Note: Descriptions are shown in the official language in which they were submitted.
CA 02727208 2011-01-07
TITLE: SYSTEM AND METHOD FOR TESTING A VALVE ACTUATOR
INVENTORS: GARTH STEVEN HANSON, THOMAS JOSEPH MacARTHUR and
HENRI RICHARD TESSIER
TECHNICAL FIELD
[0001] The present disclosure is related to the field of electric valve
actuators, particular
those used for surface and subsurface safety valves in oil and gas operations
and more
so to electrically-actuated valves used in a system as a Emergency Shut Down
fail safe
feature, in particular, systems and methods for testing the valve actuators.
BACKGROUND
[0002] An electric Emergency Shut-Down ("ESD") valve actuator is relied upon
to
actuate a valve to a fail-safe position in the event of a system control
failure. An
example of such a system failure would be when a separator floods on an oil or
gas
well. When the master control system detects such a control failure, it can
actuate the
ESD to the fail-safe position stopping the flow of incoming oil or gas. As a
critical
element in a safety system, it is important that the ESD valve works correctly
in all
situations, even if abnormal. There are four abnormal major failure modes in a
typical
system protected with an electrical ESD valve. The first, when the main power
fails, can
be solved with either a mechanical or battery-based backup energy storage
system that
has enough energy to actuate the valve when this failure occurs. The other
three failure
modes occur when the ESD controller, the backup energy source or the master
controller fails. If any of these three items cease to function, the fail-safe
feature will
compromised and catastrophic failure can occur. In systems where this failure
cannot
{E5889209.DOC;1)
CA 02727208 2011-01-07
2
be tolerated, it is important to minimize the risk of any of these three
failure modes
occurring.
[0003] It is, therefore, desirable to provide a system and method that can
minimize
these risks.
[0004] SUMMARY
[0005] A system and method for testing a valve actuator is provided. In some
embodiments, the system can comprise an electrical valve actuator that can
test itself
automatically for common failures and detect when the system controller that
normally
actuates the valve fails. This can be useful when electrically actuated valves
are used
in Emergency Shut Down ("ESD") systems, where system failure cannot be
tolerated
and risk reduction is necessary. In some embodiments, an electrical ESD
controller
with four safety mechanisms can be provided that can be used in whole or in
part to
lower such risk depending on the situation.
[0006] In some embodiments, ESD failure detection can be provided by an ESD
controller periodically testing the ESD valve to ensure it can actuate. The
detection can
be done by measuring the angular position of the valve and/or by monitoring
the current
draw by the electric motor that actuates the valve. If failure is detected, a
alarm
condition can be sent to a master controller.
[0007] In some embodiments, the ESD backup energy supply can be tested
periodically
to verify that it has enough energy to actuate the valve if the main power
fails. Like a
valve failure, the system master controller can be informed of the alarm
condition upon
detection of a malfunctioning energy storage device.
{E5889209. DOC;1)
CA 02727208 2011-01-07
3
[0008] In some embodiments, the ESD controller can be protected by an external
watchdog circuit that can detect a failure of the ESD controller. If not reset
by the ESD
controller periodically to indicate that the ESD controller is operating, the
external
watchdog circuit can be capable of separately actuating the valve to the fail-
safe
position.
[0009] In some embodiments, the ESD controller can further comprise a separate
master controller watchdog that can be reset by the master controller. If the
master
controller ceases to function, the ESD controller can actuate the valve to the
fail-safe
position.
[0010] Broadly stated, in some embodiments, a system is provided for actuating
a valve
comprising an electrical motor operatively connected to a valve actuator
operatively
connected to the valve, the system comprising: a main motor driver operatively
connecting the electrical motor to a primary power source, the main motor
driver
configured to control the flow of current from the primary power source to the
electrical
motor; a first sensor configured to monitor the voltage of the primary power
source; a
second sensor configured to monitor the flow of current from the main motor
driver to
the electrical motor; a third sensor configured to monitor the angular
rotation of the
valve; and an emergency shut down ("ESD") controller operatively connected to
the
main motor driver, the first sensor, the second sensor and the third sensor,
the ESD
controller configured to operate the main motor driver in the event of an
alarm condition
to actuate the valve to a fail-safe position.
