Remote wellhead, pipeline pressure and cathodic protection monitoring

At a glance

Item	Typical answer
Problem	Wellheads, block valve stations and cathodic protection rectifiers are spread over tens or hundreds of kilometres. Many have no telemetry, and the rest report to separate systems, so pressures, stopped wells and CP faults are found on driving rounds.
What is connected	Wellhead pressures and temperatures, flow computer values, pumpjack controllers, ESD valve positions, valve station pressures and valve states, CP rectifier outputs and test-post potentials, solar and battery health.
Who uses it	Field operators, production engineers, the pipeline integrity and CP team, the operations control room and contractors who maintain CP.
Typical first scope	Five to ten wells on one pad or gathering system, two valve stations and ten CP points, read-only.
Time to first screen	Typically days for a wellhead with an existing flow computer. Budget six to eight weeks for a pilot including a LoRaWAN coverage survey and solar sizing.

The situation

An onshore field has flowing wells and wells on rod pumps, each with a few pressure gauges, a choke, sometimes a flow computer and a chemical injection pump. Gathering lines bring production to a station; a transmission or export pipeline runs on with block valve stations every few tens of kilometres. The line is protected by impressed-current cathodic protection: rectifiers feeding groundbeds, and test posts where potentials are surveyed.

Larger operators run a pipeline SCADA on the main line, but most wells, small valve stations and nearly all CP equipment are visited by people. A rod pump that stopped on Friday is found on Monday. A rectifier that lost its AC supply leaves a section unprotected until the monthly reading. A slow pressure drop on a gathering line is noticed when the station's intake falls. Each round costs vehicle hours, often on poor roads and in heat, and every visit is a driving risk.

The goal is a light, low-power layer over the field: pressures and states from every remote point on one platform, alarms routed to the person who can drive out, and history that production and integrity engineers can use. It works beside an existing pipeline SCADA, not in place of it.

Goals and measures

• Well uptime = hours the well is producing ÷ hours in the period. Producing is taken from the pumpjack running state, or from flowline pressure above a set value for flowing wells.
• Deferred production indicator = sum of downtime hours × the well's expected rate (an attribute). An estimate to rank wells, not an allocation figure.
• Time to detect a stopped well = time from stop to the first alarm notification. With five-minute reporting it falls from days to minutes.
• Pressure excursions = count and duration of readings above the line's operating limit (attribute) per segment per month.
• CP protection ratio = test posts meeting your criterion (for example an instant-off potential more negative than −850 mV against a copper sulphate electrode; use your own) ÷ posts measured.
• Rectifier availability = hours with AC present and output within range ÷ hours in the period.
• Data availability per site, to spot weak radio links and failing solar systems.

One-minute, hourly and daily aggregates are kept for every numeric key, so uptime and daily minimum pressures come straight from stored data. Send states such as pump_run and rect_ac_ok as 0/1 numbers, not true/false, so hourly averages give hours running or available.

Architecture

Three kinds of sites share one platform:

• Wellhead or pad. A licensed 4G gateway running Hermetry Edge in the wellsite enclosure reads the flow computer or RTU and the rod pump controller over Modbus RTU (RS485) or Modbus TCP, a pressure transmitter or two on its analog inputs, and the ESD valve limit switches and intrusion contact on its digital inputs. A gateway such as the Edge Pro LTE8421 has 8 digital inputs and 2 analog inputs; more analog points need a Modbus I/O module.
• Block valve station. The same gateway reads upstream and downstream pressure, valve open and closed limits and the actuator's fault contact, and the station's solar charge controller if it has Modbus.
• Line points and CP. Battery LoRaWAN pressure sensors on taps along the line, and rectifier monitoring units with Modbus or analog outputs. Where a LoRaWAN gateway at a valve station covers them, the sensors join Hermetry's own LoRaWAN network server; elsewhere, a low-power cellular gateway (NB-IoT or Cat-M1 models exist in the licensed devices list) can carry a rectifier's readings.

