Method and system for safe personnel entry to high-risk area

Abstract

A system (1) for a drilling rig (30) comprising equipment (400,500) with machines operable on a drill floor (37), the system (1) comprising an operator station (100) including an operator station controller (120) and an operating device (130) comprising a control interface (60,61) for an operator (77) and located in a driller's cabin (36) adjacent the drill floor (37); wherein an equipment controller (410,510) is operatively connected to the operator station controller (120) and configured to control the equipment (400,500); and the system (1) further comprises a safety controller (300) configured to manipulate an actuation signal between the equipment controller (410,510) and an actuator (430,530) forming part of the equipment (400,500). There is also provided a method of upgrading a drilling rig (30) comprising retrofitting a safety controller (300) to the drilling rig (30).

Description

[0001] METHOD AND SYSTEM FOR SAFE PERSONNEL ENTRY TO HIGH-RISK AREA

[0002] FIELD

[0003] The present disclosure relates to industrial plants, such as drilling rigs, comprising heavy machinery located at areas where personnel may also be present, and associated safety aspects of such plants. More particularly the disclosure relates to a method and a system for enhancing safety when personnel enter such a high-risk area.

[0004] BACKGROUND

[0005] A key element of industrial plants with integrated moving machinery or parts is the control and monitoring system. One example of such a plant is a drilling rig, which may be a land-based drilling rig or an offshore drilling rig. Equipment, such as drilling equipment (for example power tongs / wrenches, pipe handling equipment, etc.), is remotely controlled by an operator by means of a control and monitoring system. Many operations that are performed by means of such a system are potentially high-risk. As an example, an operation may include handling of heavy loads by powerful equipment. At the same time, there may be a need for personnel to be present in or around the operational area of the equipment, for example to carry out manual operations which are difficult to carry out using machines.

[0006] Publications which may be useful for understanding the field of technology include US 10,317,877 B2.

[0007] Due to the increasing complexity of industrial plants and the associated control and monitoring systems, there is a risk that errors may occur when personnel are in the vicinity of the operational area of plant equipment. Human or technical errors, including software errors, may occur. Hence, increased safety is needed in such control and monitoring systems. Operation of such plants is, however, associated with high costs, and measures to increase safety may reduce operational efficiency or plant complexity, which is undesirable. There is consequently a need for improved solutions for increasing safety in industrial plants, such as drilling rigs. The present disclosure has the objective to provide such improved solutions, or at least to provide useful alternatives to the state of the art.

[0008] SUMMARY

[0009] In an example, there is provided a system for a drilling rig comprising equipment operated by an equipment controller, the equipment comprising machines operable on a drill floor on the drilling rig, the system comprising an operator station including an operator station controller and an operating device comprising a control interface for an operator, the operating device being located in a driller’s cabin arranged adjacent the drill floor; wherein the equipment controller is operatively connected to the operator station controller and configured to control operation of the equipment; and wherein the system further comprises a safety controller configured to manipulate an actuation signal between the equipment controller and an actuator forming part of the equipment.

[0010] In an example, there is provided a method of upgrading a drilling rig comprising equipment operated by an equipment controller, the method comprising retrofitting a safety controller to the drilling rig.

[0011] The appended claims and detailed description below outlines further examples and embodiments.

[0012] BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other characteristics will become clear from the following description of illustrative, non-restrictive examples, with reference to the attached drawings, in which:

[0014] Fig. 1 illustrates a drilling rig.

[0015] Fig. 2 illustrates a driller’s cabin of the drilling rig.

[0016] Fig. 3 is an exemplary block diagram illustrating principles of a system for controlling equipment in an industrial plant. Fig. 4 is an exemplary block diagram illustrating principles of a system for enhancing safety in an industrial plant.

