is used with a buffer manifold for relieving pressure of fluid flow in a drilling system. The drilling system has a pneumatic supply, and the buffer manifold has one or more flow inlets, one or more flow outlets, and first and second pressure relief valves. The one or more flow inlets are disposed in fluid communication with an upstream portion the drilling system and receive the fluid flow therefrom. The one or more flow outlets are disposed in fluid communication with a downstream portion the drilling system and deliver the fluid flow thereto. The first and second pressure relief valves are disposed in fluid communication between the one or more flow inlets and the one or more flow outlets and are disposed in fluid communication with at least one discharge outlet. Each of the first and second pressure relief valves is operable to open and close fluid communication with the at least one discharge outlet.

The control assembly comprises a hydraulic arrangement, a plurality of sensors, and a pair of controllers. The hydraulic arrangement is operably connected to the first and second pressure relief valves and is connected to the pneumatic supply. The hydraulic arrangement is powered by the pneumatic supply and provides hydraulic motive force in two hydraulic circuits respectively to the first and second pressure relief valves. The two hydraulic circuits are cross-connected to one another.

The sensors are distributed in the hydraulic arrangement and measure a plurality of operational parameters of the hydraulic arrangement. The controllers are operably connected to the hydraulic arrangement. Each of the controllers receives the operational parameters from the sensors and receives a pressure level measurement of the drilling system. Both of the controllers control the hydraulic motive force provided in the two hydraulic circuits respectively to the first and second pressure relief valves to open and close the first and second pressure relief valves in response to the pressure level measurement.

According to the present disclosure, a method of controlling fluid flow in a drilling system comprises: receiving the fluid flow from an upstream portion of the drilling system at one or more flow inlets of a manifold assembly; in response to a first pressure level measurement of the drilling system, flowing the fluid flow out one or more flow outlets of the manifold assembly to a first downstream portion of the drilling system in response thereto; in response to a second pressure level measurement of the drilling system, flowing the fluid flow out at least one discharge outlet of the manifold assembly to a second downstream portion of the drilling system, instead of out the one or more flow outlets, by simultaneously controlling, with controllers, hydraulic motive force provided in hydraulic circuits respectively to pressure relief valves to independently open the respective pressure relief valve; in response to a first failure condition of either one of the controllers, independently controlling, with the other one of the controllers, the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to simultaneously open and close the respective pressure relief valves in response to the first and second pressure level measurements; and in response to a second failure condition of either one of the hydraulic circuits, automatically faulting either one of the pressure relief valves closed regardless of the first and second pressure level measurements.

To provide the hydraulic motive force in the hydraulic circuits of the hydraulic arrangement respectively to the pressure relief valves controlled by the controllers, the method can comprise powering pumping of the hydraulic motive force in n the hydraulic circuits with a pneumatic supply.

In automatically faulting either one of the pressure relief valves closed, both of the pressure relief valves can be automatically faulted closed in response to a total loss of power.

To automatically fault either one of the pressure relief valves closed, the method can comprise: measuring a plurality of operational pressures of the hydraulic arrangement using a plurality of pressure transducers distributed in the hydraulic arrangement; receiving the operational pressures from the pressure transducers at the controllers; and faulting the pressure relief valves closed in response to at least one of the operations pressure exceeding a pressure limit.

To provide the hydraulic motive force in the hydraulic circuits of the hydraulic arrangement respectively to the pressure relief valves controlled by the controllers, the method can comprise routing the hydraulic motive force in the hydraulic circuits cross-connected to one another.

To open the at least one pressure relief valve with the at least one controller in response to the second pressure level measurement, the method can comprise communicating both of the pressure relief valves in fluid communication between the one or more flow inlets and the one or more flow outlets and in fluid communication with at least one discharge outlet, each of the pressure relief valves being operable to open and close fluid communication with the at least one discharge outlet, both of the controllers operably connected to the hydraulic arrangement controlling the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to open and close the pressure relief valves.

The foregoing summary is not intended to summarize each potential embodiment or every aspect of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a drilling system according to the present disclosure.

FIG. 2A illustrates a schematic view of a pressure relief system of the present disclosure for the drilling system.

FIG. 2B illustrates an isolated view of a buffer manifold for the drilling system.

FIG. 3 illustrates a graph of pressures used by the pressure relief system.

FIG. 4 illustrates a cross-sectional view of a plug type valve for use as a pressure relief valve for the disclosed system.

FIG. 5 illustrates a schematic view of a processing control unit for the disclosed pressure relief system.

FIG. 6 illustrates a schematic view of a hydraulic control unit for the disclosed pressure relief system.

DETAILED DESCRIPTION OF THE DISCLOSURE

A. Drilling System

FIG. 1 diagrams a drilling system 10 according to the present disclosure. As shown and discussed herein, this system 10 is a closed-loop system for controlled pressure drilling and can be a Managed Pressure Drilling (MPD) system and, more particularly, a Constant Bottomhole Pressure (CBHP) form of MPD system. Although discussed in this context, the teachings of the present disclosure can apply equally to other types of drilling systems, such as conventional drilling systems, other MPD systems (Pressurized Mud-Cap Drilling, Returns-Flow-Control Drilling, Dual Gradient Drilling, etc.) as well as to Underbalanced Drilling (UBD) systems, as will be appreciated by one skilled in the art having the benefit of the present disclosure.

The drilling system 10 is depicted for use offshore on a rig 12, such as a floating, fixed, or semi-submersible platform or vessel known in the art, although teachings of the present disclosure may apply to other arrangements. The drilling system 10 uses a riser 20 extending between a diverter 24 on the rig floor 14 to a blow-out preventer stack 40 on the sea floor. The riser 20 connects by a riser joint 22 from the diverter 24 and includes a rotating control device (RCD) 30, an annular isolation device 32, and a flow spool 34 disposed along its length. A drill string 16 having a bottom hole assembly (BHA) and a drill bit extends downhole through the riser 20 and into a wellbore 18 for drilling into a formation.

During operations, the riser 20 can direct returns of drilling fluids, wellbore fluids, and earth-cuttings from the subsea wellbore 18 to the rig 12. In some conventional forms of operation, the diverter 24 can direct the returns of drilling fluid, wellbore fluid, and earth-cuttings to a mud gas separator 90 and other element to separate out the drilling fluid for potential recycle and reuse, and to separate out gas.

In certain situations, the BOP stack 40 can be operated to close off flow of the returns in the riser 20. The BOP stack 40 may have one or more annular or ram-style blow out preventers on a subsea wellhead, and preventers on the BOP stack 40 can be controlled by various control lines (not shown) from equipment on the rig 12. In certain situations of an uncontrolled release of wellbore fluids (e.g. high-pressure liquid and/or gas streams) during drilling, the riser 20 with its rotating control device 30, annular isolation device 32, and flow spool 34 can be configured to divert the uncontrolled wellbore fluid flow in a controlled fashion as described below.