[0011] Broadly stated, in some embodiments, a method is provided for testing a
valve
actuator operatively connected to a valve, the valve actuator comprising an
electrical
{E5889209.DOC;1 }
CA 02727208 2011-01-07
4
motor operatively connected thereto, the method comprising the steps of:
providing a
system comprising: a main motor driver operatively connecting the electrical
motor to a
primary power source, the main motor driver configured to control the flow of
current
from the primary power source to the electrical motor, a first sensor
configured to
monitor the voltage of the primary power source, a second sensor configured to
monitor
the flow of current from the main motor driver to the electrical motor, a
third sensor
configured to monitor the angular rotation of the valve, and an emergency shut
down
("ESD") controller operatively connected to the main motor driver, the first
sensor, the
second sensor and the third sensor, the ESD controller configured to operate
the main
motor driver in the event of an alarm condition to actuate the valve to a fail-
safe
position; actuating the valve; monitoring the angular rotation of the valve;
and
generating an alarm if the valve does not rotate in response to the step to
actuate the
valve.
[0012] Broadly stated, in some embodiments, a system is provided for testing a
valve
actuator operatively connected to a valve, the valve actuator comprising an
electrical
motor operatively connected thereto, the system comprising: first means for
controlling
the flow of current from a primary power source to the electrical motor; means
for
monitoring the voltage of the primary power source; means for monitoring the
flow of
current from the primary power source through the first controlling means to
the
electrical motor; means for monitoring the angular rotation of the valve;
means for
actuating the valve to a fail-safe position in the event of an alarm
condition; and means
for generating an alarm in the event that the valve cannot be actuated to the
fail-safe
position.
{E5889209. DOC;1 }
CA 02727208 2011-01-07
[0013] Broadly stated, in some embodiments, a method is provided for testing a
backup
power source operatively connected to a valve actuator, the valve actuator
operatively
connected to a valve, the valve actuator comprising an electrical motor
operatively
connected thereto, the method comprising the steps of: providing a system
comprising:
a main motor driver operatively connecting the electrical motor to a primary
power
source, the main motor driver configured to control the flow of current from
the primary
power source to the electrical motor, a first sensor configured to monitor the
voltage of
the primary power source, a second sensor configured to monitor the flow of
current
from the main motor driver to the electrical motor, a third sensor configured
to monitor
the angular rotation of the valve, and an emergency shut down ("ESD")
controller
operatively connected to the main motor driver, the first sensor, the second
sensor and
the third sensor, the ESD controller configured to operate the main motor
driver in the
event of an alarm condition to actuate the valve to a fail-safe position;
disconnecting the
primary power source; actuating the valve with the backup power source;
monitoring the
angular rotation of the valve; and generating an alarm if the valve does not
rotate in
response to the step to actuate the valve.
BRIEF DESCRIPTION OF THE DRAWINGS
[0014] Figure 1 is a block diagram depicting a system for testing and
actuating a valve.
[0015] Figure 2 is a flowchart depicting the operation of an emergency
shutdown
controller.
[0016] Figure 3 is a flowchart depicting the operation of an emergency
shutdown
watchdog.
{E5889209. DOC;1 }
CA 02727208 2011-01-07
6
DETAILED DESCRIPTION OF EMBODIMENTS
[0017] Referring to Figure 1, a block diagram of a system for testing and
actuating a
valve is shown. In normal operation, ESD controller 1 can open and close valve
5 via
electric motor 4. When master controller 11 receives information from sensors
11 b
such that valve 5 needs to be closed, master controller 11 can send a signal
via
communication path 11 a to ESD controller 1. Upon receiving a valid command
from
master controller 11, ESD controller 1 can transmit a signal via signal path
2a to main
motor driver 2 to supply power to electric motor 4 to actuate the valve 5 via
valve
actuator 4a.
[0018] In order to verify that valve 5 can be actuated in the event of a
emergency, valve
can be periodically tested for actuation failure. In order to determine if
valve 5 can be
actuated, position sensor 6 can be used to send a signal corresponding to the
angular
position of valve 5 via signal path 6a to ESD controller 1. If valve 5 has
failed to
actuate, or if valve position sensor 6 itself has failed, an alarm condition
can be sent
from ESD controller 1 to master controller 11 via signal path 11 a. What
actually failed
depends on the feedback signal received from valve position sensor 6 and motor
current sensor 2b via signal path 2c. If valve 5 cannot mechanically turn, and
there is a
high current measured by current sensor 2b, a locked rotor condition alarm can
be
generated. If current sensor 2b senses that the current flowing to motor 4 is
too low,
this can indicate either a failure of electric motor 4 or of main motor driver
2. In both
conditions, an alarm can also be generated. In addition, backup motor driver 3
can be
activated to attempt to actuate valve 5 via backup motor driver 3 as a backup
to main
{E5889209. DOC;1 }
CA 02727208 2011-01-07
7
motor driver 2. In this situation, current sensor 3b can monitor the current
flowing to
motor 4 and send a feedback signal to ESD controller 1 via signal path 3c.