[0017] DETAILED DESCRIPTION

[0018] Fig. 1 illustrates an example of a drilling rig 30. The drilling rig 30 may be used for drilling / construction of hydrocarbon wells or for other drilling purposes such as construction of geothermal wells, injection wells, or other types. The drilling rig 30 illustrated in Fig. 1 is an offshore drilling rig, however the present teaching is equally applicable to land-based rigs. The drilling rig 30 may comprise a derrick 34 and associated equipment / machines (such as a hoisting system, a top drive, pipe handling equipment, power tongs, etc., not illustrated in detail here) to build a drill string 35 and construct the well in a manner familiar to the skilled reader. The drilling operation may be controlled from a driller's cabin 36 proximal to a drill floor 37. Fig. 2 illustrates the driller’s cabin 36. An operator 77 (for example a “driller”) monitors and controls various aspects of the drilling operation, via among other things display apparatus 60 (such as computer screens) and input apparatus 61 (such as touchscreens, machine control joysticks, steering wheels / multifunction wheels, pushbuttons, etc.).

[0019] Fig. 3 illustrates parts of a system 1 for an industrial plant. The system 1 may be a drilling system. Fig. 3 shows an exemplary block diagram illustrating principles of a two pieces of industrial plant equipment 400 and 500 controlled by equipment controllers 410 and 510. The equipment 400 and 500 may, for example, be a drilling or pipe handling machine on the drilling rig 30.

[0020] An operator station 100 includes an operator station controller 120 and an operating device 130 comprising various control elements, such as pushbuttons and joysticks. The operating device 130 may include or be operatively connected to associated display apparatus. The operating device 130 may, for example, be implemented on and / or integrated with the display apparatus 60 and / or the input apparatus 61. In the following examples, the operating device 130 and operator station display apparatus are integrated with the display apparatus 60 and input apparatus 61. The operating device 130 may be located in the driller’s cabin 36 or in another control room, remotely from the location of the equipment 400,500 to be controlled. In a typical example, the operating device 130 may be embodied as an operator input element in a touch panel which combines the functionality of the operating device 130 and the display apparatus. The operating device 130 may, for example, be implemented as software controls operable via an interactive screen, such as a touchscreen. The operator station 100 may typically include an operator chair to which the operating device(s) 130 and / or display apparatus are operatively connected, in order to form an integrated workstation.

[0021] The display apparatus may be configured to display remotely captured image data and / or video data, such as video data captured by a video camera arranged at the remotely controlled equipment 400,500 or in its environment. With such features, the system 1 acts as a combined monitoring and control system, for remotely monitoring and controlling the equipment 400,500, e.g. the drilling equipment at or around the drill floor 37 on the drilling rig 30. Also, the display apparatus may be configured to display various process information, status information, warnings, alarms, etc., to the operator 77.

[0022] The operator station controller 120 may include central processing unit, communication bus, I / O devices, firmware and application software. The operator station controller 120 is communicatively connected to the two equipment controllers 410 and 510. There may be multiple equipment and process controllers connected to the same operator station 120.

[0023] The equipment controllers 410 and 510 may each include a central processing unit, communication bus, I / O devices, firmware and application software.

[0024] The equipment controllers 410 and 510 each controls an actuator. Equipment controller 410 in the illustrated example controls a hydraulic oil supply valve 430, for example being part of an actuator in a hydraulically operated piece of equipment wherein the oil supply valve 430 may energise the equipment. Equipment controller 510 in the illustrated example controls an actuator in the form of an electric motor 530, via a variable frequency drive 520.

[0025] More specifically, in the illustrated example, the equipment controller 410 controls the oil supply to a first piece of equipment 400 through opening or closing the oil supply valve 430 and the equipment controller 510 controls the speed of the motor Illustrated in Fig. 4, the system 1 comprises a safety limiter system, which has been added in addition to the parts described above. The safety limiter system in this example consists of a safety controller 300, an operator pushbutton 110, an operator lamp 140, a floor pushbutton 210, a floor traffic light 220, a block keyswitch 310, and a safety relay 420. The safety controller 300 is operable to provide a motor speed limit signal 550 to the variable frequency drive 520. In other examples, the safety limiter system may comprise only some of these components or functionalities.