In managed pressure drilling, the rotating control device 30, which can include any suitable pressure containment device, keeps the wellbore 18 in a closed-loop at all times while the wellbore 18 is being drilled. To do this, the rotating control device (RCD) 30 sealingly engages (i.e., seals against) the drilling string 16 passing in the riser 20 and can contain and divert annular drilling returns through a flow line 31c that connects to downstream flow controls on the rig 12. In this way, the rotating control device 30 can complete the circulating system to create the closed-loop of incompressible drilling fluid.

A hydraulic power unit 31a on the rig 12 can connect by control lines 31b to the rotating control device 30 to control its operation. The control lines 31b can carry supply and/or return of hydraulic fluid to and from the rotating control device 30 for its operation.

The annular sealing device 32 can be used to sealingly engage (i.e., seal against) the drillstring 16 or to fully close off the riser 20 when the drillstring 16 is removed so fluid flow up through the riser 20 can be prevented. Typically, the annular sealing device 32 can use a sealing element that is closed radially inward by hydraulically actuated pistons. Control lines 33 from rig controls 57 can be used for controlling the annular sealing device 32.

The flow spool 34 includes a number of controllable valves and connects by flow lines 35 to the downstream flow controls on the rig 12 described below. The controllable valves of the flow spool 34 can be opened and closed using control lines 33 from the rig controls 57.

As shown in FIG. 1, the flow controls downstream of the rotating control device 30, the annular sealing device 32, and the flow spool 34 include a managed pressure drilling buffer manifold 60 and a choke manifold 70. The buffer manifold 60 connects by the flow lines 31c and 35 from the rotating control device 30 and the flow spool 34 and receives flow returns during drilling operations. A buffer manifold hydraulic power unit 55 operates the buffer manifold 60. Among other components, the buffer manifold 60 has pressure relief valves 64a-b, pressure sensors (not shown), electronic valves (not shown), and other components to control operation of the manifold 60.

The choke manifold 70 is downstream from the buffer manifold 60. The choke manifold 70 can produce surface backpressure to perform managed pressure drilling with the drilling system 10 and can measure parameters of the flow returns. Among other components, for example, the choke manifold 70 has flow chokes 72, a flowmeter 74, pressure sensors (not shown), a local controller (not shown), and the like to control operation of the manifold 70. A hydraulic power unit (not shown) and/or electric motor of the choke manifold 70 can actuate the chokes 72.

In addition to these components, the system 10 also includes mud pumps 42; a mud standpipe manifold 46 for a standpipe (not shown); a choke & kill manifold 80 having kill and choke lines 82, 84 for the BOP stack 40; a mud gas separator 90; and various other components. During drilling operations, these components can operate in a known manner.

Finally, a control system 50 of the drilling system 10 integrates hardware, software, and applications across the drilling system 10 and is used for monitoring, measuring, and controlling parameters in the drilling system 10. For example, the control system 50 can be integrated with or communicatively coupled to the RCD hydraulic power unit 31a, the buffer manifold hydraulic power unit 55, the buffer manifold 60, the choke manifold 70, and other components. During standard operating conditions, the drilling control system 50 operates the various components to operate the drilling system 10.

In the contained environment of the closed-loop drilling system 10, for example, minute influxes or losses in the wellbore 18 are detectable at the surface, and the control system 50 can further analyze pressure and flow data to detect kicks, losses, and other events. In turn, at least some operations of the drilling system 10 can then be automatically handled by the control system 50.

To monitor operations, the control system 50 can use data from a number of sensors and devices in the system 10. For example, one or more sensors can measure pressure in the standpipe. One or more sensors (La, stroke counters) can measure the speed of the mud pumps 42 for deriving the flow rate of drilling fluid into the drillstring 16. In this way, flow into the drillstring 16 may be determined from strokes-per-minute and/or standpipe pressure.

One or more sensors can measure the volume of fluid in the mud tanks 44 and can measure the rate of flow into and out of mud tanks 44. In turn, because a change in mud tank level can indicate a change in drilling fluid volume, flow-out of the wellbore 18 may be determined from the volume entering the mud tanks 44.

Rather than relying on conventional pit level measurements, the control system 50 can use the flowmeter 74, such as a Coriolis mass flowmeter, on the choke manifold 70 to capture fluid data—including mass and volume flow, mud weight (i.e., density), and temperature—from the returning annular fluids in real-time, at a sample rate of several times per second. Because the Coriolis flowmeter gives a direct mass rate measurement, the flowmeter 74 can measure gas, liquid, or slurry. Other sensors can be used, such as ultrasonic Doppler flowmeters, SONAR flowmeters, magnetic flowmeter, rolling flowmeter, paddle meters, etc.

Additional sensors can measure mud gas, flow line temperature, mud density, and other parameters. For example, a flow sensor can measure a change in drilling fluid volume in the well. Also, a gas trap, such as an agitation gas trap, can monitor hydrocarbons in the drilling mud at surface. To determine the gas content of drilling mud, for example, the gas trap mechanically agitates mud flowing in a tank. The agitation releases entrained gases from the mud, and the released gases are drawn-off for analysis. The spent mud is simply returned to the tank 44 to be reused in the drilling system 10.

During operations, the drill string 16 passing from the rig 12 can extend through the riser 20 and through the BOP stack 40 for drilling the wellbore 18. As the drillstring 16 is rotated, the rotating control device 30 seals the annulus between the drillstring 16 and the riser 20 to conduct a managed pressure drilling operation. In this way, flow returns having drilling fluid, wellbore fluid, and cuttings flow up through the annulus between the drillstring 16 and the riser 20 to the rotating control device 30, which diverts the flow returns through the flow line 31c to the buffer manifold 60.

The fluid data and other measurements noted herein are transmitted to the control system 50, which in turn operates drilling functions. In particular, the control system 50 can operate the automated choke manifold 70, which manages pressure and flow during drilling and which is incorporated into the drilling system 10 downstream from the rotating control device 30 and buffer manifold 60 and upstream from the gas separator 90.

In general, the buffer manifold 60 can direct the flow returns in various way as needed. During standard operating conditions, the buffer manifold 60 passes the flow returns to the choke manifold 70. The automated choke manifold 70 measures the return flow (e.g., flow-out) and density using the flowmeter 74 installed in line with the chokes 72. Software components of the control system 50 then compares the flow rate in and out of the wellbore 18, the injection pressure (or standpipe pressure), the surface backpressure (measured upstream from the drilling chokes 72), the position of the chokes 72, and the mud density, among other possible variables. Comparing these variables, the control system 50 then identifies minute downhole influxes and losses on a real-time basis and control surface backpressure with the chokes 72 to manage the annulus pressure during drilling.

By identifying the downhole influxes and losses during drilling, for example, the control system 50 monitors circulation to maintain balanced flow for constant BHP under operating conditions and to detect kicks and lost circulation events that jeopardize that balance. The drilling fluid is continuously circulated through the system 10, the buffer manifold 60, the choke manifold 70, and the flowmeter 74. As will be appreciated, the flow values may fluctuate during normal operations due to noise, sensor errors, etc. so that the system 50 can be calibrated to accommodate such fluctuations. In any event, the control system 50 measures the flow-in and flow-out of the well and detects variations. In general, if the flow-out is higher than the flow-in, then fluid is being gained in the system 10, indicating a kick. By contrast, if the flow-out is lower than the flow-in, then drilling fluid is being lost to the formation, indicating lost circulation.

