1700 Wellhead Control Systems

Abstract
This section provides guidance for the design of a wellhead control system to be
used to monitor the flowing conditions of the well flowline and to initiate a shut-
down of the well. The various components of a wellhead shutdown system, their
function in the system, and their operation are discussed. Shutdown systems for
both surface controlled and subsurface controlled shutdown systems are included.

Contents Page

1710 Basic Principles 1700-2

1711 Shutdown Sensors
1712 Fail-Safe Design
1713 Surface Safety Valve (SSV)
1714 Surface-Controlled Subsurface Safety Valves (SCSSV)
1720 Design Considerations 1700-18
1721 Flowline Pressure Rating, Ten Foot Rule
1722 First Out Indication
1723 Testability and Maintenance During Operation
1724 Panels for Wellhead Controls
1725 Enclosures for Wellhead Control Systems
1726 Tagging and Nameplates
1727 Functional Requirements
1730 References 1700-27

Chevron Corporation 1700-1 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

1710 Basic Principles

The function of the wellhead control system is to monitor each well’s flowline pres-
sure, interface with the facility Emergency Shutdown System (ESD), and control the
surface safety valve (SSV).
Like other shutdown systems described in Section 1300, a wellhead control system
should be used to prevent the risk of injury or damage to personnel, the environ-
ment, or equipment. Wellhead control systems are designed to be “fail-safe.”
When required, the wellhead control system also monitors the surface controlled
subsurface safety valve (SCSSV) for the well. SCSSVs are required for offshore
platforms. Regulations, such as API RP 14 C and the Minerals Management Service
OCS Order No. 5, govern the requirements for these safety systems.
SCSSVs have been installed on land wells in some facilities that are located near
population centers or where the wellhead may be subject to physical damage.
When hydraulically operated SCSSVs are required, the wellhead shutdown system
must include a hydraulic reservoir and pump system to maintain pressure on the
subsurface valves during normal operation.
Almost all wellhead control systems are pneumatic for sensing and control of the
surface safety valve (SSV). Pneumatics have been widely used for a long time and
are accepted by the users. Pneumatics work well in the vicinity of wellheads, where
they are subject to vibrations and fluids from drilling activities.
On land, a separate wellhead control system is usually provided for wells operating
under pressure flow conditions, when damage or injury to the environment,
personnel, or equipment could occur.
In temperate climates the controls may be mounted individually out-of-doors. In
colder climates the controls are often mounted in a small panel, which may be
housed in a building or shelter.
On offshore platforms, the wellhead control systems are grouped on one or more
panels. The control logic for each well is kept separate from the other wells so that
wells may be easily added to or deleted as required. SCSSVs are hydraulically
controlled and operated from these panels. A separate hydraulic system is usually
furnished for every panel. Shutdown controls for each pneumatically operated SSV
and its SCSSV are arranged together on the same control panel.
When instrument air is available, as it is on many offshore platforms, it is the best
source of gas pressure to operate these safety control systems. When instrument air
is not available, process gas can be used. The source of gas pressure for the control
system must be dry and filtered and free of contaminants.
Nitrogen is often used on land as the source of gas pressure in the following circum-
stances:
• When only sour gas is available
• When hydrocarbons cannot be vented to the atmosphere

July 1999 1700-2 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

• When a source of clean, dry gas is unavailable

In extreme cold conditions, hydraulics have been used for the surface control
systems.

Electric Wellhead Control

Electrical control systems have been developed and are very feasible for harsh
climates or when handling toxic fluids in the flowline.
One Company location in Wyoming, faced with an extremely high level of H2S, has
successfully used electric pressure switches, hand switches, and solenoid valves on
every wellhead in the entire field for years. They also included H 2S detectors as one
of the shutdown sensors.
When annunciation or indication of the shutdown sensor is important, electric shut-
down systems would be more flexible, easier to implement, and more cost effective
than pneumatic systems.
Electric systems are far easier to interface with a Supervisory Control And Data
Acquisition (SCADA) system for remote monitoring and control.

1711 Shutdown Sensors

Generally, four types of shutdown sensors are used to send signals to each wellhead
control panel:
• Process and ESD shutdown pilot relays
• Fusible plugs on fire loop systems
• High- and low-pressure sensors from the flowline
• Sand probes in the flowline
SSVs are closed by any of the above devices whether on land or offshore. SCSSVs
are shut down only by an ESD or fire signal and only after a time delay to allow the
SSV to close first.

