Underwater safety valve actuator

Abstract

A subsea safety valve actuation system in an oil well piping including a safety valve, a piston assembly, a motor, a pump, a spring, a reservoir, a first valve, and a second valve, the system being configured to provide pressure in a chamber of the piston assembly that drives the safety valve to an open position, maintain pressure in the chamber that holds the safety valve in the open position, and release the pressure in the chamber via a first hydraulic release path and / or a second hydraulic release path between the chamber and the reservoir, the first hydraulic release path and the second hydraulic release path extending through the first valve and the second valve, respectively, the first hydraulic release path and the second hydraulic release path being independent of each other, whereby the pressure in the chamber that holds the safety valve in the open position can be released via the first hydraulic release path or the second hydraulic release path if there is a fault in the other of the first hydraulic release path or the second hydraulic release path.

Description

[Technical Field]

[0001] The present invention relates generally to the field of subsea drilling, processing and production equipment, and more specifically to an improved subsea safety valve actuator system. [Background Art]

[0002] In subsea oil and gas exploration, a drilling system or wellhead device may be located thousands of feet below the sea surface, and a well may extend thousands of feet below the seabed. Therefore, specialized equipment is used for drilling, producing and processing subsea oil and gas, such as subsea Christmas trees, processing systems, separators, high integrity pipeline protection systems, drills, manifolds, coupling systems, and production and distribution systems. Such equipment is generally controlled by several types of valves, including blowout preventers for stopping unintended discharge of hydrocarbons into the sea.

[0003] In order to shut off the flow of production fluid from the well to the sea surface in an emergency, a subsea safety valve (SSSV) is usually installed in the wellbore of a hydrocarbon production well. It is known that such an SSSV may be a downward-opening flapper valve, wherein the flow of fluid in the well acts to close the valve, and pressure from the sea surface acts to open the valve.

[0004] Existing SSSVs are hydraulically operated from the sea surface by supplying pressurized hydraulic fluid from a surface vessel to the wellhead device. Large hydraulic power lines from a surface vessel or rig feed subsea drilling, production and processing equipment. When hydraulic pressure is applied down the hydraulic line from the sea surface, the hydraulic pressure forces a sleeve within the SSSV to slide downward, compressing a large spring and pushing the valve flapper downward out of the fluid flow path to open the SSSV. When the hydraulic pressure is removed, the spring pushes the sleeve back, thereby causing the flapper to close and shut off the fluid flow path. In this manner, the SSSV is a fail-safe valve that isolates the wellbore in the event of an emergency. [Summary of the Invention]

[0005] For illustrative purposes only and not limiting, corresponding parts, sections, or surfaces of the disclosed embodiments are denoted by reference numerals in parentheses. The Disclosure provides a subsea safety valve actuation system (90), which is located within an oil well (105) and comprises piping (16, 80) forming a channel (18) down to sea level (104) for fluid originating from below sea level, and within the piping (80) below sea level (104a), which controls the flow of fluid in the channel (18) by having an open position (Figure 2) and a closed position ( Figure 3) includes a safety valve (91) that can operate between the first chamber (2) and the safety valve (91), a hydraulic piston assembly (92,192,492) located in piping (80) below sea level (104a) and including a piston (4,404) between the first chamber (2) and the safety valve (91), an electric motor (10) located in piping (80) below sea level (104a) and configured to be supplied with current, and a hydraulic piston assembly located in piping (80) below sea level (104a) and driven by the motor (10). A hydraulic pump (8) configured to be connected to a first chamber (2) (92,192,492), a spring element (36) located in a pipe (80) below sea level (104a) and configured to provide spring force to a piston (4,404), a fluid reservoir (14) connected to the pump (8) and the first chamber (2), and a first valve connected to the first chamber (2) and the fluid reservoir (14) having a first open position (Figures 8, 12, 14) and a first closed position (Figures 6, 7, 11, 13, 17, 18) The system includes a valve (34,234) and a second valve (35) connected to a first chamber (2) and a fluid reservoir (14), having a second open position (Figures 8, 14) and a second closed position (Figures 6, 7, 11, 12, 13, 17, 18), and the pump (8), hydraulic piston assembly (92,192,492), first valve (34,234), second valve (35), and reservoir (14) are connected within a substantially closed hydraulic system (93,193,293,393),393) is configured to provide pressure within the first chamber (2) that drives the safety valve (91) from the closed position to the open position in the first state (Figures 6 and 12), the hydraulic system (93, 193, 293, 393) is configured to maintain a pressure level within the first chamber (2) that holds the safety valve (91) in the open position in the second state (Figures 7, 11, 13, 17, and 18), the hydraulic system (93, 193, 293, 393) is configured to hold the first valve (34, 234) in the first open position in the third state (Figures 10 and 16) The hydraulic system (93,193,293,393) is configured to release the pressure level in the first chamber (2) via a first hydraulic release path (6,206 / 20 / 34 / 7,107;206 / 234 / 22 / 8 / 7,107) between the first chamber (2) and reservoir (14) which extends through the first valve (34,234) at some point, and in the fourth state (Figures 9 and 15), the hydraulic system (93,193,293,393) is configured to release the pressure level in the first chamber (2) via a first hydraulic release path (6,206 / 20 / 34 / 7,107;206 / 234 / 22 / 8 / 7,107) between the first chamber (2) and reservoir (14) which extends through the second valve (35) when the second valve (35) is in the second open position. The pressure level in the first chamber (2) is released via a second hydraulic release path (6,206 / 21 / 35 / 7,107), and the first hydraulic release path (6,206 / 20 / 34 / 7,107; 206 / 234 / 22 / 8 / 7,107) is independent of the second hydraulic release path (6,206 / 21 / 35 / 7,107), and the second hydraulic release path (6,206 / 21 / 35 / 7,107) is independent of the first hydraulic release path (6,206 / 20 / 34 / 7,107; 206 / 234 / 22 / 8 / 7,107), and Therefore, the pressure level in the first chamber (2) that holds the safety valve (91) in the open position may be released via the first hydraulic release path (6,206 / 20 / 34 / 7,107; 206 / 234 / 22 / 8 / 7,107) if the second hydraulic release path (6,206 / 20 / 34 / 7,107) is obstructed, or if the first hydraulic release path (6,206 / 20 / 34 / 7,107; 206 / 234 / 22 / 8 / 7,107) is obstructed, it may be released via the second hydraulic release path (6,206 / 21 / 35 / 7,107).

[0006] The hydraulic system (93,193,293,393) may be configured to maintain the pressure level in the first chamber (2) independently of the motor (10) and pump (8) in a second state (Figures 7, 11, 13, 17, 18). The second state (Figures 7, 11, 13, 17, 18) may include the first valve (34,234) being in a first closed position and the second valve (35) being in a second closed position.

[0007] In the second state (Figures 7, 11, 13, 17, and 18), the spring element (36) may be compressed between the piston (4,404) and the piping (66). The hydraulic piston assembly (192) may essentially consist of a first chamber (2) connected to a closed hydraulic system.

[0008] The first hydraulic release path (206 / 234 / 22 / 8 / 7,107) may extend through the pump (8). The first state (Figure 12) may include providing a hydraulic force to the piston (4,404) that is opposed to and exceeds the spring force, causing the piston (4,404) to translate in a first direction and actuating the safety valve (91) to the open position. The first state (Figure 12) may also include the first valve (234) being in a first open position and driving the motor (10) to control the flow of fluid to the first chamber (2) through the pump (8). The second hydraulic release path (206 / 21 / 35 / 7,107) may be independent of the pump (8). The first state (Figure 12) may include the first valve (234) being in a first open position and the second valve (35) being in a second closed position.

[0009] The hydraulic piston assembly (92,492) may include a second chamber (3) connected to a fluid reservoir (14), and the piston (4,404) may separate the first and second chambers, and a positive pressure difference between the first chamber (2) and the second chamber (3) may provide the piston (4,404) with a hydraulic force that exceeds the spring force, overriding the spring force. A negative pressure difference between the first chamber (2) and the second chamber (3) may provide the piston with hydraulic pressure in a second direction opposite to the first direction. A third state may include a negative pressure difference, the resulting hydraulic pressure, and a spring force that translates the piston (4,404) in the second direction and acts the safety valve (91) to the closed position.

[0010] The second state (Figures 13, 17, and 18) may include providing the piston (4,404) with at least an equal hydraulic force in opposition to the spring force. The second state (Figures 13, 17, and 18) may include the first valve (234) being in the first closed position. The second hydraulic release path (6,206 / 21 / 35 / 7,107) may be independent of the pump (8). The second state (Figures 13, 17, and 18) may include the second valve (35) being in the second closed position.

[0011] The third state (Figure 16) may include providing a hydraulic force to the piston (4,404) that is opposite to and less than the spring force, causing the piston to translate in a second direction opposite to the first direction, and acting the safety valve (91) to the closed position. The second hydraulic release path (6,206 / 21 / 35 / 7,107) may be independent of the pump (8). The third state (Figure 16) may also include the second valve (35) being in a faulty closed state. The third state may include driving the motor (10) to control the fluid flow rate in the first hydraulic release path (206 / 234 / 22 / 8 / 7,107). The third state may also include releasing the motor (10) and the pump (8) to allow fluid flow in the first hydraulic release path (206 / 234 / 22 / 8 / 7,107). The third state may include the second valve (35) being in the second closed position and the motor (10) and pump (8) being released to allow fluid flow in the first hydraulic release path (206 / 234 / 22 / 8 / 7,107). The third state may also include the second valve (35) being in the second closed position and the motor (10) being driven to control the fluid flow rate in the first hydraulic release path (206 / 234 / 22 / 8 / 7,107).

[0012] The fourth state (Figure 15) may include providing the piston (4,404) with a hydraulic force that is opposed to and less than the spring force, and the piston (4,404) translating in a second direction opposite to the first direction, thereby acting the safety valve (91) to the closed position. The fourth state (Figure 15) may also include the first valve (234) being in a faulty closed position and / or the pump being in a faulty flow-off position.

[0013] The first hydraulic release path (6,206 / 20 / 34 / 7,107) may be independent of the pump (8), and the second hydraulic release path (6,206 / 21 / 35 / 7,107) may be independent of the pump (8). The first state (Figure 6) may include providing a hydraulic force to the piston (4,404) that is opposed to and exceeds the spring force, causing the piston (4,404) to translate in a first direction and actuating the safety valve (91) to the open position. The first state (Figure 6) may also include the first valve (34) being in a first closed position, the second valve (35) being in a second closed position, and driving the motor (10) to control the flow of fluid to the first chamber (2) through the pump (8).

[0014] The hydraulic piston assembly (92,492) may include a second chamber (3) connected to a fluid reservoir (14), and the piston (4,404) may separate the first and second chambers, and a positive pressure difference between the first chamber (2) and the second chamber (3) may provide the piston (4,404) with a hydraulic force that exceeds the spring force, overriding the spring force. A negative pressure difference between the first chamber (2) and the second chamber (3) may provide the piston with hydraulic pressure in a second direction opposite to the first direction. A third state may include a negative pressure difference, the resulting hydraulic pressure, and a spring force that translates the piston (4,404) in the second direction and acts the safety valve (91) to the closed position.

[0015] The second state (Figure 7) may include providing the piston (4,404) with at least an equal hydraulic force in opposition to the spring force. The second state (Figure 7) may include the first valve (34) being in a first closed position and the second valve (35) being in a second closed position. The operating system may include a check valve (24) located between the pump (8) and the first chamber (2) and configured to be operable to allow fluid flow from the pump (8) to the first chamber (2) and to block fluid flow from the first chamber (2) to the pump (8), thereby maintaining the pressure level in the first chamber (2) independently of the motor (10) and the pump (8).

[0016] The third state (Figure 10) may include providing the piston (4,404) with a hydraulic force that is opposed to and less than the spring force, and the piston (4,404) translating in a second direction opposite to the first direction, thereby acting the safety valve (91) to the closed position. The third state (Figure 10) may also include the second valve (35) being in a faulty closed position. The third state may also include the second valve (35) being in a second open position.

[0017] The fourth state (Figure 9) may include providing the piston (4,404) with a hydraulic force that is opposed to and less than the spring force, and the piston (4,404) translating in a second direction opposite to the first direction, thereby acting the safety valve (91) to the closed position. The fourth state (Figure 9) may also include the first valve (34) being in a faulty closed position. The fourth state may also include the first valve (34) being in a first open position.

[0018] The operating system may include a third hydraulic release path (6 / 22 / 8 / 7, 107) between the first chamber (2) and the reservoir (14), which extends through the pump (8) when the motor (10) and pump (8) are released, allowing fluid to flow in the third hydraulic release path (6 / 22 / 8 / 7, 107), and the third hydraulic release path (6 / 22 / 8 / 7, 107) may be independent of both the first hydraulic release path (6 / 20 / 34 / 7, 107) and the second hydraulic release path (6 / 21 / 35 / 7, 107). The operating system may be configured to release the pressure level in the first chamber (2) via a third hydraulic release path (6 / 22 / 8 / 7, 107) between the first chamber (2) and the reservoir (14), extending through the pump (8) when the motor (10) and pump (8) are released, allowing fluid to flow in the third hydraulic release path (6 / 22 / 8 / 7, 107).