To then control pressure, the control system 50 introduces pressure and flow changes to the incompressible circuit of fluid at the surface to change the annular pressure profile in the wellbore. In particular, using the choke manifold 70 to apply surface backpressure within the closed loop, the control system 50 can produce a reciprocal change in bottom hole pressure. In this way, the control system 50 uses real-time flow and pressure data and manipulates the annular backpressure to manage wellbore influxes and losses.

During operations, certain events may occur that require reconfiguring of flow controls. For example, the drillstring 16 may be lifted out of the riser 20, and the annular sealing device 32 may be actuated to close off the riser 20. The controllable valves on the flow spool 34 can be operated to direct fluid in the riser 20 below the rotating control device 32 through the flow lines 35 to the buffer manifold 60.

In other examples, certain events or failures, such as an uncontrolled release of wellbore fluids, may occur. In this case, the annular sealing device 32 can be actuated to seal off the annulus around the drillstring 16 (if present). The rotation of the drillstring 16 can be stopped during the event, or the annular sealing device 32 may be capable of sealing against the drillstring 16 while rotating. Either way, the controllable valves on the flow spool 34 can be operated to direct fluid in the riser 20 below the annular sealing device 32 through the flow lines 35 to the buffer manifold 60.

Additional events may occur requiring the pressure relief system 100 to divert fluid flow overboard, to trip tanks 44, or to other fluid handling components. For example, an uncontrolled release of wellbore fluids may occur, and the annular flow in the riser 20 captured by the rotating control device 30 or the annular sealing device 32 may need to be relieved to protect the formation or to protect the equipment of the system. To relieve the system 10 of overpressure, a pressure relief system 100 operates pressure relief valves 64a-b on the buffer manifold 70 to divert the flow returns from the flow lines 31c, 35 overboard, to trip tanks 44, or to other fluid handling components. This diversion can then prevent the overpressure flow from damaging the riser 20 and passing on to the choke manifold 70.

As schematically shown, components of the pressure relief system 100 can be incorporated into the buffer hydraulic power unit 55, although separate configurations are possible. As discussed in more detail below, the pressure relief system 100 has an integrated PLC based control system and a hydraulic control unit (HCU) and is connected to the pressure relief valves 64a-b and other components of the buffer manifold 60 by control lines 105. The pressure relief system 100 can open and close the pressure relief valves 64a-b simultaneously. When opened, the redundant pressure relief valves 64a-b provide pressure relief in the event of over-pressurization of the wellbore 18 and/or surface equipment. Once opened, the pressure relief system 100 provides a further function of closing the pressure relief valves 64a-b to prevent an induced kick from occurring after the relief of overpressure.

The pressure relief valves 64a-b are configured to nominally fail in the closed position. There may be several reasons for this. Primarily, the purpose of the MPD drilling system 10 is to impose dynamic backpressure on the wellbore 18 using the choke manifold 70. If one of the pressure relief valve 64a-b fails open, then backpressure cannot be maintained. Additionally, the wellbore 18 is normally in static or dynamic balance so a demand for overpressure protection of equipment is less likely to occur. Instead, the more likely cause of an open command to the pressure relief valves 64a-b would be to protect the formation.

B. Pressure Relief System

As hinted to above, the pressure relief system 100 can operate in a stand-alone mode to protect against process upsets during drilling with the drilling system 10. As schematically shown in FIG. 2A, the pressure relief system 100 includes a sensor arrangement 110, a processing control unit 120, and a hydraulic control unit 130 for the buffer manifold 60. Power from a power supply 140 can be common to the three elements 110, 120, and 130 of the system 100.

As described in more detail below, each of the elements 110, 120, 130, and 140 includes redundancies so that a fault of a component in one element does not fault other components of that element nor fault components of the other elements. To achieve the required redundancy, the system 100 is more than just a combination of one pressure relief valve having its control console with another pressure relief valve having its own control console. In such an arrangement, limited fault protection would be achieved as discussed in the background section of the present disclosure. Instead, the pressure relief system 100 disclosed herein addresses multiple points of failure in the disclosed arrangement by providing a redundancy at that point of failure, by providing independent monitoring of that point of failure, and by preventing a fault at that point of failure from translating to a fault of the redundancy. In this way, the disclosed pressure relief system 100 provides a redundant, fault-tolerant integration of sensing, processing, hydraulic, and power elements 110, 120, 130, and 140 for the redundant pressure relief valves 64a-b.

As briefly shown here and described in more detail below, the sensor arrangement 110 includes sensors 112, 116 and electrical buffers 114, and the processing control unit 120 includes two programmable logic controllers (PLCs) 122a-b. The hydraulic control unit 130 provides hydraulic valve control for the two pressure relief valves 64a-b of the manifold 60.

The sensors in the arrangement 110 include transducers 112 receiving pressure and other measurements from pneumatic and hydraulic sources. These transducers 112 can be distributed in the hydraulic control unit 130 in the manifold 60. The sensors in the arrangement 110 also include sensors 116 receiving line or process pressures from the drilling system (10). These sensors 116 can be disposed on the flow line entering the inlet 62a of the buffer manifold 60. These sensors 116 measure redundant measurements of the process pressure, and voting between the sensor measurements can be used in decisions of the processing control unit 120.

The buffer manifold 60 in FIG. 2A is used for directing process flow in various ways. The manifold 60 includes one or more flow inlets 62a disposed in fluid communication with an upstream portion of the drilling system (10) and receives the fluid flow therefrom. The manifold 60 also includes one or more flow outlets 62b disposed in fluid communication with a downstream portion of the drilling system (10) and delivers the fluid flow thereto. Finally, the manifold 60 includes at least one discharge outlet 65 to relieve pressure.

In the context of the present disclosure, the pressure relief valves 64a-b are used for relieving pressure of fluid flow in the drilling system (10: FIG. 1) in response to a pressure level measurement, such as a flow line pressure from the sensors 116, being over a limit. For instance, as shown in FIG. 2B, the manifold 60 has a number of inlets 62a and receives fluid from the RCD (30) via flow lines 31c, receives flow from the flow spool (34) via flow lines 35, receives flow from the choke/kill manifold (80), etc. The manifold 60 has a number of outlets 62b and delivers flow returns to the choke manifold (70), to the choke/kill manifold (80), trip tank (44), and other downstream portions of the drilling system (10) instead of to the choke manifold (70).

Internally, the manifold 60 includes a number of solenoid actuated gate valves 66, flow tees, manifold elements, piping, etc. for controlling flow between the inlets 62a and the outlets 62b during drilling operations. The buffer unit 55 interfaces with the solenoid actuated gate valves 66 for directing flow according to operational needs. For its part, the pressure relief system 100, which can part of the buffer unit 55 and which includes the elements 110, 120, 130, 140, of FIG. 2A interfaces with the pressure relief valves 64a-b to relieve overpressure from the inlets 62a to the discharge outlets 65.