Process Shutdown Relays

The pneumatic wellhead control system must be pressurized in order to operate. The
interface with the process or platform shutdown system is accomplished by using a
pilot relay. Pilot relay is short for a “pilot operated, three-way valve or relay.”
The relay consists of a three-way block and bleed valve and a pneumatic piston or a
pressure pilot on the other end. The relay is mounted inside the wellhead control
panel. This pilot relay will automatically reset when the process shutdown system
has been repressured or brought back to a normal situation. With a signal applied
from the remote process or platform shutdown system, the three-way pilot valve
allows free passage of the pneumatic holding pressure. When the remote signal is
removed, the relay will switch, block in the supply pressure, and vent all the down-
stream holding pressure. This series of actions will initiate a wellhead shutdown by
venting the pneumatic signal from a manually reset pilot relay that controls the
surface safety valve (SSV).

Chevron Corporation 1700-3 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Manual Reset Relays

A shutdown signal from a plant or platform ESD to the wellhead control system is
usually caused by a possible dangerous or damaging condition existing downstream
of the wellhead.
It is important that the wellhead shutdown system be designed with a manual reset
pilot relay. See Figure 1700-1. The manual reset pilot relay has a knob on one end
as well as the pressure pilot on the other end of a three-way valve. The three-way
valve will switch and shut down the surface safety valve either when the knob is
pushed or the pilot is depressured.

Fig. 1700-1 Pilot Relay with Manual Reset (Courtesy of the Cooper Cameron Corporation, owner of the W-K-M
trademark.)
The Model 3300-A pilot relay valve is a normally closed, block and
bleed three-way valve. The relay will stay locked in the normally
closed position until the pull knob is pulled out. In this position, the
spool valve is pinned with the automatic bypass holding the spool
valve open, allowing actuator pressure to flow through. When
instrument pressure is applied to the bottom of the relay piston, the
spool valve is moved upward, automatically releasing the auto-
matic bypass pin. As long as instrument pressure is present at the
bottom of the relay piston, the relay will stay in operating position.
Loss of instrument pressure returns the relay to its locked closed
position and back-bleeds the downstream side. In the closed posi-
tion, the relay is automatically locked closed and must then be
manually reset for operation.
FEATURES:
1. Fail safe.
2. Automatic bypass pin release.
3. Internal lock-closed device.
4. Manual shut-in of SSV by pushing in pull knob.
5. Can control multiple wells individually.
6. Pressure through relay from 0 to 250 psi.
7. Instrument pressure from 30 to 40 psi.
8. Materials meet NACE MR-01-75 specifications.
9. Viton seals. (Temperature range -20°F +400°F.)
10. Can be panel-mounted. Hole size is 1.5 inches.
11. All ports 1/4" NPTF

This means that when the shutdown signal is initiated, the system will trip and stay
shut down. Clearing of the possibly dangerous or damaging condition will not auto-
matically reset the system and open the surface safety valve. The only way the SSV
or the SCSSV can be opened is for the production operator to manually reset this
shutdown relay by pulling the knob. Pulling the knob sets a pin that latches the

July 1999 1700-4 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

three-way valve until pressure is applied to the pilot. The pin will disengage when
the pilot is pressured, thus activating this shutdown relay.
This relay should not have a lockout feature that disengages the manual reset, which
would allow the surface safety valve to automatically cycle shut and open. The
design of this safety relay should require that it can only be latched in the open posi-
tion while no instrument pressure is applied to the pilot diaphragm.
Indicators are available to enable the operator to tell at a distance that a wellhead
surface safety valve is shut down. On panels controlling multiple wells, indicators
for the valve signals are very helpful to the operator. These indicators can be inte-
gral to the relay knob, or they can be a separate panel-mounted device.
It is important to determine that the possibly dangerous or damaging condition has
been corrected and to make sure that the operator is present at the wellhead to
monitor the well while it is placed back into operation.

Pressure Sensors
High- and low-pressure sensors are used to monitor the flowline pressure of the well
downstream of the choke. The high-pressure sensor is used to protect both the final
flowline segment and the downstream process equipment. The low-pressure sensor
is used to detect a leak or flowline rupture. Requirements for pressure sensors are
covered in API RP 14C Section A1 for offshore platforms and by established
Company practices.
The settings for these sensors must be carefully determined, reviewed, and docu-
mented. Because of the pressures normally encountered in flowline service and the
proximity to the workover operations, the most commonly used pressure sensors are
called “stick pilots.” See Figure 1700-2.
These pressure sensors come in a wide selection of ranges, which can be easily
adjusted. The sensors have 1/2 NPT connections and are typically color-coded to
identify the spring range. See Figure 1700-3.
The pressure sensors are usually connected in tandem. The holding circuit supply
pressure is connected to the inlet of the high-pressure pilot. The low connection of
the high-pressure pilot is connected to the inlet connection of the low-pressure pilot.
The upper connection of the low-pressure pilot continues through the system
holding circuit. A typical pneumatic hookup is shown in Figure 1700-4.
Should the flowline pressure downstream of the choke exceed the preset limit, the
high-pressure sensor internal piston will shift upwards, blocking its supply port and
venting the holding circuit pressure, thus triggering a wellhead shutdown. Should
the flowline pressure decrease below the low limit, the low-pressure sensor internal
piston will shift down, blocking its supply port and venting the holding circuit pres-
sure, thus triggering a wellhead shutdown.
Pressure sensors are normally mounted on a manifold on the flowline and on the
pneumatic signal tubing sent to the wellhead control panel. Some of the reasons for
remote mounting are as follows.

