Keeping a Lid On Blowouts

As industrial accidents go, a blowout in offshore natural gas or oil exploration surely ranks among the worst. When not contained, a blowout can release high pressure gasses that are frequently toxic and flammable, resulting in environmental damage and possible fatalities. Keeping a lid on these events requires a combination of the right hardware and control strategy.

By Eric Milne, Hydril April 1, 2008

As industrial accidents go, a blowout in offshore natural gas or oil exploration surely ranks among the worst. When not contained, a blowout can release high pressure gasses that are frequently toxic and flammable, resulting in environmental damage and possible fatalities. Keeping a lid on these events requires a combination of the right hardware and control strategy.

Offshore drilling is a complex process. A drill pipe or drill string extends from the drilling rig down thousands of feet to the wellhead and into the wellbore on the sea floor directly beneath. This drill string is contained within a riser, or solid casing, to create an enclosed space. Inside the riser is drilling mud, a fluid mixture whose sheer weight is intended to contain any upsurge from the highly pressurized formations that are the ultimate target.

But sometimes the “kick” from the newly released hydrocarbons can literally push the drilling mud up the drill string and riser. If not blocked by heavier mud or stopped by a pressure control system, the oil or gas can rush up the pipe and emerge like a geyser on top of the rig. This is a blowout, and on something as small as a drilling platform, it is a disaster.

Containing blowouts

Thankfully, blowouts are rare today. This stems in large part from the emergence of sophisticated and robust pressure control devices called blowout preventers (BOPs), controlled by real-time computing networks. Hydril LLC invented the first hydraulically operated BOP as well as the annular BOP, which features an opening lined with high-strength rubber that narrows or widens to control oil or gas flow.

Hydril’s reputation for such inventions goes back into the 1930’s, and still today the company is a leader in the design and manufacture of BOPs and drilling control systems. Hydril products are used worldwide, at drilling sites with the most extreme environments in terms of depth and wellbore pressure and temperature.

One major development goal has been to provide multiple levels of backup protection. Current designs achieve this by integrating three separate software disciplines — real-time operating systems (RTOSs), embedded high-availability database systems, and enterprise-style SQL server database management — into a single control system.

The enterprise database, Microsoft’s SQL Server, lives on the rig and is used for archiving, reporting and troubleshooting functions. The embedded database, McObject’s eXtremeDB High Availability, runs on QNX’s Neutrino RTOS within the individual controllers, both on the rig and subsea, and provides duplicate “working copies” of data to support real-time processes.

Hydril’s objective is to produce the safe and reliable BOPs and drilling control systems for the industry. The real risk takers are the specialist contractors who do exploratory drilling to determine whether or not there is a resource worth extracting. The initial drilling is critical since, much less is known about what’s underground, and surprises can be greatest. These contractors are the most concerned about having failsafe solutions should the oil or gas within the wellbore deliver an unanticipated kick.

A pressure control system’s key hardware is the BOP, which is essentially a large, heavy valve to contain pressure. A system will use multiple, specialized BOPs, configured in a vertical stack that sits on top of the well head. Above the stack are redundant BOP control pods, each consisting of a lower unit containing hydraulics to control the BOPs, and an upper electronics housing (EH). The EH is contained in a three-inch thick steel domed container to protect sensitive electronics gear from the surrounding water pressure. The pod also controls solenoids that operate hydraulic valves on the BOP.

Drilling a complex process

During operation, each redundant Pod continuously gathers data from remote sensors, including:

Temperature and pressure in the wellbore — Obviously it is very cold at depths of 10,000 feet, but the energy used in drilling can generate temperatures as high as 82–176 °C (180 – 350°F) or higher. Sensors in the wellbore capable of measuring both high temperatures and high pressures monitor pressure spikes to help predict and control kicks.

Positioning — The stack should remain vertical, with the riser extending straight to the surface, but environmental conditions and positioning of the drilling vessel can make this a challenge. A KVH fiber optic gyro within the pod’s electronics housing monitors stack rotation, while inclinometers measure tilt. If the riser is in an unacceptable position with regards to either the stack or the surface vessel, a dynamic positioning system on the rig corrects the problem.

