Remote emergency shutdown device for oil platform

ENI Petroleum is an Italian multinational oil and gas company with around 78,400 employees at sites in 77 countries. ENI operates in the oil and gas, electricity generation and sales, petrochemicals, oilfield services construction and engineering industries. It has oil and natural gas production of almost two million barrels per day, with exploration and production efforts at sites throughout North America, Africa and Asia.

One of these production locations is an oil well platform located just off the coast of Louisiana. Drill ships perform periodic operations within close proximity to subsea pipelines that transport oil and gas to and from the production platform.

Platform operators were informed by the US Mineral Management Service that a direct, real-time communications link needed to be installed to increase safety if any wells are affected by a possible event such as a ‘dropped object’ near a submerged pipeline. If a potential hazard is recognised or communications are lost, the wells and pipes will be shut down and production stopped - a shutdown that costs $100,000 a day in lost production. Therefore, this communications method must be proven reliable with an independent verification process in order to avoid unnecessary shutdowns.

ENI’s original solution involved short-range radio links in their control room and drill ships in communication with each other. However, new pipeline work done by ENI expanded the scope of operations to a distance greater than 100 km from the platform - further than the operating scope of existing radios. Also, two-way voice radios are not appropriate to meet MMS requirements, and the solution needs to be suitable for use on both platforms and drill ships.

ENI uses an ethernet network for most of the communications on its oil platform. This network handles telephone, email, weather updates, internet and communications between the oil platform and the mainland. The ethernet cabling is readily available in the control room and critical areas of the platform. Drill ships use ethernet satellite communications for the same important tasks.

ENI chose to implement a solution from Moore Industries consisting of a simple NET Concentrator System mounted on DIN rails. The data concentrator system has two ethernet interface modules: one is coupled to a discrete input module and is mounted in the drill ship’s control room while the second EIM is coupled with a relay output module and mounted in the oil platform’s control room. Communications between the two assembled data concentrator systems is via the standard ethernet data communications layer that includes satellite communication. The system uses an IEC 61131-compliant software configuration program, which sets up the data concentrators to collect contact switch input signals, timers and communicate with each other.

ENI developed application software to scan the input switch contacts and combine them into digital memory locations. These contact closures are transferred from one data concentrator to another via ethernet. The receiving data concentrator disassembles the ethernet data and places it into variables and memory locations to activate relay contact closures as needed. A contact closure at one data concentrator activates a relay on the other data concentrator.

The drill ship data concentrator has a mechanically latching push button switch, while the oil platform data concentrator has a klaxon horn plus a set of contact closures connected to the control panel, wired in failsafe mode. During normal operations, the data concentrator provides the operator with visual indicators, audible alarms (through the klaxon) and electrical signal connections to the control room panel.

ENI needed to verify a continuous line of communications between the two data concentrators in order to satisfy the MMS directive on reliable communications. If the link is lost, the system automatically sounds an alarm. Normal communications include a bidirectional update of all data within each data concentrator every second along with a ‘watchdog’ subroutine that monitors communications between data concentrators. When the watchdog timer doesn’t recognise valid communications between data concentrators, it times out and a ‘communications status’ lamp changes from green to a warning colour and sends a separate set of closed contacts to the control panel. Additional watchdog time delays trigger a second level of closed contacts and signal the end of the grace period for down communications to automatically initiate shutdown, should human operators not be readily available to respond.

Initial testing on the bench confirmed the value of the system. After the data concentrators were secured via password protection, ethernet port assignments were activated to allow data to be forwarded to the satellite link.

The data concentrator system was installed on schedule and remains in service. It has been proven to meet the requirements of the MMS directive for reliable communications for safety tasks along with expectations for performance. When severe weather briefly obstructs the satellite communications link, the data concentrator briefly goes offline with its appropriate signalling lamps. Upon restoration of the satellite link, the data connector’s remote ESD recovers immediately.

Implementing the NET Concentrator System has given ENI a reliable and durable communications platform, allowing it to operate its oil platforms safely from any distance. The low-cost solution helps ENI avoid costly shutdowns and maintain a regular production schedule.