Chevron Corporation 1700-5 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Fig. 1700-2 Typical Pressure Sensor (Courtesy of the Cooper Cameron Corporation, owner of
the W-K-M trademark.)

Fig. 1700-3 Typical Pressure Sensor Ranges (Courtesy of the Cooper Cameron Corporation,
owner of the W-K-M trademark.)

July 1999 1700-6 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-4 Pressure Sensors in Tandem Service (Courtesy of the Cooper Cameron Corpora-
tion, owner of the W-K-M trademark.)

• To avoid high wellhead pressures and process fluids in the control panel
• To reliably measure viscous liquid hydrocarbon pressures by having the sensors
mounted close to the process
• To minimize the risk of chloride or sulfide stress cracking when corrosive fluids
are present
• To avoid plugging problems in the tubing when paraffins are present
• To avoid plugging problems in the tubing when the formation of hydrates is
possible
• To avoid freezing in long process leads in cold environments
• To avoid mechanical damage during workover operations
Dual pressure pilot sensors, such as the Fisher Model 4660, have been directly
mounted in the control panel in some locations.

Chevron Corporation 1700-7 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Sand Probes
Sand probes are used on flowlines where erosion due to flowing conditions may be
experienced. Under these conditions the probe will erode with the passage of sand
and actuate the sensor.
When properly placed in the flowline, the number of sand probe sensor failures can
be valuable in helping to determine the erosion wear on the flowline. Therefore, the
number and date of occurrence of sand probe failures should be carefully docu-
mented. One rule of thumb is to schedule for a wall thickness test (e.g., x-rays) after
four sand probe failures.
Sand probes should be inserted in a straight run of pipe at least ten (10) feet down-
stream of the well choke or any other change in piping direction. The pipe down-
stream of the probe should also be straight for another four feet. Probes should be
selected for the line size of the flowline and should be purchased with 1/2 NPT
connections. Figure 1700-5 shows a typical sand probe sensor.
When erosion causes failure of the probe, the flowline pressure enters the sand
probe sensor and the internal piston shifts upwards. The supply or instrument port is
blocked, and the holding circuit pressure is vented, thus triggering a wellhead shut-
down.
The manual handle of the sand probe will give an instant indication that the sand
probe has tripped. This manual handle may also be used to manually test the well-
head control system.

1712 Fail-Safe Design

Two types of failure modes are described in Section 1300, “Process Alarm and
Shutdown Systems.” One mode is de-energized-to-trip and the other energized-to-
trip. All wellhead control systems and components must use the de-energized-to-trip
design, which means that the system will be a fail-safe design.
As previously mentioned, the fail-safe design is accomplished by maintaining a
pneumatic pressure holding circuit on all the components of the control system
located at the surface of the wellhead and a hydraulic pressure on the SCSSV during
normal operation.
A typical simplified pneumatic circuit for a wellhead control of an SSV is shown in
Figure 1700-6.

1713 Surface Safety Valve (SSV)

The SSV is normally located as a wing valve on a high- or low-pressure wellhead
Christmas tree. This name is derived from the tree-like appearance of the valves and
fittings branching out from it. A manual valve must be installed between the SSV
and the well to allow for maintenance. See Figure 1700-7.
The type of valve used in the flowline for a shutdown valve is usually a reverse gate
valve. This valve is well suited for this application due to its self-closing feature.

July 1999 1700-8 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-5 Typical Sand Probe Sensor (Courtesy of the Cooper Cameron Corporation, owner of the W-K-M
trademark.)