Fluid Levels — Electronics and saltwater do not mix well, thus the need for the 3-inch-thick, one-atmosphere electronics housing. If water monitors and liquid level detectors within the pod indicate water, operators can power down the electronics from the surface prior to damaging any equipment. The standby pod then takes over primary control of the stack.

Solenoid current — Every stack function is controlled via solenoid actuation within the pods. For example, if the pod sends a signal to fire any one of a number of solenoids to open or close BOP valves, current through every solenoid must be monitored to verify proper operation.

Pressure — BOP hydraulic pressure must exceed the hydrostatic pressure exerted by the surrounding water to ensure proper operation, and even higher pressure is required to ensure shearing of the pipe if and when severe measures are needed. Each pod monitors up to 20 pressure transducers to maintain proper operating pressures.

Electrical states — Power for the pods is generated on the surface, cleaned of spikes and noise, converted to 720 V or 480 V, and transmitted subsea to the pod, where transformers reduce it to a variety of voltages to operate the electronics. Power levels are constantly monitored.

Pod temperature — Electronics are also sensitive to heat which can degrade performance. Each pod monitors air temperature within the electronics housing as well as processor core temperature. Temperatures in the electronics housing are typically not a problem subsea due the presence of the world’s largest heat sink (the ocean). However when the stack and pods are on the surface, the dome can exceed 60 °C.

Data where it’s needed

All of this collected data has to be in the right place, at the right time. To improve data management efficiency, we found it useful to think of the system in terms of three streams:

First, data collected by sensors moves to local data storage on the controllers. The primary controllers within the pods are Intel x86-based, with serial, digital, and analog I/O boards for communication. Gear on the surface includes industrial-rated, passive-backplane, single-board controllers, some of which include PCI- and ISA-based serial, digital, and analog I/O boards. The surface-based display station controllers typically use touch screen monitors with the QNX Neutrino RTOS’s Photon graphical interface.

Second, data must travel from the controllers to the archival Microsoft SQL server database. Access to SQL server is facilitated using Easysoft’s open database connectivity (ODBC) bridge technology for QNX.

The third flow is directed from the operator working at the display station controller HMI, to the controllers that are responsible for operating parts of the system. For example, when the operator pushes a button, that action is recorded in the display station’s local data storage, and it also triggers a remote procedure call causing the appropriate controller to do something such as opening a valve.

Local data storage on the controllers is provided by eXtremeDB-HA. Using a third-party’s database means that the database logic and application logic are inherently separate, which enforces software modularity. This promises to ease future upgrades and maintenance to the system.

The databases and their interaction are all configured to ensure high availability. The database itself is an in-memory DBMS: it stores data records in memory at all times, for real-time access (disk and file I/O are eliminated). However, databases are replicated on every controller, and eXtremeDB’s high-availability (HA) subsystem automatically propagates changes from the primary database to the secondary, backup database. Any database update action occurs within the scope of a database transaction, to guarantee that physically separate data stores remain in synch.

The HA mechanism also replicates selected data between controllers. In addition, the entire control system is designed for redundancy via a secondary network of controllers, with the database managing updates between networks. This replication of vital system data, at multiple levels and with automatic fail-over, provides the highest degree of reliability.

The database also provides the core messaging component in our system by using remote access interfaces, which enable controllers and software components to read from, and write to, databases at every network node. The database high availability mechanism is integral to this update process, which ensures that whatever happens on one controller gets reflected on all other parts of the system. Underneath the messaging layer, QNX Neutrino’s networking support with transparent distributed processing (TDP) simplifies the coordination of system nodes by enabling all network devices to recognize one another and share information in a peer-to-peer fashion, regardless of their location.

This redundancy, and the need to update system elements with mission critical information, makes for software complexity, but a well-functioning pressure control system keeps the drilling process on track and cuts downtime. This is a very high priority since drilling operators can lose millions of dollars per day for a rig that is not drilling. Therefore high reliability and availability along with safety are Hydril’s key design considerations. Our new system’s seamless integration of RTOS technology, multiple replicated HA embedded databases, and an archival SQL server database, advances these goals to a point that can justifiably be termed state-of-the-art.

Author Information

Eric Milne is electrical and software chief engineer at Hydril. Reach him at emilne@hydril.com .