As can be seen in the manifold 60 as shown in FIGS. 2A-2B, the redundant pressure relief valves 64a-b are disposed in fluid communication between the one or more flow inlets 62a and the one or more flow outlets 62b and disposed in fluid communication with the at least one discharge outlet 65. Each of the redundant pressure relief valves 64a-b is operable to open and close fluid communication with the at least one discharge outlet 65.

The hydraulic control unit 130 in FIG. 2A has a hydraulic arrangement operably connected to the redundant pressure relief valves 64a-b. Redundant hydraulic circuits of the unit 130 are cross-connected to one another and are operably connected to the redundant pressure relief valves 64a-b. The redundant hydraulic circuits provide hydraulic motive force respectively to the redundant pressure relief valves 64a-b.

The transducers 112 are distributed in the redundant hydraulic circuits of the hydraulic control unit 130 and measure operational parameters of the hydraulic circuits to diagnose the unit 130 and its operation. The other sensors 116 are distributed to measure line or process pressure of the manifold's inlets 62a as the pressure level measurement used in activating or deactivating the pressure relief system 100. These sensors 116, for example as shown in FIG. 2B, can be disposed on the flow line 31c from the RCD (30) leading into the inlet 62a of the buffer manifold 60.

In general, two or more of these sensors 116 can be used for redundancy. In a particular arrangement, four sensors 116 can be used to measure the process pressure at the same point of the flow line to the inlet 62a. Each of these sensors 116 can be the same as one another (i.e., have the same ratings, same sensitivities, etc.) for redundant verification of the pressure measurements. In fact, the sensors 116 can be identical. In other arrangements, one or more of the sensors 116 may have different ratings, sensitivities, or the like from the other sensors 116.

In the processing unit 120, the redundant controllers 122a-b are operably connected to the redundant hydraulic circuits of the hydraulic control unit 130. Each of the redundant controllers 122a-b receives the operational parameters from the transducers 112 and also receives pressure level measurements of the drilling system (10) for the sensors 116. Both of the redundant controllers 122a-b in a standard operating condition then simultaneously control the hydraulic motive force provided in the redundant hydraulic circuits of the hydraulic unit 130 respectively to the redundant pressure relief valves 64a-b to independently open and close the respective pressure relief valve 64a-b in response to the pressure level measurement from the line pressure sensors 116.

Additional details of the processing unit 120 are disclosed in FIG. 5, and additional details of the hydraulic control unit 130 are disclosed in FIG. 6.

C. Modes of Operation

The system 100 is a redundant, fault tolerant, pressure protection system used in the operation of the two pressure relief valves 64a-b intended for protection of process or line pressure in the drilling system (10: FIG. 1). For fault tolerance, the pressure relief system 100 is operable in response to different failure or fault conditions. In response to a first failure condition of either one of the redundant controllers 122a-b, for example, the other one of the redundant controllers 122a-b independently controls the hydraulic motive force provided in the redundant hydraulic circuits of the hydraulic unit 130 respectively to the redundant pressure relief valves 64a-b to simultaneously open and close the respective pressure relief valves 64a-b in response to the pressure level measurement from the line pressure sensors 116. In response to a second failure condition of either one of the redundant hydraulic circuits of the hydraulic unit 130, however, either one of the redundant pressure relief valves 64a-b automatically faults closed regardless of the pressure level measurement from the line pressure sensors 116.

In the configuration of the manifold 60, one pressure relief valve 64a-b and its associated electrical, hydraulic, or pneumatic controls is capable of relieving excess line pressure. In case of single point failure failing one pressure relief valve 64a-b, the failed pressure relief valve 64a-b fails closed allowing the remaining pressure relief valve 64a-b and its associated electrical, hydraulic, or pneumatic controls to continue to maintain control over line pressure and relieve pressure as needed. (As to be understood herein, having a valve “fail closed” refers to the failed valve closing, as opposed to the valve simply failing-in-place—i.e., the valve staying in its current position.)

For overpressure protection, the pressure relief system 100 is controlled by a user-defined setpoint 124, which can be set over a pressure range to a coded equipment protection setpoint 126. The user-defined setpoint 124 can be entered locally at a console or remotely by computer using an interface application. Under normal operation, exceeding the setpoint 124 for line pressure causes both pressure relief valves 64a-b to open to relieve line pressure. Thereafter, when line pressure is reduced, both pressure relief valves 64a-b then close.

For additional reference, FIG. 3 illustrates a graph of pressure set points and values used by the pressure relief system 100. The user-defined setpoint 124 to open the two pressure relief valve 64a-b is a dynamic process protection level (PPL) setpoint 124, which extends over a pressure range from 0 to a hard-coded equipment protection level (EPL) setpoint 126.

The dynamic setpoint 124 is the “open” setpoint for the pressure relief valves 64a-b, indicating the pressure level set for the pressure relief valves 64a-b to open and relieve process pressure for overpressure protection. The dynamic setpoint 124 allows operators to limit the applied surface backpressure while (a) drilling narrow margin wells (well protection setpoint) and while (b) during short periods for make and break of drilling stands (connections setpoint.)

The equipment protection setpoint 126 is hard-coded and is set based on the lowest pressure rating. The dynamic setpoint 124 (valve opens) may cover a range of pressure from 0 to 80% of riser (or surface equipment) maximum allowable operating pressure (MAOP). Typically, the MAOP is separately hard coded into the programmable logic controllers 122a-b to protect the riser (20) and surface equipment (60, 70, etc.).

During operation, the process sensors (116) measure the process pressure at the inlet (62a) of the manifold (60) to provide the current line or process pressure 128. Because multiple sensors 116 are used, a voting scheme between the sensors' measurements can be used to decide what the current line pressure 128 is. For example, the voting scheme can decide the pressure 128 from an average of the three closest measurements, or some other scheme can be used. Thus, if one sensor 116 makes a momentary erroneous measurement, it need not be relied upon.

The current line pressure 128 is compared to the dynamic setpoint 124, which can be changed, for example, (a) during drill-pipe make-and-break, (b) as the wellbore (18) is deepened and new geological structures are encountered, and (c) when conducting formation integrity tests (FIT) or leak off tests (LOT). Therefore, as the drilling process goes through different operations, the dynamic setpoint 124 is changed so overpressure protection is provided in the manner best suited to the drilling operations at the time.

Under normal operation, having the current line pressure 128 exceed the dynamic setpoint 124 results in both pressure relief valves 64a-b opening simultaneously in order to reduce pressure. Thereafter, both pressure relief valves 64a-b close at a trailing setpoint 125 in order to prevent an induced kick from occurring due to the relief of pressure. The trailing setpoint 125 is the close setpoint for when the valves 64a-b close after opening. The trailing setpoint 125 may be hard coded at 80% of the dynamic open setpoint 124.