[0019] The fluid reservoir (13) may include a pressure compensator (15 / 16) configured to normalize the pressure difference between the outside and inside of the hydraulic system. The pressure compensator may include a membrane or a piston (15). The operating system may include a position sensor (53) configured to detect the position of the membrane or piston (15).

[0020] The first valve (34, 234) may include an active actuated valve configured to open each side of the first valve to allow equalization of fluid pressure, and the second valve (35) may include an active actuated valve configured to open each side of the second valve to allow equalization of fluid pressure. The first valve (34, 234) may include a solenoid valve configured to open in the event of a power failure to allow equalization of fluid pressure on each side of the first valve, and the second valve (35) may include a solenoid valve configured to open in the event of a power failure to allow equalization of fluid pressure on each side of the second valve.

[0021] The piping (80) may include an outer tubular surface (81) oriented around a longitudinal axis (xx), an inner tubular surface (82) oriented around a longitudinal axis and defining a flow path (18), a first modular cavity (84) between the inner tubular surface (82) and the outer tubular surface (81), and a second modular cavity (83) between the inner tubular surface (82) and the outer tubular surface (81). The hydraulic piston assembly (92) may be located in the first modular cavity (84), and the motor (10) and pump (8) may be located in the second modular cavity (83).

[0022] The safety valve may include a flapper element (61) configured to rotate around a hinge axis (62) between an open position and a closed position within a flow path (18), a hinge axis (62) fixed to a pipe (80), and a flapper actuation sleeve (64) oriented around a longitudinal axis and configured to move the flapper element (61) from a closed position to an open position within the flow path (18).

[0023] The hydraulic piston assembly (92,192) may include a first actuator rod (5,405b) connected to the piston (4,404) to move with the piston, and a first actuator collar (60) connected to the actuator rod (5,405b) to move with the actuator rod, and the flapper operating sleeve (64) may be connected to the actuator collar (60) to move with the actuator collar. The spring element (36) may be compressed between the piston (5,405) and the piping (80,66) in the second state, and may include a coil spring (36) oriented around a longitudinal axis and axially positioned between the hinge axis (62) and the first actuator collar (60).

[0024] The hydraulic piston assembly (92,492) may include a second chamber (3) connected to a fluid reservoir (14), and the piston (4,404) may separate the first and second chambers. The piston (4,404) may include a first surface area (4a,404a) exposed to the first chamber (2) and a second surface area (4b,404b) exposed to the second chamber (3). The first surface area (4a,404a) may be greater than or equal to the second surface area (4b,404b). The hydraulic piston assembly (92,492) may include a cylinder (9,409) having a first end wall (9b,409b), and a piston (4,404) may be positioned inside the cylinder to perform a sealed sliding motion along the cylinder (9,409), and the hydraulic piston assembly (92,492) may include a first actuator rod (5,405b) connected to the piston (4,404) to move together with the piston and having a portion that seals and penetrates the first end wall (9b,409b). The cylinder (409) may have a second end wall (409a), and the hydraulic piston assembly (492) may include a second actuator rod (409a) connected to the piston (404) to move together with the piston and having a portion that seals and penetrates the second end wall (409a), and the first surface area (405a) may be equal to the second surface area (405b).

[0025] The operating system may include a sub-sea control electronics (95) located below sea level and connected to a motor (10), a first valve (34, 234), and a second valve (35); a sea level controller (11) located above sea level (103); a power cable (12) supplying power from sea level (103) to the sub-sea control electronics (95); and a communication cable (12) between the sub-sea control electronics (95) and the sea level controller (11).

[0026] The operating system may include a plurality of sensors (40a, 40b, 53) configured to detect the operating parameters of the system, and subsurface control electronics (95) including a signal processor configured to communicate with the sensors (40a, 40b, 53), receive sensor data from the sensors (40a, 40b, 53), and output the data to the surface controller (11) via a communication cable (12). The operating system may also include a position sensor configured to detect the position of the piston (4), the position sensor may include a first contact switch (40a) and a second contact switch (40b).

[0027] The electric motor (10) may include a variable-speed electric motor, and the hydraulic pump (8) may include a reversible hydraulic pump. The hydraulic pump may be selected from the group consisting of fixed-displacement pumps, variable-displacement pumps, two-port pumps, and three-port pumps.

[0028] The actuation system may comprise: a subsea controller (74) that is located below sea level (104) and connected to a motor (10), a first valve (34) and a second valve (35); and subsea sensors (40a, 40b, 53, 153, 43, 44, 41) that are located below sea level (104), configured to detect operating parameters of the components (92, 13, 34, 35) of the actuation system (90), and connected to the controller (74). The subsea controller (74) may comprise a non-transitory computer-readable medium storing one or more instructions executable by the subsea controller (74) to perform diagnostic tests (210, 300, 400, 400b, 400c) on the actuation system components (92, 13, 34, 35) as a function of the operating parameters of the actuation system components (92, 13, 34, 35) detected by the subsea sensors (40a, 40b, 53, 153, 43, 44, 41). The fluid reservoir (13) may comprise a pressure compensator (13). The actuation system components may be selected from the group consisting of the pressure compensator (13), a hydraulic piston assembly (92), the first valve (34) and the second valve (35). The subsea sensors may be selected from the group consisting of a position sensor (40a, 40b, 53, 153), a current sensor (76), and a pressure sensor (41).

[0029] The subsea sensors comprise position sensors (40a, 40b) configured to detect a position of pistons (4, 60) of the hydraulic piston assembly (92), and the diagnostic test (210) may comprise: commanding movement (212, 215) of the pistons (4, 60) to a preset position; monitoring (216) the position sensors (40a, 40b) after the commanded movement (212, 215); and determining (213, 217) an operating state (222, 219, 220) of the hydraulic piston assembly (92) as a function of output or lack of output from the monitored position sensors (40a, 40b). The step of determining the operating state of the hydraulic piston assembly may be a function of a threshold elapsed time (214, 218) from the commanded movement.

[0030] The pressure compensator (13) may comprise a compensator membrane or a compensator piston (15), the subsea sensor may comprise a position sensor (53, 153) configured to detect the position of the compensator membrane or the compensator piston (15), and the diagnostic test (300) may comprise: commanding movement (302, 305) of a piston (4, 60) of a hydraulic piston assembly (92) to a preset position; monitoring (306) the compensator position sensor (53, 153) after the commanded movement (302, 305); and determining (314) an operating state (315, 316) of the pressure compensator (13) as a function of an output or an output from the monitored compensator position sensor (53, 153). The step of determining the operating state of the pressure compensator may be a function of a threshold elapsed time (308) from the commanded movement.

[0031] The first or second valve (34, 35) may include a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, and the subsea sensor may include a current sensor (76) configured to detect the current of the solenoid valve, and the diagnostic test (400) may include commanding the energization of the solenoid valve (405), monitoring the current sensor (76) after the commanded energization (406), and determining the operating state of the solenoid valve (409, 410) as a function of the output from the monitored current sensor (76) (408). The step of determining the operating state of the solenoid valve may be a function of current reference data stored in the subsea controller (74). The first or second valve (34,35) may include a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, and the subsea sensor may include a valve position sensor (43,44) configured to detect the position of the solenoid valve, and the diagnostic test (400b) may include commanding the energization of the solenoid valve (405b), monitoring the valve position sensor (43,44) after the commanded energization (406b), and determining the operating state of the solenoid valve (409b,410b) as a function of the output or absence of output from the monitored valve position sensor (43,44) (408b).The first or second valve may include a solenoid valve configured to open in the event of a power failure to allow equalization of fluid pressure on each side of the first valve; the pump (8) may include a rotary pump; the subsea sensor may include a pressure sensor (41) configured to detect pressure in a closed hydraulic system (93); and the diagnostic test (400c) may include commanding the de-energization of the solenoid valve (403, 409c, 413c), commanding the rotary pump to rotate at a reference rotational speed (405c), monitoring the pressure sensor (41) after the commanded de-energization of the solenoid valve (404c), and determining the operating state of the solenoid valve (419c, 420c, 421c, 418c) as a function of the output from the monitored pressure sensor (41) (406c, 408c, 410c, 412c, 414c, 416c). The step of determining the operating state of the solenoid valve may be a function of stored pressure reference data. A diagnostic test (400c) may include commanding the energization of the solenoid valve (407c, 411c, 415c) and monitoring the pressure sensor after the commanded energization of the solenoid valve (404c). [Brief explanation of the drawing]

[0032] [Figure 1] This is a schematic diagram of a subsea oil well facility having one embodiment of an improved safety valve actuator system in a subsea production line. [Figure 2] This is an enlarged schematic diagram of an embodiment of the safety valve actuator system shown in Figure 1, in the open position. [Figure 3] This is an enlarged schematic diagram of an embodiment of the safety valve actuator system shown in Figure 1, in the closed position. [Figure 4] This is a horizontal cross-sectional view of the assembly shown in Figure 3, roughly along line AA in Figure 3. [Figure 5] Figure 1 is a detailed schematic diagram of an embodiment of the safety valve actuator system shown. [Figure 6]This is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown in Figure 5, with the valve in the open position. [Figure 7] This is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown in Figure 6, in the valve-holding-open state. [Figure 8] This is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown in Figure 6, with the valve in the closed position. [Figure 9] This is a detailed schematic diagram of the hydraulic system of the embodiment of the safety valve actuator system shown in Figure 6, in the case of valve closure involving the first failure condition. [Figure 10] Figure 6 is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system in the case of valve closure involving a second failure condition. [Figure 11] Figure 6 is a detailed schematic diagram of a second embodiment of the hydraulic system of the safety valve actuator system shown, which represents a single-chamber hydraulic piston configuration. [Figure 12] This is a detailed schematic diagram of a third embodiment of the hydraulic system of the safety valve actuator system shown in Figure 6, with the valve in the open position. [Figure 13] This is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown in Figure 12, in the valve-holding-open state. [Figure 14] This is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown in Figure 12, with the valve in the closed position. [Figure 15] Figure 12 is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown, in the case of valve closure involving the first failure condition. [Figure 16] Figure 12 is a detailed schematic diagram of the hydraulic system of an embodiment of the safety valve actuator system shown, in the case of valve closure involving a second failure condition. [Figure 17] Figure 6 is a detailed schematic diagram of a fourth embodiment of the hydraulic system of the safety valve actuator system shown, which represents a single-chamber hydraulic piston configuration. [Figure 18] Figure 6 is a detailed schematic diagram of a fifth embodiment of the hydraulic system of the safety valve actuator system shown, which exhibits equal piston area and dual rod configuration. [Figure 19] Figure 5 is a cross-sectional view of one embodiment of the bidirectional pump shown. [Figure 20] Figure 5 is a cross-sectional view of an electrically operated variable-speed bidirectional motor. [Figure 21] Figure 5 is a flowchart showing one embodiment of the cylinder diagnostic function of the safety valve actuator system. [Figure 22] Figure 5 is a flowchart showing one embodiment of the compensator diagnostic function of the safety valve actuator system. [Figure 23] Figure 5 is a flowchart showing the first embodiment of the solenoid diagnostic function of the safety valve actuator system. [Figure 24] Figure 5 is a flowchart showing a second embodiment of the solenoid diagnostic function of the safety valve actuator system. [Figure 25] Figure 5 is a flowchart showing a third embodiment of the solenoid diagnostic function of the safety valve actuator system. [Modes for carrying out the invention]

[0033] First, it should be clearly understood that similar reference numerals are intended to consistently identify the same structural element, part, or surface throughout several drawings, and such element, part, or surface may be further described or explained throughout this specification, and that detailed description is an essential part. Unless otherwise indicated, the drawings are intended to be read in conjunction with this specification (e.g., cross-hatching, part arrangement, proportions, degree, etc.) and should be considered as part of the entire description of the invention. Where used in the following description, the terms “horizontal,” “vertical,” “left,” “right,” “up,” and “down,” as well as their adjective and adverbial derivatives (e.g., “horizontal,” “rightward,” “upward,” etc.), simply refer to the orientation of the illustrated structure when a particular drawing faces the reader. Similarly, the terms “inward” and “outward” generally refer to the orientation of a surface relative to its extensional or rotational axis, as necessary.

[0034] Referring here to the drawings, more specifically Figure 1, this disclosure broadly provides a sea-level controlled subsea safety valve (SCSSV), one embodiment of which is shown in 90. The subsea safety valve 90 is used in a production system including a platform 100 floating above the sea surface 103 and a production line 101 extending from a subsea wellhead device 102 to the platform 100 at a distance 103a below the sea surface 103. A drilled well bore 105 extends from the seabed 104 to a point below the seabed 104. The well bore forms a well 18 alongside a casing and production piping 16, providing fluid communication between the well 18 and the surrounding hydrocarbon support formation. The subsea safety valve 90 is positioned within the piping 16 at a distance 104a to stop the flow of production fluid in the subsea piping 16 as needed, such as in an emergency. The subsea safety valve 90 operates in fail-safe mode with a hydraulically controlled pressure used to hold the open flapper valve 91, and if the control pressure is lost, the flapper valve 91 closes, thereby cutting off the flow from the wellhead device 102.