[0026] The safety controller 300 acts independently of the controllers 120, 410 and 510, and is able to block or limit a function of the associated equipment / machinery to protect personnel entering the vicinity of the equipment 400 and 500, for example personnel entering the drill floor 37 or a specific zone (e.g. the zone around and adjacent a well center opening) on the drill floor 37.

[0027] The safety controller 300 is operated by the operator pushbutton 110, the floor pushbutton 210 and / or the block keyswitch 310.

[0028] The safety controller 300 provides indications and information to personnel through the operator lamp 140, the floor traffic light 220 and through state information (indicative of the operational state of the safety controller 300 / the safety limiter system) sent to the equipment controllers 410 and 510.

[0029] The floor pushbutton 210 and / or the floor traffic light 220 may be arranged spaced from the operating device 130 and the operator pushbutton 110. The floor pushbutton 210 and / or the floor traffic light 220 may be arranged in a floor operator stand 200 at or adjacent the operational zone of the equipment 400,500, for example adjacent a drill floor 37 on a drilling rig 30.

[0030] Safety limiter system state information, i.e. which state the safety limiter system / the safety controller 300 is in, may be presented on a human-machine interface (HMI), such as a display apparatus 60 and / or the input apparatus 61. The safety limiter system state information may be provided to the operation station controller 120 and operating device 130 via the equipment controllers 410 and 510.

[0031] Furthermore, the equipment controllers 410 and 510 may utilize safety limiter system state information for internal logic. The safety limiter system, via the safety controller 300, may be operable in different operational states. For example, the safety controller 300 may be operable in one of the following states: “No protection”, “System Active” and “System Blocked”. The operator station 100 may be configured to allow an operator, such as the operator 77 in the driller’s cabin 36, to select or change the state of the safety controller 300. During normal operation, the safety controller 300 may be in the state “No protection”. The “No protection” state may be active during normal operations, with no personnel being present in a relevant high-risk zone, such as an operational zone of the equipment 400,500. The safety relay 420 is in this case closed, allowing the equipment controller 410 to control the oil supply valve 430. The motor speed limit signal 550 is inactive, resulting in the variable frequency drive 520 to operate on full speed potential, i.e. without restrictions imposed by the safety controller 300. The operator lamp 140 is non-active, e.g. not illuminated / dark. The floor traffic light 220 is activated with a non-entry signal, e.g. a red light, indicating that it is dangerous to enter the operational zone of the equipment 400 and 500. The equipment controllers 410 and 510 execute normal behaviour.

[0032] When the operator 77 activates the operator pushbutton 110, the safety controller 300 may change state to “System Active”. The transition from “No Protection” to “System Active”, or activation of “System Active”, happens when the operator 77 pushes the operator pushbutton 110. The equipment controllers 410 and 510 may keep their current operating state to be prepared for resuming operation later.

[0033] The “System Active” state may be active when personnel are present in the operational zone of the equipment 400 and 500. The equipment 400,500 is now blocked or operating at limited speed. The safety controller 300 may be configured to direct the safety relay 420 to be open, resulting in the oil supply valve 430 to close and bring equipment 400 into a non-operative state. Additionally, or alternatively, the motor speed limit signal 550 may be activated, resulting in the variable frequency drive 520 being directed to limit the speed of the motor 530 to a speed which is within a pre-determined safe range.

[0034] In the “System Active” state, the operator lamp 140 may be active, e.g. light up with a coloured (such as yellow) light, indicating that the function is active. The floor traffic light 220 may be operated to indicate a warning signal, e.g. to light up with a yellow light, indicating that it is permitted to enter the respective zone, such as the operational zone of the equipment 400 and 500. Optionally, an indication that the safety controller 300 is in the “System Active” state may be communicated in a different manner, such as verbally or by hand signals. In this manner, personnel may be informed that entering the respective zone is permitted.

