Blowout preventer control system and methods for controlling a blowout preventer

Abstract

A blowout preventer system includes a lower blowout preventer (BOP) stack including a number of hydraulic components, and a lower marine riser package (LMRP) including a first control pod and a second control pod adapted to provide, during use, redundant control of hydraulic components of the lower blowout preventer stack where the first and the second control pods are adapted to being connected, during use, to a surface control system and to be controlled, during use, by the surface control system, wherein the blowout preventer system further includes at least one additional control pod connected to at least one additional surface control system and to be controlled, during use, by the additional surface control system. In this way, an improved blowout preventer system is provided.

Claims

1. A blowout preventer system comprising: a lower blowout preventer stack comprising a set of hydraulic components, a lower marine riser package comprising a first control pod and a second control pod, wherein the first and the second control pods being adapted to provide, during use, redundant control of the set of hydraulic components of the lower blowout preventer stack, and to be connected, during use, to a main surface control system on a boat or vessel and to be controlled, during use, by the surface control system, the lower blowout preventer stack comprising an additional control pod, wherein the additional control pod being adapted to be connected to an additional surface control system and to be controlled, during use, by the additional surface control system to provide control of at least a part of the set of hydraulic components of the lower blowout preventer stack, and wherein the main surface control system and the additional surface control system are separate from each other and are both operable from the boat or vessel.

2. The blowout preventer system according to claim 1, wherein the first and second control pods are each capable of performing a number of functions and the additional control pod is capable of performing a fewer number of functions compared to the number of functions supported by the first and second control pods.

3. The blowout preventer system according to claim 2, wherein the fewer number of functions includes a subset of functions compared to the number of functions supported by the first and second control pods.

4. The blowout preventer system according to claim 1, wherein the blowout preventer system further comprises an acoustic control pod, and wherein the additional control pod comprises or is integrated with the acoustic control pod.

5. The blowout preventer system according to claim 1, wherein the additional surface control system is adapted, during use, to monitor one or more functions of the lower blowout preventer stack.

6. The blowout preventer system according to claim 1, wherein the blowout preventer system further comprises an additional subsea control unit connected to the additional control pod, wherein the additional subsea control unit is adapted to control, during use, the additional control pod and wherein the additional subsea control unit is further connected to the additional surface control system.

7. The blowout preventer system according to claim 6, wherein the additional subsea control unit is adapted, during use, to monitor one or more functions of the lower blowout preventer stack.

8. The blowout preventer system according to claim 1, wherein the additional surface control system, during use, is adapted to receive one or more sensor signals from one or more units selected from the group consisting of: the surface control system, a surface flow meter, measuring one or more current flows of hydraulic fluid to the lower blowout preventer stack, the lower marine riser package, a pressure transmitter located on the lower marine riser package, a power hub of the lower marine riser package, and a communication hub of the lower marine riser package.

9. The blowout preventer system according to claim 6, wherein the additional subsea control unit is adapted to receive one or more input signals, during use, from one or more units selected from the group consisting of: a power hub of the lower marine riser package, a communication hub of the lower marine riser package, a position and pressure sensor of the lower blowout preventer stack, a pressure transmitter of the lower blowout preventer stack, a pressure transmitter of an autoshear hydraulic circuit, a pressure transmitter of a deadman hydraulic circuit, one or more pressure transmitters of a closing shear ram circuit, and one or more pressure transmitters of a blind shear ram circuit, and wherein the additional subsea control unit is adapted to initiate, during use, one or more safety instrumented functions in response to one or more of a control signal received from the additional surface control system and a control logic of the additional subsea control unit.

10. The blowout preventer system according to claim 1, wherein the additional surface control system is independent from the main surface control system controlling the first and second control pods of the lower marine riser package.

11. The blowout preventer system according to claim 10, wherein the signaling path for signals between the additional surface control system and the additional control pod is routed via the main surface control system controlling the first and second control pods.

12. The blowout preventer system according to claim 1, wherein the additional surface control system comprises at least a first control panel in a driller's house and a second control panel at a bridge of the boat or vessel.

13. The blowout preventer system according to claim 1, wherein one or more of the following, are SIL (safety integrity level) rated as a connected system: the additional surface control system, and the additional control pod.

14. The blowout preventer system according to claim 6, wherein one or more of the following, are SIL (safety integrity level) rated as a connected system: the additional subsea control unit, the additional surface control system, and the additional control pod.

15. The blowout preventer system according to claim 1, wherein the additional surface control system is adapted to automatically activate, during use, at least one safety instrumented function in response to one or more predetermined conditions.

16. The blowout preventer system according to claim 6, wherein the additional subsea control unit is adapted to activate, during use, at least one safety instrumented function in response to one or more predetermined conditions.

17. The blowout preventer system according to claim 1, wherein the main surface control system is connected to the first control pod via a first communication cable, and the second control pod via a second communication cable, wherein the additional surface control system is connected to the additional control pod via the first communication cable as well via the second communication cable.

18. The blowout preventer system according to claim 17, wherein the first communication cable is connected to a first subsea junction box being connected to the first control pod and the additional control pod, and the second communication cable is connected to a second subsea junction box being connected to the second control pod and the additional control pod, wherein the first and second subsea junction boxes are connected and further adapted to cross connect signals of one or more conductors of the first and second communication cables, respectively, and to cross connect one or more of signals of one or more conductors between the first junction subsea box and the additional control pod, and signals of one or more conductors between the second subsea junction box and the additional control pod.