[0035] The surface controller 11 on platform 100 communicates with the subsurface control electronics 95 via power and data cables 12. In an emergency, the surface controller 11 can provide the downhole control electronics 95 with a valve closure command, such command may include cutting off power to the control electronics 95 and the subsurface safety valve 90. The surface controller 11 may also store and relay detection data from the subsurface safety valve 90 and otherwise provide a user interface for reviewing the detection data and setting operating parameters. The processor may include a data sampling and storage mechanism for receiving and storing detection data, and may include a data storage device for storing operating parameters and a log of detection data.

[0036] As shown in Figures 2 and 5, the subsea safety valve 90 generally includes a motor and pump assembly or module 94, a hydraulic manifold assembly or module 93, a system pressure compensation reservoir assembly or module 13, a hydraulic piston actuator assembly or module 92, a safety valve assembly or module 91, and downhole control electronics 95. Each of these modules is contained within the piping 16.

[0037] As shown in Figures 2 to 4, in this embodiment, section 80 of the piping 16 houses the motor and pump assembly 94, the hydraulic manifold assembly 93, the system pressure compensating reservoir assembly 13, the hydraulic piston actuator assembly 92, and the downhole control electronics 95 between the outer cylindrical surface 81 and the inner cylindrical surface 82 of the piping section 80. In this embodiment, section 80 includes a first cavity 83 that is spaced apart circumferentially and extends longitudinally, and a second cavity 84 that is spaced apart circumferentially and extends longitudinally. In this embodiment, the compensated reservoir assembly 13, the motor and pump assembly 94, and the control electronics 95 are stacked within cavity 83, and the control electronics are above the compensated reservoir assembly 13 and the motor and pump assembly 94 and sealed away from them. The hydraulic manifold assembly 93 and the hydraulic piston actuator assembly 92 are stacked within cavity 84. The fluid conduit 85 extends through a section 80 between the compensating reservoir assembly 13 and the motor and pump assembly 94 in the cavity 83 and the hydraulic manifold assembly 93 and the hydraulic piston actuator assembly 92 in the cavity 84.

[0038] The pump and motor assembly 94 generally includes a variable-speed bidirectional electric servo motor 10 and a bidirectional or reversible pump 8 driven by the motor 10. As shown in more detail in Figure 20, in this embodiment the motor 10 is a brushless DC variable-speed servo motor supplied with current. The motor 10 has an inner rotor 50 having permanent magnets and a fixed, non-rotating stator 51 having coil windings. When current is properly passed through the coils of the stator 51, a magnetic field is induced. The magnetic field interaction between the stator 51 and the rotor 50 generates torque that can rotate the output shaft 52. Electronic equipment 71 is driven to generate and rectify the stator magnetic field based on position feedback to change the speed and direction of the motor 10. Thus the motor 10 selectively applies torque to the shaft 52 in one direction around axis xx at various speeds and applies torque to the shaft 52 in opposite directions around axis xx at various speeds. Other motors may be used as alternatives. For example, a variable-speed stepper motor, a brushed motor, or an induction motor may be used.

[0039] As shown in more detail in Figure 19, in this embodiment, the pump 8 is a fixed-capacity bidirectional internal two-port gear pump. The pumping elements, i.e., gears 55 and 56, can rotate in either direction, thereby allowing the hydraulic fluid to flow in either direction 47 or 48. This allows oil to be added to the inside and outside of the system when the system controller closes the position or pressure control loop. The shaft of gear 55 is connected to the output shaft 52 of the motor 10, followed by the other pump gear 56. The fluid is guided to flow outwards from gears 55 and 56 between the outer gear teeth of gears 55 and 56 and the housing 57, respectively. Thus, rotation of gear 55 in the clockwise direction 46 produces a fluid flow in one direction 48 from port 8a to port 8b. Rotation of gear 55 in the counterclockwise direction 45 produces a fluid flow in the opposite direction 47 from port 8b to port 8a. Therefore, the direction of flow in pump 8 depends on the rotational direction of the rotor 50 and output shaft 52 around axis xx. Furthermore, the speed and output of pump 8 are variable with the speed of motor 10. Other bidirectional pumps may be used as alternatives. For example, a variable displacement pump may be used.

[0040] The downhaul electronics 95 receives commands from the sea level controller 11 via cable 12, such as valve open or valve close commands and power commands. The downhaul electronics 95 includes a controller 74, a power distribution component 70, motor controller drive electronics 71 for controlling and rectifying the motor 10, and solenoid drive electronics 72 for energizing and controlling the solenoid valves 34 and 35. The controller 74 receives feedback from sensors in the system via a sensor interface 73. The controller 74 communicates with the sea level platform control electronics 11 via data and power cables 12.

[0041] In this embodiment, the position of the sleeve collar 60 fixed to the end of the rod 5 of the piston assembly 92 is monitored via position sensors 40a and 40b, and the position signals are then fed back to the controller 74. In this embodiment, position sensors 40a and 40b are shown as limit switches, but other position sensors may be used as alternatives, and such position sensors may be located at alternative positions within the assembly. For example, but are not limited to, magnetostrictive linear position sensors or LVDT position sensors may be used as alternatives.

[0042] As shown in Figures 2 and 6, the hydraulic piston assembly 92 includes a piston 4 slidably disposed within a cylindrical housing 9. A rod 5 is attached to the piston 4 for movement with the piston 4, extends to the right, and sealably penetrates the right end wall 9b of the cylinder 9. The piston 4 is slidably disposed within the cylinder 9, sealing and separating the left chamber 2 from the right chamber 3. In this embodiment, almost the entire circular vertical end face 4a facing left of the piston 4 faces into the left chamber 2. However, only the annular right-facing vertical end face 4b of the piston 4 faces right into the right chamber 3 due to the addition of the rod 5 passing through the chamber 3 and the outer housing 9. This creates an uneven piston area configuration in which the surface area of ​​face 4a is larger than the surface area of ​​face 4b.

[0043] In this embodiment, the reservoir module 13 generally includes a piston-type pressure compensator for a closed hydraulic fluid system. As shown, the reservoir 13 is separated into two variable volume chambers 14 and 16 by a piston 15 slidably positioned within a cylindrical housing. As the system fluid is displaced, the piston 15 moves, displacing the contents of chamber 16 to the other side. The piston 15 moves within the housing to ensure that the fluid inside is substantially equal to the ambient pressure outside the system. Chamber 16 is open to the external environment, and the chamber or tank 14 acts as a hydraulic reservoir for the system fluid, sealed from the external environment 16 by the piston 15, and the pressure is balanced. As shown, in this embodiment, the reservoir module 13 includes a position sensor 53 configured to detect the position of the piston 15 within the cylindrical housing and communicate with a controller 74. In this embodiment, the sensor 53 is an LVDT position sensor.

[0044] Alternatively, though not limited to, the reservoir 13 may use a bladder-type pressure compensator for fluid systems instead of a piston-type compensator. Such a compensator functions in much the same way as the piston type, except that the barrier between the system fluid in the tank 14 and the external environment in the chamber 16 is an elastomer bladder or diaphragm. The bladder is easily movable and ensures that the fluid inside is substantially equal to the ambient pressure outside the system.

[0045] As shown in Figures 2 and 3, the downhole safety valve 91 generally includes a flapper 61 rotatable in and out of the flow path 18 around a hinge 62, a valve operating sleeve 64 connected to one end of the rod 5 by an annular sleeve collar 60, and a spring 36 acting between an annular spring stop 66 in the production piping 16 and the sleeve collar 60 fixed to the rod 5 and piston 4. The spring stop 66 is fixed to the flapper hinge 62 on the piping 16, and the valve operating sleeve 64 slides freely axially within the piping 16 relative to the hinge 62 as the piston 4 moves axially within the cylinder 9. The spring 36 is compressed between the annular spring stop 66 and the annular sleeve collar 60 in the piping 16.

[0046] The piston 4 is driven via the piston rod 5, which slides the sleeve 64 downward within the piping 16 via the sleeve collar 60, compressing the spring 36, which pushes the valve flapper 61 downward and counterclockwise around the hinge 62, pushing it out of the fluid passage 18 and opening the valve assembly 91. The spring 36 is configured to bias the rod 5 toward the retracted position and the safety valve 91 toward the closed position via the sleeve collar 60, which is connected to both the rod 5 of the piston assembly 92 and the cylindrical sleeve 64 of the valve assembly 91 and moves with them. Thus, when the hydraulic pressure is removed from the chamber 2 of the piston 4, the spring 36 provides a spring force that drives the sleeve 64 upward via the collar 60, thereby allowing the flapper 61 to close the fluid passage 18. The flapper valve 61 is oriented to open downward and close upward so that an upward fluid flow in the oil well channel 18 acts to push the flapper 61 upward around the hinge axis 62, causing it to close or shut. Therefore, if it becomes necessary to close the valve assembly 91 in an emergency, the spring 36 is configured to provide a spring force that drives the cylindrical sleeve 64 upward to a position that allows the flapper 61 to rotate upward around the hinge axis 62 and enter the channel 18, thereby blocking the flow through the production piping 16. In this way, the valve assembly 91 is a fail-safe valve that can be operated to isolate the well 18 in the event of an emergency.

[0047] A hydraulic manifold 93 of the first embodiment is shown in Figures 5 to 10. As shown, the hydraulic manifold 93 generally includes a solenoid valve 34, a solenoid 35, and several hydraulic lines 6, 7, 20, 21, and 22. The pump 8, chamber 2, chamber 3, tank 14, valve 34, valve 35, and hydraulic flow lines 6, 7, 20, 21, and 22 form a closed fluid system.

[0048] In this embodiment, both valves 34 and 35 are active valves that open and close using an external actuation force, rather than passive valves whose open / closed operating state is determined by the fluid controlled by the valve (e.g., a check valve). In this embodiment, valves 34 and 35 are two-way, two-port solenoid valves. When valves 34 and 35 are energized, they close by holding the shut-off ports, thereby blocking flow in either direction through the valves. When valves 34 and 35 are de-energized, the springs of the solenoid valves return them to the open position, thereby equalizing the fluid pressure on each side of the valves and allowing flow through the valves in either direction. Thus, in the event of a power failure, valves 34 and 35 open, allowing for equalization of the fluid pressure on each side of the valves.

[0049] As shown in Figures 6 to 10, in the hydraulic manifold embodiment 93, the pump 8 is located in the fluid line 22, with one side or port 8a of the pump 8 communicating with the left chamber 2 via fluid lines 22 and 6, and the opposite side or port 8b of the pump 8 communicating with the right chamber 3 via fluid lines 22 and 7. Port 8b of the pump 8 communicates with the tank 14 via fluid lines 22 and 7. The right chamber 3 communicates with the tank 14 via fluid line 7. A bypass fluid line 20 connects lines 6 and 7, and thus connects chamber 2 to both tank 14 and chamber 3. A solenoid-operated valve 34 is provided in line 20. The bypass fluid line 20 and the solenoid-operated valve 34 are located in line 6 between side 8a of the pump 8 and the left chamber 2, and thus provide an independent first fluid line between chamber 2 and reservoir tank 14, bypassing the pump 8. The bypass fluid line 21 also connects lines 6 and 7, and therefore also connects chamber 2 to both tank 14 and chamber 3. Line 21 is provided with a solenoid-operated valve 35. The bypass fluid line 21 and the solenoid-operated valve 35 are located in line 6 between the side 8a of pump 8 and the left chamber 2, and therefore provide an independent second fluid line between chamber 2 and reservoir tank 14, bypassing pump 8. Thus, line 22, which has pump 8 inside, line 20, which has valve 34 inside, and line 21, which has valve 35 inside, are parallel hydraulic flow connections between chamber 2 and tank 14. Thus, the solenoid-operated valve 34 and fluid line 20 are configured to operate to provide a first hydraulic release path between chamber 2 and reservoir tank 14. The solenoid-operated valve 35 and fluid line 21 are configured to operate to provide a second hydraulic release path between chamber 2 and reservoir tank 14. Furthermore, the fluid line 22 and pump 8 can be configured to operably provide a third hydraulic release path between the chamber 2 and the reservoir tank 14, if necessary.

[0050] The system of this embodiment may be controlled in at least two operating states and at least two fail-safe states. Also, as shown in Figure 6, the valve 34 is energized to close the valve 35, which is a closed port, in order to extend the rod 5 and open the safety valve assembly 91, and the valve 35 is energized to close the valve 35, which is a closed port. Thus, the side 8a of the pump 8 is flow-connected to the chamber 2 in at least one direction via line 6. However, when valve 34 is closed, the chamber 2 is not flow-connected to the reservoir 14 via line 20, and when valve 35 is closed, the chamber 2 is not flow-connected to the reservoir 14 via line 21. The piston 4 moves to the right to extend the rod 5 when the bidirectional motor 10 is rotated in the first direction, thereby rotating the bidirectional pump 8 (i.e., the driven gear 55) in direction 45, drawing fluid flow through port 8b from lines 22 and 7. In this embodiment, such fluid is drawn from the chamber 3 and also from the reservoir 14 via line 7. One function of this configuration is to address the volume difference between the opposing chambers 2 and 3. As the piston 4 moves to the right within the cylinder 9, the volume of fluid removed from collapsing the right chamber 3 is less than the volume of fluid required to supply the left chamber 2, which expands without the reservoir tank 14 and line 7. The bidirectional pump 8 outputs fluid to line 6 via port 8a. The fluid in line 6 flows into chamber 2, thereby creating a differential pressure on the piston 4 between chambers 2 and 3. This differential pressure is positive when the pressure in chamber 2 on the piston 4 is greater than the opposing pressure in chamber 3 on the piston 4. This differential pressure is negative when the pressure in chamber 2 on the piston 4 is lower than the pressure in chamber 3 on the piston 4. In this embodiment, since chamber 3 is always connected to the reservoir 14, the differential pressure is always zero or positive. When such a positive differential pressure, in this case the pressure in the left chamber 2 on the piston 4, is large enough to overcome the opposing spring force of spring 36, such pressure extends the rod 5 to the right.Since chamber 3 is always connected to reservoir 14, when this piston force exceeds the opposing spring force of spring 36, piston 4 moves to the right, extending rod 5, thereby compressing spring 36 and opening safety valve 91.