Component	Role	Notes
Licensed 4G or 5G gateway with Edge	Reads Modbus, contacts and analog inputs; publishes over MQTT with TLS	One per pad or valve station. Factory identity, X.509 certificate, claimed by the operator.
Low-power cellular gateway	Rectifier sites with poor power	NB-IoT or Cat-M1; check the model's inputs for your signals.
LoRaWAN gateway	Covers pressure sensors along the line	Basics Station, EU868; gateway health reported as telemetry.
LoRaWAN pipe pressure sensor	Line pressure at taps	Battery, OTAA, class A. Decoded by a library codec; keys normalised in the root flow.
Flow computer or RTU	Flow, totals, wellhead values	Stays the reference for measurement; read-only.
Rod pump controller	Strokes per minute, run state, motor current	Read-only over Modbus where the controller exposes a map.
CP rectifier monitoring unit	Output voltage and current, AC present, potentials	Modbus or analog; instant-off values only if the unit interrupts.
Solar and battery system	Site power	Sized by your electrical engineer; battery voltage monitored.
SIMs and routers	Uplink	Your own operator and SIMs today. eSIM management is in development (Hermetry Connect).

Every site makes one outbound connection; no inbound ports are opened in the field. Profiles require TLS 1.2 or later and can limit source networks, which suits a private APN with known address ranges. Equipment in classified areas around the wellhead must carry the right certification for the zone; settle placement with the HSE team before ordering hardware.

Point list

Representative points for a rod-pumped well, a flowing well, a valve station and a CP rectifier. Registers come from your controllers' maps; intervals are starting values chosen for cellular data and battery life.

Point	Telemetry key	Unit	Source	Interval	Notes
Tubing pressure	tubing_bar	bar	4-20 mA transmitter, gateway AI1	5 min	Range in the profile matches the transmitter.
Casing pressure	casing_bar	bar	4-20 mA transmitter, gateway AI2	5 min
Flowline pressure	flowline_bar	bar	Flow computer, Modbus	5 min	Producing indicator for flowing wells.
Flowline temperature	flowline_temp_c	°C	Flow computer	5 min
Gas flow rate	gas_flow_sm3d	Sm³/d	Flow computer	5 min	Reference value stays in the flow computer.
Gas volume today	gas_today_sm3	Sm³	Flow computer contract-day total	15 min	Read the total; do not integrate the rate.
ESD valve closed	esd_closed	bool	Limit switch, DI1	on change	Indication only.
Pumpjack running	pump_run	0/1	Rod pump controller or run contact	on change	Plus a 15 min heartbeat.
Strokes per minute	spm	1/min	Rod pump controller	5 min
Motor current	motor_a	A	Controller or current transducer	5 min
Pump fillage	fillage_pct	%	Rod pump controller, if it computes it	15 min	Optional; controller-dependent.
Chemical tank level	chem_level_pct	%	Level sensor, Modbus or AI	30 min
Chemical pump running	chem_run	bool	Run contact, DI2	on change
Site battery voltage	batt_v	V	Charge controller or gateway	15 min	Early warning of solar failure.
Enclosure door	door_open	bool	Reed contact, DI3	on change
Valve station upstream pressure	up_bar	bar	Transmitter	60 s	Valve station profile.
Valve station downstream pressure	down_bar	bar	Transmitter	60 s
Line valve open / closed	valve_open, valve_closed	bool	Limit switches	on change	Both, so travel and disagreement are visible.
Pressure fall rate	dp_rate_bar_min	bar/min	Derived in the root flow from down_bar	60 s	Stored as its own key.
Line tap pressure	pressure_bar	bar	LoRaWAN pipe pressure sensor	15 min	Battery and signal keys come with it.
Rectifier output voltage	rect_v	V	Rectifier monitoring unit	15 min	Rectifier profile.
Rectifier output current	rect_a	A	Rectifier monitoring unit	15 min
Rectifier AC present	rect_ac_ok	0/1	Unit or contact	on change
Pipe-to-soil potential, instant off	psp_off_mv	mV	Unit with interruption cycle	daily	Only where the unit can interrupt.

LoRaWAN codecs name their outputs the vendor's way. Rename them to pressure_bar and battery in the profile's root flow, or save a copy of the codec with your names, so line points of different makes share one profile and one set of rules.

Asset model

• Field (free kind) with operator_area and time zone.
• Pad or well (Site) with location, well_type (rod pump or flowing), expected_rate_sm3d, shut_in_limit_bar and criticality.
• Pipeline (free kind) with maop_bar, diameter_mm and product.
• Segment (Area) between two valve stations, with kp_from_km and kp_to_km.
• Valve station (Site) with kp_km, location and has_solar.
• CP system (Other) under the segment, with rectifiers and test posts as children, each with kp_km and the criterion cp_limit_mv.

Add Feeds relations from wells to the gathering line and from segment to segment so a drill-down follows the flow. Placement decides which site's status and alarm counts a device feeds into and which Rules-card rules may act on it. Per-device limits (hi_bar, lo_bar, cp_limit_mv) are server attributes on the devices, so the alarm rules on each profile stay identical.