[0035] The equipment controllers 410 and 510 may receive information about the safety limiter system state from the safety controller 300, and may be configured to act accordingly. The equipment controllers 410 and 510 may stay ready to resume the operations from before the “System Active” state was activated. Alarms normally triggered by limited or missing response in equipment 400,500 may, however, be disabled in “System Active” state by the equipment controllers 410 and 510.

[0036] Alternatively, the motor speed limit signal 550 can be operated to command the motor 530, via the variable frequency drive 520, to be stopped, i.e. inoperative, in the “System Active” state. Alternatively, or additionally, the safety relay 420 or associated instrumentation can activate a throttle (such as a throttle valve) to limit an operating speed of hydraulic equipment operatively connected to the hydraulic oil supply valve 430. The throttle may be arranged in conjunction with the hydraulic oil supply valve 430, in series therewith, or in parallel therewith. Alternatively, any other kind of de-energizing and limitation of speed or energy designed to prevent dangerous situations can be engaged in the “System Active” state.

[0037] In this manner, equipment 400,500 may, individually or collectively, be limited in their operation when the safety controller 300 is in the “System Active” state. Such limitation may be a reduced operating speed, or the equipment being made inoperable, i.e. stopped. Personnel may thereby enter and carry out work in a respective high-risk zone with lower safety risks.

[0038] The safety limiter system may be changed from the “System Active” state to the “No protection” state when personnel leave the respective zone(s), or when it otherwise is desirable to resume normal operation. The floor pushbutton 210 may be operatively connected to the safety controller 300 and permit personnel to signal, via the floor pushbutton 210, that the zone(s) are clear and the system 1 is ready to resume normal operation. The operator 77 may change to the “No protection” state and resume normal operation. The operator pushbutton 110 may be arranged to change the state in this manner upon activation. Optionally, system 1 may comprise different or separate pushbuttons or operator interfaces for the purpose of changing state. Alternatively, the personnel may indicate to the operator 77 that the state can be changed to “No protection” in a different manner, for example by direct verbal communication or hand signals, whereby the operator 77 can carry out this change. Alternatively, the personnel which have carried out work may change the state after having cleared the relevant zone(s), for example when the relevant personnel enters or returns to the driller’s cabin 36. As such, the floor pushbutton 210 may be optional.

[0039] Alternatively, a separate subsystem automatically detecting personnel in the dangerous area or any other dangerous situations may be configured to automatically change safety limiter system state to “System Active” without manual intervention. Such a separate subsystem may, for example, be a camera-based surveillance system at the drill floor 37 or an access control system for the drill floor 37, which is operable to indicate personnel and / or an irregular operational situation (e.g. an unexpected machine position in view of the operation being carried out, unexpected items or equipment present at the drill floor 37, etc.). In any example or embodiment described herein, the system 1 may thus comprise a risk detection subsystem, and the safety controller 300 may comprise an input operatively connected to the risk detection subsystem, and the safety controller 300 being configured to activate the “System Active” state if receiving a signal at the input indicative of a detected risk. The risk detection subsystem may be a personnel detection subsystem. Additionally, or alternatively, an automated change to “No protection” may be implemented, if the automated detection is considered to have sufficient safety level.

[0040] Upon change to the “No protection” state, the equipment controllers 410,510 may resume the status from before the safety limiter system was activated, i.e. normal operation. The normal operation may involve drilling operations controlled by the operator 77 and / or a drilling control system on the drilling rig 30.

[0041] The system 1 may optionally also comprise a safety controller block feature, in this example in the form of a block keyswitch 310. The block keyswitch 310 is operable to fully disable the safety controller 300, whereby the system 1 will operate as if no safety limiter system functionality existed. In this “System Blocked” state, e.g. when the block keyswitch 310 is open, the floor traffic light 220 may be permanently showing the non-entry signal, e.g. a red light, or may be switched off completely, indicating to personnel that the safety controller 300 is disabled.