Chevron Corporation 1700-9 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Fig. 1700-6 Simplified Wellhead Control for SSV

The valve consists of a gate assembly that operates at ninety degrees to the pathway
through the valve. The valve stem and gate rise to effect closure. This stem action is
opposite the stem action of a normal gate valve.
The internals of the valve are designed so that the body pressure generates a force
on the gate and stem in the upward direction, always tending to drive the valve shut.
A diaphragm- or piston-type of actuator is used with a reverse gate valve. The valve
is opened by applying pressure above the diaphragm, which drives the stem down.
To close the valve, the pressure is removed from the diaphragm. The flowline pres-
sure drives the gate stem upward, closing the valve. A spring, located below the
actuator diaphragm, will also close the valve when equal pressure is present on both
sides of the valve.
The actuator must be sized above the maximum anticipated operating pressure or
for the maximum allowable working pressure (MAWP) of the valve itself. A safety

July 1999 1700-10 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-7 Typical Wellhead Christmas Tree with SSV

factor of about 25% for wear and friction losses in the future should be added.
Diaphragm actuators are presently used up to 15,000-psig design pressures.
Manual overrides for an SSV can be provided on land but are not allowed offshore.
Three types are available:
• Hydraulic
• Handwheel
• Lockout cap
Lockout caps should be furnished with a fusible insert so that the valve will close in
case of a fire.
A diaphragm-actuated valve is shown in Figure 1700-8. All surface safety valves
should have a firesafe seal on the shaft and an external relief valve on the actuator
housing. A fusible link has been installed on the pressure line to the actuator in
some areas.
Many wellhead SSVs require a quick bleed or quick exhaust valve on long actuator
supply lines to ensure that the valve closes quickly enough. See Figure 1700-9.
SSVs should be provided with some means to visually indicate to the operator
whether the valve is open or closed.

1714 Surface-Controlled Subsurface Safety Valves (SCSSV)

SCSSVs are specially designed wellhead shutdown valves that are held open by the
maintenance of a constant hydraulic pressure. These valves are usually located
hundreds of feet below the bottom of the sea or surface of the land. Sometimes more
than one valve is required per well.

Chevron Corporation 1700-11 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

The valve is installed in the wellhead tubing and the hydraulic control tubing is run
between the tubing and the intermediate casing. One type of SCSSV is shown in
Figure 1700-10.
The number of wells being controlled by a hydraulic system depends upon local
preference. Sometimes individual hydraulic systems are preferred. Usually the wells
are grouped in logical “blocks” that enable good operator access and control in case
of a problem. Normally, a limit of no more than 10 to 20 wells per hydraulic system
will allow all the SCSSVs to be reset in under 5 minutes.
Hydraulic pressure is supplied by a pneumatically driven pump with a second pump
as a backup. The backup pump can be another pneumatically driven pump with a
manual operator option or just a manually operated pump.
A low-pressure sensor can be installed to monitor the hydraulic pressure and alert
the operator. A relief valve is provided on the discharge of the pump to relieve
excess back pressure back to the supply tank. The main pump is driven by approxi-
mately regulated 100-psig air or natural gas.
Regulations such as API RP 14B and OCS Order No. 5 govern the requirements for
these systems.

Control of SCSSVs
Each well should have its subsurface controls located in the control panel, adjacent
to the surface controls. A typical hydraulic circuit for an SCSSV is shown in
Figure 1700-11.
To operate the control system in order to open the SCSSV and the SSV, the
following sequence occurs:
1. By pulling the knob, the operator manually resets the pilot relay for the
hydraulic system (MR-1). The pin will hold the relay open.
2. Instrument gas will flow through the ESD/Fire Loop pilot relay (R-2), and
a. Pressure up relay MR-1 and release its pin
b. Pressure up the hydraulic system latching relay (R-3) and allow gas to flow
to the hydraulic pumps
c. Start the pneumatically driven hydraulic pump and
d. Close the hydraulic dump valve (R-4)
3. The selected SCSSVs will open and at the shut-in tubing pressure (SITP) the
hydraulic low-pressure switch will allow instrument gas to flow to the
hydraulic pressure pilot relay (R-5).
4. Instrument gas will flow through R-5 and through the process equipment S/D
pilot relay (R-6) and will pressure up the field flowline instrument tubing up to
the pressure-switch-low (PSL) switch.

July 1999 1700-12 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-8 Typical SSV with Diaphragm Actuator (Courtesy of Axelson, Inc.)

Chevron Corporation 1700-13 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Fig. 1700-9 Quick Bleed or Exhaust Valve (Courtesy of Otis Engineering Division of Halliburton)

5. After confirming that the first SCSSV is open, the operator pulls the knob to
manually reset the pilot relay for the first SSV (MR-7-1). The pin will hold the
relay open.
6. 100 psig instrument gas will flow through MR-7-1 to the quick exhaust valve
and open the SSV.
7. After the first well is sending crude oil to the process equipment, instrument
gas will flow through the PSL switch and the sand probe and back to the SSV
pilot relay (MR-7-1), where the pin will release.
8. The second well is put onstream the same way by manually resetting the
SCSSV selector and confirming that the SCSSV is open, then resetting the SSV
pilot relay (MR-7-2), etc., until all the wells are flowing.