19. The blowout preventer system according to claim 18, wherein a first part of the main surface control system is further adapted to control the second control pod, wherein a second part of the main surface control system is further adapted to control the first control pod, and wherein the additional surface control system is adapted to control the additional control pod selectively via the first or second communication cables.

20. The blowout preventer system according to claim 1, wherein communication lines between the main surface control system and the first and second control pods are independent of communication lines between the additional control pod and the additional surface control system.

21. The blowout preventer system according to claim 1, further comprising a set of valves that are controlled by the first control pod and the second control pod, and which valves control the hydraulic components in the lower blowout preventer stack; and wherein the additional control pod also is configured to control the set of valves that control the hydraulic components in the lower blowout preventer stack.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 schematically illustrates one embodiment of the invention implemented in a typical blowout preventer (BOP) system,

(2) FIG. 2 schematically illustrates a BOP control system according to one embodiment of the invention.

(3) FIG. 3 schematically illustrates a BOP control system according to one embodiment of the invention; and

(4) FIG. 4 schematically illustrates one exemplary implementation of subsea junction boxes for power, control and/or communication signals in the BOP control system.

DETAILED DESCRIPTION

(5) Various aspects and embodiments of a blowout preventer control system, a blowout preventer system, and methods for controlling a blowout preventer as disclosed herein will now be described with reference to the figures.

(6) When relative expressions such as “upper” and “lower”, “right” and “left”, “horizontal” and “vertical”, “clockwise” and “counter clockwise” or similar are used in the following terms, these refer to the appended figures and not necessarily to an actual situation of use (for lower BOP, upper BOP, upper and lower do also refer to an actual situation of use). The shown figures are schematic representations for which reason the configuration of the different structures as well as their relative dimensions are intended to serve illustrative purposes only.

(7) Some of the different components are only disclosed in relation to a single embodiment of the invention, but is meant to be included in the other embodiments without further explanation.

(8) FIG. 1 schematically illustrates one embodiment of the invention implemented in a typical blowout preventer (BOP) system.

(9) FIG. 1 illustrates a typical blowout preventer system (lower BOP stack and LMRP) 200 coupled to a wellhead 202 where an optional acoustic pod and one embodiment of one implementation of an additional control pod (denoted SIS pod) according to the present invention are also shown as will be explained further in the following.

(10) Blowout preventer system 200 comprises a lower BOP stack assembly 204 and an upper stack assembly (also denoted LMRP) 206. Lower BOP stack assembly 204 comprises a wellhead connector 208, ram blowout preventers 210, annular blowout preventer 212, choke and kill valves 214, and hydraulic accumulators 216. Sometimes the annular blowout preventer 212 is located on the LMRP.

(11) The LMRP 206 comprises annular blowout preventer 218, choke and kill connectors 220, riser adapter/flex joint 222, MUX controlled pods 310, 320, and LMRP connector 226. The LMRP connector 226 provides a releasable connection between the LMRP 206 and the lower BOP stack assembly 204.

(12) Hydraulic accumulators 216 are mounted to frame 228 that surrounds lower BOP stack assembly 204. There may also be hydraulic accumulators attached to the LMRP frame.

(13) One embodiment of possible controls for closing the BOP stack are illustrated identifying the MUX controlled YL and BL pods 310, 320, various ROV controls that may be utilized to allow an ROV to operate one or more of the BOPs (rams and/or annulars), choke/kill valves, connectors in the stack, a deadman function 365, and an acoustic pod 341. The acoustic pod 341 may e.g. be triggered remotely to initiate emergency functions like closing, isolating, and/or sealing the wellbore in case of an emergency or precautionary situation e.g. if the connections between the BL and YL pods and their surface control systems are disrupted.

(14) The blue and yellow pods BL, YL 310, 320 are located on a LMRP connected to a riser through which drilling operations are conducted. The blue/BL control pod 310 is shown to the left in FIG. 1 while the yellow/YL control pod 320 is shown to the right. These control pods contain electronics and valves that are used in the monitoring and control of a wide variety of functions related to drilling operations. The BL and YL pods that typically are used, provides redundant systems by having two similar/identical pods so that if there is a failure in one “on line” pod, e.g. a failure of electronics or of a valve, the other “standby” pod can be brought to an “on line” status, e.g. by a driller, to immediately perform the required actions or functions. The blue and yellow pods are throughout the present specification and in the accompanying claims also denoted first and second control pod. A control pod may sometimes also be referred to as an electro/hydraulic (E/H) pod.

(15) As mentioned, the retrieval of a control pod for replacement or for repair is a complex and expensive operation but is typically required even if the other pod is still functional. During use, the riser extends from the drill floor, e.g. from a boat or rig at the water's surface, down to the stack, “Tripping” out the riser is a long expensive process and LMRP retrieval typically requires such a “trip.”

(16) Many prior art deep water multiplexed BOP Control Systems include two identical systems either of which may control stack functions. One such system (but with additional novel features) is illustrated schematically in FIG. 1. This configuration (sans novel features) is commonly referred to as being “Dually Redundant”. Both systems may be active electronically and may have single or dually redundant sets of electronic controls. One of the systems including one of the pods is active hydraulically. The system that is active hydraulically is manually selected by a driller to be the active system or “Active Pod”. Each system, or pod, is equipped with a hydraulic conduit supply. This supply is run from a Hydraulic Pressure Unit (HPU) above the water surface to the pod that is mounted on the LMRP. A “Crossover Valve” may be actuated. This actuation diverts hydraulic fluid from the pod it is designed to supply to the redundant pod normally supplied by the other conduit. This “Crossover” function allows either pod to be supplied by either conduit. As mentioned, also mounted on the LMRP and/or the lower BOP stack are hydraulic accumulators 216.