[0051] As shown in Figure 7, in order to maintain the safety valve assembly 91 in an open state, valve 34 is energized to set valve 34 to a closed port state, and valve 35 is energized to set valve 35 to a closed port state. In these valve states, the flow of fluid from the left chamber 2 to the tank 14 through lines 6 and 20 and lines 6 and 21, respectively, is blocked. In this embodiment, line 6 includes a check valve 24 between port 8a of pump 8 and line 20, which allows the flow of fluid from port 8a of pump 8 to chamber 2, but blocks the flow of fluid from chamber 2 to line 22 and returns to port 8a of pump 8. Valve 24 is positioned so as not to block the flow from chamber 2 to line 20 or line 21. This configuration maintains the pressure in the left chamber 2, keeps the spring 36 compressed, prevents the piston 4 and rod 5 from being retracted, and keeps the safety valve assembly 91 in an open state. The oil pressure on piston 4 is opposite to, and at least equal to, the spring force of spring 36. The valve 24 maintains such pressure independently of the motor 10 and pump 8. Alternatively, the valve 24 can be removed and the motor 10 energized so that the pump 8 shuts off the flow through line 22 from chamber 2 to reservoir 14, keeping the valve assembly 91 open.

[0052] As shown in Figure 8, both valves 34 and 35 are de-energized to retract rod 5 and close valve 91. When valve 34 is de-energized, the spring of solenoid valve 34 returns it to the open position. In this open state, chamber 2 is flow-connected to tank 14 via lines 6 and 20. When valve 35 is de-energized, the spring of solenoid valve 35 returns it to the open position. In this open state, chamber 2 is flow-connected to tank 14 via lines 6 and 21. Collar 60 is biased by spring 36 to retract rod 5 and move piston 4 to the left and close valve assembly 91. When the pressure in chamber 2 on piston 4 falls below the opposing spring force of spring 36, such spring force moves piston 4 to the left, and fluid flows from chamber 2 through open lines 20 and 21 to tank 14 and chamber 3. In this embodiment, such fluid flows into chamber 3 via line 7 and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. As the piston 4 moves to the left within the cylinder 9, the volume of fluid removed from collapsing the left chamber 2 is greater than the volume of fluid required to supply the right chamber 3, which expands without the reservoir tank 14 and line 7.

[0053] The system of this embodiment provides at least two fault-redundant hydraulic paths for closing the valve assembly 91 in the event of failure or malfunction. Firstly, as shown in Figure 9, in the event of a flow-limiting or interruption failure of the motor 10, pump 8, and / or valve 34, the energization of valve 35 can be released even in the event of an emergency power loss, and the spring of the solenoid valve 35 returns valve 35 to the open position. In this state, chamber 2 is flow-connected to line 7 and the right chamber 3 and reservoir 14 via line 21, thereby equalizing the pressure in chambers 2 and 3. The spring force of spring 36 acts to retract rod 5 and move piston 4 to the left. The pressurized fluid obtained from chamber 2 flows into chamber 3 via lines 6, 21, and 7, and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. As piston 4 moves to the left within cylinder 9, the volume of fluid removed from collapsing left chamber 2 is greater than the volume of fluid required to supply to right chamber 2, which expands without reservoir tank 14 and line 7. When the pressure in left chamber 2 on piston 4 falls below the opposing spring force of spring 36, such spring force moves piston 4 to the left, retracts rod 5, and closes safety valve 91. Such valve closure of valve 91 does not require the operation of motor 10, pump 8, and / or valve 34, and can therefore be provided even in the event of flow restriction or interruption failure of motor 10, pump 8, and / or valve 34.

[0054] Secondly, as shown in Figure 10, in the event of a flow restriction or interruption failure of the motor 10, pump 8, and / or valve 35, the energization of valve 34 may be released even in the event of an emergency power loss, and the spring of the solenoid valve 34 returns valve 34 to the open position. In this state, chamber 2 is flow-connected to line 7 and the right chamber 3 and reservoir 14 via line 20, thereby equalizing the pressure in chambers 2 and 3. The spring force of spring 36 acts to pull in rod 5 and move piston 4 to the left. The pressurized fluid obtained from chamber 2 flows into chamber 3 via lines 6, 20, and 7, and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. As piston 4 moves to the left within cylinder 9, the volume of fluid removed from collapsing left chamber 2 is greater than the volume of fluid required to supply the right chamber 2, which expands without reservoir tank 14 and line 7. When the pressure in the left chamber 2 above the piston 4 falls below the opposing spring force of the spring 36, such spring force moves the piston 4 to the left, retracting the rod 5 and closing the safety valve 91. Such valve closure of valve 91 does not require the operation of the motor 10, pump 8, or valve 35, and can therefore be provided even in the event of flow restriction or interruption failure of the motor 10, pump 8, and / or valve 35.

[0055] A hydraulic manifold 193 and piston assembly 192 of a second embodiment are shown in Figure 11. As shown, the hydraulic manifold 193 has substantially the same configuration as the hydraulic manifold embodiment 93 and generally includes a solenoid valve 34, a solenoid 35, and several hydraulic lines 6, 107, 20, 21, and 22. However, the piston assembly in this embodiment 192 includes only a single chamber within a closed fluid system. As shown, the piston assembly 192 does not include a second chamber 3, and only chamber 2 is within a closed fluid system having a tank 14, valve 34, valve 35, and hydraulic flow lines 6, 107, 20, 21, and 22.

[0056] As shown in Figure 11, in the hydraulic manifold embodiment 193, the pump 8 is located in fluid line 22, with one side or port 8a of the pump 8 communicating with a single chamber 2 via fluid lines 22 and 6, and the opposite side or port 8b of the pump 8 communicating with tank 14 only via fluid lines 22 and 107. A bypass fluid line 20 connects lines 6 and 107 and thus connects chamber 2 to tank 14. Line 20 is provided with a solenoid-operated valve 34. The bypass fluid line 20 and the solenoid-operated valve 34 are located in line 6 between side 8a of the pump 8 and the left chamber 2 and thus provide an independent first fluid line between chamber 2 and reservoir tank 14, bypassing the pump 8. A bypass fluid line 21 also connects lines 6 and 107 and thus also connects chamber 2 to both tanks 14. Line 21 is provided with a solenoid-operated valve 35. The bypass fluid line 21 and the solenoid-operated valve 35 are located in line 6 between the side 8a of the pump 8 and the chamber 2, and thus provide a second fluid line between the chamber 2 and the reservoir tank 14, bypassing the pump 8 and operating independently of it. Thus, line 22, which contains the pump 8, line 20, which contains the valve 34, and line 21, which contains the valve 35, are parallel hydraulic flow connections between the chamber 2 and the tank 14. Therefore, the solenoid-operated valve 34 and the fluid line 20 are operably configured to provide a first hydraulic release path between the chamber 2 and the reservoir tank 14. The solenoid-operated valve 35 and the fluid line 21 are operably configured to provide a second hydraulic release path between the chamber 2 and the reservoir tank 14. Furthermore, the fluid line 22 and the pump 8 can be configured to operably provide a third hydraulic release path between the chamber 2 and the reservoir tank 14, if necessary.

[0057] The system of this embodiment may be controlled in substantially the same manner as described above with respect to the first embodiment 93 in order to provide at least two operating states and two fail-safe states. Also, as shown in Figure 11, in order to extend the rod 5 and open the safety valve assembly 91, the valve 34 is energized to set the valve 35 to a closed port and closed state, and the valve 35 is energized to set the valve 35 to a closed port and closed state. Thus, the side 8a of the pump 8 is flow-connected to the chamber 2 through line 6 in at least one direction, and the chamber 2 is not flow-connected to the reservoir 14 through line 20 or 21. The piston 4 moves to the right to extend the rod 5 when the bidirectional motor 10 is rotated in the first direction, thereby rotating the bidirectional pump 8 (i.e., driven gear 55) in direction 45, drawing fluid flow through port 8b from lines 22 and 107. In this embodiment, such fluid is drawn only from the reservoir 14 via line 107. The bidirectional pump 8 outputs fluid to line 6 via port 8a. The fluid in line 6 flows into chamber 2, thereby pressurizing the piston 4. When the pressure in the sole chamber 2 on the piston 4 is large enough to overcome the opposing spring force of spring 36, such pressure extends rod 5 to the right. When this piston force exceeds the opposing spring force of spring 36, the piston 4 moves to the right, extending rod 5 and compressing spring 36 to open safety valve 91. Similar to embodiment 93, this configuration may also be used to maintain pressure in the left chamber 2 such that spring 36 is held in a compressed state, preventing the piston 4 and rod 5 from being retracted, and holding the safety valve assembly 91 in an open state. The oil pressure to the piston 4 is maintained at least equal to the opposing spring force of spring 36. By valve 24, such pressure is maintained independently of motor 10 and pump 8.

[0058] Similar to Embodiment 93, in the event of a flow restriction or interruption failure in either the motor 10, the pump 8, and / or valve 34 or 35, the other valve 34 or 35 can be de-energized, even in the event of an emergency power loss, after which the spring of the solenoid valve in question returns the valve in question to the open position. In these failure conditions, chamber 2 is flow-connected to line 107 through line 20 or line 21, but only chamber 2 is not connected to the second chamber. The spring force of spring 36 still acts to retract rod 5 and move piston 4 to the left. The pressurized fluid obtained from sole chamber 2 flows to reservoir 14 through lines 6, 107 and valve 34 or 35, and the configuration does not need to deal with any volume difference between opposing chambers, as in Embodiment 92. When the pressure in left chamber 2 on piston 4 falls below the opposing spring force of spring 36, such spring force moves piston 4 to the left, retracts rod 5, and closes safety valve 91. Such valve closure of valve 91 does not require the operation of motor 10, pump 8, or valve 34 or 35, and can therefore be provided even in the event of flow restriction or interruption failure in motor 10, pump 8, and / or valve 34 or 35.

[0059] A hydraulic manifold 293 of a third embodiment is shown in Figures 12 to 16. As shown, the hydraulic manifold 293 generally includes a solenoid valve 234, a solenoid 35, and several hydraulic lines 206, 7, 21, and 22. The pump 8, chamber 2, chamber 3, tank 14, valve 234, valve 35, and hydraulic flow lines 206, 7, 21, and 22 form a closed fluid system.

[0060] As shown in Figures 12 to 16, in this embodiment 293 of the hydraulic manifold, the pump 8 is located in the fluid line 22, with one side or port 8a of the pump 8 communicating with the left chamber 2 via fluid lines 22 and 206, and the opposite side or port 8b of the pump 8 communicating with the right chamber 3 via fluid lines 22 and 7. Port 8b of the pump 8 also communicates with the tank 14 via fluid lines 22 and 7. The right chamber 3 communicates with the tank 14 via fluid line 7. A solenoid-operated valve 234 is provided in line 206 between the pump 8 and the chamber 2. Fluid line 22, the pump 8 and the valve 234 connect lines 206 and 7, and thus connect the chamber 2 to both the tank 14 and the chamber 3. Fluid line 22, the pump 8 and the valve 234 provide a first fluid line between the chamber 2 and the reservoir tank 14. Such a streamline does not bypass and is not independent of the pump 8.

[0061] Bypass fluid line 21 also connects lines 206 and 207, and therefore also connects chamber 2 to both tank 14 and chamber 3. Line 21 is provided with a solenoid-operated valve 35. Bypass fluid line 21 and solenoid-operated valve 35 are provided in line 206 between side 8a of pump 8 and left chamber 2, and therefore provide an independent second fluid line between chamber 2 and reservoir tank 14, bypassing both pump 8 and valve 234. Thus, line 22, which has pump 8 and valve 234 inside, and line 21, which has valve 35 inside, are parallel hydraulic flow connections between chamber 2 and tank 14. Thus, solenoid-operated valve 234, pump 8, and fluid line 22 are configured to operate to provide a first hydraulic release path between chamber 2 and reservoir tank 14. Solenoid-operated valve 35 and fluid line 21 are configured to operate to provide a second hydraulic release path between chamber 2 and reservoir tank 14.