Hydraulic Pumps
Most hydraulic pumps are air or natural gas driven reciprocating pumps. Electri-
cally driven pumps are occasionally used. As shown in Figure 1700-12, the gas
power end has a larger area than the liquid end. The pump reciprocates due to the
action of a cycling gas supply.
The maximum discharge pressure of the liquid at no flow is approximately equal to
the pneumatic supply pressure times the area ratio plus the liquid suction pressure.
When this balance of forces is reached, the pump stalls and ceases pumping without
consuming any supply gas. The pump will automatically restart when the hydraulic
pressure drops below 97% of the design pressure.
Normally, a backup manually operated hydraulic pump is used for maintenance or
emergency use to keep the SCSSV open.

Time Delays to Close SCSSV

A remote emergency shutdown from the platform ESD system must shut down the
SCSSV, but only after a nominal 2-minute time delay.

July 1999 1700-14 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-10 Typical SCSSV (Courtesy of the American Petroleum Institute)

This delay will ensure that the SSV at the wellhead is closed first to allow it to
absorb the wear and tear of opening and closing against a differential pressure at
flowing conditions. The SSV is much easier and cheaper to repair than the SCSSV.
The time delay, which is adjustable, is accomplished by adding a needle valve and
volume bottle in the pneumatic ESD signal line going to a pilot relay that controls
the air or gas to the hydraulic pump and dump valve. The orifice in the needle valve
restricts the air or gas bleed to the piston of a pilot relay. After about 2 minutes, the
three-way valve in the relay will shift and depressure the system. This action will
open the hydraulic dump valve, which quickly allows the hydraulic pressure on the
SCSSV to be relieved to the supply tank. Refer to Figure 1700-13.

Chevron Corporation 1700-15 July 1999

 Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-11 Typical Hydraulic Circuit for SCSSV

Chevron Corporation 1700-16 July 1999

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-12 Schematics of Basic Pump Types

Fig. 1700-13 Time Delay Circuit to Close SCSSV Slowly

Safety Interlock to Open SCSSV First

The SCSSV must have a safety interlock to make sure that this valve is opened
before the SSV. The SCSSV is extremely difficult to open when there is a maximum
differential pressure across the valve, which would be true if the SSV were opened
first.
The addition of a pilot relay in the pneumatic circuit is the method usually used to
provide the safety interlock. Pressure is thereby supplied to the hydraulic pump

Chevron Corporation 1700-17 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

supply pressure, the hydraulic dump valve, and the supply port of the manual reset
pilot relay that controls the SSV.

Other Safety Interlocks and Features

Low- and high-level alarms on the main hydraulic reservoir tank are normally
included to alert the operator that a hydraulic leak or backflow of process fluids
from the well through the control tubing has occurred.
The hydraulic fluid reservoir must be adequately vented to prevent any pressure
buildup caused by returning fluid during an emergency shutdown of all the
SCSSVs, or in case of backflow from the well through the control tubing.
A low-pressure alarm on the automatic hydraulic pump discharge alerts the oper-
ator of a pump malfunction before the SCSSVs all close against operating wells.
Exact requirements for surface-controlled systems for SCSSVs used on offshore
platforms are covered in API RP 14B and shown in Figure 1700-14.

1720 Design Considerations

1721 Flowline Pressure Rating, Ten Foot Rule

Flowlines transport hydrocarbons from the wellhead to the first downstream process
equipment or vessel. Flowlines are divided into flowline segments. A flow-line
segment is a portion of the flowline that has an assigned operating pressure from the
other portions of the flowline. Thus, most wells have an initial and a final segment
with an inline pressure reducing device or choke separating the segments.
API RP 14C Section A1 describes the requirements for safety devices and their
location for offshore platforms. These rules follow the Company requirements and
should apply on land as well as offshore. The following discussion is an abbrevia-
tion of RP 14C. It assumes that the flowline has only one choke and therefore is
divided into two segments. Refer to Figure 1700-15.
Two important considerations determine the requirements for safety devices on
wellheads and flowlines.
• Is the first choke device in the initial flowline segment less than 10 feet from
the wellhead?
• Is the maximum allowable working pressure of the final flowline segment (after
the choke) greater than or less than the shut-in tubing pressure (SITP) of the
well?
When the distance to the choke is less than 10 feet, then pressure sensors in the
initial segment of the flowline upstream of the choke are not required. When the
distance is greater than 10 feet, then API RP 14C only requires a low-pressure
sensor to detect leaks and ruptures. High- and low-pressure sensors are always
required in the final flowline segment downstream of the choke. When the
maximum allowable working pressure (MAWP) of the final segment of the flow-