Device setup

Profiles

Create Wellhead, rod pump, Wellhead, flowing, Valve station, CP rectifier and Line pressure point (LoRaWAN). Use the Recent message online rule everywhere, with expected intervals that match each heartbeat: 15 minutes for wells, 5 minutes for valve stations, the uplink period for LoRaWAN sensors. A device that is quiet for longer than interval × factor goes offline and raises its inactivity alarm.

Provisioning

Gateways are claimed with their factory identity before they leave the warehouse: scan the code, pick the profile and name the device after the well or station. The installer only mounts and powers it. LoRaWAN sensors are added with their join keys, singly or by batch import, on the built-in LoRaWAN profile type, with the codec chosen per model.

Intervals, report by exception and data use

Cellular data and solar power are the constraints. Send contacts on change with a heartbeat, analog values on a slower fixed interval, and use a deadband where the gateway model supports one (for example 0.2 bar on pressures). If it does not, a report-by-exception block in the root flow stops small changes from being stored, though they still travel over the link. Measure the real data use on the pilot before choosing SIM plans. Remote device settings change intervals and deadbands on licensed gateways one by one or as a baseline in waves; a change that is not applied within 7 days expires.

Derived pressure-fall rate

A pressure that falls quickly at a valve station matters more than a value under a fixed limit. In the valve station profile's root flow, a delta block takes the change of down_bar since the previous reading, a short script divides it by the minutes between the readings, and a save-telemetry block stores dp_rate_bar_min. An alarm rule then compares that key with a limit.

Time, buffering and firmware

Gateways should synchronise their clocks over the network; a device that cannot keep time omits ts and lets Hermetry stamp arrival. Licensed gateways can buffer readings during cellular gaps, with a capacity that depends on the model; buffered readings are stored with their own time stamps and alarm rules evaluate them as backfill, marked Backfilled, without late paging. Firmware is signed and rolled out in waves; devices on metered links wait unless metered downloads are allowed, so plan updates for sites on fixed links or allow them deliberately per wave.

Dashboards

Board	Audience	Widgets and what they show
Field map	Control room, field supervisors	Map on satellite tiles with every well, valve station and rectifier coloured by status; stat cards for wells producing, wells down and open Critical alarms; alarm table; device table sorted by last seen.
Well page	Field operators, production engineers	Opened by clicking a well. Gauges for tubing, casing and flowline pressure; state cards for pump and ESD valve; line chart of pressures and strokes per minute over 7 days; stat with trend for today's gas against the previous period; the well's drawing and alarm history.
Pipeline	Integrity team, control room	Table of valve stations sorted by kilometre post with upstream and downstream pressure, valve state and last reading; line chart of all stations' downstream pressure over 24 hours; line chart of dp_rate_bar_min.
Cathodic protection	CP engineer, contractor	Table of rectifiers with voltage, current, AC state and last reading, exportable to Excel; table of test posts with the latest instant-off potential against cp_limit_mv; stat card counting posts outside criterion (compute script on the card); bar chart of daily rectifier current.
Site health	Telemetry technicians	Battery voltage of every solar site; LoRaWAN gateway health; device table with online state and last seen; heatmap of messages per hour to show weak links.

Entity parameters make the well page and the valve station page one board each for the whole field. The field map can run on a control-room screen through a read-only display link.

SCADA screens

Draw one screen per site type. The wellhead drawing places the wellhead (christmas tree) symbol, the pumpjack or the flowline, the emergency shutdown valve, chemical injection skid, a three-phase separator if the pad has one, and pressure transmitter symbols on the lines. The valve station drawing uses the valve manifold, pig launcher and receiver or scraper trap, the line valve, metering skid and pressure transmitters. These come from the Oil & gas pack, which also holds gas network symbols such as the pressure reduction station, filter separator and odorizer; instruments come from the Process pack's ISA family.

• States: the pumpjack symbol animates while pump_run is 1 and shows fault colour when the controller reports one; the ESD valve shows closed from esd_closed; the line valve shows open, closed or travelling from the two limits.
• Second readings: transmitters print their pressures; the wellhead prints today's gas volume.
• Rules on symbols: a rule turns a pressure label red above the device's limit and blinks a valve whose two limits disagree.
• Reuse: attach the wellhead drawing as a view on the wellhead profile, so every well gets its own bound view; Match everything proposes bindings for unbound symbols.