[0019] To verify that the mechanical or electrical back up power supply 7 has
enough
energy to actuate valve 5, a test can be carried out wherein switch 8 can be
opened to
disconnect the main power supply. In some embodiments, backup power supply 7
can
comprise a mechanical backup power source (not shown) such as a spring-
operated or
functionally equivalent biasing mechanism as well known to those skilled in
the art that
can operate valve actuator 4a. In other embodiments, the mechanical backup
power
source can further comprise a reset mechanism that can reset the spring or
biasing
mechanism to an "armed" position wherein the spring or biasing mechanism is
set to
operate valve actuator 4a again.
[0020] ESD controller 1 can monitor valve 5 if it has actuated from the signal
received
from sensor 6. If the test fails, then an alarm condition can be sent from ESD
controller
1 to the main controller 11 via 11 a. If backup power source 7 comprises an
electric
backup power supply, testing can be done by opening switch 8 to disconnect
main
power supply 9. Then, ESD controller 1 can either use a built in load resistor
to test the
current flow from backup power source 7, or activate main motor driver 2 via
communication path 2a to provide an electrical load to backup power source 7.
By
monitoring the current flow with current sensor 2b and the voltage of backup
power
source 7 with voltage sensor 7a operatively connected to ESD controller 1 via
signal
path 7b, ESD controller 1 can determine whether backup power source 7 can
operate
when needed (ie, is "good") or whether backup power source 7 is failing or has
failed.
{E5889209.DOC;1}
CA 02727208 2011-01-07
8
[0021] To detect when ESD controller 1 itself has failed, the system can
comprise, in
some embodiments, external ESD controller watchdog 10. In other embodiments,
ESD
controller watchdog 10 can be embodied, embedded or integrated functionally or
physically in ESD controller 1. ESD controller 1 can communicate with ESD
controller
watchdog 10 via signal path la to determine whether ESD controller 1 is
functioning
correctly. When ESD controller watchdog 10 no longer received communication
from
ESD controller 1 on signal path 1 a, ESD controller watchdog 10 can conclude
that ESD
controller 1 has failed. In this event, ESD controller watchdog 10 can
independently
actuate valve 5 via signals sent along signal path 10a to main motor driver 2
to operate
valve 5 to the fail-safe position. In the event that main motor driver 2 has
failed or is
inoperable, ESD watchdog can independently actuate valve 5 via signals sent
along
signal path 1 Ob to backup motor driver 3 to operate valve 5 to the fail-safe
position.
[0022] In normal operation, a periodic signal can be transmitted to ESD
controller 1 from
master controller 11 to master controller watchdog 1 b via signal path 11 a to
indicate
that main system controller 11 is operating correctly. In the event of a
failure of the
periodic signal from master controller 11 to master controller watchdog 1 b
disposed
within ESD controller 1, which can indicate a failure of master controller 11,
ESD
controller 1 can actuate valve 5 to the fail-safe position via a signal sent
along signal
path 2a to main motor driver 2 to supply current to motor 4 to actuate valve
5.
[0023] In some embodiments, the system can detect when there is a failure of
primary
power supply 9. Voltage sensor 9a can monitor the voltage of primary power
source 9.
When the voltage of primary power source changes or drops, sensor 9a can send
a
{E5889209. DOC;1 }
CA 02727208 2011-01-07
9
signal to ESD controller 1 via signal path 9b to indicate an alarm condition.
ESD
controller 1 can then actuate valve 5 to the safe position.
[0024] In some embodiments, each of ESD controller 1 and ESD controller
watchdog 10
can comprise discrete electronic or electro-mechanical components, such as
transistors, field-effect transistors ("FETS"), diodes, triacs, optocouplers,
operational
amplifiers, relays, solenoids, resistors, capacitors and inductors, and any
other discrete
or integrated electronic device or component as well known to those skilled in
the art
wherein ESD controller watchdog 10 can operate either of main motor driver 2
or
backup motor driver 3 in response to a triggering event as discussed above. In
other
embodiments, either or both of ESD controller 1 and ESD controller watchdog 10
can
comprise a microprocessor, a microcontroller, integrated logic circuits, timer
circuits,
programmable gate arrays, field-programmable gate arrays or application
specific
analogue devices as well known to those skilled in the art. In representative
embodiments, ESD controller watchdog 10 can comprise a model ADM6316 series
supervisory circuit as manufactured by Analog Devices, Inc. of Norwood,
Massachusetts, U.S.A. In further embodiments, ESD controller 1 can comprise
any or
all of the aforementioned electronic components and devices in combination, as
well
known to those skilled in the art.