[0042] The safety controller 300 may be operatively connected with the equipment controller(s) 410,510 and configured to communicate a signal indicative of the state to the equipment controller(s) 410,510. The equipment controller(s) 410,510 may be configured to suppress an alarm or error message relating to operational limitations of the equipment 400,500 while the communicated state is the “System Active” state. In this manner, alarms or error messages which would normally be triggered or issued by the equipment controller(s) 410,510 due to the equipment 400,500 being de-energised or operationally limited (e.g. due to reduced power availability or speed restrictions) can be temporarily muted.

[0043] In any of the examples or embodiments described or claimed herein, any one or more of the controller(s) 120, 300, 410 or 510 may be a programmable logic controller (PLC) or another type of computing device comprising a processor and memory (e.g. via a storage medium as described below) executing software instructions. The controllers may be integrated with a common (i.e., the same) microprocessor-based infrastructure, e.g. the same computing device, where software modules are provided for carrying out the respective control functions. The system 1 may comprise hardware and software modules for the above-mentioned purposes, or it may be implemented in the form of software module(s) operating on other hardware, such as computing hardware shared with other functionality on the drilling rig 30. The system 1 and / or the safety limiter system may, for example, share hardware (e.g. microprocessor-based computing infrastructure) with a general drilling control system which is operable to control other aspects of or other equipment on the drilling rig 30. The safety controller 300 may be a safety certified control unit with sufficient safety level to execute the protection. The control unit may be a safety PLC, a programmable safety relay or a certified micro controller based device.

[0044] As used herein, the term software module may comprise computer -executable instructions stored in the memory of the controller or computing device, which, when executed by the processor, perform specific functions such as processing update messages, interfacing with a database, and managing the display of information; these instructions may be organized into components or layers, such as data access layers, business logic layers, and user interface layers, and may be developed using programming languages like C++, Java, or Python. The processor may be a microprocessor or microcontroller, such as an ARM Cortex -M series, an Intel x86 processor, or a digital signal processor (DSP), capable of executing software instructions stored in memory; it may perform functions like receiving update messages, processing data, and controlling interactions with the database and other components, and may include or be connected to associated hardware components such as storage medium units (RAM, ROM, flash storage), communication interfaces (Ethernet ports, serial interfaces, wireless modules), and bus systems for facilitating data exchange within the system 1.

[0045] In any of the examples or embodiments described or claimed herein, the system 1 may be adapted to display to an operator 77 the state of the safety controller 300 via the display apparatus 60. The display apparatus 60 may for this purpose comprise a graphical user interface (GUI) displayed on a monitor, touchscreen, or other visual display units such as liquid crystal displays (LCDs) or light-emitting diode (LED) screens, which are operatively connected to or within the system 1. The display may be in real-time.

[0046] The operator pushbutton 110 and / or the floor pushbutton 210 may alternatively be implemented as a different form of input device which enables operator interaction, such as buttons, switches, touchscreen features, voice commands, or other control mechanisms.

[0047] The operator lamp 140 and / or the floor traffic light 220 may alternatively be implemented as a different form of visual indicator for operator notification or information, such as an information screen, a light signal, a movable physical signpost or indicator, or another type of visual cue or signalling device.

[0048] In any of the examples or embodiments described or claimed herein, the safety controller 300 and associated components may have an enhanced safety certification compared to the operating device 130. In this manner, the safety controller 300 may be configured with an appropriate safety level for personnel protection, even if this safety level is not present in the operating device 130. The operator pushbutton 110 and / or the floor pushbutton 210 may for example be manual components, and not implemented via touchscreens of software controls. An operational interface of the operator pushbutton 110 may be separate from the operating device 130.