For its part, the hard-coded equipment protection setpoint 126 simultaneously opens both pressure relief valves 64a-b in order to protect the riser (20) and surface equipment from overpressure. Although one form of voting between the measurements of the pressure sensors (116) can be used to determine whether the current line pressure 128 has reached the equipment protection setpoint 126, preferably the equipment protection setpoint 126 is triggered by another form of voting when any one of the pressure sensors 116 reports a measured value exceeding the equipment protection setpoint 126.

After opening due to triggering from the equipment protection setpoint 126, both pressure relief valves 64a-b then close at a trailing setpoint (not shown) in order to prevent an induced kick. As noted, the open equipment protection setpoint 126 is nominally set at 80% of maximum allowable operating pressure (MAOP). The trailing close setpoint used after opening for the equipment protection may correspond to the dynamic close setpoint 124. This may ensure that the well is bought back to a state previously identified as being required to drill the wellbore or make the connection.

The dynamic setpoint 124 allows backpressure adjustment during make-and-break of drillpipe of the drillstring (16). When making connections in the system (10) of FIG. 1, for example, the mud pumps (42) are stopped prior to making a connection. This results in a loss of equivalent circulating density (ECD), which in turn reduces downhole pressure. The drilling system (10) is used to compensate for the loss of ECD by increasing the backpressure applied at the chokes (72) of the choke manifold (70). The increase in backpressure may be several hundred PSI, which means the dynamic setpoint 124 must be increased to a value equal to surface backpressure (SBP) plus a margin (M) that prevents the pressure relief valves (64a-b) from opening erroneously. In practice, the adjustment of the dynamic setpoint 124 may be reviewed with the connection every drillpipe stand. However, if the ‘open’ dynamic setpoint 124 is triggered, then there is a risk of an influx that could escalate to a loss of well control. For this reason, the processing unit (120) is programmed to close the pressure relief valves (64a-b) with the trailing ‘close’ setpoint 125.

The dynamic setpoint 124 also provides wellbore protection while drilling. For example, the pressure relief valves (64a-b) must open at a dynamic setpoint 124 chosen by the driller whose goal is to protect the open formation against fracture. If the hydrostatic and applied backpressure from the column of drilling mud is too high, then drilling fluid may be lost into the formation. The dynamic open setpoint 124 may be up to 80% of MAOP (e.g. if RCD is rated for 2000 psi, 80% of the MAOP is 1600 psi), leaving no pressure margin and time-delay between relief for well protection, and equipment overpressure. Opening the pressure relief valves (64a-b) results in a significant and rapid loss of surface back pressure, so both pressure relief valves (64a-b) preferably close at the trailing setpoint 125 to minimize an induced kick. The trailing close setpoint 125 may be set at 80% of the dynamic open setpoint 124. If the dynamic setpoint 124 is set high and one or both pressure relief valves (64a-b) fails to close, then there is the risk of an induced kick that could escalate to blow out after a period of minutes or hours. In this situation, the driller would have to secure the well.

Other than the modes of operation for making connections and well protection, the pressure relief system 100 operates in an equipment protection mode to open and close in emergency scenarios where high surface pressure (i.e., overpressure) is detected in the line pressure at the inlets (62a) of the manifold (60). There are two primary scenarios. First, the return flow path of the MPD system (10) is blocked (e.g. by an inadvertently closed valve). Alternatively, a gas kick has been transported or migrated to surface, resulting in a threat of equipment overpressure. In both cases, the pressure relief valves (64a-b) open at the dynamic setpoint 124 to relieve pressure and then close at the trailing setpoint 125 to maintain backpressure on the well.

The programming in the controllers (122a-b) for the dynamic setpoint 124 does not allow the operator to enter a value greater than the open setpoint 126 for equipment protection. This means the dynamic open setpoint 124 operates first, thereby preventing conflicting commands from the controllers (122a-b) (i.e., simultaneous close for dynamic setpoint 124, and open for equipment protection 126).

D. Pressure Relief Valve

The pressure relief valves 64a-b of the disclosed pressure relief system 100 can be a plug type valve rated for high-pressure service in drilling applications, although other types of valves, chokes, and the like can be used. As a brief example, FIG. 4 schematically illustrates a plug type valve that can be used for the system's pressure relief valve 64. The valve 64 includes a body 150, a plug 160, and a hydraulic actuator 168.

An interior 152 of the valve body 150 has an inlet 154 and an outlet 156 with a seat 155 disposed therebetween. The plug 160 is sealed in the interior 152 and is movable relative to the seat 155. As shown here, the hydraulic actuator 168 is a piston connected to the plug 160 by a stem 162. The actuator 168 is sealed in a hydraulic chamber 158 communicating with hydraulic ports 159a-b. Other hydraulic arrangements, such as scroll screw actuators, choke actuators, or the like, can be used for the actuator 168.

Operation of the valve 64 is achieved via the hydraulic actuator 168 integral to the plug 160. The air-driven hydraulic power unit (130: FIG. 2A) provides motive force to the actuator 168 via the ports 159a-b. A position or proximity sensor 157 can be used with the actuator 168 to at least indicate that the valve 64 is open.

The valve 64 is held closed by line pressure at the input 154 acting against the plug 160 and by application of the piston force of the actuator 168. Reversing the hydraulic pressure acting across the actuator 168, to a point where piston force exceeds well fluid force, opens the valve 64. This moves the plug 160 off the seat 155 at which point downstream pressure assists opening, and line flow can pass from the inlet 154 to the outlet 156.

E. Processing Control Unit

FIG. 5 illustrates a schematic of the processing control unit 120 for the disclosed pressure relief system 100. The processing control unit 120 uses an electric control panel containing duplicate power input sources (AC-1, AC-2), duplicate power supplies 140, redundant failsafe programmable logic controllers (PLC) 122a-b, and redundant sensor inputs via a communication interface 105 with the hydraulic control unit (130).

The processing unit 120 can further use fusing to prevent cascade electrical faults, a connection for a local HMI display 104a, and a fiber optic interface for remote operation by other processing equipment 104b, such as in a driller's cabin on the rig. Instrumentation can be included to reveal any electronic failure of components. The local and remote interfaces 104a-b are redundant of one another so one could be used in the absence or failure of the other. In general, the interfaces 104a-b can provide setup, configurations, alarms, diagnostics, and the like for both controllers 122a-b.

The two programmable logic controllers 122a-b operate in a fully parallel, redundant configuration. The controllers 122a-b can be powered by the duplicate AC power input sources (AC-1, AC-2), and duplicate DC power supplies 140. One power source (AC-1) can be rig power, while the other power source (AC-2) can be an uninterruptable power supply. A router for communications may or may not be necessary.

The redundant sensor inputs of the interface 105 can be protected by the electrical barriers 114 having fuses to prevent a cascade of electrical faults. Each controller 122a-b can be connected to the common, local HMI display 104a. The fiber optic interface may support remote monitoring and basic process control via interface applications with remote processing equipment 104b. The interface electronics configuration is redundant and fault tolerant.