[0025] Referring to Figure 2, a flowchart of process 200 that can be carried
by ESD
controller 1 in some embodiments is shown. Process 200 can begin at step 204
and
then carry out step 208 where ESD controller 1 can query whether a standard
communication has been received from master controller 11. If "yes", then ESD
controller 1 can carry out any process as set out in the standard
communication at step
{E5889209. DOC;1 }
CA 02727208 2011-01-07
212. If "no", then ESD controller 1 can determine whether master controller
watchdog
1 b has received communication from master controller 11 at step 216. If
"yes", then
master controller watchdog lb can be reset at step 220 whereupon ESD
controller 1
can proceed to step 232. If "no", then ESD controller 1 can determine whether
master
controller watchdog 1 b has timed out at step 224. If "yes", then ESD
controller 1 can
proceed to actuate valve 5 to a safe position and generate an alarm at step
228, and
then proceed to step 232. If "no", ESD controller 1 can proceed to step 232.
[0026] At step 232, ESD controller 1 can send a reset request to ESD
controller
watchdog 10 and then proceed to step 236. At step 236, ESD controller 1 can
determine whether it is time to run a test procedure, such as testing the
operation of
valve 5 or testing backup power source 7. If the answer to the query at step
236 is
"yes", then ESD controller 1 can carry out the testing procedure or operation
at step
240. At step 244, a query can be made to determine if the testing procedure or
operation passed. If "yes", process 200 can proceed to step 252. If "no", ESD
controller 1 can generate an alarm and optionally actuate valve 5 to a safe
position at
step 248 and then proceed to step 252. If the answer to the query at step 236
is "no",
then process 200 can proceed to step 252.
[0027] At step 252, ESD controller 1 can carry out other process measurement
and
control tasks, which can include measuring voltages and currents and detecting
the
angular position of valve 5 from the sensors disposed in the system. After
step 252,
process 200 can proceed to step 256 where it can then loop back to step 204
and
repeat itself.
{E5889209.DOC;1 }
CA 02727208 2011-01-07
11
[0028] Referring to Figure 3, a flowchart of process 300 that can be carried
by ESD
controller watchdog 10 in some embodiments is shown. Process 300 can begin at
step
304 and then carry out step 308 where ESD controller watchdog 10 can query
whether
it has received communication from ESD controller 1 along signal path 1 a. If
"yes", then
ESD controller watchdog 10 can be reset at step 312, and process 300 can then
proceed to step 324. If "no", then a query can be made at step 316 to
determine if ESD
controller watchdog 10 has timed out. If "yes", then ESD watchdog 10 can
actuate
valve 5 to a safe position at step 320. If "no", then process 300 can proceed
to step
324. At step 324, ESD controller watchdog 10 can then carry out any remaining
housekeeping tasks as programmed therein. After step 324, process 300 can then
proceed to step 328 where it can then loop back to step 304 and repeat itself.
[0029] In some embodiments, either or both of master controller watchdog 1 b
and ESD
controller watchdog 10 can comprise discrete active and passive electronic
components
or integrated analogue and/or digital electronic devices and components, or a
combination thereof, as well known to those skilled in the art, wherein
watchdogs 1 b
and 10 can be external or not integrated with ESD controller 1. In other
embodiments,
either or both of master controller watchdog 1 b and ESD controller watchdog
10 can be
integrated or embedded in ESD controller 1, either in terms of electronic
components or
embodied as "virtual components or circuits" wherein the functions of
watchdogs lb or
can be carried out by a microprocessor or microcontroller disposed in ESD
controller
1 following a series of steps programmed in a computer-readable memory
disposed
thereon or therein, as well known to those skilled in the art.
(E5889209.DOC;1)
CA 02727208 2011-01-07
12
[0030] Although a few embodiments have been shown and described, it will be
appreciated by those skilled in the art that various changes and modifications
might be
made without departing from the scope of the invention. The terms and
expressions
used in the preceding specification have been used herein as terms of
description and
not of limitation, and there is no intention in the use of such terms and
expressions of
excluding equivalents of the features shown and described or portions thereof,
it being
recognized that the invention is defined and limited only by the claims that
follow.
{E5889209. DOC;1 }
