Abstract:
A high integrity protection system (HIPS) for protection of a gathering line downstream of a number of wellhead flow lines includes: an inlet; an outlet; two sets of two series-connected isolation valves (ZVs) in fluid communication with the inlet and outlet, the two sets being in parallel fluid flow relation to each other, either one or both of the sets of ZVs operable as a path for fluid entering the inlet and passing through the outlet to the downstream pipe; two vent control valves (VCVs), each connected to piping intermediate one set of series-connected ZVs, the VCVs being in fluid communication with a vent line, whereby, upon opening of a VCV, process pressure between the two ZVs is vented; a signal-generating safety logic solver, in accordance with preprogrammed safety and operational protocols; and pressure sensing transmitters attached to piping upstream of the HIPS outlet. The system allows full-stroke, tight shut-off testing of the ZVs without interruption of wellhead production.

Description:
RELATED APPLICATIONS 
       [0001]    The present application is a Continuation-in-Part of U.S. patent application Ser. No. 11/648,312 filed on Dec. 29, 2006, which is incorporated herein by reference. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to a method and an apparatus for the operation and testing of a high integrity protection system (HIPS) connected to a production pipeline system. 
       BACKGROUND OF THE INVENTION 
       [0003]    In the oil and gas industry, production fluid pipelines downstream of the wellhead are generally designed to withstand the maximum wellhead shut-in pressure. However, when fully-rated piping or conventional relief systems are not practical, it becomes necessary to protect the pipelines against excessive pressure that might rupture the pipe, which would be very expensive to replace and cause environmental pollution. A conventional system used to protect pipelines from over-pressure is the high integrity protection system (HIPS). This is typically an electro-hydraulic system employing pressure sensors to measure the pressure in the pipes, which are used by the electronics of a control module to control the closure of a production pipe HIPS valve(s). This arrangement retains the high pressure within a short section of pipeline between the production tree and the HIPS valve which is capable of withstanding the pressure. This prevents the main, lower-pressure rated section of the pipeline from being exposed to pressure levels which may exceed the pipeline&#39;s pressure rating. 
         [0004]    It is a necessary requirement that the safety of the HIPS be tested regularly since a malfunction in operation of the HIPS presents the risk of significant damage to the pipeline. The conventional system cannot be tested during its operation. Thus, the production system has to cease operations and be isolated for the test. The interruption of operations has serious financial implications. In addition, at least one operator has to be close to the HIPS during the test, since operations of valves and other components are manually performed. 
         [0005]    Various approaches have been proposed for testing and protecting valves and pipeline systems from overpressure. For example, published application US2005/0199286 to Appleford et al. discloses a high integrity pressure protection system in which two modules connected to two downstream pipelines and two upstream pipelines have inlet and outlet ports. A conduit circuit connects the two ports and a docking manifold is installed in the pipeline between upstream and downstream portions. The docking manifold selectively routes flows in each of the first and second pipelines through the first or second module. The system permits routing of flows from upstream regions of both of the pipelines through one of the module and then to a downstream region of one of the pipelines to permit the other module to be removed for maintenance, repair and/or replacement. There is no disclosure or suggestion of an apparatus or method for testing the operation of the system while it is in operation. 
         [0006]    U.S. Pat. No. 6,591,201 to Hyde discloses a fluid energy pulse test system in which energy pulses are utilized to test dynamic performance characteristics of fluid control devices and systems, like gas-lift valves. This test system is useful for testing surface safety valves in hydraulic circuits, but does not provide safety information of the overall system&#39;s ability to perform safety function. 
         [0007]    U.S. Pat. No. 6,880,567 to Klaver et al. discloses a system that includes sensors, a safety control system and shut off valves used for protecting downstream process equipment from overpressure. This system utilizes a partial-stroke testing method in which block valves are closed until a predetermined point and then reopened. This system, however, has to interrupt production for the diagnostic testing. 