(17) These accumulators supply hydraulic fluid for the stack functions at a consistent pressure so that a function is actuated according to a manufacturer's specifications.

(18) A typical prior art BOP control system regulates a well during drilling operations and continuously monitors the status of such operations. The BOP system includes a structure that incorporates hydraulically actuated well control safety devices and their peripheral components, i.e. a blowout preventer system. Such system may be referred to as the BOP stack or simply as the stack. The upper portion of the (two-section) stack is referred to, as mentioned, as the LMRP while the lower portion is referred to as lower BOP stack. The LMRP typically includes a platform and is the interface between the Riser system and the stack. It is a separate structure and is supplied with, or as a part of, the stack.

(19) The LMRP is typically connected to the lower BOP stack via a hydraulically actuated stack connector. It is connected to the Riser by a “RISER” connector. Between these two connections there may be inserted annular preventer BOP's, “Pipe” BOP's (Pipe Rams), and/or other instrumentation or controlled protective and supplementary equipment.

(20) This LMRP also physically supports hydraulic accumulators and the (blue and yellow) control pods. These control pods perform the well control regulation tasks as supervised by the driller from the drill floor of a rig. The driller may for instance regulate a parameter, i.e. a hydraulic pressure subsea on the LMRP or lower BOP stack, or control a function, i.e. close a pipe ram BOP, and/or monitor the real time actuation of the function controlled or the parameter regulated.

(21) Many of the BOP Control System's end functions are on the lower portion of the BOP stack, i.e. below the LMRP stack connector. A command from the driller is transmitted via fiber optical and/or electrical data-cable in the MUX lines/cables (also often designated a blue and a yellow MUX line/cable, respectively). The electronic I/O (Input/Output) equipment located in the control pod retrieves data and instructions from, and writes status to, a data connection. These instructions (commands) are typically performed with electronic I/O equipment that interfaces with electro/hydraulic functions, i.e. electrical solenoid valves. These solenoid valves either hydraulically actuate LMRP functions directly, or pilot larger valves, i.e. sub plate mounted (SPM) valves. These SPM valves supply hydraulic fluid at greater volumes or flow rates than could be accomplished with the solenoid valves themselves.

(22) As stated above for redundancy, “Oil Field” tradition dictates that one hydraulic source be associated with one control pod, e.g. designated as the blue pod while another hydraulic source is associated with another control pod, e.g. be labelled as the yellow pod”.

(23) Each one of these pods are identical, and contain identical components, i.e. the electronic I/O, the solenoid valves, the SPM valves, and the hydraulic stab plate (LMRP side). Only one pod is hydraulically active at a time. The other pod is considered a hot back up and may be electrically active and functioning. The electronic I/O and the solenoid valves portion of the control pod may also be referred to as the Subsea Remote Terminal Unit (SSRTU).

(24) The driller is often supplied with two panels corresponding to a control of the blue and yellow pods. A copy of these panels are typically provided at the bridge or the tool pusher's office. The combination of panels, electronics, and hydraulics located on the drilling rig is referred to as the surface MUX systems or surface control system (for the blue and yellow/first and second control pods) and typically consists of two parallel systems—one for the first/blue and one for the second/yellow. The surface MUX control system is connected to the respective pods via the MUX cables (one cables for each pod). It is a driller function to select one of the hydraulic subsea sources as active, i.e. either the blue hydraulic line or the yellow hydraulic line. Identical control activity can often also be performed in like manner from the blue or yellow toolpusher's Panel. Two computer screens with an MMI (“man-machine”) interface may be provided, one in the driller's house and the other in the toolpusher's office. It is possible with some prior art systems to use the MMI's instead of the panels for primary control of the SSRTU's.

(25) In one such prior art system in which the driller has two panels and the toolpusher has two panels (total of four panels), command data may be sent from any panel or from dual MMI interfaces to a surface mounted Programmable Logic Controller (PLC), usually in a dually redundant mode.

(26) The surface PLC may also be referred to as a central control unit or central computer unit (CCU). The CCU processes commands through audible or optical moderns and transmits them to the SSRTU's. These SSRTU's are either PLC devices or microprocessor printed circuit boards and each SSRTU may be referred to as a controller. Each controller has associated electrical I/O units. These controllers are respectively enclosed in pod containers of the first and second control pods (also referred to as electronic pods). The SSRTU's mounted on the LMRP, one of which is the on-line unit, executes the command received from the modems. “Inferred” position sensors, pressure “feed backs”, etc. transmit a signal indicating a command has been executed back to the CCU and the originating panel or MMI via modem transmissions. Activation of a pilot light or a flow meter read-back confirms the execution of the commanded function at all panels and at the MMI's. CCU functions are performed sequentially via serial data links to the remote I/O either in the panels or in the SSRTU's. If a function is not accomplished, the driller is alerted to this and can change the system configuration to put an alternate pod on-line. If, e.g. the driller is working on the blue pod fed from the blue hydraulic conduit, he first changes to the yellow hydraulic conduit and again tries to accomplish the previously-commanded function. If this does not work, the driller transfers control to the yellow pod operating of the yellow hydraulic conduit. If the commanded function still is not accomplished, the driller reconfigures the system with the yellow pod using the blue hydraulic conduit. If the command is not accomplished, typically the entire LMRP is tripped out to discover and correct the problem. This often involves bringing the LMRP to the surface, test, fix, and/or potentially replace equipment, and then bringing the LMRP back to the wellhead again for resumed operation.