Rules and alarms

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Well stopped	Rod pump profile: pump_run == 0. Flowing profile: flowline_bar < attribute lo_bar	Debounce 2 samples	Major	Field operators of the area, push and SMS	Reminder every 60 min until acknowledged
Tubing pressure high	tubing_bar >= attribute hi_bar	Debounce 2 samples; hysteresis 2 bar	Major	Field operators, production engineer	Critical above shut_in_limit_bar
ESD valve closed	esd_closed == true	Debounce 1 sample	Major	Control room, field supervisor	Reminder every 30 min
Valve station pressure fall	dp_rate_bar_min < -0.5	Debounce 3 samples	Critical	Control room and integrity on duty, SMS	Reminder every 10 min
Line pressure low	down_bar < attribute lo_bar	Debounce 3 samples; hysteresis 1 bar	Major	Control room, push	Reminder every 30 min
Line valve disagreement	any of: (all of valve_open == true, valve_closed == true), (all of valve_open == false, valve_closed == false)	Debounce 120 s, so normal travel does not alarm	Minor	Maintenance, e-mail	None
Tap pressure high	pressure_bar >= attribute hi_bar	Debounce 2 samples	Major	Integrity team, push	Reminder every 30 min
Rectifier AC lost	rect_ac_ok == 0	Debounce 5 min	Minor	CP engineer and contractor, e-mail	Reminder daily
Rectifier output abnormal	rect_a < attribute rect_min_a	Debounce 3 samples	Warning	CP engineer, e-mail	None
Potential outside criterion	psp_off_mv > attribute cp_limit_mv	Debounce 1 sample	Minor	CP engineer, e-mail	None
Solar battery low	batt_v < 11.8 (12 V system)	Debounce 3 samples; hysteresis 0.4 V	Warning	Telemetry technicians, e-mail	None
Enclosure opened	door_open == true	None	Info	Field supervisor, in-app	Out-of-hours version via the Rules card
Site offline	Inactivity rule, 3 × the heartbeat		Major	Telemetry technicians, push	Reminder every 2 h

Severity levels are Critical, Major, Minor, Warning and Info. A severity rise notifies again; reminders repeat until the alarm is acknowledged. Recipients are users, roles (Owner, Admin, User) or e-mail addresses, up to 20 per rule; list the users or a shared crew address per field area so the right crew is paged, or notify a team per area from a Rules-card rule on the alarm. Alarms open after the debounce, are acknowledged with an optional note and resolve when the condition clears; they cannot be latched, so supervisors should review resolved Major alarms nobody acknowledged.

Debounce in seconds advances only when readings arrive. A well that reports every 5 minutes needs at least two samples before an alarm, so expect up to 10 minutes from stop to alarm. For rules about time of day, use a Rules card: when door_open becomes true, only if outside 07:00 to 18:00 or on a holiday, then raise a Minor alarm and notify the security team. A rule such as "pump_run stays 0 for 30 minutes" also fits the Rules card's timer and avoids alarms on short controller restarts.

Mute a site during workovers, pigging or CP surveys; alarms are still recorded, marked as muted. A regional cellular outage takes many sites offline together; the storm digest (above 20 notifications a minute) helps, and a long debounce on the offline rule helps more.

Automation and integrations

• No well control from Hermetry. Shutting in a well, closing a line valve and restarting a pump stay with the RTU, the pipeline SCADA and people on site. This blueprint is read-only.
• Production systems: a production accounting system can pull hourly pressures, run hours and flow computer totals through the REST series API with a read-only API key limited to its network. Flow computer totals remain the measurement of record.
• Work orders: webhooks alarm.created and alarm.cleared, signed with HMAC, open and close work orders in the CMMS; a flow can call the CMMS directly through an HTTP endpoint with OAuth 2 client credentials.
• Daily summary: a scheduled flow at 06:00 can notify the field supervisors' role with a short message; detailed downtime and CP tables are exported to Excel. Scheduled, e-mailed reports are not built in today.
• Remote support: router remote access opens a licensed router's web panel through an outbound tunnel. On metered links it asks for confirmation and caps the session at 50 MB.