         [0008]    U.S. Pat. No. 7,044,156 to Webster discloses a pipeline protection system in which pressure of fluid in a section of pipeline that exceeds a reference pressure of the hydraulic fluid supplied to a differential pressure valve, the differential pressure valve is opened, and thereby causes the hydraulic pressure in the hydraulically actuated valve to be released via a vent. The protection system, however, does not provide any valve diagnostic means and is forced to interrupt the production for shut off valves to be fully closed. 
         [0009]    U.S. Pat. No. 5,524,484 to Sullivan discloses a solenoid-operated valve diagnostic system which permits the valve user with the ability to monitor the condition of the valve in service over time to detect any degradation or problems in the valve and its components and correct them before a failure of the valve occurs. This system does not permit a testing of shut off valves without an interruption of production. 
         [0010]    U.S. Pat. No. 4,903,529 to Hodge discloses a method for testing a hydraulic fluid system in which a portable analyzing apparatus has a supply of hydraulic fluid, an outlet conduit, a unit for supplying hydraulic fluid under pressure from the supply to the outlet conduit, a return conduit communicating with the supply, a fluid pressure monitor connected to the outlet conduit, and a fluid flow monitor in the return conduit. The analyzing apparatus disconnects the fluid inlet of the device from the source and connects the fluid inlet to the outlet conduit, and disconnects the fluid outlet of the device from the reservoir and connects that fluid outlet to the return conduit. Fluid pressure is monitored in the outlet conduit and the flow of fluid through the return conduit with the unit in place in the system. This method, however, requires that the production be interrupted for the testing of the hydraulic system. 
         [0011]    U.S. Pat. No. 4,174,829 to Roark, et al. discloses a pressure sensing safety device in which a transducer produces an electrical signal in proportion to a sensed pressure and a pilot device indicates a sensing out-of-range pressure when the sensed pressure exceeds a predetermined range, which permits an appropriate remedial action to be taken if necessary. The device requires operators intervention. 
         [0012]    U.S. Pat. No. 4,215,746 to Hallden et al. discloses a pressure responsive safety system for fluid lines which shuts in a well in the event of unusual pressure conditions in the production line of the well. Once the safety valve has closed, a controller for detecting when the pressure is within a predetermined range is latched out of service and must be manually reset before the safety valve can be opened. The system results in an interruption of production and operators intervention. 
         [0013]    The parent application, U.S. patent application Ser. No. 11/648,312, which is incorporated herein by reference, provides a wellhead high integrity protection system that is directed to a flow line from a single wellhead. However, a unique problem arises in the context of a group of wellhead flow lines that feed into a gathering line. The flow lines can join the gathering line at a common header, or can join the gathering line at a number of points along the gathering line. In such a system, it may not be desirable to test and protect each flow line that feeds into the header. 
         [0014]    It is therefore an object of the present invention to provide an apparatus and a method for testing a HIPS in operation with a gathering line receiving fluid flow from a group of flow lines, where the HIPS operates to provide a path for fluid flow without shutting down the gathering line to which it is connected. 
         [0015]    Another object is to provide an apparatus and a method for automatically testing a HIPS without the intervention of an operator. 
         [0016]    The unit is preferably provided with standardized flanges and is integrally constructed. 
       SUMMARY OF THE INVENTION 
       [0017]    The above objects, as well as other advantages described below, are achieved by the method and apparatus of the invention which provides a high integrity protection system (HIPS) which protects and tests the control of a piping system connected to a group of wellheads. 
         [0018]    In one embodiment, a group of flow lines feed into a gathering line, either joining the gathering line at a single point through a header, or joining the gathering line at multiple points along the gathering line. A HIPS of the present invention has an inlet for receiving fluid flow from a portion of the gathering line upstream of the HIPS, and the HIPS has an outlet for connection to a portion of the gathering line downstream of the HIPS. 
         [0019]    In a preferred embodiment, a HIPS is constructed as a skid-mounted integral system for transportation to the site where it is to be installed. 
         [0020]    The HIPS comprises two sets of isolation valves (ZVs), two vent control valves (VCVS) and a safety logic solver. When the HIPS is used with a single wellhead flow line, the isolation valves are termed surface safety valves (SSVs). However, in the broader context, and in an application of the HIPS to a gathering line, the more general terminology isolation valve (ZV) is appropriate. 