(27) In addition to the components explained above, the BOP system 200 shown in FIG. 1 further comprises a SIS (Safety Instrumented System) control pod 340 (equally referred to as additional control pod) according to an embodiment of the present invention, which is shown and explained further in the following.

(28) FIG. 2 schematically illustrates a BOP control system according to one embodiment of the invention.

(29) Shown in FIG. 2 is a blowout preventer (BOP) system 200 comprising a lower blowout preventer stack 204 comprising a number of hydraulic components adapted to carry out, during use, a number of BOP related functions as described earlier and throughout the description.

(30) The BOP system 200 further comprises a lower marine riser package (LMRP) 410 comprising a first (also designated blue) control pod 310 and a second (also designated yellow) control pod 320 adapted to provide, during use, redundant control of hydraulic components of the lower blowout preventer stack 204. The first and/or second control pods 310, 320 may e.g. be more or less conventional control pods as generally known in the art.

(31) The LMRP 410 further comprises two flow meters 311, 321 or the like where one flow meter is connected to one of the first and second control pod and the other is connected to the other of the first and second control pod. These flow meters and/or the like may e.g. provide feedback signals, confirmations, etc. back to the surface of successful execution (or not) of a commanded function. In some embodiments, the flow meters are in line with the hydraulic system and in some embodiments one or more (such as all) these flow meters are not inline e.g. sensing the flow from the outside of the flow-line.

(32) The first and second control pods 310, 320 are adapted to being connected, during use, to a surface control system 330 (designated surface MUX system) that controls them during operation as generally known and as described earlier. Please also refer to FIGS. 3 and 4 and related description for further details of various embodiments of how the different systems and components may be connected.

(33) It is noted that during e.g. deep sea operations the distance between the LMRP to the surface may e.g. be as much as about 3 kilometres or even more.

(34) The LMRP 410 is connected to the lower BOP stack 204. As mentioned earlier, The LMRP 410 may releasably be connected to the lower BOP stack 204 typically via one or more stack connectors then forming a boundary between the LMRP 410 and the lower BOP stack 204. The stack connectors may e.g. include one or more hydraulic connection elements, e.g. one or more hydraulic stabs or the like (see e.g. 381 in FIG. 3), and in some embodiments, one or more electrical (or alternatively optical) connectors, e.g. an electrical (or alternatively optical) wet-mate or the like (see e.g. 382 in FIG. 3).

(35) The lower BOP stack 204 is adapted to carry out, during use, a number of functions carried out by BOP functional components 370 as described earlier.

(36) One or more sensors 402 may monitor various parameter values e.g. like position and/or pressure of various components carrying out or assisting in carrying out one or more BOP functions 370. At least one of such sensors may e.g. by of the type often referred to as a Ramtel plus sensor, similar, or other.

(37) More specifically in this particular and similar embodiments, the first and second control pods 310, 320 are connected to valves or the like 380 in the lower BOP stack 204 that is further connected to the BOP functional components 370.

(38) As mentioned, the lower BOP stack 204 may be controlled, during regular operation, from the surface control system 330 by pumping a pressurized (control) hydraulic fluid or the like from the surface to either the first 310 or the second control pod 320 (as the other is provided only for redundancy purposes), e.g. using a crossover valve or similar, that through the valves 380 controls and/or activates the BOP functions 370.

(39) In some embodiments the present invention generally relates to a blowout preventer system 200 further comprises an additional control pod 340 (designated SIS pod) and at least one additional surface control system 350 (designated SIS).

(40) The additional control pod(s) is/are also equally referred to as SIS pod(s) throughout the description where SIS is short for Safety Instrumented System. The SIS pod(s) 340 may e.g. be responsible for carrying out one or more safety instrumented functions (SIFs).

(41) The at least one additional control pod 340 is connected, electrically and/or optically, to the at least one additional surface control system 350 where the at least one additional surface control system 350 controls the at least one additional control pod 340. The additional surface control system 350 may comprise at least one control panel for the operator, e.g. one in the driller's house and another in the toolpusher's office, the bridge, etc.

(42) As shown, the lower BOP stack 204 also comprises one or more (subsea) hydraulic accumulators or the like 360 comprising hydraulic ‘working’ fluid for activating various BOP or stack functions, including safety related functions, should the supply of hydraulic (working) fluid from the surface become unavailable. The one or more (subsea) hydraulic accumulators or the like 360 provide hydraulics to the at least one additional control pod 340 (and e.g. to at least one acoustic control pod and/or to an autoshear and deadman hydraulic circuit, if present; see below).

(43) The blowout preventer system 200 may comprise precisely one additional control pod 340. Alternatively, the blowout preventer system 200 may comprise two additional control pods 340. As yet another alternative, the blowout preventer system 200 may comprise three or more additional control pods 340.

(44) In at least some embodiments, and as shown in FIGS. 2 and 3, the at least one additional control pod 340 is located on the lower BOP stack 204. This location is opposed to being located on the LMRP 410.

(45) However, in some other alternative embodiments, the additional control pod 340 is located on the LMRP 410. In yet other alternative embodiments, one additional pod 340 is located on the LMRP 410 while another additional pod 340 is located on the lower BOP stack 204. Such additional pods may each have a different configuration and/or functionality as described throughout the present description or they may have the same.

(46) The provision of at least one additional control pod 340 (and associated control system) provides further redundancy in an expedient way. In this way, continued operation is enabled even if one of the other control pods 310, 320 becomes unavailable since redundancy is still available, even in this case. This may avoid the need e.g. for tripping the LMRP to the surface and back again to the wellhead, which increases the operational time and avoid costly unproductive downtime.