[0049] Alternatively, the operational interface of the operator pushbutton 110 may be integrated in the operating device 130, for example arranged in a driller’s cabin control interface comprising the display apparatus 60 and / or the input apparatus 61. In any of the examples or embodiments described or claimed herein, the safety controller 300 may be isolated from the operator station controller 120 and the equipment controller(s) 410,510 in such a way that the safety controller 300 does not accept any operative input from the operator station controller 120 or the equipment controller(s) 410,510. The operator station controller 120 and the equipment controller(s) 410,510 are thereby not able to override or influence the operation of the safety controller 300. The safety controller 300 may be configured to only accept operative input signals from the pushbutton(s) 110,120. The pushbutton(s) 110,120 may be configured with the same safety certification as the safety controller 300.

[0050] A system 1 according to examples and embodiments described herein can provide enhanced safety during operation of industrial plants such as drilling rigs 30, for example during critical operations such as manual work by personnel in high-risk zones on the drilling rig 30, such as at or around the drill floor 37. For such situations, individual machines (or groups of machines) may be put in a non-active mode, i.e. be made temporarily inoperable by the equipment controller, or may be put in a reduced operating mode, for example a reduced speed mode (e.g. only permitting the machine to run in “creep speed” while manual work is being carried out near the machine).

[0051] The system 1 may be retrofittable in existing drilling rigs 30 without or with only minor adaptions of existing equipment. For example may in a retrofit arrangement the main parts of the operator station 100, equipment controller(s) 410,510, etc. in an existing drilling rig system be left substantially unmodified, and the safety controller 300 and associated components retrofitted. The system 1 may alternatively be incorporated in newbuilds. The operator pushbutton 110 and / or the operator lamp 140 may be arranged to be independent of the operating device 130. Alternatively, the operator pushbutton 110 and / or the operator lamp 140 may be incorporated into the operating device 130.

[0052] Further inventive examples and embodiments are outlined in the following numbered clauses.

[0053] 1. A system (1) for an industrial plant, the system (1) comprising equipment (400,500) operated by an equipment controller (410,510),

[0054] the system (1) comprising an operator station (100) including an operator station controller (120) and an operating device (130) comprising a control interface (60,61) for an operator (77);

[0055] wherein the equipment controller (410,510) is operatively connected to the operator station controller (120) and configured to control operation of the equipment (400,500);

[0056] and wherein the system (1) further comprises

[0057] a safety controller (300) configured to manipulate an actuation signal between the equipment controller (410,510) and an actuator (430,530) forming part of the equipment (400,500).

[0058] 2. The system (1) of any preceding clause, wherein the safety controller (300) is configured to operate in at least two states, the two states being a normal operation state and a safety active state,

[0059] wherein in the normal operation state, the safety controller (300) is configured not to manipulate the actuation signal,

[0060] and in the safety active state, the safety controller (300) is configured to block or limit operation of the equipment (400,500), for example such as to allow safe entry of personnel into a high-risk area associated with the equipment (400,500).

[0061] 3. The system (1) of any preceding clause, wherein the safety controller (300) is operable independently of the operator station controller (120) and / or the equipment controller (410,510).

[0062] 4. The system (1) of any preceding clause, wherein the safety controller (300) is isolated from the operator station controller (120) and the equipment controller (410,510) in such a way that the safety controller (300) does not accept any operative input from the operator station controller (120) or the equipment controller (410,510).

[0063] The system (1) of any preceding clause, the system (1) further comprising an operator input device, such as an operator pushbutton (110), operatively connected to the safety controller (300), and wherein the safety controller (300) is configured to transition between the normal operation state and the safety active state in response to activation of the operator input device. The system (1) of any preceding clause, comprising an operator visual indicator, such as an operator lamp (140), operatively connected to the safety controller (300), and wherein the safety controller (300) is configured to provide a visual indication of the state via the operator visual indicator. The system (1) of any preceding clause, wherein the operator visual indicator is independent of the operating device (130).

[0064] The system (1) of any preceding clause, wherein the control interface (60,61) is operatively connected to the operating device (130), providing an integrated workstation for the operator (77).

[0065] The system (1) of any preceding clause, wherein the operating device (130) includes a display apparatus (60) and an input apparatus (61).