         [0021]    The two sets of ZVs are in fluid communication with the inlet, and the two sets are in parallel with each other. Each set of ZVs has two ZVs in series, and either one or both of the two sets of ZVs is operable as a path for fluid entering the inlet and passing through the HIPS outlet for the piping system. Each of the VCVs is connected to piping intermediate the two sets of ZVs, and each of the VCVs is in fluid communication with a vent line, which upon opening of a VCV vents process pressure between the two ZVs. The safety logic solver is in communication with the ZVs and the VCVs and produces signals to control the operation of the ZVs and VCVs. The VCVs are preferably electrically operated. 
         [0022]    The pressure sensing transmitters monitor the fluid pressure on a section of piping upstream of the HIPS outlet. In a preferred embodiment, three pressure transmitters are provided on the outlet. The logic solver is programmed to transmit a signal to close the ZVs upon an increase in pressure above a threshold value transmitted by at least two of the three pressure sensors. As will be apparent to one of ordinary skill in the art, more or less than three pressure sensors can be employed in this part of the system. 
         [0023]    Each of the two VCVs is connected to a pipe that is in fluid communication with a common vent line. The vent line can be connected to a reservoir tank or other storage or recirculating means. Each set of ZVs is operable independently of the operation of the parallel set of ZVs. Pressure sensing transmitters are positioned for monitoring the pressure between the ZVs in each of the two sets of ZVs. 
         [0024]    In a preferred embodiment, the safety logic solver is programmed to maintain one set of the ZVs in an open position when the parallel set of ZVs is moved to a closed position from an open position during a full-stroke test. In addition, the safety logic solver is programmed to measure and record the pressure between a pair of the closed ZVs during a tight shut-off test, and to open the VCV between the closed ZVs for a short period of time during the test to relieve or reduce the line pressure. 
         [0025]    In another preferred embodiment, the safety logic solver is programmed to generate a failure signal during the tight shut-off test period if the pressure between the closed and vented ZVs rises above a predetermined threshold value following closing of the VCV. In still another preferred embodiment, the safety logic solver is programmed to designate the closed ZVs for use as an operating set of ZVs if, during the test period, the pressure between the closed ZVs does not rise above a predetermined threshold value. 
         [0026]    The VCVs are closed during normal operations and during a full-stroke test. 
         [0027]    The HIPS of the invention further comprises manual shut-off valves positioned upstream and downstream of each of the parallel sets of ZVs, which can be used to isolate each of the ZV sets from the piping system, e.g., for maintenance, repairs and/or replacement of system components. 
         [0028]    In a preferred embodiment for a HIPS that has an inlet for connection to a wellhead and an outlet for connection to a downstream outlet pipe, the ZVs are provided with electric failsafe valve actuators, whereby all of the valves are moved to a closed position in the event of a power failure. This would result in a termination of all fluid flow in the outlet pipe downstream of the HIPS. As will be apparent to those of ordinary skill in the art, this type of failsafe shut down would be coordinated with similar shut down requirements at the wellhead or elsewhere upstream of the HIPS. 
         [0029]    In another aspect of the invention, a method is provided to test the operational safety of a HIPS that has an inlet for connection to a wellhead flow line and an outlet for connection to a downstream outlet pipe, with the outlet pipe connecting to a common gathering line. The HIPS has first and second sets of isolation valves (ZVs) in fluid communication with the piping system, and the two sets are in parallel with each other. Each set of ZVs has two ZVs in series, and the ZVs are operable in response to signals from a safety logic solver as was described in detail above. 
         [0030]    The first set of ZVs moves from an open position to a closed position for a tight shut-off safety test while the second set of ZVs is open as a fluid path for the pipeline system. 
         [0031]    A transmitter positioned between the closed ZVs transmits a signal to the safety logic solver that corresponds to the pressure of fluid in the piping between the two closed valves. The VCV located between the closed set of ZVs vents the pressurized fluid between the closed ZVs at the beginning of the safety test. The vented fluid is preferably passed to a reservoir. An alarm signal is actuated if the first set of ZVs do not maintain the pressure in piping between the ZVs at or below a predetermined threshold level during a predetermined shut down time. 