(47) Furthermore, the at least one additional pod 340 may monitor what commands or instructions are sent to the control pod(s) 310, 320 and monitor and indicate to a system and/or operator whether a function successfully was performed or not. In this way, redundancy on the feedback received from the first and/or second pods 310, 320 may be provided.

(48) Accordingly, some embodiments of the invention generally relates to an additional control pod and/or the control system (subsea and/or surface) monitoring the input and/or actions of one or more other control pods.

(49) Furthermore, according to some embodiments of the present invention, the at least one additional control pod 340 may initiate one or more safety critical functions and/or safety instrumented functions (SIFs) in response to a control signal received from the SIS surface control system 350—alternatively via a SIS subsea control unit (as shown as 351 in and as will be explained further in connection with FIG. 3).

(50) Input and other functionality will be explained further in connection with FIG. 3 and elsewhere.

(51) In some embodiments, the at least one additional control pod 340 is adapted to carry out only about ten, e.g. ten, to about twelve, e.g. twelve, (where the actual number may vary and be dependent on actual use or implementation) predetermined functions.

(52) In some embodiments, preferably only safety critical functions and/or SIF functions, are supported by the at least one additional control pod 340.

(53) Accordingly, in some embodiments, the at least one additional control pod 340 is adapted to carry out a number of functions being selected from a predetermined group of safety critical functions (and/or SIF functions). Examples of safety critical functions and/or SIF functions are given in the following.

(54) Letting the at least one additional control pod 340 being adapted to only carry out the functions designated as safety critical functions keeps to overall number of supported functions relatively low (reducing complexity and/or potential failure rate of the (at least one) additional control pod 340 compared to either of the first and second control pod 310, 320) while providing additional redundancy and/or back up for the (e.g. most) safety critical functions.

(55) In contrast, current (first/blue, second/yellow) conventional control pods support up to as much as about 160 different functions. Supporting far fewer functions reduces the overall complexity of the additional control pod 340, and possibly its manufacturing costs, compared to the conventional control pods. Having fewer functions may very well reduce the potential failure rate of an additional control pod 340 compared to conventional control pods 310, 320.

(56) Accordingly, in some embodiments the invention generally relates to the incorporation of at least one (3rd) additional pod 340 (additional to first/BL and second/YL) with fewer functions than the first/BL and second/YL control pods (such as fewer than 50% or less, such as fewer than 60% or less, such as fewer than 70% or less, such as fewer than 80% or less, and such as fewer than 90% or less of of the number of function supported by the first/BL and second/YL control pods) where the 3rd additional pod 340 is connected to an additional control panel on the surface as described elsewhere.

(57) In some embodiments, the predetermined group of safety critical functions mentioned above comprises one or more selected from the group of: closing of one or more, e.g. all, shear ram (e.g. (UBSR HP close, CSR HP close, LBSR HP close), closing of one or more, e.g. all, pipe ram, engaging ram locks, autoshear and deadman functions, and/or unlatching a lower marine riser package connector, thereby enabling separating the lower marine riser package 410 from the lower blowout preventer stack 204.

(58) The safety critical functions may also be included as part of an EDS (Emergency Disconnect System) function or sequence. The EDS system or function may trigger in the event that communication to the surface is lost (typically loss of high-pressure hydraulics) but could in principle also (or in the alternative) be triggered in the event of loss of connection via both MUX cables. In such event, the EDS will close (or attempt to close) the well by closing one or more rams and/or annular BOPs typically via pressure from the subsea accumulators such as accumulator bottles, and subsequently disconnect of the LMRP.

(59) In one embodiment, the invention generally relates to a system for cutting hydraulic supply to the BOP so as to activate the EDS function or sequence, e.g. via a push button (or push of two buttons at the same time) on a control panel or the like above surface, This is advantageous in the event that both MUX cables becomes dysfunctional and provides a convenient method of quickly closing the lower BOP stack.

(60) It is also to be understood, that other functions may be used as safety critical functions.

(61) In some embodiments, e.g. as shown in FIG. 3, the BOP system 200 further comprises one additional subsea control unit (see e.g. 351 in FIG. 3), which will be explained further in connection with FIG. 3. In addition or alternatively to the additional control pod initiating one or more safety instrumented functions (SIFs), the additional subsea control unit may initiate one or more safety instrumented functions (SIFs) in response its own control logic.

(62) In some embodiments, the BOP system 200 further comprises at least one acoustic control pod (see e.g. 340, 341 in FIG. 3) and one or more acoustic subsea control units (see e.g. 345 in FIG. 3) as shown and explained further in connection with FIG. 3. The acoustic control pod and acoustic subsea control units provide another way of communicating (acoustic communication) with the lower BOP stack 204, e.g. in the event of loss of connection via both MUX cables.

(63) In some embodiments, the drilling rig further comprises a spare MUX reel enabling fast replacement,

(64) The connections between the shown entities are, in this and corresponding exemplary embodiments, hydraulic or electrical as indicated by the connecting lines being either full (hydraulic) or broken (electric). Optical connections may be used, at least somewhere, as an alternative to electric connections.

(65) In some embodiments, the at least one additional control pod 340 is controllable to be enabled, disabled, or electrically live only.

(66) Enabled may be defined as electrical power, communications, and hydraulics live in the at least one additional control pod and associated control circuits.

(67) Disabled may be defined as electrical power, communications, and hydraulics disabled in the at least one additional control pod and associated control circuits. Electrically live may be defined as electrical power and communications being live and hydraulics being disabled.

(68) In some embodiments, the at least one additional control pod 340 is controllable to enter a lower blowout preventer stack 204 test mode, and/or enter a test mode for the at least one additional control pod 340.