[0062] The system of this embodiment may be controlled in at least two operating states and at least two fail-safe states. As shown in Figure 12, the power to valve 234 is cut off in order to extend rod 5 and open the safety valve assembly 91. When valve 234 is de-energized, the spring of the solenoid valve 234 returns it to the open position. In this open state, chamber 2 is flow-connected to side 8a of pump 8 via line 206. However, since valve 35 is energized, the state of valve 35 is the shut-off port and closed state. When valve 35 is closed, chamber 2 is not flow-connected to reservoir 14 via line 21. When the bidirectional motor 10 is rotated in the first direction, piston 4 moves to the right, extending rod 5, thereby rotating the bidirectional pump 8 (i.e., driven gear 55) in direction 45, drawing fluid flow through port 8b from lines 22 and 7. In this embodiment, such fluid is drawn from chamber 3 and also from reservoir 14 via line 7. One function of this configuration is to address the volume difference between opposing chambers 2 and 3. As the piston 4 moves to the right within the cylinder 9, the volume of fluid removed from collapsing the right chamber 3 is less than the volume of fluid required to supply the left chamber 2, which expands without the reservoir tank 14 and line 7. The bidirectional pump 8 outputs fluid to line 206 via port 8a. The fluid in line 206 flows into chamber 2, thereby creating a differential pressure on the piston 4 between chambers 2 and 3. This differential pressure is positive when the pressure in chamber 2 on the piston 4 is greater than the opposing pressure in chamber 3 on the piston 4. When such a positive differential pressure, in this case the pressure in the left chamber 2 on the piston 4, is large enough to overcome the opposing spring force of spring 36, such pressure extends the rod 5 to the right. Since chamber 3 is always connected to reservoir 14, when this piston force exceeds the opposing spring force of spring 36, piston 4 moves to the right, extending rod 5, thereby compressing spring 36 and opening safety valve 91.

[0063] As shown in Figure 13, in order to maintain the safety valve assembly 91 in the open state, valve 34 is energized to set valve 34 to the closed port state, and valve 35 is energized to set valve 35 to the closed port state. In these valve states, the respective fluid flows from the left chamber 2 through lines 206 and 21 to the pump 8 and tank 14 are blocked, thereby holding the spring 36 in a compressed state, preventing the piston 4 and rod 5 from being retracted, and maintaining the pressure in the left chamber 2 so that the safety valve assembly 91 is held in the open state. The oil pressure on the piston 4 is opposite to, and at least equal to, the spring force of the spring 36. By valve 234, such pressure is maintained independently of the motor 10 and pump 8.

[0064] Valve 234 is de-energized to retract rod 5 in a speed-controlled manner and close valve assembly 91. When valve 234 is de-energized, the spring of solenoid valve 234 returns it to the open position. In this open state, chamber 2 is flow-connected to port 8a of pump 8 via lines 206 and 22. However, since valve 35 is energized, the state of valve 35 blocks the port, and therefore chamber 2 is not flow-connected directly to reservoir 14 and chamber 3 via line 21. The spring force of spring 36 acts to retract rod 5 and move piston 4 to the left. When the bidirectional motor 10 is rotated in the second direction, piston 4 moves to the left, retracting rod 5, thereby rotating bidirectional pump 8 in direction 46, allowing fluid to flow from line 206 and chamber 2 through port 8a. Bidirectional pump 8 also outputs fluid from port 8b to line 7. In this embodiment, such fluid flows into chamber 3 via line 7 and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. Therefore, the motor 10 and pump 8 can be used to adjust the fluid flow from the left chamber 2, thereby adjusting the speed at which the safety valve assembly 91 closes.

[0065] As shown in Figure 14, both valves 234 and 35 may be de-energized to retract rod 5 and close valve 91. When valve 234 is de-energized, the spring of solenoid valve 234 returns it to the open position. In this open state, chamber 2 is flow-connected to tank 14 via line 22 and pump 8. When valve 35 is de-energized, the spring of solenoid valve 35 returns it to the open position. In this open state, chamber 2 is flow-connected to tank 14 via line 21. Collar 60 is biased by spring 36 to retract rod 5 and move piston 4 to the left and close valve assembly 91. When the pressure in chamber 2 on piston 4 falls below the opposing spring force of spring 36, such spring force moves piston 4 to the left, and fluid flows from chamber 2 through the opening pump 8 and opening lines 22 and 21 to tank 14 and chamber 3. In this embodiment, such fluid flows into chamber 3 via line 7 and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3.

[0066] The system of this embodiment provides at least two fault-redundant hydraulic paths for closing the valve assembly 91 in the event of failure or malfunction. Firstly, as shown in Figure 15, in the event of a flow-limiting or interruption failure of the motor 10, pump 8, and / or valve 234, the energization of valve 35 can be released even in the event of an emergency power loss, and the spring of the solenoid valve 35 returns valve 35 to the open position. In this state, chamber 2 is flow-connected to line 7 and the right chamber 3 and reservoir 14 via line 21, thereby equalizing the pressure in chambers 2 and 3. The spring force of spring 36 acts to retract rod 5 and move piston 4 to the left. The pressurized fluid obtained from chamber 2 flows into chamber 3 via lines 206, 21, and 7, and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. When the pressure in the left chamber 2 above the piston 4 falls below the opposing spring force of the spring 36, such spring force moves the piston 4 to the left, retracting the rod 5 and closing the safety valve assembly 91. Such valve closure of valve 91 does not require the operation of the motor 10, pump 8, and / or valve 234, and can therefore be provided even in the event of a flow restriction or interruption failure of the motor 10, pump 8, and / or valve 234.

[0067] Secondly, as shown in Figure 16, in the event of a flow restriction or interruption failure of valve 35, valve 234 may be de-energized even in the event of an emergency power loss, and the spring of the solenoid valve 234 will then return valve 234 to the open position. In this state, chamber 2 is flow-connected to port 8a of pump 8 via line 206. Even if valve 35 is faulty and does not open, and motor 10 and pump 8 are faulty and do not open, chamber 2 is flow-connected to right chamber 3 and reservoir 14 via line 206, pump 8, and lines 22 and 7, thereby enabling equalization of pressure in chambers 2 and 3, so that gears 55 and 56 can rotate freely, thereby allowing hydraulic fluid to flow from port 8a to port 8b. The spring force of spring 36 acts to pull in rod 5 and move piston 4 to the left. The pressurized fluid obtained from chamber 2 flows into chamber 3 via line 6, pump 8, and lines 22 and 7, and also into reservoir 14. This configuration addresses the volume difference between the opposing chambers 2 and 3. When the pressure in the left chamber 2 on the piston 4 falls below the opposing spring force of the spring 36, such a spring force moves the piston 4 to the left, retracting the rod 5 and closing the safety valve assembly 91. Such valve closure of the valve assembly 91 does not require the operation of the valve 35 and can therefore be provided even in the event of flow restriction or blockage failure of the valve 35.

[0068] A hydraulic manifold 393 of a fourth embodiment is shown in Figure 17. As shown, the hydraulic manifold 393 has substantially the same configuration as the hydraulic manifold embodiment 293 and generally includes a solenoid valve 234, a solenoid 35, and several hydraulic lines 206, 107, 21, and 22. However, the piston assembly in this embodiment is the same as the piston assembly 192 shown in Figure 11 and includes only a single chamber within a closed fluid system. As shown, the piston assembly 192 does not include a second chamber 3, and only chamber 2 is within a closed fluid system having a tank 14, valve 234, valve 35, and hydraulic flow lines 206, 107, 21, and 22.

[0069] As shown in Figure 17, in the hydraulic manifold embodiment 393, the pump 8 is located in fluid line 22, with one side or port 8a of the pump 8 communicating with a single chamber 2 via fluid line 22, the pump 8, and fluid line 206, and the opposite side or port 8b of the pump 8 communicating only with the tank 14 via fluid lines 22 and 107. Line 206, solenoid-operated valve 234, pump 8, and lines 22 and 107 provide a first fluid line between the chamber 2 and the reservoir tank 14 that does not bypass and is not independent of the pump 8. Bypass fluid line 21 and solenoid-operated valve 35 are located in line 6 between side 8a of the pump 8 and the chamber 2, and thus provide a second fluid line between the chamber 2 and the reservoir tank 14 that bypasses the pump 8 and valve 234 and is independent. Thus, line 22, which has the pump 8 and valve 234 inside, and line 21, which has valve 35 inside, are parallel hydraulic flow connections between the chamber 2 and the tank 14. Therefore, the solenoid-operated valve 234, the pump 8, and the fluid line 22 are configured to operate to provide a first hydraulic release path between the chamber 2 and the reservoir tank 14. The solenoid-operated valve 35 and the fluid line 21 are configured to operate to provide a second hydraulic release path between the chamber 2 and the reservoir tank 14.

[0070] The system of this embodiment may be controlled in substantially the same manner as described above with respect to embodiment 293 to provide at least two operating states and two fail-safe states. To extend the rod 5 and open the safety valve assembly 91, valve 234 is de-energized so that the state of valve 35 is open, and valve 35 is energized so that the state of valve 35 is closed, blocking the port. Thus, side 8a of pump 8 is flow-connected to chamber 2 in at least one direction through valve 234. Chamber 2 is not flow-connected to reservoir 14 via line 21. Only side 8b of pump 8 is flow-connected to reservoir 14. When the bidirectional motor 10 is rotated in the first direction, piston 4 moves to the right to extend the rod 5, thereby rotating the bidirectional pump 8 (i.e., driven gear 55) in direction 45, drawing fluid flow from lines 22 and 107 as well as from reservoir 14 through port 8b. In this embodiment, such fluid is drawn only from reservoir 14 via line 107. The bidirectional pump 8 outputs fluid to line 206 via port 8a and through the release valve 234. The fluid in line 206 flows into chamber 2, thereby applying positive pressure to the piston 4. When the pressure in the sole chamber 2 on the piston 4 is large enough to overcome the opposing spring force of spring 36, such pressure extends rod 5 to the right. When this piston force exceeds the opposing spring force of spring 36, the piston 4 moves to the right, extending rod 5 and compressing spring 36 to open safety valve 91.

[0071] As shown in Figure 17, in order to maintain the safety valve assembly 91 in the open state, valve 34 is energized to set valve 234 to the closed port state, and valve 35 is energized to set valve 35 to the closed port state. In these valve states, the respective fluid flows from the left chamber 2 through lines 206 and 21 to the pump 8 and tank 14 are blocked, thereby holding spring 36 in a compressed state, preventing the piston 4 and rod 5 from being retracted, and maintaining the pressure in the left chamber 2 so that the safety valve assembly 91 is held in the open state. The oil pressure on piston 4 is opposite to, and at least equal to, the spring force of spring 36. By valve 234, such pressure is maintained independently of motor 10 and pump 8.

[0072] Similar to Embodiment 293, if a flow restriction or interruption failure occurs in either valve 234 or valve 35, the other valve 234 or 35 can be de-energized, even in the event of an emergency power loss, and then the spring of the solenoid valve in question returns the valve in question to the open position. In these failure conditions, chamber 2 is optionally connected to pump 8 and line 107 and tank 14 via line 22 or line 21, and chamber 2 is not connected to the second chamber. The spring force of spring 36 still acts to pull in rod 5 and move piston 4 to the left. The pressurized fluid obtained from sole chamber 2 flows to reservoir 14 via line 206, valve 234, line 22 and line 107, or via line 206, valve 35, line 21 and line 107. In this configuration, there is no need to deal with the volume difference between opposing chambers, as in Embodiment 92. When the pressure in the left chamber 2 above the piston 4 falls below the opposing spring force of the spring 36, such a spring force moves the piston 4 to the left, retracting the rod 5 and closing the safety valve assembly 91.

[0073] Because the configuration does not require addressing the volume difference between opposing chambers, the system of this embodiment may also be controlled to provide at least a third operating state. To selectively retract the rod 5 at a variable or controlled speed, or to position the safety valve 91 between its open and closed positions, valve 234 is de-energized so that the state of valve 35 is open, and valve 35 is energized so that the state of valve 35 is closed, closing the port. Thus, side 8a of the pump 8 is flow-connected to chamber 2 in at least one direction through valve 234. Chamber 2 is not flow-connected to reservoir 14 via line 21. Only side 8b of the pump 8 is flow-connected to reservoir 14. When the bidirectional motor 10 is rotated in the second direction, the piston 4 moves to the left to retract the rod 5, thereby rotating the bidirectional pump 8 in direction 46, drawing fluid flow through port 8a from line 206 and chamber 2. In this embodiment, such fluid is drawn only from chamber 2. The bidirectional pump 8 outputs fluid to line 107 via port 8b, and to reservoir 14 only when valve 35 is closed. When the pressure in the sole chamber 2 on piston 4 falls below the opposing spring force of spring 36, piston 4 moves to the left, retracting rod 5 and beginning to close the safety valve assembly 91. Once the safety valve 91 reaches a desired position between the open and closed positions, valve 234 can be biased to close and hold such a position as needed. Thus, the motor 10 and pump 8 can be used to variably control the pressure in chamber 2, the flow rate of fluid entering and leaving chamber 2, and thereby the speed at which the safety valve assembly 91 opens and closes and the position of the safety valve assembly 91 in either direction.