         [0032]    The pressure, e.g., in PSI, of the fluid in the section of piping between each set of ZVs is recorded before and during the safety shutoff testing of the valves. A graphic display of the recorded pressure is preferably provided to assist operating personnel in evaluating the performance of the system in real time during the test. 
         [0033]    The second set of ZVs remains open while the first set of ZVs return to the fully open position. If the first set of ZVs do not open fully, an alarm signal is actuated. Each of the two sets of isolation valves is provided with a vent control valve (VCV). The VCV connected to the first set of ZVs opens for a predetermined period of time to effect the pressure venting after the first set of ZVs are fully closed. 
         [0034]    The first set of ZVs are moved to the open position and the second set of ZVs are moved to the closed position. The pressure between the ZVs of the second set of ZVs is measured and an alarm signal is actuated if the second set of ZVs do not maintain the pressure in the intermediate piping at or below a predetermined level. 
         [0035]    In another aspect of the invention, a method is provided to test the operational safety of a HIPS that is placed along a common production pipeline that has upstream connections from a group of wellheads and their associated feeder pipes. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0036]    The present invention will be further described below and in conjunction with the accompanying drawings in which: 
           [0037]      FIG. 1  is a schematic diagram of a high integrity protection system (HIPS) in accordance with the invention that is connected to a wellhead and a downstream pipeline; 
           [0038]      FIG. 2  is a flowchart of the process steps for a tight shut-off test on the HIPS of  FIG. 1 ; 
           [0039]      FIG. 3  is a comparative illustrative graphic display illustrating both a satisfactory and a failed pressure test of a pair of isolation valves (ZVs) during the tight shut-off test; 
           [0040]      FIG. 4  is a schematic illustration of a plurality of wellhead flow lines connected to a common gathering line in which certain flow lines include the HIPS of  FIGS. 1 ; and 
           [0041]      FIG. 5  is a schematic illustration of a plurality of wellhead flow lines connected to a header that in turn connects to a common gathering line, in which the gathering line includes the HIPS of  FIG. 1 . 
       
    
    
       [0042]    To facilitate an understanding of the invention, the same reference numerals have been used, when appropriate, to designate the same or similar elements that are common to the figures. Unless stated otherwise, the features shown and described in the figures are not drawn to scale, but are shown for illustrative purposes only. 
       DETAILED DESCRIPTION OF THE INVENTION 
       [0043]    Referring to  FIG. 1 , a high integrity protection system (HIPS)  10  is installed in proximity to a wellhead in a piping system to convey a pressurized fluid product, such as oil or gas, from the wellhead  102  to a remote host location via pipeline  104 . The HIPS has an inlet  1  connected to the wellhead piping  102  and an outlet  2  connected to piping system  104  through which the liquid product enters and exits the HIPS  10 . The HIPS is preferably skid-mounted for delivery to the site of the wellhead and is provided with appropriate flanges and adapters, if necessary, for attachment to the inlet and outlet to the oil field piping. 
         [0044]    Two sets of isolation valves (ZVs)  11 ,  12  and  13 ,  14  are in fluid communication with the inlet  1  and the outlet  2  are thereby operable as a path for the fluid product. Each set of ZVs, identified and referred to as ZV- 1  and ZV- 2 , has two ZVs  11 - 12  and  13 - 14 , respectively, which are connected in series. The ZVs close automatically in the absence of power being supplied to them and are maintained in an open position by conventional hydraulically or electrically powered actuators to protect the downstream piping system  104  from abnormal operational conditions. 