July 1999 1700-18 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

line after the choke is greater than the shut-in tubing pressure (SITP), then both
high- and low-pressure sensors are required to detect a blocked line or flow control
failure as well as a leak or rupture.
However, when the MAWP of the final flowline segment is less than the SITP, then
a pressure relief valve as well as both high- and low-pressure sensors are required.
This requirement follows the concept of an independent backup device discussed in
Section 1300, “Process Alarm and Shutdown Systems.”
In the previous case, where the MAWP of the final segment is less than the SITP,
API RP 14C allows the substitution of a second shutdown valve and an indepen-
dent high-pressure sensor in place of a pressure relief valve.
If the flowline has no choke then the MAWP for the entire flowline must be greater
than the SITP. Both high- and low-pressure sensors are required in this case where
there is only one segment.
Flowlines may have more than two segments. API RP 14C should be consulted to
determine the required safety equipment.
For all flowlines, the following safety devices should be included:
• Check valve in the final flowline segment to prevent any backflow
• ESD shutdown
• Fire loop shutdown
• Downstream process equipment shutdown
In some locations fusible plugs have been installed in the pressure line to the SSV
actuator and in other locations they have been installed inside every control panel.

1722 First Out Indication

If three sensors are used to shut down the surface safety valve (e.g., high-pressure,
low-pressure, and sand probe), then first out indication may be desirable. Most well-
head control panels in the Company have not required this feature in the past, but
new installations are beginning to put them in.
First out indicators can help during the testing of pressure sensors, especially when
multiple wellhead control panels are installed. The sensors are mounted on the flow-
line and pilot relays are installed in the wellhead control panel. Panel indicators are
connected to the outlet port of each of the pilot relays. From written instructions, the
operator can determine which sensor tripped by observing the number of tripped
indicators. The knob on the sand probe could also be used as an indicator, but
because it is mounted remotely, it may not be visible from the panel.
A better way to do the same thing is to install first out indicators (e.g., Amot Model
4400) which have internal porting and will only indicate the sensor that tripped. See
Figure 1700-16.

Chevron Corporation 1700-19 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Fig. 1700-14 Schematic of a Control System for SCSSVs (Courtesy of the American Petroleum Institute)

July 1999 1700-20 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

Fig. 1700-15 Recommended Safety Devices for Wellhead Flowlines (Courtesy of the American Petroleum Institute)

1723 Testability and Maintenance During Operation

A three-way valve on the panel can be installed to bypass the high- and low-pres-
sure pilots and the sand probes while sensors are being tested, calibrated, or
replaced. For safety reasons, it should be very evident from a distance that the
bypass valve has been switched by the use of panel-mounted indicators. Many facil-
ities require an alarm when bypass switches are used. Sometimes individual bypass
valves for each of the three sensors are used.
A test connection in the field should be provided for checking the pressure sensors.
Individual barstock root valves and test valves are normally used. When oil quality
allows the pressure pilots to be panel-mounted, then the test connection can be
panel-mounted also.

Chevron Corporation 1700-21 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

Fig. 1700-16 Pilot Relay with First Out Indication (Courtesy of Amot Controls Corp.)

When a fault condition arises, the valve sensing that condition opens, causing a loss of pressure at the large end of the piston and
allowing pressure on the small end to move the piston to the “Red” or tripped position. The OUT Port connects with the VENT Port
through specially formed vent grooves, and all pressure downstream is released to the VENT as the IN Port is closed off from the OUT
Port. This loss of pressure can be used to close fuel valves, actuate audible alarm devices or operate remote signal devices or switches.
Any indications existing at that moment will be held indefinitely. The unique Red and White striped “Trip” tape, selected by optical
specialists, can be clearly seen at a distance even in poor light and by those with impaired color vision. An operator can check the 4400
Relay panel at any time and tell immediately what caused the trouble.

Needle valves in the supply gas and hydraulic oil tubing runs should be provided to
allow components to be replaced without requiring that an individual wellhead or all
the wellheads be shut down. Some of the components which may require replace-
ment are as follows:
• Pressure regulators
• Pressure gages
• Indicators
• Hydraulic pumps and their regulators

1724 Panels for Wellhead Controls

Several vendors specialize in building wellhead control panels. In order to be
competitive, they will offer to supply the minimum number and lowest quality of
logic and panel components.
To get a panel that is reliable and maintainable, a drawing should be prepared that
shows in general terms such things as the following.
• Available space that the panel can occupy or the maximum acceptable panel
dimensions

July 1999 1700-22 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

• Accessibility to the panel for maintenance and the location of doors and bulk-
heads
• General layout of the controls showing the wellhead control groupings, the
location of subsurface controls for each well in relation to the surface controls,
and the location of the hydraulic control unit and manual pump override
• The minimum and maximum height of the controls from grade and how the
panel is to be mounted
• The amount of space required for expansion
• Nameplate engraving details including the lines of text, the size of letters and
nameplate, and color scheme, if any
• Distances from the field devices to the panel
• Indication requirements for such things as valve status and bypass switches
• Bypass switch and test valve requirements
• First out indication requirements for shutdown sensors
The drawing or an attached specification should include a list of the components
and the acceptable manufacturers.
To ensure quality and reliability, it is often necessary to include model numbers to
avoid the problem when a vendor supplies the least expensive option. Model
numbers also help in bid evaluation, during inspection of the finished panels, and to
maintain standardized spare parts.
Vendors should be allowed to offer reasonable substitutions in order to produce the
lowest cost panel by avoiding unusual construction requirements.