Identical logic can run on each controller 122a-b. Thus, each controller 122a-b receives input from the same sources. For example, each controller 122a-b receives input from the transducers 112a-d distributed in the hydraulic power unit (130), receives position sensing input 107a-b from the pressure relief valves (64a-b), and receives input from the process sensors 116a-d of the manifold (60). Each of the various pressure transducers and sensors (112a-d, 116) can be installed in a location and orientation designed to sense line blockage.

Each controller 122a-b uses a voting scheme for the measurements of the process sensors 116a-d, and each controller 122a-b processes the inputs with the identical logic. In turn, each controller 122a-b provides control signals through outputs 106a-b to the pressure relief valves (64a-b). Therefore, the controllers 122a-b should operate the same and should produce the same processing results. In this way, the controllers 122a-b simultaneously operate the two pressure relief valves 64a-b, yet do their processing independently.

Diagnostics from each individual controller 122a-b may or may not be included in the logic. Such diagnostics may or may not be communicated between the controllers 122a-b. If diagnostics are shared, each controller 122a-b can operate according to an appropriate voting scheme to resolve conflicts between any processing results. Alternatively, the controller 122a-b with superior diagnostics may override the other. In fact, one controller 122a-b may operate on standby, awaiting its need to assume control from the other controller 122a-b. Preferably, however, both controllers 122a-b as noted herein simultaneously process the inputs and provide their independent results, which should be identical or nearly identical under the circumstances.

During normal operation with no faults, both controllers 122a-b and their associated electronics can operate both pressure relief valves (64a-b) simultaneously, but independently. As shown, each controller 122a-b shares a first control output 106a to open the first pressure relief valve (64a), and each controller 122a-b shares a second control output 106b to open the second pressure relief valve (64b). Each valve (64a-b) is, however, independently capable of the needed open/close functions. In the event of a failure of either one of the controllers 122a-b or its associated electronics, the remaining controller 122a-b and associated electronics can continue to operate both pressure relief valves 64a-b.

As shown, each controller 122a-b also shares the communication interface 105 connected to the transducers 112a-d of the hydraulic control unit (130). The interface 105 includes connections to a first transducer 112a for measuring the pneumatics for the manifold (60) and connections to other transducers 112b-d for measuring the hydraulics for the manifold (60), as described later. The communication interface 105 includes a connection to a level indicator 112e for receiving an indication of hydraulic level of the hydraulic control unit (130). In this way, the transducers 112a-e provide diagnostics of the hydraulic unit (130).

As shown, each controller 122a-b also shares communication with the sensors 116, which can be pressure transducers that redundantly measure the line pressure to detect an overpressure condition requiring pressure relief by the pressure relief system 100. These pressure transducers 116 can have the same or different ranges, alarms, sensitivities, etc. The communication interface 105 also includes a first connection (PRV1 ZT1) to a first position sensor (157) for the first pressure relief valve (64a), and includes a second connection (PRV2 ZT2) to a second position sensor (157) for the second pressure relief valve (64b). In general, the position sensors (157) can indicate if the associated valve 64a-b is fully open.

F. Hydraulic Control Unit

FIG. 6 illustrates a schematic of a hydraulic control unit 130 for the disclosed pressure relief system (100). As shown in FIG. 6, the hydraulic control unit 130 consists of redundant hydraulic, pneumatic, and electrical components. Field deployment uses bulkhead connections 170 for rig air supply 172, sensors connections 112a-d, and hydraulic connections 174a-b. Hydraulics controls consist of dual air driven pumps 186a-b, dual accumulators 188a-b, and hydraulic circuits 180a-b cross-connected for redundancy. Each half of the duplicated components is sized to operate both pressure relief valves 64a-b simultaneously.

The two hydraulic circuits 180a-b operate the pressure relief valves 64a-b independently. Each circuit 180a-b includes a spring-biased (to default close) solenoid operated directional control valve (DCVs) 192a-b. Each electrically-operated valve (DCVs) 192a-b in turn energizes four (4) hydraulically-operated directional control valves (DCVs) 194a-d, 196a-d. Based on the control of these valves 192a-b, 194a-b, 196a-b, each circuit 180a-b delivers open pressure 174a and close pressure 174b for the motive force of the pressure relief valves (64a-b).

To do this, rig air supply 172 for the circuits 180a-b is split and passes through filter-regulator-lubricator components 181a-b to pneumatic pumps 186a-b. Hydraulic fluid from a hydraulic source 182 is drawn by the pneumatic pumps 186a-b through suction lines 184a-b. From the pneumatic pumps 186a-b, the hydraulics pass components 187a-b of pressure relief valves, check valves, and the like. The hydraulics then combine together in a common hydraulic input 188 and pass connections to the accumulators 188a-b. The accumulators 188a-b can take over in maintaining the hydraulic pressure should the rig air supply 172 fail or both of the pumps 180a-b fail. Moreover, one of the accumulators 188a-b can take over for the other should it fail.

The combined pumped hydraulic input 188 then pass to split controls 190a-b, each having an electrically-driven directional control valve 192a-b. The first electrically-driven valve 192a operates to open/close the first of the pressure relief valves (64a) and receives first control signals (106a: FIG. 5) from either of the controllers 122a-b of the processing control unit (120). The second electrically-driven valve 192b operates to open/close the second of the pressure relief valves (64b) and receives first control signals (106b: FIG. 5) from either of the controllers (122a-b) of the processing control unit (120).

As noted herein, each electrically-driven valve 192a-b receives an input signal from both of the controllers 122a-b. In this way, an input signal to actuate the electrically-driven valves 192a-b and open the pressure relief valve 64a-b can be received from one or both of the controllers 122a-b. Because each of the electrically-driven valves 192a-b shares two electrical connections with the controllers 122a-b, each connection needs to be isolated from the other so that a short of one connection does not translate to a short of the other. In other words, a short of the electrical connection of one controller 122a to the electrically-driven valve 192a should not cause a short of the electrical connection of the other controller 122b to the electrically-driven valve 192a. As will be appreciated, each of the electrical connections between components of the control unit (120) and the hydraulic control unit 130 for the various shared sensors, signals, inputs, outputs, and the like are likewise isolated to prevent a short of one translating to a short of another.

Each electrically-driven valve 192a-b has a set of four hydraulically-operated directional control valves (DCVs) 194a-d, 196a-d, which are stacked as piloted valves with reduced leakage in the hydraulic arrangement. The combined pumped hydraulics pass to both the electrically-driven valves 192a-b and also split to pass to the open and close hydraulically-driven valves 194a-b, 196a-b. Respective output from the split controls 190a-b pass pilot-operated check valves 198a-b before reaching the open connections 174a and the close connections 174b on the bulkhead 170 for the two pressure relief valves 64a-b.

Looking at the first circuit 180a, the first electrically-driven valve 192a has a default state, including (3 closed) closing off communication of the pumped hydraulics and including (1-2 pass) connecting the pressure inputs (3) of the hydraulically-operated valves 194a-d to the discharge line 185. The first electrically-driven valve 192a has an active state, including (3-2 pass) and including (1 closed) directing the pumped hydraulics to the pressure inputs (3) of the hydraulically-operated valves 194a-d.