         [0045]    Two vent control valves (VCVs)  41 ,  42  are connected to the piping intermediate the two set of ZVs  11 ,  12  and  13 ,  14 , respectively, and are in fluid communication with a vent line  106 . The vent line  106  is in fluid communication with a fluid reservoir  70  that serves as a closed collection system tank. Alternatively, the vent line can be routed to a burn pit (not shown) near the well site. The VCVs  41 ,  42  upon their opening can vent pressurized fluid between the two ZVs into the vent line  106 . Valves  71 ,  72  and  81  control supply of hydraulic pressure by the pressure reservoir via their opening and closing. When the valve  81  is opened, pressurized nitrogen from the tank  80  forces fluid out of the reservoir  70 , either into the HIPS pipeline or via valve  72  for alternate use or disposed. The VCVs  41 ,  42  vent pressurized fluid from between the two ZVs into the vent line upon their opening. Pressure sensing transmitters  54 , 55  are located between the respective ZVs to determine the fluid pressure between the two ZVs. Multiple pressure sensing transmitters can optionally be installed at locations  54  and  55  to assure reliability and as back-ups to the test system. 
         [0046]    Pressure sensing transmitters  51 ,  52 ,  53  are installed upstream of the outlet  2  to monitor the fluid pressure exiting the HIPS from outlet  2 . The three transmitters are monitored by the safety logic solver  31 . If any two of three transmitters  51 - 53  sense a pressure rise above a predetermined threshold value, the logic solver  31  automatically shuts in the well via the ZVs  11 - 14 , thereby protecting the downstream pipeline from excessive pressure. 
         [0047]    A safety logic solver  31 , which is preferably a software module preprogrammed in a computer or the like, is in communication with the ZVs  11 - 14 , VCVs  41 ,  42 , and pressure sensing transmitters  51 - 55  via a hard-wired connection or by wireless transmitters. The safety logic solver  31  produces and transmits signals to control the operation of the ZVs  11 - 14  and VCVs  41 ,  42 . The control is performed based on pressure data from the pressure sensing transmitters  51 - 55 . 
         [0048]    Manual valves  61 - 64  are installed between inlet  1  and outlet  2  and ZVs  11 - 14  to isolate the two sets of ZVs  11 - 14  from the piping system in case of an emergency and also so that the system can be shut down manually for repair and/or replacement of any of its components. 
         [0049]    All valves are operated by conventional valve actuators (not shown) such as those that are well known to art. The valve actuators and pressure transmitters  51 - 55  have self-diagnostic capabilities and communicate any faults to the safety logic solver  31  that are detected. 
         [0050]    The method for conducting the shut-off test and full-stroke test in accordance with the invention will be described with reference to  FIG. 2 . Before the commencement of the test, a safety check of the HIPS piping system is made. If the fluid pressure exceeds a predetermined threshold level (S 10 ), all ZVs are closed (S 20 ). Otherwise, the first set of ZVs  11 ,  12  are closed and the second set of ZVs  13 ,  14  remain opened (S 30 ). 
         [0051]    The first set of ZVs  11 ,  12  are then opened to prepare for a test of the second set of ZVs  13 ,  14  (S  40 ). It is determined whether the first set of ZVs  11 ,  12  which are used as a fluid path during the shut-off test of the second set of ZVs  13 ,  14  are fully opened (S 50 ). If the first set of ZVs  11 ,  12  are not fully opened, an alarm signal is actuated and the test is terminated (S 60 ). If the first set of ZVs  11 ,  12  are fully opened, the second set of ZVs  13 ,  14  are closed (S 70 ). The full closing of the ZVs  13 ,  14  to be tested are checked for the preparation of the tight shut-off test (S 80 ). If the ZVs  13 ,  14  are not fully closed, an alarm signal is actuated (S 90 ) and the test is terminated. 
         [0052]    If the ZVs  13 ,  14  are fully closed, the tight shut-off test of the ZVs  13 ,  14  is initiated. The VCV  42  located intermediate the second set of ZVs  13 ,  14  is opened to reduce the pressure between the ZVs  13 ,  14  to a stable value (S 100 ). 
         [0053]    The VCV  42  is then closed and the pressure sealing of VCV  42  is checked (S 110 ). If the VCV  42  is not fully closed, or the valve is leaking so that pressure continues to drop in the vented section of pipe between the valves, an alarm signal is actuated (S 120 ) and appropriate remedial action is taken. If the VCV  42  is fully closed, the pressure between the ZVs  13 ,  14  is measured (S 130 ). The pressure between the ZVs  13 ,  14  continues to be monitored by the pressure transmitter  55  and the result is sent to the safety logic solver  31  during the tight shut-off test up to the end of the tight shut-off test period (S 140 ). 