Roles and access

Who	Role or group	Can
Field operator	User	See wells and stations of their area, acknowledge alarms, add notes.
Control room	User + IoT operator group	See everything, acknowledge, switch an area's rules to Manual.
Production engineer	User + IoT viewer group	Read all well data, export history.
CP engineer	User	See CP devices, acknowledge CP alarms.
CP contractor	User, narrowed by policy	See only rectifiers and test posts of the contracted segments.
Telemetry engineer	Admin	Profiles, codecs, rules, flows, drawings, remote settings, firmware.
IT owner	Owner	Members, SSO and 2FA policy, API keys, signing keys.

Attribute-based policies can limit a contractor to the CP system assets of their segments; test the policy with the policy simulator before inviting them. Alternatively, keep contractors in a separate organisation fed by a webhook. The hash-chained audit log records sign-ins, acknowledgements, rule changes, attribute writes, mutes and firmware actions.

Sizing and data

As an order of magnitude for 60 wells, 12 valve stations, 20 rectifiers and 40 LoRaWAN line points:

• Wells: one analog message every 5 minutes (288 a day) plus about 100 contact and heartbeat messages: 60 × 388 ≈ 23,300 a day.
• Valve stations: one message a minute: 12 × 1,440 = 17,280 a day.
• Rectifiers: one every 15 minutes: 20 × 96 = 1,920 a day.
• LoRaWAN points: one uplink every 15 minutes: 40 × 96 = 3,840 a day.
• Total: about 46,000 messages a day, roughly 1.4 million a month, counted as one message per device per reading. Commands, alarms and connection events do not count toward the allowance.
• Values: about 330,000 a day, around 120 million a year.

The plan's retention class decides history: in the one- and three-year classes raw readings stay for 90 days, minute aggregates for 31 days and hourly and daily aggregates for the whole class. The three-year class suits integrity work, where engineers compare hourly pressure minima and maxima across seasons. Per-device rate limits are far above these rates. For battery LoRaWAN sensors, the uplink interval, not the platform, decides battery life; follow the sensor maker's guidance.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Survey	1-3	Controller register maps, power budget per site, cellular signal readings, LoRaWAN coverage survey along the line, hazardous area review.	Point list per site type; antenna and solar design signed off.
1. Pilot	4-9	Five to ten wells, two valve stations, ten line points, two rectifiers. Profiles, codecs, root flows, alarm rules, field map and well page.	Three weeks of data; pressures within transmitter accuracy of calibrated gauges; every alarm tested; measured data use per site.
2. Field	10-16	All wells of the field in batches, using pre-claimed gateways and setting baselines.	Uptime figures accepted by production; nuisance alarms below the agreed level.
3. Pipeline and CP	17-26	Remaining valve stations, line points and rectifiers; CP board; contractor access.	CP readings match the contractor's survey; integrity team uses the pipeline board weekly.

Commissioning checklist

1. Gateway claimed on the right profile, named after the site, placed on its asset; certificate active.
2. Each pressure compared with a calibrated test gauge at two points; ranges and units match the profile.
3. ESD valve position watched during its scheduled function test, never operated for Hermetry's sake.
4. Pump run state checked by stopping the pump with the operator; the Well stopped alarm opens after the expected delay.
5. LoRaWAN sensors joined; RSSI and SNR checked in each device's LoRaWAN tab; readings arrive at the set interval; codec outputs renamed.
6. Rectifier voltage and current compared with a portable meter.
7. Battery voltage reading checked against a meter; solar charge seen during the day.
8. Time stamps of a known event appear at the right local time.
9. Offline test: uplink removed for 30 minutes; offline alarm raised; buffered readings fill the gap.
10. Notification routes tested per field area on SMS, push and e-mail.

Pitfalls

• Polling fast on cellular. Minute-by-minute wellhead data rarely changes a decision and drains data plans and solar batteries. Start slow and use deadbands.
• LoRaWAN without a survey. Terrain and distance along a pipeline vary; survey coverage before buying sensors.
• Mixing on and instant-off potentials. Label which one a device reports; criteria apply to instant-off values.
• Integrating flow rate for volumes. Read the flow computer's totals; rates sampled every 5 minutes do not add up to the measured volume.
• One limit for every well. Use device attributes so each well has its own limits under the same rules.
• Treating Hermetry as leak detection. A pressure-fall alarm is a useful early hint, not a certified leak detection system.

What Hermetry does not replace

Hermetry monitors and alerts. Emergency shutdown, high-integrity pressure protection, relief systems, gas detection trips, well control and certified pipeline leak detection stay in their certified safety and control systems and must work without the link or the platform. Hermetry reads valve and alarm states for indication only. Flow computers stay the measurement of record, and regulatory CP and integrity records stay in the systems your regulator accepts.