The open hydraulically-driven valve 194a has a default closed state (2 closed, 1 closed) and has an active opened state (2-1 pass) when hydraulically driven by pressure input (3). The close hydraulically-driven valve 194b has a default opened state (2-1 pass) and has an active closed state (2 closed, 1 closed) when hydraulically driven by pressure input (3) shared with the open hydraulically-driven valve 194a.

The other hydraulically-driven valves 194c-d control communication from the open and close hydraulically-driven valve 194a-b to the discharge line 185. These valves 194c-d share pressure inputs (3) selectively connected by the electrically-driven valves 192a to the discharge line 185 or the combined pumped hydraulics. One of these valves 194c has a default state, including (2-closed, 1-closed) preventing communication of the output from the close valve 194b to the discharge line 185, and has an active state, including (1-2 pass) communicating the output from the close valve 194b to the discharge line 185. The other of these valves 194d has a default state, including (1-2 pass) communicating the output from the open valve 194a to the discharge line 185, and an active state, including (2-closed, 1-closed) preventing communication of the output from the open valve 194a to the discharge line 185.

The electrically-driven valve 192b and hydraulically-driven valves 196a-d for the second circuit 180b are similarly configured. Therefore, the above discussion is reincorporated here, applying to the connections between the electrically-driven valve 192b and the hydraulically-driven valves 196a-d for the second circuit 180b.

Instrumentation is included to monitor critical pneumatic and hydraulic functions to reveal any hydraulic or pneumatic component or circuit failure. In particular, the instrumentation includes the transducers 112a-d, which connect via buffers (114) to the processing unit's interface (105: FIG. 5) for the controllers (122a-b) of the processing control unit (120). The first transducer 112a measures the air supply 172 for the pumps 186a-b. The second transducer 112b measures the hydraulic power unit's pressures for the two circuits 180a-b. The third transducer 112c measures the pressure relief valve's pressure for the first circuit 180a, and the fourth transducer 112d measures the pressure relief valve's pressure for the second circuit 180b. The level indicator 112e measures the level of hydraulic fluid in the hydraulic source 182.

In the event of failure of any critical hydraulic or pneumatic component (worst case), only one pressure relief valve 64a-b fails and remains closed while the other pressure relief valve 64a-b continues to operate normally and relieves line pressure as needed. Preferably then, no single point failure in the electrical, hydraulic, or pneumatic controls of the processing unit (120) and hydraulic control unit (130) prevents operation of at least one pressure relief valve 64a-b when needed.

G. Conclusion

The pressure relief system 100 is configured so that no component failures would cause one of the pressure relief valves 64a-b to fail open. Instead, certain component failures cause one of the pressure relief valves 64a-b to fail closed. Examples of component failures that can cause one pressure relief valve 64a-b to fail closed (after opening) include: (a) failures of certain electrical fuses; (b) failures of one of the directional control valves 192a-b (DCV1 or DCV2); or (c) failure of one of the pilot operated check valves 198a-b. An example of component failures that can cause both pressure relief valves 64a-b to fail closed (after opening) includes a total loss of power (blackout).

Other component failures may occur that require operations to be stopped. For example, certain component failures may potentially cause one or both the pressure relief valves 64a-b to fail in place or fail open, at which point operations would be stopped. These component failures could include failure of the hydraulically-operated control valves 194a-d, 196a-d (DCV1A to DCV1D or DCV2A to DCV2D), failure of analog inputs, failures of accumulator bleed valves, and the like.

As discussed above, the pressure relief system 100 of the present disclosure can be used for the buffer manifold 60 in a managed pressure drilling system 10. In particular, the equipment protection provided by the pressure relief system 100 is applied with the pressure relief valves 64a-b at the buffer manifold 60 to protect the riser 20, the choke manifold 70, the formation, etc. Separate consideration can be given to overpressure protection of surface equipment for scenarios where the source of overpressure is from the standpipe manifold 46, the choke & kill manifolds 80, or other equipment. Therefore, the teachings of the present disclosure can be applied to rapid acting pressure protection for other interconnects of the drilling system 10, such as interconnects of the standpipe manifold 46, the choke and kill manifold 80, and discharge of the mud pumps 42.

Accordingly, the pressure relief system 100 can be used elsewhere in a drilling system 10 and can be used in processes where protection from overpressure is desired. As one example, FIG. 1 illustrates where a pressure relief system 100′ can used in another location of the drilling system 10. Here, the pressure relief system 100′ is used for the overpressure protection at the discharge of the mud pumps 42. The details of the pressure relief system 100′, including the pressure relief valves, controllers, sensors, hydraulic circuits, etc., are similar to those disclosed above so that the description of these details are incorporated here. Redundant sensors measure the discharge pressure of the mud pumps 42 for overpressure protection so the pressure relief system 100′ can be opened to relieve overpressure when needed. As another example, the disclosed pressure relief system 100′ can be used for overpressure protection in the standpipe manifold 46.

The disclosed pressure relief system can be used in other drilling configurations and systems. For example, the drilling system can include a flowline from the wellbore. The pressure relieve system can use a pressure relief valve and a choke on the flowline from the wellbore. The flow passes through the pressure relief valve and passes to the choke before passing on to further downstream equipment. As disclosed herein, the pressure relief system in this arrangement can relieve overpressure so equipment can be protected, while still being able to be dynamically adjusted for the current needs of an operation.

The foregoing description of preferred and other embodiments is not intended to limit or restrict the scope or applicability of the inventive concepts conceived of by the Applicants. It will be appreciated with the benefit of the present disclosure that features described above in accordance with any embodiment or aspect of the disclosed subject matter can be utilized, either alone or in combination, with any other described feature, in any other embodiment or aspect of the disclosed subject matter.

In exchange for disclosing the inventive concepts contained herein, the Applicants desire all patent rights afforded by the appended claims. Therefore, it is intended that the appended claims include all modifications and alterations to the full extent that they come within the scope of the following claims or the equivalents thereof.

Claims

1. An assembly for relieving pressure of fluid flow in a drilling system in response to a pressure level measurement of the drilling system, the assembly comprising:

pressure relief valves disposed in fluid communication between the fluid flow and at least one discharge outlet, each of the pressure relief valves operable to open and close fluid communication of the fluid flow with the at least one discharge outlet;

hydraulic circuits being cross-connected to one another and being operably connected to the pressure relief valves, the hydraulic circuits providing hydraulic motive force respectively to the pressure relief valves; and

controllers operably connected to the hydraulic circuits, each of the controllers receiving the pressure level measurement of the drilling system, both of the controllers in a standard condition simultaneously controlling the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to independently open and close the respective pressure relief valve in response to the pressure level measurement,

in response to a first failure condition of either one of the controllers, the other one of the controllers independently controlling the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to simultaneously open and close the respective pressure relief valves in response to the pressure level measurement.

2. The assembly of claim 1, wherein, in response to a second failure condition of either one of the hydraulic circuits, either one of the pressure relief valves automatically faults closed regardless of the pressure level measurement.