(69) FIG. 3 schematically illustrates a BOP control system according to one embodiment of the invention.

(70) Shown in FIG. 3 is a BOP control system corresponding to the one shown in FIG. 2 but with further details given.

(71) Shown is a surface control system 330, at least one additional surface control system 350 (designated SIS Surface Control Unit), one or more hydraulic subsea accumulators or the like 360, at least one additional control pod 340, a lower blowout preventer stack 204 capable of performing a number of BOP functions 370, and an LMRP 410 capable of performing a number of LMRP functions 385 that all correspond to the same units as shown and explained in connection with FIG. 2 and elsewhere.

(72) The LMRP 410 is (releasably) connected with the lower BOP 204 via one or more hydraulic connection elements 381, e.g. one or more hydraulic stabs or the like, and one or more electrical (or alternatively optical) connectors 382, e.g. an electrical (or alternatively optical) wet-mate or the like.

(73) In some embodiments and as further shown, the blowout preventer system 200, and more specifically the lower blowout preventer stack 204, further comprises an autoshear and deadman hydraulic circuit 365 that is responsible for carrying out a number of autoshear and/or deadman functions using hydraulic fluid from the accumulators 360.

(74) The one or more subsea accumulators 360 is/are connected to the additional control pod 340, the autoshear and/or deadman hydraulic circuit 365, and/or, if present, one or more acoustic control pods (see below),

(75) In some embodiments and as further shown, the blowout preventer system 200, and more specifically the lower blowout preventer stack 204, further comprises at least one additional subsea control unit 351 wherein the at least one additional subsea control unit 351 is/are adapted to control, during use, one or more of the at least one additional control pods 340, e.g. automatically as explained in the following and/or under the control of the additional surface control system 350.

(76) The additional subsea control unit(s) 351 is/are connected (e.g. by electric and/or optical connection, etc.) to one or more of the at least one additional control pods 340 in order to control them.

(77) The additional subsea control unit(s) 351 is/are further connected (e.g. by electric and/or optical connection, etc.) to the additional surface control system 350 for receiving control information and commands and send back feedback signals.

(78) In some embodiments and as shown, the one or more subsea control unit(s) 351 each comprises a battery or other electrical power source 346 to supply, during use, the given subsea control unit(s) 351 with electrical power to generate one or more electrical control signals. In some embodiments and as shown, the blowout preventer system 200, and more specifically the lower blowout preventer stack 204, further comprises at least one acoustic control pod 340 (see e.g. also 341 in FIG. 1) and one or more acoustic subsea control units 345 adapted, during use, to control the at least one acoustic control pod 340.

(79) In some embodiments, the one or more acoustic subsea control units, each comprises a battery or other electrical power source 346 to supply, during use, the given acoustic subsea control units 345 with electrical power to generate one or more electrical control signals.

(80) In some of the embodiments comprising at least one acoustic control pod, one (or potentially two or more for such embodiments) of the additional control pod(s) 340 are integrated together with the acoustic control pod as shown in the Figure.

(81) In general, the additional pod 340 is in some embodiments arranged to receive wireless (such as acoustic) input and/or ROV manipulation.

(82) In some embodiments the battery pack of the acoustic and the additional pod 340 is shared and in some embodiments the battery is ROV replacable.

(83) In some embodiments, the at least one additional control pod 340 comprises a number (e.g. three as shown) of control valves or other control mechanisms (e.g. dual valves, dual coil solenoid valves as shown, etc.) 403 where each control valve or other control mechanism 403 is adapted, during use, to receive a control signal from the additional subsea control unit 351 and, if present, the one or more acoustic subsea control units 345 in order to carry out an associated function.

(84) In embodiments with dual valves, dual coil solenoid valves, etc. (i.e. one or more control valves, each receiving control signals from at least two sources), the at least one additional control pod 340, at least in some embodiments, need only a control signal from one of the at least two sources to be able to react.

(85) In some embodiments, the one or more additional subsea control units 351 and/or the one or more acoustic subsea control units 345 controls the at least one additional control pod 340 using electric and/or optical signals.

(86) In some embodiments, the additional subsea control unit 351 and/or the additional surface control system 350 are adapted, during use, to monitor one or more functions of the lower BOP stack 204 and/or the LMRP 410.

(87) In some embodiments, the additional subsea control unit 351 and/or the additional surface control system 350 are adapted, during use, to automatically take safety measures (such as initiating safety critical functions or safety instrumented functions) in response to the monitoring and/or according to one or more predetermined conditions.

(88) In particular, input signal(s) provided to the first and/or second control pods (see e.g. 310, 320 in FIGS. 1, 2 and 4) may be monitored in order to determine whether a corresponding action is executed and completed by the first and/or the second control pod and/or the lower BOP 204/LMRP 410. If this is not the case (such as within a predetermined amount of time) then the additional control pod(s) 340 take/takes action to execute the function and/or another safety critical function.

(89) The additional subsea control unit 351 may initiate one or more safety instrumented functions (SIFs), e.g. using the additional control pod 340, in response to a control signal received from the additional surface control system 350.

(90) In addition or alternatively, the additional subsea control unit 351 may initiate one or more safety instrumented functions (SIFs), e.g. using the additional control pod 340, in response its own control logic.

(91) The additional subsea control unit 351 may initiate one or more of these safety critical functions or SIFs using the one or more additional control pods 340.