[0074] A hydraulic piston assembly 493 of a fifth embodiment is shown in Figure 18. This embodiment is similar to the embodiment shown in Figure 13, but has a dual rod and equal-area piston assembly 493. As shown, the piston 404 includes opposing rods 405a and 405b attached to the piston 404 to move with the piston 404. Rod 405b extends to the right and passes through the right end wall 409b of the housing 409. Rod 405a extends to the left and passes through the left end wall 409a of the housing 409. In this embodiment, the annular vertical end face 404a facing the left side of the piston 404 faces into the left chamber 2 by the addition of rod 405a passing through chamber 2, and the annular vertical end face 404b facing the right side of the piston 404 faces into the right chamber 3 by rod 405b extending out of the housing 409 through chamber 3. Since rods 405a and 405b have equal diameters, this forms an equal piston area configuration, and the surface area of ​​face 404a is substantially the same as the surface area of ​​face 404b. In this embodiment, rod 405b is connected to the collar 60 of the safety valve assembly 91.

[0075] The safety valve 91 may include sensors 40a and 40b for monitoring the position of the actuator rod 5 and sleeve collar 60; the compensator 13 may include a sensor 153 for monitoring the position of the compensator piston 15; the valve 34 may include a sensor 43 for monitoring the position of the valve 34; the valve 35 may include a sensor 44 for monitoring the position of the valve 35; and the hydraulic system 93 may include a pressure sensor 41 for monitoring the pressure of the hydraulic system 93. Such sensors may be used by the controller 74 to provide downhole diagnostic functionality to the undersea safety valve 90. The controller 74 is a digital device having output lines which are logical functions of its input lines, examples of which include a microprocessor, microcontroller, field-programmable gate array, programmable logic device, application-specific integrated circuit, or other similar device. The controller 74 is configured to perform various computer implementation functions, such as performing method steps and calculations and storing associated data, as disclosed herein. To communicate with various sensors, a sensor interface 73 allows signals transmitted from sensors to be converted into signals that can be understood and processed by the processor 74. The sensors may be coupled to the sensor interface 73 via a wired connection. In other embodiments, they may be coupled to the sensor interface 73 via a wireless connection. Diagnostic monitoring of the underwater safety valve 90 can be performed in the controller 74. Programming may be performed in any form of computer-readable medium or dedicated computer or data processor programmed, configured or constructed to execute instructions of the subject. Thus, the downhaul electronics 95 includes a processor, a non-temporary computer-readable medium, and processor-executable code stored in the non-temporary computer-readable medium. The processor may be implemented as a single processor or multiple processors operating together or independently to execute the processor-executable code described herein.Some examples of processors include microprocessors, microcontrollers, central processing units (CPUs), peripheral interface controllers (PICs), programmable logic controllers (PLCs), microcomputers, digital signal processors (DSPs), programmable logic devices ("PLDs"), multicore processors, field-programmable gate arrays (FPGAs), and combinations thereof. The terms computer or processor used herein refer to any of the above devices and any other data processors. Computer-readable media include media configured to store or transfer computer-readable code, or to which computer-readable code can be embedded. Non-temporary computer-readable media can be implemented in any suitable way, such as via random access memory (RAM), read-only memory (ROM), hard drives, hard drive arrays, solid-state drives, memory devices, magnetic drives, flash drives, flash memory, memory cards, optical drives, or other similar devices or media. Non-temporary computer-readable media may be a single non-temporary computer-readable medium, or multiple non-temporary computer-readable media functioning logically together or independently. The computer systems described herein are for illustrative purposes only. The embodiments and methods described herein may be implemented in any type of computer system or programming or processing environment. Furthermore, when a task or module is executed by two or more processing units, this means that the process is carried out in a distributed computing environment. Those skilled in the art will recognize that any computer system having appropriate programming means can perform steps of the disclosed method incorporated into a program product. Those skilled in the art will also recognize that while some of the exemplary embodiments described herein are intended for software installed and run on computer hardware, alternative embodiments implemented as firmware or hardware are also well within the scope of this disclosure.

[0076] As a result, the system 90 includes diagnostic commands from the controller 74 and feedback to the controller. Figure 21 is a flowchart of an exemplary method 210 for performing a diagnosis of a hydraulic piston assembly 92 implemented in the controller 74 and the diagnostic module 75. Method 210 can be performed in computer-readable code on a computer-readable medium so that the processor of the controller 74 executes method 210 when the processor executes computer-readable code. Thus, method 210 is performed as code stored in the non-temporary computer-readable medium of the controller 74, and the controller 74 executes such processor-executable code. Referring to Figure 21, in step 211 of the diagnostic function 210, an initiation signal is generated to invoke the various steps of method 210 and subject commands stored in the non-temporary computer-readable medium of the controller 74. In step 212, the controller 74 commands the system 90 to fully retract the actuator rod 5 and sleeve collar 60, and thereby move the sleeve collar 60 to the position shown in Figure 8, referring to Figure 5. In blocks 213 and 214, the controller 74 monitors the sensor 40a for a specified period after commanding the system 90 to the fully retracted position. In block 213, the controller 74 determines whether the sleeve collar 60 has triggered the proximity switch 40a, which indicates that the actuator rod is in the fully retracted position shown in Figure 8. In block 214, the controller 74 determines whether the sleeve collar 60 has exceeded a threshold period without triggering the proximity switch 40a. In this embodiment, such a threshold period is 5 minutes, but alternative time thresholds can be used as needed. If, after command 212, the position sensor 40a is not activated within the stored time threshold, in step 222, the controller 74 generates an “error” signal or report, and in step 223, the controller 74 commands the motor drive 10 to a “disable” state by turning off the output power in the motor drive 71 so that the motor drive 71 can spin freely.On the other hand, if the sleeve collar 60 triggers the sensor 40a within a stored time threshold indicating that the actuator rod 5 and sleeve collar 60 are in the commanded fully retracted position, in step 215, the controller 74 commands the system 90 to fully extend the actuator rod 5 and sleeve collar 60, thereby moving the sleeve collar 60 to the position shown to the right and in Figure 6, referring to Figure 5. In step 216, the controller 74 monitors the state change of the position sensor 40b. In blocks 217 and 218, the controller 74 monitors the sensor 40b for a specified period after commanding the system 90 to the fully extended position. In block 217, the controller 74 determines whether the sleeve collar 60 has triggered the proximity switch 40b, which indicates that the actuator rod is in the fully extended position shown in Figure 6. In block 218, the controller 74 determines whether the sleeve collar 60 has exceeded the threshold period without triggering the proximity switch 40b. In this embodiment, such a threshold period is 5 minutes, but alternative time thresholds can be used as needed. If, after command 215, the position sensor 40b is not activated within a stored time threshold, in step 219 the controller 74 generates an “error” signal or report, and in step 221 the controller 74 commands the motor drive unit 71 to enter a “disabled” state. On the other hand, if the sleeve collar 60 triggers the sensor 40b within a stored time threshold indicating that the actuator rod 5 and the sleeve collar 60 are in the commanded fully extended position, in step 220 the controller 74 generates an operation signal or report, and the hydraulic piston assembly 92 is diagnosed as fully operational. This provides the controller 74 with a diagnostic routine for the built-in downhole hydraulic piston assembly 92 that can be run at selected and automated periodic intervals. If the movement of the safety valve is not detected within a given time threshold by either the sensor 40a for a fully retracted command or the sensor 40b for a fully extended command, an error signal is provided by the controller 74.The controller 74 can also provide valve closing commands, and a “disable” command may include cutting off power to solenoids 34 and 35 to place the safety valve 90 in a fail-safe closed position. Error signals may also be sent to the surface controller 11 on the platform 100, and if no error is detected, the controller 74 may send a confirmation signal to the surface controller 11 on the platform 100. In this embodiment, the time threshold is greater than 5 minutes, but other time thresholds may be used depending on the desired operating parameters of the system.

[0077] The controller 74 also includes a compensator diagnostic function or routine 300 in the diagnostic module 75 for determining whether the compensated reservoir assembly 13 is operational. Figure 22 is a flowchart of an exemplary method 300 for performing a diagnosis on the compensated reservoir assembly 13 implemented in the controller 74 and the diagnostic module 75. Method 300 can be performed in computer-readable code on a computer-readable medium so that the processor of the controller 74 executes method 300 when the processor executes computer-readable code. Thus, method 300 is performed as code stored in the non-temporary computer-readable medium of the controller 74, and the controller 74 executes such processor-executable code. Referring to Figure 22, step 301 of the diagnostic function 300 generates an initiation signal to invoke the various steps of method 300 and subject instructions stored in the non-temporary computer-readable medium of the controller 74. In step 302, the controller 74 commands the system 90 to fully retract the actuator rod 5 and sleeve collar 60, and, referring to Figure 5, thereby moving the sleeve collar 60 to the left and the position shown in Figure 8. In blocks 303 and 304, the controller 74 monitors the sensor 40a for a specified period of time after commanding the system 90 to the fully retracted position. In block 303, the controller 74 determines whether the sleeve collar 60 has triggered the proximity switch 40a, and the proximity switch indicates that the actuator rod is in the fully retracted position shown in Figure 8. In block 304, the controller 74 determines whether the sleeve collar 60 has exceeded a threshold period without triggering the proximity switch 40a. In this embodiment, such a threshold period is 5 minutes, but alternative time thresholds can be used as needed. If the position sensor 40a is not activated within a stored time threshold after command 302, in step 312 the controller 74 generates an "error" signal or report, and in step 313 the controller 74 commands the motor drive unit 71 to enter a "disable" state.On the other hand, if the sleeve collar 60 triggers sensor 40a within a stored time threshold indicating that the actuator rod 5 and sleeve collar 60 are in the commanded fully retracted position, in step 305, the controller 74 commands the system 90 to fully extend the actuator rod 5 and sleeve collar 60, thereby moving the sleeve collar 60 to the position shown to the right and in Figure 6, referring to Figure 5. In step 306, the controller 74 monitors the compensator position sensor 153 for changes in state. In blocks 314, 307 and 308, the controller 74 monitors sensor 153 and sensor 40b for a specified period after commanding the system 90 to the fully extended position. In block 314, sensor 153 is monitored for changes in state indicating the movement of the compensator piston 15. Since the spring 36 is biased to increase the pressure inside the closed hydraulic system 93 against external pressure inside the closed hydraulic system 93, the compensator piston 15 moves to compensate for such a pressure difference when the actuator piston 4 is extended. Such movements are monitored by the controller 74 via the position sensor 153. If the position sensor 153 indicates a change in the position of the compensator piston 15 in block 314, in step 315, the controller 74 generates an operation signal or report and diagnoses that the compensated reservoir assembly 13 is fully operational. On the other hand, if the position sensor does not detect a change in the position of the compensator piston 15 in block 314, in block 307, the controller 74 determines whether the sleeve collar 60 has triggered the proximity switch 40b, which indicates that the actuator rod is in the fully extended position as shown in Figure 6. In block 308, the controller 74 determines whether the detected change in the position of the compensator piston 15 or the sleeve collar 60 has exceeded a threshold time without triggering the proximity switch 40b. In this embodiment, such a threshold period is 5 minutes, but alternative time thresholds can be used as needed.If, after command 305, neither position sensor 153 nor position sensor 40b is activated within a stored time threshold, in step 309, the controller 74 generates an “error” signal or report, and in step 311, the controller 74 commands the motor drive unit 71 to a “disable” state. On the other hand, if the sleeve collar 60 triggers sensor 40b within a stored time threshold indicating that the actuator rod 5 and sleeve collar 60 are in the commanded fully extended position, but sensor 153 did not detect a change in the position of the compensator piston 15, in step 316, the controller 74 generates an “error” signal indicating a failure of sensor 153 or the compensated reservoir assembly 13, or the controller 74 may generate a timeout to stop the process, indicating that the actuator is not responding as intended and requires alternative diagnostics. This allows the controller 74 to provide a built-in downhole compensated reservoir assembly 13 diagnostic routine that can be run at selected and automated periodic intervals. The controller 74 can also provide valve closing commands, and a “disable” command may include cutting off power to solenoids 34 and 35 to place the safety valve 90 in a fail-safe closed position. Error signals can be sent to the surface controller 11 on the platform 100, and if no error is detected, the controller 74 can send a confirmation signal to the surface controller 11 on the platform 100. In this embodiment, the time threshold is greater than 5 minutes, but other time thresholds may be used depending on the desired operating parameters of the system.