3. The assembly of claim 1, comprising a manifold having one or more flow inlets disposed in fluid communication with an upstream portion of the drilling system and receiving the fluid flow therefrom, and having one or more flow outlets disposed in fluid communication with a downstream portion of the drilling system and delivering the fluid flow thereto.

4. The assembly of claim 1, further comprising sensors communicatively connected to the controllers and providing readings for the pressure level measurement of the drilling system.

5. The assembly of claim 1, further comprising a plurality of sensors distributed in the hydraulic circuits and measuring a plurality of operational parameters, both of the controllers receiving the operational parameters, either one of the controllers detecting a second failure condition associated with the operational parameters from one of the hydraulic circuits and automatically faulting the respective pressure relief valve closed in response to the second failure.

6. The assembly of claim 5, wherein the hydraulic circuits comprise pumps connected to a pneumatic supply and pumping the hydraulic motive force; and wherein a first of the sensors comprises a first pressure transducer measuring pressure of the pneumatic supply as one of the operational parameters.

7. The assembly of claim 6, wherein the pumps connected to the pneumatic supply pump the hydraulic motive force to a common hydraulic input for the hydraulic circuits.

8. The assembly of claim 7, wherein a second of the sensors comprises a second pressure transducer measuring the common hydraulic input as one of the operational parameters.

9. The assembly of claim 7, comprising one or more accumulators connected to the common hydraulic input.

10. The assembly of claim 6, wherein the hydraulic circuits provide the hydraulic motive force in the event of failure of either one of the pumps.

11. The assembly of claim 5, wherein a third of the sensors comprises a third pressure transducer measuring pressure of the hydraulic motive force to a first of the pressure relief valves as one of the operational parameters, either one of the controllers detecting the measured pressure below a first threshold as the second failure condition and automatically faulting the first pressure relief valve closed in response thereto.

12. The assembly of claim 11, wherein a fourth of the sensors comprises a fourth pressure transducer measuring pressure of the hydraulic motive force to a second of the pressure relief valves as one of the operational parameters, either one of the controllers detecting the measured pressure below a second threshold as the second failure condition and automatically faulting the second pressure relief valve closed in response thereto.

13. The assembly of claim 1, wherein each of the controllers is communicatively connected to a position sensor of each of the pressure relief valves, either one of the controllers detecting either one of the pressure relief valves failing to open as the second failure condition.

14. The assembly of claim 1, wherein each of the hydraulic circuits comprises an electrically-driven directional control valve having a default no-flow state and an active flow state, both of the electrically-driven directional control valves being connected to a common hydraulic input.

15. The assembly of claim 14,

Wherein each of the controllers is communicatively connected to the electrically-driven directional control valves of both of the hydraulic circuits to provide a control signal thereto;

wherein in the second failure condition, either of the controllers is configured to automatically fault a respective one of the pressure relief valves closed in response to a failure of the respective electrically-driven directional control valve; and/or

wherein the hydraulic motive force is provided in the open circuit of a first of the hydraulic circuits in the event of a failure of the electrically-driven directional control valve in a second of the hydraulic circuits, the pressure relief valve of the second hydraulic circuit defaulting to a closed condition.

16. The assembly of claim 14, wherein each of the hydraulic circuits comprises a pair of open and close hydraulically-driven directional control valves connected to the common hydraulic input, the open hydraulically-driven directional control valve having a default closed state and an active opened state, the close hydraulically-driven directional control valve having a default opened state and an active closed state, the active opened state providing an open output of the hydraulic motive force to open the respective pressure relief valve, the default opened state providing a close output of the hydraulic motive force to close the respective pressure relief valve, the open and close hydraulically-driven directional control valves each having the respective default state in response to the electrically-driven directional control valve having the default no-flow state and each having the respective active state in response to the electrically-driven directional control valve having the active flow state.

17. The assembly of claim 16, wherein each of the hydraulic circuits comprises a pair of discharge hydraulically-driven directional control valves, a first of discharge hydraulically-driven directional control valves connected to the open output and having a default open state and an active close state, the default open state communicating with a discharge, a second of the discharge hydraulically-driven directional control valves connected to the close output of the close hydraulically-driven directional control valve and having a default closed state and an active opened state, the active opened state communicating with the discharge, the discharge hydraulically-driven directional control valves each having the respective default state in response to the electrically-driven directional control valve having the default no-flow state and each having the respective active state in response to the electrically-driven directional control valve having the active flow state.

18. The assembly of claim 16, wherein each close output comprises a pilot-operated check valve piloted by the respective open output.

19. An assembly used with a buffer manifold for relieving pressure of fluid flow in a drilling system, the drilling system having a pneumatic supply, the buffer manifold having one or more flow inlets, one or more flow outlets, and first and second pressure relief valves, the one or more flow inlets disposed in fluid communication with an upstream portion the drilling system and receiving the fluid flow therefrom, the one or more flow outlets disposed in fluid communication with a downstream portion the drilling system and delivering the fluid flow thereto, the first and second pressure relief valves disposed in fluid communication between the one or more flow inlets and the one or more flow outlets and disposed in fluid communication with at least one discharge outlet, each of the first and second pressure relief valves operable to open and close fluid communication with the at least one discharge outlet, wherein the control assembly comprises:

a hydraulic arrangement operably connected to the first and second pressure relief valves and connected to the pneumatic supply, the hydraulic arrangement powered by the pneumatic supply and providing hydraulic motive force in two hydraulic circuits respectively to the first and second pressure relief valves, the two hydraulic circuits being cross-connected to one another;

a plurality of sensors distributed in the hydraulic arrangement and measuring a plurality of operational parameters of the hydraulic arrangement; and

a pair of controllers operably connected to the hydraulic arrangement, each of the controllers receiving the operational parameters from the sensors and receiving a pressure level measurement of the drilling system, both of the controllers controlling the hydraulic motive force provided in the two hydraulic circuits respectively to the first and second pressure relief valves to open and close the first and second pressure relief valves in response to the pressure level measurement.

20. A method of controlling fluid flow in a drilling system, the method comprising:

receiving the fluid flow from an upstream portion of the drilling system at one or more flow inlets of a manifold assembly;

in response to a first pressure level measurement of the drilling system, flowing the fluid flow out one or more flow outlets of the manifold assembly to a first downstream portion of the drilling system in response thereto;

in response to a second pressure level measurement of the drilling system, flowing the fluid flow out at least one discharge outlet of the manifold assembly to a second downstream portion of the drilling system, instead of out the one or more flow outlets, by simultaneously controlling, with controllers, hydraulic motive force provided in hydraulic circuits respectively to pressure relief valves to independently open the respective pressure relief valve;

in response to a first failure condition of either one of the controllers, independently controlling, with the other one of the controllers, the hydraulic motive force provided in the hydraulic circuits respectively to the pressure relief valves to simultaneously open and close the respective pressure relief valves in response to the first and second pressure level measurements; and

in response to a second failure condition of either one of the hydraulic circuits, automatically faulting either one of the pressure relief valves closed regardless of the first and second pressure level measurements.