(92) In some embodiments, and as further shown, the blowout preventer system 200, and more specifically the LMRP 410 comprises a power and/or communication hub 384, e.g. a data bus system for transporting data to and/or from the first and/or second control pods (not shown; see e.g. 310, 320 in FIGS. 1, 2, and 3), and a network switch (e.g. comprising an AC/DC converter if required) or the like 383 where the network switch is located in the communications path between the additional surface control system 350 and the one or more electrical or optical connectors 382.

(93) Input/command and feedback signals relating to the first and/or second control pods, the status of the BOP rams/annular, etc. may thus be forwarded to the additional surface control system 350 and/or the additional subsea control unit 351.

(94) Information about the commands (and potentially status) issued to the first and/or second control pod may in this way be forwarded to the additional control units (surface 350 and/or subsea 351) enabling them to monitor what commands are given and whether they are completed or not and if not then react to notify an operator (e.g. on a surface panel) and/or react by executing the commands using the additional control pod 340.

(95) In order to efficiently control the at least one additional control pod 340, the additional subsea control unit 346 and/or the additional surface control system 350 should receive various input, status, and/or feedback signals, e.g. as described in the following.

(96) In some embodiments, the additional surface control system 350 is adapted to receive one or more input signals, during use, from one or more of:

(97) the surface control system 330 (see also 331, 332 in FIG. 4),

(98) a surface flow meter 404, measuring one or more current flows of hydraulic fluid to the lower blowout preventer stack 204, e.g. via a hotline conduit or similar i.e. a line providing high pressure hydraulics from the surface to the LMRP 410/lower BOP stack 204),

(99) the lower marine riser package LMRP 410 or a pressure transmitter 401 located on the LMRP 410, and/or

(100) the power and/or communication hub (384), e.g. a data bus system for transporting data to and/or from the first and/or second control pods (see e.g. 310, 320 in FIGS. 1, 2, and 4) or similar of the LMRP 410.

(101) Accordingly, in some embodiments of the invention generally relates to an additional control pod and/or the control system (subsea and/or surface) monitoring the input and/or actions of one or more other control pods.

(102) In some embodiments, the at least one additional subsea control unit 351 is adapted to receive one or more input signals, during use, from one or more selected from the group consisting of:

(103) the power and/or communication hub or similar 384 of the LMRP 410,

(104) a position and pressure sensor 402 and/or a pressure transmitter 401 of the lower BOP stack 204,

(105) a pressure transmitter 401 of the autoshear hydraulic circuit 365, e.g. located on a pilot hydraulic autoshear valve),

(106) a pressure transmitter 401 of a deadman hydraulic circuit 365, and/or

(107) one or more pressure transmitters 401 of a closing shear ram circuit and/or a blind shear ram circuit.

(108) In some embodiments, the additional surface control system 350 is adapted to receive, during use, one or more input signals representing

(109) one or more input signals 501 to the first and/or second control pods (see e.g. 310, 320 in FIGS. 1, 2, and 4),

(110) one or more measured current flows 502 of hydraulic fluid to the lower blowout preventer stack 204,

(111) a LMRP disconnect feedback signal 503, e.g. as obtained by a pressure transmitter 401 or similar at LMRP 410, and/or

(112) one or more signals 504, e.g. obtained from the power and/or communication hub or similar 384 of the LMRP 410.

(113) In some embodiments, the additional subsea control unit 351 is adapted to receive, during use, one or more input signals representing

(114) one or more signals 504 obtained from the power and/or communication hub or similar 384 of the LMRP 410,

(115) one or more values 505 of one or more blowout preventer system functions 370, e.g. as obtained by a position and pressure sensor 402 or a pressure transmitter 401 of the lower BOP stack 204,

(116) a feedback close signal 506 for an autoshear hydraulic circuit 365, e.g. as obtained by a pressure transmitter 401 of the autoshear hydraulic circuit 365,

(117) a feedback close signal 506 for a deadman hydraulic circuit 365, e.g. as obtained by a pressure transmitter 401 of the deadman hydraulic circuit 365, and/or

(118) one or more feedback close signals 506 for at least one closing shear ram circuit and/or at least one blind shear ram, e.g. as obtained by one or more pressure transmitters 401 of a closing shear ram circuit and/or a blind shear ram.

(119) Above is provided an array of examples of various feedback signals i.e. signals providing an indication of whether a function has been or is in the process of being performed such as by measuring a position of a ram-piston, the flow of hydraulic fluid, pressure, the disengagement of the LMRP, etc.

(120) The feedback examples of above may be generalized to any suitable sensor signal that may be used to provide such indications.

(121) One or more safety instrumented functions (SIFs) may be initiated, by the additional subsea control unit 351 and/or the additional surface control system 350 in response to receiving one or more of the input signals e.g. as listed above and/or in response to receiving input from one or more of the selected unit, systems, or functions e.g. as also listed above.

(122) In some embodiments the additional surface control system is arranged to indicate a successfully performed function. In this way redundancy on the feedback received to the first and/or second control pods may be provided.

(123) Accordingly, in some embodiments the invention generally relates to one or more additional control pods optionally with a control system arranged to receive one or more input signals provided to the first and/or second control pods, monitor whether a corresponding action is executed and completed by the first and/or second control pod and/or the BOP/LIMP.

(124) If this is not the case (such as within a predetermined time) then the additional pod(s) takes action to execute the function and/or another safety critical function. Input/command and feedback signals relating to the first and/or second control pods, the status of the BOP rams/annular, etc. may be received by the additional surface control system 350 and/or the additional subsea control unit 351.