1725 Enclosures for Wellhead Control Systems

Enclosures are usually made of 316 stainless steel to withstand the corrosive envi-
ronment of offshore platforms or the workover conditions around the wellheads. As
a minimum, all the hardware must be made of 316 stainless steel. This includes
hinges, latches, handles, bolts, and nuts.
Enclosures may be made to withstand such things as windblown rain, sand, and
dust; splashing water; hose-directed water; and spray from wellhead workover
activities. External icing may also be a problem, but it is usually handled by the use
of buildings or shelters.
Specifications may be written to describe the enclosure construction required to
withstand operating conditions, but the use of NEMA-type enclosures, developed
for electrical equipment, can match the right cabinet or enclosure to the operating
conditions. Some of the NEMA types are as follows.
NEMA 13 — indoor use, protection against dust, spraying of water, oil, and noncor-
rosive fluids.

Chevron Corporation 1700-23 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

NEMA 12 — indoor use, protection against dust, falling dirt, and dripping noncor-
rosive liquids.
NEMA 3 — outdoor use, protection against windblown dust, rain and external
icing.
NEMA 3R — outdoor use, protection against falling rain, external icing, and only
rust resistant
NEMA 4 or 4X — outdoor use, protection against windblown dust and rain,
splashing water, hose-directed water, and external icing. (The “4X” means corro-
sion-resistant, but “316 stainless steel” should be added to this description.)
Following are some other important requirements for construction.
• Tubing runs between components should be designed to allow easy removal of
components or in-place maintenance to replace “O” rings and gaskets.
• Stacking or double layering of tubing runs should not be allowed.
• Longer tubing runs should be clamped with solid stainless steel spacers.
• All tubing should be reamed and blown clean with dry air before installation.
• Pipe-to-tube fitting adapters should be used to connect components instead of
pipe nipples and unions.
• All penetrations or bulkhead fittings should be on the sides, back, or bottom.
No penetrations should be allowed into the top of the enclosure.
• No internal components should be mounted from the top or bottom of the
enclosure.
• When height or width exceeds 36 inches, then construction should be with at
least 12-gage stainless steel. Otherwise 16-gage metal is satisfactory.
• Gaskets should be made of oil- and water-resistant material such as neoprene.
• Gaskets should be secured with an oil-resistant adhesive and supported by
continuous stainless steel retainer strips.
• The bottom should be sloped, with a 1/2-inch flush-mounted half-coupling for
draining.
• Lifting eyes with reinforced plates should be provided to support the entire
weight of the completed panel for installation.
• Mounting brackets or stands (including nuts and bolts) should be provided for
small enclosures that are less than 48 inches tall.
• Integral legs should be provided for free standing enclosures 48 inches or taller,
including hardware to bolt the legs to the floor.
• If earthquake requirements exist, brackets should be provided for securing tall
enclosures.

July 1999 1700-24 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

• Number and size of doors should be specified and should depend on the width
of the enclosure. If it is wider than 36 inches, multiple doors are required, with
a maximum width for each door of 30 inches.
• If the type of door latch is not specified as NEMA 4X, three-point latches made
of stainless steel are typically used.
• Locks or other features should be provided for security.
• Mounting and bracing of all internal components should be provided to prevent
damage during shipment and installation and from operating conditions such as
vibration. These supports and shelves are usually made from a corrosion-resis-
tant material such as stainless steel.
• All clips, clamps, straps, bolts, nuts, washers, screws, etc., should be made of
316 stainless steel, nylon, or some other durable, corrosion-resistant material.
• It may be desirable to have a panel or even individual compartments to sepa-
rate hydraulic systems from pneumatic systems.
• When potentially hazardous or corrosive gasses are being handled, the design
of the control system should prevent them from entering any panels or enclo-
sures.