[0066] The system (1) of any preceding clause, wherein the safety controller (300) is operable to close or limit a hydraulic supply to an hydraulic actuator (430), for example to close the hydraulic supply and bring hydraulic equipment (400) associated with the hydraulic actuator (430) into a nonoperative state, or to reduce a hydraulic supply rate to the hydraulic actuator (430) such as to limit an operating speed of the hydraulic equipment (400) associated with the hydraulic actuator (430).

[0067] The system (1) of any preceding clause, wherein the safety controller (300) is operable to manipulate an electric control of an electric actuator (530), for example to stop and bring electric equipment (500) associated with the electric actuator (530) into a non-operative state, or to reduce an operating speed of the electric equipment (500) associated with the electric actuator (530).

[0068] The system (1) of any preceding clause, wherein the safety controller (300) is operable to send a motor speed limit signal (550) to a variable frequency drive (520) to limit the speed of an electric motor (530) operating the equipment (500).

[0069] 13. The system (1) of any preceding clause, wherein the safety controller (300) is further configured to transition back to the normal operation state upon receiving a signal indicating personnel have exited the high-risk area, the signal being generated by activation of a floor input device, such as a floor pushbutton (210), or by activation of the operator input device.

[0070] 14. The system (1) of any preceding clause, further comprising a floor visual indicator, such as a floor traffic light (220), wherein the safety controller (300) is configured to provide an indication on the floor visual indicator corresponding to the state,

[0071] for example such that in the safety active state, the floor visual indicator indicates that personnel are permitted to enter the high-risk area and / or in the normal operation state the floor visual indicator indicates a non-entry signal.

[0072] 15. The system (1) of any preceding clause, further comprising a block keyswitch (310) operable to disable the safety controller (300), for example wherein upon disabling, the safety controller (300) prevents activation of the safety active state.

[0073] 16. The system (1) of any preceding clause, wherein the safety controller (300) is operable in a further state, a blocked state, wherein the safety controller (300) is fully disabled, preventing activation of the safety active state.

[0074] 17. The system (1) of any preceding clause, wherein in the blocked state, the floor visual indicator is configured to indicate a non-entry signal.

[0075] 18. The system (1) of any preceding clause, wherein the safety controller (300) is operatively connected with the equipment controller (410,510) and configured to communicate a signal indicative of the state to the equipment controller (410,510), and the equipment controller (410,510) is configured to suppress an alarm or error message relating to operational limitations of the equipment (400,500) while the communicated state is the safety active state.

[0076] 19. The system (1) of any preceding clause, comprising a plurality of equipment controllers (410,510). 20. The system (1) of any preceding clause, wherein the industrial plant is a drilling rig (30) and the operating device (130) is located in a driller’s cabin (36) arranged adjacent a drill floor (37) on the drilling rig (30).

[0077] 21. The system (1) of any preceding clause, wherein the operator input device is located in a driller’s cabin (36) on a drilling rig (30).

[0078] 22. The system (1) of any preceding clause, wherein the operator visual indicator is located in a driller’s cabin (36) on a drilling rig (30).

[0079] 23. The system (1) of any preceding clause, wherein the floor input device is located outside a driller’s cabin (36) on a drilling rig (30).

[0080] 24. The system (1) of any preceding clause, wherein the equipment (400,500) comprises machines operable on the drill floor (37).

[0081] 25. A method of upgrading an industrial plant comprising equipment (400,500) operated by an equipment controller (410,510), the method comprising retrofitting a safety controller (300) to the industrial plant to produce a system (1) according to any preceding clause or according to any example or embodiment described above in the industrial plant.

[0082] 26. The method of any preceding clause, wherein the industrial plant is a drilling rig (30).

[0083] 27. The method of any preceding clause, wherein the step of retrofitting the system (1) comprises retrofitting the system (1) without modification of the equipment controllers (410, 510).

[0084] The invention is not limited to the embodiments described herein; reference should be had to the appended claims.