[0078] The controller 74 also includes a solenoid valve diagnostic function or routine 400 in the diagnostic module 75 for determining whether either solenoid valve 34 or solenoid valve 35 is operable. Figure 23 is a flowchart of an exemplary method 400 of a first embodiment for performing diagnostics of solenoid valves 34 and 35 implemented in the controller 74 and the diagnostic module 75. Method 400 may be performed in computer-readable code on a computer-readable medium so that the processor of the controller 74 executes method 400 when the processor executes computer-readable code. Thus, method 400 is performed as code stored in a non-temporary computer-readable medium of the controller 74, and the controller 74 executes such processor-executable code. In this embodiment, the solenoid drive unit 72 includes a solenoid sensor 76, the resistance of the solenoid coil and the solenoid drive current of the solenoid valve 34 or 35 in question are used to determine the state of the solenoid valve 34 or 35 in question. In particular, referring to Figure 23, step 401 of the diagnostic function 400 generates a start signal to activate the various steps of method 400 and subject commands stored in the non-temporary computer-readable medium of the controller 74. In step 402, the controller 74 commands the motor drive unit 71 to a “disable” state. In step 403, the controller 74 monitors the solenoid coil resistance of the solenoid valve in question, and in step 404, the controller 74 estimates the solenoid coil temperature from its solenoid coil resistance. In step 405, the controller 74 commands the solenoid valve 34 or 35 in question to be “on” or energized via the solenoid drive unit 72. In step 406, the controller 74 monitors the solenoid current. In step 407, the controller 74 commands the solenoid valve 34 or 35 in question to be “off” or de-energized via the solenoid drive unit 72.If, in block 408, the current sensor 76 indicates a current within the range established based on the lookup table stored in the controller 74, in step 410, the controller 74 generates an operation signal or report and diagnoses that the solenoid valve 34 or 35 in question is fully operational. On the other hand, if, in block 408, the current sensor 76 indicates a current outside the established range based on the lookup table stored in the controller 74, in step 409, the controller 74 generates an “error” or “out of range” signal or report indicating a fault in the solenoid valve 34 or 35 in question.

[0079] Figure 24 is a flowchart of an exemplary method 400b of a second embodiment for performing diagnostics on solenoid valves 34 and 35 implemented in controller 74 and diagnostic module 75. Method 400b may be performed in computer-readable code on a computer-readable medium so that the processor of controller 74 executes method 400b when the processor executes computer-readable code. Thus, method 400b is performed as code stored in a non-temporary computer-readable medium of controller 74, and controller 74 executes such processor-executable code. In this embodiment, solenoid valve 34 includes a sensor 43 for monitoring the position of valve 34, and solenoid valve 35 includes a sensor 44 for monitoring the position of valve 35. Referring to Figure 24, step 401b of the diagnostic function 400b generates an initiation signal to invoke the various steps of method 400b and subject commands stored in the non-temporary computer-readable medium of controller 74. In step 402b, controller 74 commands the motor drive unit 71 to a “disable” state. In step 406b, the controller 74 monitors the position sensor 43 or 44, if applicable. In step 405b, the controller 74 commands the target solenoid valve 34 or 35 to be "on" or energized via the solenoid drive 72. In block 408b, the controller 74 determines whether the sensor 43 or 44 indicates that the valve element of the solenoid valve 34 or 35 is open as commanded. If in block 408b the sensor 43 or 44 indicates that the valve 34 or 35 is in the commanded open position, in step 410b the controller 74 generates an operation signal or report and the target solenoid valve 34 or 35 is diagnosed as fully operational. On the other hand, if in block 408b the sensor 43 or 44 indicates that the valve 34 or 35 is not in the commanded open position, in step 409b the controller 74 generates an “error” or “out of range” signal or report indicating a fault in the solenoid valve 34 or 35 in question.

[0080] Figure 25 is a flowchart of an exemplary method 400c of a third embodiment for performing diagnostics on solenoid valves 34 and 35 implemented in a controller 74 and a diagnostic module 75. Method 400c may be performed in computer-readable code on a computer-readable medium so that the processor of the controller 74 executes method 400c when the processor executes computer-readable code. Thus, method 400c is performed as code stored in a non-temporary computer-readable medium of the controller 74, and the controller 74 executes such processor-executable code. In this embodiment, as shown in Figure 5, the solenoid valve 34 includes a pressure sensor 41 for monitoring the pressure of the hydraulic system 93. Referring to Figure 25, in step 401c of the diagnostic function 400c, a start signal is generated to invoke the various steps of method 400c and subject instructions stored in the non-temporary computer-readable medium of the controller 74. In step 402c, the controller 74 commands the system 90 to fully retract the actuator rod 5 and sleeve collar 60, and, referring to Figure 5, thereby moving the sleeve collar 60 to the left and the position shown in Figure 8. In step 403c, the controller 74 commands the motor drive 71 and solenoid drive 72 to be "disabled" by turning off the output power in the motor drive 71 so that the motor 10 can spin freely, and by turning off the output power in the solenoid drive 72 so that the solenoids 34 and 35 can be unenergized and open freely, respectively. In step 404c, the controller 74 monitors the pressure sensor 41. In step 405c, the pump 8 is driven by the motor 10 at a predetermined test speed. In this embodiment, such a test speed is 1000 rpm, but alternative test speeds may be used as needed. In block 406c, the controller 74 determines whether the pressure sensor 41 indicates that a first threshold pressure has been exceeded. In this embodiment, such a first threshold pressure is 100 psi, but alternative pressure thresholds may be used as needed.If the pressure sensor 41 indicates a pressure greater than the first threshold pressure in block 406c, in step 419c, the controller 74 generates an “error” or “out of range” signal or report indicating a failure in the solenoid valves 34 and 35. On the other hand, if the pressure sensor 41 indicates a pressure less than or equal to the first threshold pressure in block 406c, in step 407c, the controller 74 commands both solenoid valves 34 and 35 to “on” or energize via the solenoid drive unit 72. In block 408c, the controller 74 determines whether the pressure sensor 41 indicates that it has exceeded a second threshold pressure. In this embodiment, such a second threshold pressure is 500 psi, but an alternative pressure threshold may be used if necessary. If the pressure sensor 41 indicates a pressure less than the second threshold pressure in block 407c, in step 419c, the controller 74 generates an “error” or “out of range” signal or report indicating a failure in the solenoid valves 34 and 35. On the other hand, in block 408c, if the pressure sensor 41 indicates a pressure greater than or equal to the second threshold pressure, in step 409c, the controller 74 commands the solenoid valve 34 to be "off" or de-energized via the solenoid drive 72. In block 410c, the controller 74 determines whether the pressure sensor 41 indicates that it has exceeded a third threshold pressure. In this embodiment, such a third threshold pressure is 100 psi, but an alternative pressure threshold may be used if necessary. If the pressure sensor 41 indicates a pressure greater than the third threshold pressure in block 410c, in step 420c, the controller 74 generates an "error" or "out of range" signal or report indicating a malfunction of the solenoid valve 34. On the other hand, if the pressure sensor 41 indicates a pressure less than or equal to the third threshold pressure in block 410c, in step 411c, the controller 74 commands both solenoid valves 34 and 35 to be "on" or energized via the solenoid drive 72. In block 412c, the controller 74 determines whether the pressure sensor 41 indicates that the pressure has exceeded a fourth threshold pressure.In this embodiment, such a fourth threshold pressure is 500 psi, but alternative pressure thresholds may be used as needed. If the pressure sensor 41 indicates a pressure below the fourth threshold pressure in block 412c, in step 420c, the controller 74 generates an “error” or “out of range” signal or report indicating a fault in the solenoid valve 34. On the other hand, if the pressure sensor 41 indicates a pressure equal to or greater than the fourth threshold pressure in block 412c, in step 413c, the controller 74 commands the solenoid valve 34 via the solenoid drive 72 to “off” or de-energized. In block 414c, the controller 74 determines whether the pressure sensor 41 indicates that it has exceeded a fifth threshold pressure. In this embodiment, such a fifth threshold pressure is 100 psi, but alternative pressure thresholds may be used as needed. If the pressure sensor 41 indicates a pressure greater than the fifth threshold pressure in block 414c, in step 421c, the controller 74 generates an “error” or “out of range” signal or report indicating a failure of the solenoid valve 35. On the other hand, if the pressure sensor 41 indicates a pressure less than or equal to the fifth threshold pressure in block 414c, in step 415c, the controller 74 commands both solenoid valves 34 and 35 to “on” or energized via the solenoid drive unit 72. In block 416c, the controller 74 determines whether the pressure sensor 41 indicates that it has exceeded the sixth threshold pressure. In this embodiment, such a sixth threshold pressure is 500 psi, but an alternative pressure threshold may be used if necessary. If the pressure sensor 41 indicates a pressure less than the sixth threshold pressure in block 416c, in step 421c, the controller 74 generates an “error” or “out of range” signal or report indicating a failure of the solenoid valve 35. On the other hand, if the pressure sensor 41 in block 416c indicates a pressure greater than or equal to the sixth threshold pressure, in step 417c the controller 74 commands the motor drive unit 71 and the solenoid drive unit 72 to enter a "disabled" state. In step 418c, the controller 74 generates an operation signal or operation report and both solenoid valves 34 or 35 are diagnosed as fully operational.The controller 74 may also provide a valve closing command in the event of an error or out-of-range signal to place the safety valve 90 in a fail-safe closed position. The error or out-of-range signal may also be sent to the sea level controller 11 on the platform 100, and if no error is detected, the controller 74 may send a confirmation signal to the sea level controller 11 on the platform 100. In this embodiment, various pressure thresholds are disclosed, but other pressure thresholds may be used depending on the desired operating parameters of the system.

[0081] Therefore, a redundant fault-tolerant hydraulic system is provided to close the safety valve assembly 91, and critical components of such a system may be automatically tested periodically to diagnose or detect failures of such components.

[0082] The present invention is intended to be subject to numerous changes and modifications. Thus, while one embodiment of an improved underwater safety valve operating system is shown and described, and several alternative forms are discussed, those skilled in the art will readily understand that various additional changes and modifications can be made without departing from the spirit of the invention, as defined and distinguished by the following claims.

Claims

1. A subsea safety valve operating system, A pipe located within an oil well, which forms a flow path up to the sea level for a fluid originating below sea level, A safety valve located in the piping below the sea level, which is operable between an open position and a closed position to control the flow of fluid in the flow path, A hydraulic piston assembly located in the piping below the sea level, including a first chamber and a piston between the first chamber and the safety valve, An electric motor, located in the piping below the sea level, is configured to receive electric current, A hydraulic pump located in the piping below the sea level, driven by the electric motor, and configured to be connected to the first chamber of the hydraulic piston assembly, A spring element located in the piping below the sea level and configured to provide spring force to the piston, The hydraulic pump and the fluid reservoir connected to the first chamber, A first valve connected to the first chamber and the fluid reservoir, having a first open position and a first closed position, The system includes a second valve connected to the first chamber and the fluid reservoir, having a second open position and a second closed position, The hydraulic pump, the hydraulic piston assembly, the first valve, the second valve, and the fluid reservoir are connected within a substantially closed hydraulic system. The hydraulic system is configured to provide pressure within the first chamber to drive the safety valve from the closed position to the open position in the first state. In the second state, the hydraulic system is configured to maintain the pressure level in the first chamber that holds the safety valve in the open position. In the third state, the hydraulic system is configured to release the pressure level in the first chamber via a first hydraulic release path between the first chamber and the fluid reservoir, which extends through the first valve when the first valve is in the first open position. In the fourth state, the hydraulic system is configured to release the pressure level in the first chamber via a second hydraulic release path between the first chamber and the fluid reservoir extending through the second valve when the second valve is in the second open position. The first hydraulic release path is independent of the second hydraulic release path, and the second hydraulic release path is independent of the first hydraulic release path. A subsea safety valve operating system wherein the pressure level in the first chamber that holds the safety valve in the open position may be released via the first hydraulic release path if there is an obstruction in the second hydraulic release path, and may be released via the second hydraulic release path if there is an obstruction in the first hydraulic release path.

2. The subsea safety valve operating system according to claim 1, wherein the hydraulic system is configured to maintain the pressure level in the first chamber independently of the electric motor and the hydraulic pump in the second state.

3. The subsea safety valve operating system according to claim 2, wherein the second state includes the first valve being in the first closed position and the second valve being in the second closed position.

4. The subsea safety valve operating system according to claim 1, wherein the spring element is in a compressed state between the piston and the piping in the second state.

5. The subsea safety valve operating system according to claim 1, wherein the hydraulic piston assembly comprises the first chamber essentially connected to the closed hydraulic system.

6. The subsea safety valve operating system according to claim 1, wherein the first hydraulic release path extends through the hydraulic pump.

7. The submarine safety valve operating system according to claim 6, wherein the first state includes providing the piston with a hydraulic force that is opposed to and exceeds the spring force, and the piston translating in the first direction, thereby operating the safety valve to the open position.

8. The subsea safety valve operating system according to claim 7, wherein the first state includes the first valve being in the first open position and the electric motor being driven to control the flow of fluid through the hydraulic pump to the first chamber.

9. The subsea safety valve operating system according to claim 8, wherein the second hydraulic release path is independent of the hydraulic pump.

10. The subsea safety valve operating system according to claim 9, wherein the first state includes the first valve being in the first open position and the second valve being in the second closed position.

11. The hydraulic piston assembly includes a second chamber connected to the fluid reservoir, The piston separates the first and second chambers. The positive pressure difference between the first chamber and the second chamber provides the piston with an oil pressure that is opposed to and exceeds the spring force. The underwater safety valve operating system according to claim 10.

12. The subsea safety valve operating system according to claim 11, wherein the negative pressure difference between the first chamber and the second chamber provides oil pressure to the piston in a second direction opposite to the first direction.

13. The subsea safety valve operating system according to claim 12, wherein the third state includes the negative pressure difference, the resulting oil pressure, and the spring force that translates the piston in the second direction and operates the safety valve to the closed position.