(125) In some embodiments, the additional subsea control unit 351 and/or the additional surface control system 350 is/are adapted to activate, during use, at least one safety instrumented function (SIF) in response to one or more of the following:

(126) a lower marine riser package disconnect feedback signal 503, where the disconnect feedback signal indicates whether a disconnect signal has been given and/or executed, e.g. as obtained by a pressure transmitter 401 or similar at the LMRP 410, and/or

(127) a combination (‘OR’ or ‘AND’ in any given combination) of

(128) one or more values 505 of one or more blowout preventer system functions 370, e.g. as obtained by a position and pressure sensor 402 and/or a pressure transmitter 401 of the lower blowout preventer stack 204,

(129) a feedback close signal 506 for an autoshear hydraulic circuit 365, e.g. as obtained by a pressure transmitter 401 of the autoshear hydraulic circuit 365, e.g. located on a pilot hydraulic autoshear valve),

(130) a feedback close signal 506 for a deadman hydraulic circuit 365, e.g. as obtained by a pressure transmitter 401 of the deadman hydraulic circuit 365, and/or

(131) one or more feedback close signals 506 for at least one closing shear ram circuit and/or at least one blind shear ram, e.g. as obtained by one or more pressure transmitters 401 of a closing shear ram circuit and/or a blind shear ram.

(132) In this way, redundancy is provided (even if one of the first and second control pods becomes unavailable. Furthermore, a (potentially simpler and therefore more reliable) safety system (additional control pod 351, additional subsea control unit 351, and additional surface control system 350) is provided increasing the safety and in certain embodiments being able to monitor the first and second control pods and the LMRP/BOP functions and react automatically.

(133) According to some embodiments of the present invention, the units, systems, and/or functionality related to the additional subsea control unit 340 and/or the additional surface control system 350, including themselves, is/are certified according to a predetermined safety requirement, rating, standard or the like, e.g. according to a SIL (safety integrity level) rating or standard.

(134) In some embodiments, a SIL rating of 2 is provided for the units, systems, and/or functionality related to the additional subsea control unit 351 and/or the additional surface control system 350—including themselves.

(135) SIL 2 rated functions are called Safety Integrity Functions and ensure safe operations and safe response to any departure from normal operating conditions. The SIL concept is related to the Probability of Failure on Demand, which is the probability of a system failing to respond to a demand for action arising from a potentially hazardous condition, SIL 2 relates to a maximum allowed probability of failure on demand per year of 0.01 (a minimum Risk Reduction Factor of 100).

(136) More specifically, at least one or more, and in some embodiments all, of the following, are SIL rated (e.g. to a SIL rating of 2) as one connected system:

(137) the additional subsea control unit 351,

(138) the additional surface control system 350, and

(139) the at least one additional control pod 340.

(140) In some embodiment the first and second control pods (see e.g. 310, 320 in FIGS. 1, 2, and 4) as well as the input to these (which may be provided to the connected system for monitoring and/or control purposes) are not encompassed as part of the one connected system.

(141) In some embodiments, one or ore of the components are included.

(142) In some embodiments, also in connection with the above embodiment(s) of SIL (SIL 2 rating), the pressure transmitters, the surface flow meter, (if present) the position and pressure sensor, the electrical connector/electrical wet-mate, the hydraulic connector/stab, and (if present) the network switch+AC/DC converter are also SIL rated (e.g. to a SIL rating of 2) as part of the one connected system.

(143) FIG. 4 schematically illustrates one exemplary implementation of subsea junction boxes for power, control and/or communication signals in the BOP control system.

(144) Shown is a system corresponding to the ones shown and explained earlier and one embodiment of how the various elements may communicate together and receive/transfer power using two subsea junction boxes thereby providing redundancy in this respect.

(145) In some embodiments and as shown, the BOP system comprises one or more subsea junction boxes (or similar) 415, 416, such as two, so that power, communication and/or control signals may be cross connected where the similar connections run through both mux cables A, B.

(146) In this way one or more, such as all, of the first, second, and the one or more additional control pods 310, 320, 340 (and one or more acoustic pods 346 if any; e.g. integrated together with the additional control pod(s) 340) may communicate with the surface even if one of the MUX cable are dysfunctional.

(147) Specifically, in some embodiments and as shown, the additional control pod 340 is connected to two junction boxes 415, 416 that may be connected to each other and to each of the first and second control pods 310, 320.

(148) In some embodiments, the subsea junction boxes 415, 416 are located on the LMRP 410.

(149) In some embodiments, not all connections need to be connected through one of the surface control systems 331, 332 but may still run in both mux cables A, B (also referred to as first cable and second cable), e.g. the connections for the yellow pod 320 may run in mux cable B but instead of being connected to the blue mux control system 332 it may connect directly to the yellow mux control system 331 in the overall surface control system 330 and correspondingly for the connections for the blue pod 310. This still provides redundancy and all connections in both mux cables A, B. The surface control systems may be designated as a first (or yellow) surface control system 331 and as a second (or blue) surface control system 332.

(150) The connections between the shown entities are, in this and corresponding exemplary embodiments, power or communication as indicated by the connecting lines being either full (power) or broken (communications). Electrical and/or optical connections may be used, at least somewhere, for communication.

(151) Throughout the description, the used symbols in the drawings may have a different meaning than what they traditionally may represent. In such cases, the meaning is then the meaning as written in the description.

(152) In the claims enumerating several features, some or all of these features may be embodied by one and the same element, component or item. The mere fact that certain measures are recited in mutually different dependent claims or described in different embodiments does not indicate that a combination of these measures cannot be used to advantage.

(153) It should be emphasized that the term “comprises/comprising” when used in this specification is taken to specify the presence of stated features, elements, steps or components but does not preclude the presence or addition of one or more other features, elements, steps, components or groups thereof.