Claims

CLAIMS1. A system (1) for a drilling rig (30), the system (1) comprising equipment (400,500) operated by an equipment controller (410,510), the equipment (400.500) comprising machines operable on a drill floor (37) on the drilling rig (30),the system (1) comprising an operator station (100) including an operator station controller (120) and an operating device (130) comprising a control interface (60,61) for an operator (77), the operating device (130) being located in a driller’s cabin (36) arranged adjacent the drill floor (37);wherein the equipment controller (410,510) is operatively connected to the operator station controller (120) and configured to control operation of the equipment (400,500);and wherein the system (1) further comprisesa safety controller (300) configured to manipulate an actuation signal between the equipment controller (410,510) and an actuator (430,530) forming part of the equipment (400,500).

2. The system (1) of claim 1, wherein the safety controller (300) is configured to operate in at least two states, the two states being a normal operation state and a safety active state,wherein in the normal operation state, the safety controller (300) is configured not to manipulate the actuation signal,and in the safety active state, the safety controller (300) is configured to block or limit operation of the equipment (400,500) such as to allow safe entry of personnel into a high-risk area associated with the equipment (400.500).

3. The system (1) of claim 2, the system (1) further comprising an operator input device (110), operatively connected to the safety controller (300), and wherein the safety controller (300) is configured to transition between the normal operation state and the safety active state in response to activation of the operator input device (HO).

4. The system (1) of claim 2 or 3, comprising an operator visual indicator (140) operatively connected to the safety controller (300), and wherein the safety controller (300) is configured to provide a visual indication of the state via the operator visual indicator (140).

5. The system (1) of any preceding claim, wherein the equipment (400,500) comprises hydraulic equipment (400) and the safety controller (300) is operable to close or limit a hydraulic supply to an hydraulic actuator (430) of the hydraulic equipment (400).

6. The system (1) of any preceding claim, wherein the equipment (400,500) comprises electric equipment (500) and the safety controller (300) is operable to manipulate an electric control of an electric actuator (530) of the electric equipment (500).

7. The system (1) of claim 6, wherein the safety controller (300) is operable to send a motor speed limit signal (550) to a variable frequency drive (520) to limit the speed of an electric motor (530) operating the electric equipment (500).

8. The system (1) of claim 2, 3 or 4, the system (1) comprising a floor input device (210) and wherein the safety controller (300) is configured to transition back to the normal operation state upon receiving a signal indicating personnel have exited the high-risk area, the signal being generated by activation of the floor input device (210).

9. The system (1) of claim 2, 3 or 4, further comprising a floor visual indicator (220), wherein the safety controller (300) is configured to provide an indication on the floor visual indicator (220) corresponding to the state such that in the safety active state, the floor visual indicator (220) indicates that personnel are permitted to enter the high-risk area and in the normal operation state the floor visual indicator indicates a non-entry signal.

10. The system (1) of any preceding claim, further comprising a block keyswitch (310) operable to disable the safety controller (300).

11. The system (1) of claim 2, 3 or 4, wherein the safety controller (300) is operatively connected with the equipment controller (410,510) and configured to communicate a signal indicative of the state to the equipment controller (410,510), and the equipment controller (410,510) is configured to suppress an alarm or error message relating to operational limitations of the equipment (400,500) while the communicated state is the safety active state.

12. The system (1) of any preceding claim, wherein the safety controller (300) is isolated from the operator station controller (120) and the equipment controller (410,510) in such a way that the safety controller (300) does not accept any operative input from the operator station controller (120) or the equipment controller (410,510).

13. A method of upgrading a drilling rig (30) comprising equipment (400,500) operated by an equipment controller (410,510), the method comprising retrofitting a safety controller (300) to the drilling rig (30) to produce a system (1) according to any preceding claim at the drilling rig (30).

14. The method of claim 13, wherein the step of retrofitting the system (1) comprises retrofitting the system (1) without modification of the equipment controllers (410, 510).

Images