14. The subsea safety valve operating system according to claim 6, wherein the second state includes providing the piston with an oil pressure that is opposite to and equal to the spring force.

15. The subsea safety valve operating system according to claim 14, wherein the second state includes the first valve being in the first closed position.

16. The subsea safety valve operating system according to claim 15, wherein the second hydraulic release path is independent of the hydraulic pump.

17. The subsea safety valve operating system according to claim 16, wherein the second state includes the second valve being in the second closed position.

18. The submarine safety valve operating system according to claim 6, wherein the third state includes providing the piston with a hydraulic force that is opposite to and less than the spring force, and the piston translating in the second direction, thereby operating the safety valve to the closed position.

19. The subsea safety valve operating system according to claim 18, wherein the second hydraulic release path is independent of the hydraulic pump.

20. The subsea safety valve operating system according to claim 19, wherein the third state includes the second valve being in a malfunctioning closed position.

21. The subsea safety valve operating system according to claim 20, wherein the third state includes driving the electric motor to control the fluid flow rate in the first hydraulic release path.

22. The subsea safety valve operating system according to claim 20, wherein the third state includes releasing the electric motor and the hydraulic pump to allow fluid flow in the first hydraulic release path.

23. The subsea safety valve operating system according to claim 19, wherein the third state includes the second valve being in the second closed position and the electric motor being driven to control the fluid flow rate in the first hydraulic release path.

24. The subsea safety valve operating system according to claim 19, wherein the third state includes the second valve being in the second closed position and the electric motor and the hydraulic pump being released to allow fluid flow in the first hydraulic release path.

25. The subsea safety valve operating system according to claim 6, wherein the fourth state includes providing the piston with a hydraulic force that is opposite to and less than the spring force, and the piston translating in the second direction, thereby operating the safety valve to the closed position.

26. The subsea safety valve operating system according to claim 25, wherein the fourth state includes the first valve being in a faulty closed position and / or the hydraulic pump being in a faulty flow-blocking position.

27. The subsea safety valve operating system according to claim 1, wherein the first hydraulic release path is independent of the hydraulic pump, and the second hydraulic release path is independent of the hydraulic pump.

28. The submarine safety valve operating system according to claim 27, wherein the first state includes providing the piston with a hydraulic force that is opposed to and exceeds the spring force, and the piston translating in the first direction, thereby operating the safety valve to the open position.

29. The subsea safety valve operating system according to claim 28, wherein the first state includes the first valve being in the first closed position, the second valve being in the second closed position, and the electric motor being driven to control the flow of fluid to the first chamber through the hydraulic pump.

30. The hydraulic piston assembly includes a second chamber connected to the fluid reservoir, The piston separates the first and second chambers. The positive pressure difference between the first chamber and the second chamber provides the piston with an oil pressure that is opposed to and exceeds the spring force. The underwater safety valve operating system according to claim 29.

31. The subsea safety valve operating system according to claim 30, wherein the negative pressure difference between the first chamber and the second chamber provides oil pressure to the piston in a second direction opposite to the first direction.

32. The subsea safety valve operating system according to claim 27, wherein the second state includes providing the piston with an oil pressure that is opposite to and equal to the spring force.

33. The subsea safety valve operating system according to claim 32, wherein the second state includes the first valve being in the first closed position and the second valve being in the second closed position.

34. The subsea safety valve operating system according to claim 33, comprising a check valve located between the hydraulic pump and the first chamber, configured to be operable to allow fluid flow from the hydraulic pump to the first chamber and to block fluid flow from the first chamber to the hydraulic pump, thereby maintaining the pressure level in the first chamber independently of the electric motor and the hydraulic pump.

35. The subsea safety valve operating system according to claim 27, wherein the third state includes providing the piston with a hydraulic force that is opposite to and less than the spring force, and the piston translating in a second direction, thereby operating the safety valve to the closed position.

36. The subsea safety valve operating system according to claim 35, wherein the third state includes the second valve being in a malfunctioning closed position.

37. The subsea safety valve operating system according to claim 35, wherein the third state includes the second valve being in the second open position.

38. The subsea safety valve operating system according to claim 27, wherein the fourth state includes providing the piston with a hydraulic force that is opposite to and less than the spring force, and the piston translating in a second direction, thereby operating the safety valve to the closed position.

39. The subsea safety valve operating system according to claim 38, wherein the fourth state includes the first valve being in a malfunctioning closed position.

40. The subsea safety valve operating system according to claim 38, wherein the fourth state includes the first valve being in the first open position.

41. A third hydraulic release path between the first chamber and the fluid reservoir, which includes a third hydraulic release path extending through the hydraulic pump when the electric motor and the hydraulic pump are released to allow fluid flow in the third hydraulic release path, The third hydraulic release path is independent of both the first hydraulic release path and the second hydraulic release path. The underwater safety valve operating system according to claim 27.

42. The subsea safety valve operating system according to claim 41, wherein the hydraulic system is configured in a fifth state to release the pressure level in the first chamber via the third hydraulic release path between the first chamber and the fluid reservoir, which extends through the hydraulic pump, when the electric motor and the hydraulic pump are released to allow fluid flow in the third hydraulic release path.

43. The subsea safety valve operating system according to claim 1, wherein the fluid reservoir includes a pressure compensator configured to normalize the pressure difference between the outside of the hydraulic system and the inside of the hydraulic system.

44. The subsea safety valve operating system according to claim 43, wherein the pressure compensator includes a membrane or a piston.

45. The subsea safety valve operating system according to claim 44, comprising a position sensor configured to detect the position of the membrane or the piston.

46. The subsea safety valve operating system according to claim 1, wherein the first valve is an active operating valve configured to enable equalization of fluid pressure by opening each side of the first valve, and the second valve is an active operating valve configured to enable equalization of fluid pressure by opening each side of the second valve.

47. The subsea safety valve operating system according to claim 46, wherein the first valve includes a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, and the second valve includes a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the second valve.

48. The piping includes an outer tubular surface oriented around the longitudinal axis and an inner tubular surface oriented around the longitudinal axis and defining the flow path, The piping includes a first module cavity between the inner tubular surface and the outer tubular surface, The piping includes a second module cavity between the inner tubular surface and the outer tubular surface, The hydraulic piston assembly is placed in the first module cavity, The electric motor and the hydraulic pump are arranged in the second module cavity. The underwater safety valve operating system according to claim 1.

49. The aforementioned safety valve A flapper element configured to rotate around a hinge axis between the open position and the closed position within the flow path, The hinge shaft fixed to the aforementioned piping, The subsea safety valve operating system according to claim 48, comprising: a flapper operating sleeve oriented around the longitudinal axis and configured to move the flapper element from the closed position to the open position within the flow path.

50. The subsea safety valve operating system according to claim 49, wherein the hydraulic piston assembly includes a first actuator rod connected to the piston for movement with the piston, and a first actuator collar connected to the actuator rod for movement with the actuator rod, and the flapper operating sleeve is connected to the actuator collar for movement with the actuator collar.

51. The subsea safety valve operating system according to claim 50, wherein the spring element includes a coil spring that is compressed between the piston and the piping in the second state, oriented around the longitudinal axis, and axially positioned between the hinge axis and the first actuator collar.

52. The subsea safety valve operating system according to claim 1, wherein the hydraulic piston assembly includes a second chamber connected to the fluid reservoir, and the piston separates the first and second chambers.

53. The subsea safety valve operating system according to claim 52, wherein the piston includes a first surface area exposed to the first chamber and a second surface area exposed to the second chamber.

54. The underwater safety valve operating system according to claim 53, wherein the first surface area is greater than or equal to the second surface area.

55. The hydraulic piston assembly includes a cylinder having a first end wall, and the piston is positioned within the cylinder to perform a sealed sliding motion along the cylinder. The hydraulic piston assembly includes a first actuator rod connected to the piston for movement with the piston, having a portion that seals and penetrates the first end wall, The underwater safety valve operating system according to claim 54.

56. The subsea safety valve operating system according to claim 55, wherein the cylinder has a second end wall, and the hydraulic piston assembly includes a second actuator rod connected to the piston for movement with the piston, having a portion that seals and penetrates the second end wall, the first surface area being equal to the second surface area.

57. Below the sea level, the following sub-sea control electronic equipment is connected to the electric motor, the first valve and the second valve, A sea level controller located above the aforementioned sea level, A power cable that supplies power from the sea surface level to the underwater control electronic equipment, Includes a communication cable between the underwater control electronic equipment and the underwater controller, The underwater safety valve operating system according to claim 1.

58. The submarine safety valve operating system according to claim 57, comprising: a plurality of sensors configured to detect operating parameters of the submarine safety valve operating system; and the submarine control electronic equipment including a signal processor configured to communicate with the sensors, receive sensor data from the sensors, and output the data to the submarine controller via the communication cable.

59. The submarine safety valve operating system according to claim 1, comprising a position sensor configured to detect the position of the piston.

60. The subsea safety valve operating system according to claim 59, wherein the position sensor includes a first contact switch and a second contact switch.

61. The subsea safety valve operating system according to claim 1, wherein the electric motor includes a variable-speed electric motor and the hydraulic pump includes a reversible hydraulic pump.

62. The subsea safety valve operating system according to claim 1, wherein the hydraulic pump is selected from the group consisting of a fixed-displacement pump, a variable-displacement pump, a two-port pump, and a three-port pump.

63. A sub-sea controller located below the aforementioned sea level and connected to the electric motor, the first valve and the second valve, Includes a submarine sensor located below sea level, configured to detect the operating parameters of the components of the submarine safety valve operating system, and connected to the submarine controller, The submarine controller includes a non-temporary computer-readable medium that stores one or more commands executable by the submarine controller in order to perform a diagnostic test to detect a failure of the components of the submarine safety valve operating system based on the operating parameters of the components of the submarine safety valve operating system detected by the submarine sensor, The underwater safety valve operating system according to claim 1.

64. The fluid reservoir includes a pressure compensator, The components of the underwater safety valve operating system are selected from the group consisting of the pressure compensator, the hydraulic piston assembly, the first valve, and the second valve. The underwater sensor is selected from the group consisting of a position sensor, a current sensor, and a pressure sensor. The underwater safety valve operating system according to claim 63.

65. The subsea sensor includes a position sensor configured to detect the position of the piston of the hydraulic piston assembly, and the diagnostic test is, A step of commanding the movement of the piston to a predetermined position, The steps include monitoring the position sensor after the commanded movement, The subsea safety valve actuation system according to claim 64, comprising the step of determining the operating state of the hydraulic piston assembly as a function of the output or absence of output from the monitored position sensor.

66. The subsea safety valve operating system according to claim 65, wherein the step of determining the operating state of the hydraulic piston assembly is based on a threshold elapsed time from the commanded movement.

67. The pressure compensator includes a compensator membrane or a compensator piston, the subsea sensor includes a compensator position sensor configured to detect the position of the compensator membrane or the compensator piston, and the diagnostic test is, A step of commanding the movement of the piston of the hydraulic piston assembly to a preset position, The steps include monitoring the compensator position sensor after the commanded movement, The subsea safety valve operating system according to claim 64, comprising the step of determining the operating state of the pressure compensator as a function of the output or absence of output from the monitored compensator position sensor.

68. The subsea safety valve operating system according to claim 67, wherein the step of determining the operating state of the pressure compensator is based on a threshold elapsed time from the commanded movement.

69. The first valve includes a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, the subsea sensor includes a current sensor configured to detect the current of the solenoid valve, and the diagnostic test is, The steps include: commanding the energization of the solenoid valve, The steps include monitoring the current sensor after the commanded energization, The subsea safety valve operating system according to claim 64, comprising the step of determining the operating state of the solenoid valve as a function of the output from the monitored current sensor.

70. The submarine safety valve operating system according to claim 69, wherein the step of determining the operating state of the solenoid valve is based on current reference data stored in the submarine controller.

71. The first valve includes a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, the subsea sensor includes a valve position sensor configured to detect the position of the solenoid valve, and the diagnostic test is, The steps include: commanding the energization of the solenoid valve, The steps include monitoring the valve position sensor after the commanded energization, The subsea safety valve actuation system according to claim 64, comprising the step of determining the operating state of the solenoid valve as a function of the output or absence of output from the monitored valve position sensor.

72. The first valve includes a solenoid valve configured to open in the event of a power failure to equalize the fluid pressure on each side of the first valve, the hydraulic pump includes a rotary pump, the subsea sensor includes a pressure sensor configured to detect the pressure in the closed hydraulic system, and the diagnostic test is, The steps include: commanding the de-energization of the solenoid valve, A step of commanding the rotary pump to rotate at a reference rotational speed, The steps include monitoring the pressure sensor after the commanded de-energization of the solenoid valve, The subsea safety valve operating system according to claim 64, comprising the step of determining the operating state of the solenoid valve as a function of the output from the monitored pressure sensor.

73. The subsea safety valve operating system according to claim 69, wherein the step of determining the operating state of the solenoid valve is based on stored pressure reference data.

74. The aforementioned diagnostic test, The steps include: commanding the energization of the solenoid valve, The subsea safety valve operating system according to claim 72, comprising the step of monitoring the pressure sensor after the solenoid valve has been energized as ordered.

Images