Wellhead Control Panels Explained: SCSSV, Master and Wing Valve Sequencing

4 days ago

5 min read

This guide is for production engineers, instrument leads and project buyers who need to specify, review or troubleshoot a wellhead control panel (WHCP). The panel has one job: keep the well's safety valves open while it is safe to produce, and close them in the right order, every time, when it is not. Most of the problems we see in enquiries come from a vague shutdown philosophy rather than from the hardware, so this article starts with the valves and the sequence, then works back to what sits inside the panel.

The three valves a wellhead control panel operates

A typical producing well has three automated barriers between the reservoir and the flowline:

SCSSV: the surface-controlled subsurface safety valve, installed in the tubing below the wellhead. A hydraulic control line from the panel holds its flapper open; bleed the line and a spring closes it. It is the last line of defence if the wellhead itself is damaged.
Master valve (SSV): the actuated master valve on the christmas tree, which usually serves as the surface safety valve. Hydraulic pressure holds the gate open against a spring.
Wing valve: the actuated production wing valve, also spring-return, which is the valve that starts and stops flow into the flowline.

Some trees add a second actuated master, a kill wing or an actuated choke. The panel logic grows with each one, so list every actuated valve, its actuator swept volume and its operating pressure in the enquiry. API 6A covers wellhead and tree equipment, including surface safety valves and their actuators, and API RP 14B covers subsurface safety valve systems. Confirm the relevant clauses against the current editions your company standard calls up.

Opening sequence: bottom up

Wells are opened from the bottom up: SCSSV first, then the master valve, then the wing valve. The SCSSV opens against a closed tree, so pressure can be equalised across its flapper before it moves, and the master then opens against a closed wing with no flow through it. Only when both barriers are open and confirmed does the wing valve open and put the well on line, normally against a choke set to bring the well up gradually.

Good panels enforce this with permissives: the master valve cannot be opened until SCSSV control pressure is established, and the wing cannot be opened until the master is open. Each well module carries a manual latch reset, so after any trip an operator must physically reset the well at the panel. Nothing reopens on its own when the trip clears.

Shut-in sequence: top down, with delays

Shut-in is the reverse: wing valve first, then the master after a time delay, then the SCSSV after a further delay. The reasoning is about wear and barrier integrity:

The wing valve stops the flow. It closes against full flow and differential pressure, takes the erosion, and is the easiest valve on the tree to maintain or replace.
The master valve closes a few seconds later against a static, no-flow condition, so its gate and seats stay in good condition and it remains a dependable barrier.
The SCSSV closes last, against a column that is no longer flowing. Slamming a flapper shut against a flowing well is a common route to a damaged valve and a costly workover.

Delays are typically set with needle valves and volume chambers in a hydraulic or pneumatic panel, or with timers in a PLC. The values come from the operator's shutdown philosophy and the valve makers' guidance. Agree them at the design review, not at commissioning, and make sure they are written into the cause-and-effect matrix.

What trips the well

A wellhead control panel typically accepts these shutdown inputs:

Local and remote ESD push buttons.
A fusible-plug fire loop: a pressurised tubing loop around the wellhead with plugs that melt in a fire, venting the loop and tripping the well.
High and low flowline pressure pilots. High pressure points to a blocked or closed downstream valve; low pressure points to a leak or a line rupture.
Shutdown commands from the DCS or SCADA system, often through an RTU.
Loss of hydraulic or pneumatic supply pressure, which closes the valves by design.

These inputs map to shutdown levels. A common arrangement is a process shutdown (PSD) that closes the wing valve, and sometimes the master, so the well can be restarted quickly; an emergency shutdown (ESD) that closes wing, master and then SCSSV in sequence; and a fire shutdown that closes everything, often with shortened delays. API RP 14C describes the analysis behind safety systems of this kind in general terms. Your cause-and-effect matrix should state which input drives which level.

Fail-safe by design

Every actuated valve on the well is spring-to-close and held open by hydraulic pressure. That single principle drives most of the panel design. Loss of the pump, loss of power, a cut control line or a burst hose all bleed pressure, and the springs close the valves. The panel never needs to do anything active to make the well safe; it only needs to stop holding the valves open. When you review a design, check that no single failure, such as a stuck regulator or a plugged vent, can trap pressure and keep a valve open after a trip.

Inside the panel

Reservoir: stainless steel, with level gauge, low-level switch, breather and drain.
Pumps: air- or gas-driven, electric, or both, plus a hand pump for start-up and backup.
Accumulators: store hydraulic energy so the valves stay open through pump cycling and short supply interruptions.
Regulators: separate pressure headers for the SCSSV and the surface valves, because the SCSSV usually needs a higher control pressure, set by its depth and the shut-in tubing pressure.
Relief valves: one on each pressure header to protect tubing, actuators and control lines.
Filters: on pump discharge and return, to protect pilots, relays and actuator seals.
Well modules: one per well, with control valves, sequencing, latch reset, gauges and pressure switches or transmitters for remote status.

What to put in your specification

Number of wells now, and spare well slots for future wells.
Actuated valves per well, with actuator swept volume and operating and maximum pressures.
SCSSV setting depth, control pressure and maximum shut-in tubing pressure.
Shutdown levels, the cause-and-effect matrix and the required sequencing delays.
Trip inputs: number of ESD stations, fusible loops and flowline pilots.
Available utilities: instrument air, sweet gas, mains power or solar.
Hazardous area classification, ambient temperature range and enclosure material.
Signals to SCADA, the distance to each wellhead and the control-line tubing size.

If you are still choosing a panel type, our comparison of hydro-pneumatic and electro-hydraulic panels and our guide to single-well versus multi-well panels cover the trade-offs.

Get a panel designed around your shutdown philosophy

We design wellhead control panels in Vaughan, Canada and build them in Chennai, India: hydro-pneumatic, electro-hydraulic and multi-well panels, with EN 10204 3.1 material certificates and NACE MR0175/ISO 15156 materials where the service needs them. Every panel goes through a factory acceptance test witnessed by the client or a third-party inspector, where each shutdown level and delay is demonstrated. Browse our wellhead control panels and the full oil and gas systems range. Send your well data and cause-and-effect matrix to mail@techincresearch.com or call +91 739 749 8656 and we will return a P&ID, GA drawing and priced offer.