1726 Tagging and Nameplates

Nameplates and tagging are very important for the factory checkout of the panel, the
installation of the panel, safe operation of the controls, and maintenance trouble-
shooting of the wellhead control system.
These are some important considerations:
• All internal components should be tagged with the instrument number or the
identification number on the schematic drawing. If the component does not
have permanent markings giving the make and model number, then this infor-
mation should be added to the tag. Tags should be of stainless steel and wired
or attached onto the components by a corrosion-resistant fastener. Panel-
mounted devices should have these tags attached to the device and visible from
the inside of the panel.
• All panel-mounted instruments including pressure gages, valves, indicators,
pilot relays, etc., must have engraved Bakelite or plastic nameplates that clearly
identify the device.
• Engraved tags should have black letters in a white (or other color if a color
scheme is used) background so that they can be easily cleaned. They should be
attached with stainless steel screws.
• Nameplates should be engraved from a nameplate schedule or front of panel
drawing. They should include the tag number, a process function, and any oper-
ating instructions (e.g., “Pull To Reset”).

Chevron Corporation 1700-25 July 1999

1700 Wellhead Control Systems Instrumentation and Control Manual

• These tags are often color coded. Possible color groups are surface safety shut-
down controls; subsurface safety controls including the hydraulic system; and
bypass and ESD switches.
• Panel title nameplate should have 3/4-inch letters at a minimum and should
identify which wells in the area or wellbay are being controlled. The controls
for each well should be clearly grouped and identified.
• Each bulkhead connection should be identified with a stainless tag that is
drilled and mounted under the bulkhead connection fitting. These tags should
be mounted both on the outside and inside of the bulkhead. The tags should
include the instrument number or schematic identification number.
• Panel drawings, including a schematic and parts list, should be enclosed in a
weatherproof envelope and put in a pocket in one of the doors. On the inside of
the panel should be a stainless steel or phenolic tag with the supplier’s name,
date of manufacture, vendor job number, Company purchase order number, and
a list of the panel drawing numbers that could be useful to anyone trouble-
shooting the panel.

1727 Functional Requirements

Project descriptions should detail the factory testing procedures, as well as who is
responsible for the field installation of the panel, who is responsible for supplying
the field devices, and who is responsible for the field commissioning of the panel
connected to the field devices.
A preliminary simplified schematic diagram should be prepared. The simplified
schematic need only show the key devices in the control system, like the pressure
regulators, pressure sensors, sand probes, pressure gages, SSV and SCSSV, manual
reset pilot relays for the safety valves, and bypass switches for any sensors.
For offshore installations, these requirements should be emphasized:
• Interlock for each well to make sure that the SSV cannot be opened before the
hydraulic system is operational for opening the SCSSV valves
• Interlock for each well to make sure the SCSSV closes two minutes after the
SSV
• Interlock to make sure the SCSSV closes only on an ESD or fire loop signal
• Minimum capacity of the hydraulic reservoir, a level glass gage visible from the
outside of the enclosure, and external fill and drain lines
• When an SCSSV is opened, the design of the hydraulic system should prevent a
pressure drop to any previously opened SCSSVs
• Type of backup pump and manual override to the main hydraulic pump.
Optional functionality should then be described in text form. The description should
include the following.

July 1999 1700-26 Chevron Corporation

Instrumentation and Control Manual 1700 Wellhead Control Systems

• Dual supply regulators and filters with isolating valves for each pressure
system. (Each regulator should be capable of supplying the entire panel
capacity.)
• Pressure requirements for the system including pressure of the supply gas and a
description (e.g., natural gas, air, or nitrogen); gas pressure used to operate the
SSV; holding circuit pressure for the pilot relays, etc.
• Number of bypass switches for the field sensors plus indication or alarm
requirements for the bypass condition
• List of types of panel devices that should be equipped with isolating valves so
that they may be replaced without shutting down other wells
• Size of the tubing and the wall thickness required for each pressure service
• First out-type of indicating pilot relays

SCADA System Requirements

Many wells are tied into a SCADA or production information system. Require-
ments for these electrical tie-ins should be reviewed during the panel design to make
sure they are incorporated into the design, construction, and testing of the panel and
field devices such as the wellhead SSV valves.
Information sent to SCADA system usually includes:
• Open and closed status of wellhead valve from position or proximity switches
• Operation of bypass switches around flowline pressure sensors

1730 References
1. API RP 14B, Recommended Practice for Design, Installation, and Operation of
Subsurface Safety Valve Systems.
2. API RP 14C, Recommended Practice for Testing of Basic Surface Safety System
on Off-shore Production Platforms.
3. API Spec 14D, Specification for Wellhead Surface Safety Valves and Under-
water Safety Valves for Offshore Service.
4. API RP 14F, Recommended Practice for Design and Installation of Electrical
Systems for Offshore Platforms.
5. Department of Interior, Minerals Management Service (MMS), OCS Order No.
5, Subsurface Safety Devices.
6. Chevron Overseas Petroleum General Specifications GS 11.08-1, Alarm
Systems.
7. Chevron Overseas Petroleum Design Practice DP 11.08-1, Wellhead Controls.
8. NEMA Standards Publication No. 250.

Chevron Corporation 1700-27 July 1999