         [0054]    The data obtained during the tight shut-off test is graphically represented for two different scenarios in  FIG. 3 . When the VCV  42  is opened, the pressure between the ZVs  13 ,  14  drops from a normal operating pressure to a lower pressure and the VCV  42  is fully closed. If the pressure between ZVs  13 ,  14  rises, that is deemed to be evidence that there is leakage in one or both of ZVs  13 ,  14 . Since some minimal amount of leakage may be acceptable, it must be determined whether a pressure increase, or the rate of pressure increase, exceeds a predetermined threshold level during or after the period of the tight shut-off test (S 150 ). If during the test period, the pressure rises above the threshold level, it indicates a failure in the ability of the ZVs  13 ,  14  to seat completely and an alarm signal is actuated by the safety logic solver  31  which notifies of the failure of the tight shut-off test of the ZVs  13 ,  14  (S 160 ). If during the test period, the pressure increase does not exceed the threshold level, the second set of ZVs  13 ,  14  pass the tight shut-off test. The first set of ZVs  11 ,  12 , were in an open position providing a flowpath for production during the tight shut-off testing of ZVs  13 ,  14  (S 170 ). To complete the system functional testing, the second set of ZVs  13 ,  14 , which passed the tight shut-off test, are opened again and used as a fluid path (S 180 ). 
         [0055]    As will be apparent from the above description, the first set of ZVs  11 ,  12  is tested using substantially the same methodology. 
         [0056]    The present invention enables the HIPS to operate continuously as a fluid path while a tight shut-off and a full-stroke test is performed, and while any necessary protective action can be taken. The automatic operation by the safety logic solver assures that emergency shut-off conditions will be carried out, even during a test. A record of the test is stored and can be recovered later or displayed electronically and/or in printed graphic form or as tabulated data. 
         [0057]    Referring now to  FIG. 4 , a system  400  includes a plurality of wellhead flow lines  402  and  402 ′ that are typically connected to a common gathering line to transport oil/gas from wells to a gas oil separation plant (GOSP)  404 . Flow lines  402  each include associated therewith a HIPS  406 , e.g., including an SLS, pressure transmitters and ZVs as shown in  FIG. 1 . High pressure rated piping is used between each well and the ZV of the associated HIPS  406 , and conventional piping is used downstream of the ZV of the HIPS  406 , which is rated for a lower pressure and suitable for the transportation and distribution of the product. In certain systems  400 , additional wellhead flow lines  402 ′ are provided that do not show an associated HIPS  406 , although other protection and/or safety systems can be used for these wellheads as is within the ordinary skill of one in the art. 
         [0058]    Referring now to  FIG. 5 , a system  500  includes a plurality of wellhead flow lines  402 ,  402 ′ and  502  that are typically connected to a common gathering line to transport the oil/gas to a gas oil separation plant (GOSP)  404 . Wellhead flow lines  402  and  402 ′ join the gathering line at individual points on the gathering line. Flow lines  402  are each provided with a HIPS  406 , e.g., including an SLS, pressure transmitters, and ZVs as shown in  FIG. 1 . Flow lines  402 ′ are not protected by a HIPS  406 , although other protection and/or safety systems can be used for these wellhead flow lines, as is within the ordinary skill of one in the art. Additional flow lines  502  do not join the gathering line at individual points on the gathering line, but rather are connected to a common header  508 , the outlet of which connects to a single point on the gathering line. A single HIPS  506 , including an SLS, pressure transmitters and ZVs as shown in  FIG. 1 , is positioned downstream of the common header  508 . The upstream piping and HIPS  506  is fully rated for the connected high-pressure wells. The HIPS  506  protects the downstream piping, which can therefore be specified as lower-pressure pipe. 
         [0059]    Although various embodiments that incorporate the teachings of the present invention have been shown and described in detail, other and varied embodiments will be apparent to those of ordinary skill in the art and the scope of the invention is to be determined by the claims that follow.