Wellhead Control Panel Product

Overview

A producing oil or gas well is held open on purpose. The safety valves on a modern wellhead — the surface safety valve (SSV) in the vertical run, the wing valve on the flowline, and the subsurface safety valve (SCSSV) far down the tubing — are all spring-loaded to slam shut, and only continuous hydraulic pressure on their actuators keeps them open. The wellhead control panel is the cabinet beside the tree that supplies that pressure, and more importantly, takes it away the instant something goes wrong. Lose the panel's permissive — high or low flowline pressure, fire at the wellsite, a struck pushbutton, or a trip from the field ESD system — and the well shuts itself in within seconds, with no electricity required.

The architecture is fail-safe throughout. The panel does not act to close the well; it merely stops holding it open. Every failure mode — leaking tubing, dead air supply, melted fusible plug, broken pilot line — bleeds pressure and therefore closes valves. This logic, codified in API RP 14C and ISO 10418, is why a panel built mostly of tubing, pilots, and relay valves remains the standard even on instrumented fields.

How it works

Hydraulic pressure originates in the Hydraulic Pump Section section. The Air-Driven Hydraulic Pump is an air-driven intensifier: instrument air at 100 psig works on a large-area piston driving a small-area plunger, multiplying pressure by ratios up to 60:1 to reach the 3,000–5,000 psi a surface actuator needs, or 10,000 psi for the SCSSV circuit. Its defining habit is stalling — when output pressure balances the air drive, the pump simply stops, and it strokes again automatically the moment downstream pressure decays. No pressure switch or motor starter is involved. The Air Supply Regulator therefore sets the system pressure, and the Hand Pump charges the system during commissioning or air outages. Fluid comes from the Reservoir Tank, returns through the Return Filter, and the Accumulator Bottle smooths pump cycling while reserving enough volume for a valve stroke with the air supply dead.

Each controlled valve has its own loop through the ESD Logic Section. Supply pressure reaches the actuator through a Quick-Dump Relay Valve — a quick-dump valve held open by a pilot signal. The pilot header is the panel's nervous system: it ties together the Hi-Lo Pressure Pilot sensors on the flowline, the Fusible Plug Loop, the ESD Pushbutton stations, and any remote trip input. Vent that header anywhere and the relay valve dumps the actuator line to tank, the spring drives the gate closed, and the well is shut in — typically in under 45 seconds including the SCSSV.

The Hi-Lo pilots deserve explanation because they embody the protective philosophy. The high-pressure pilot trips if flowline pressure rises above setpoint, protecting downstream equipment from a blocked outlet. The low-pressure pilot trips if pressure falls below its setpoint — the signature of a ruptured flowline dumping the well to atmosphere. Between them, a pipeline break in either direction shuts the well without any human or computer in the loop. The Fusible Plug Loop adds fire detection the same way: a small pressurized loop of tubing strung over the wellhead, fitted with eutectic plugs that melt at 99 °C and vent the loop.

Sequencing, reset, and interface

Shut-in order matters. The panel closes the wing valve and SSV first and delays the SCSSV by 30–60 seconds, because the downhole valve is a last line of defense with a finite slam-cycle life; routine trips should never exercise it under flow. On restart the sequence reverses, and every loop requires a deliberate hand on its Manual Reset Valve — a panel never re-opens a well automatically. The First-Out Indicator annunciator latches which pilot initiated the trip, sparing the operator a guessing game at a tripped wellsite.

Where a SCADA or station ESD system supervises the field, the Solenoid Valve Section provides the electrical interface: Ex-rated Solenoid Pilot Valve cartridges on the Valve Manifold Block, energized to permit flow and de-energized to trip, preserving fail-safe behavior through any power loss. Pressure Sensor transmitters report supply and actuator pressures back to the host, while glycerine-filled Panel Gauge dials behind the Cabinet Door window give the field operator the same picture without opening the cabinet.

Construction is dominated by corrosion service: 316 stainless Enclosure, Instrument Tubing with twin-ferrule compression fittings throughout, and a Drip Tray for containment. Panels for offshore or sour-gas wellsites upgrade trim materials per NACE MR0175. Function testing follows API 6A and operator policy — typically a full trip test of every pilot and the fusible loop at intervals of one to six months, with valve closure times logged against the original acceptance values.