Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
®
Originally appeared in MARCH 2014 issue, pgs 39-42. Posted with permission.
tem, but Marine Cybernetics has previously tested several drill- relevant documentation is collected, to get an overview of the
ing control systems, BOP control systems, and a large number of system, define interfaces, decide which components to include in
maritime control systems.³, ⁴ the laboratory, and which components to simulate.
The planning phase is followed by the preparations phase,
WHAT IS HIL TESTING? where system analysis and test design are the key activities.
HIL testing is an efficient black-box method for testing and The system analysis is similar to a hazard and operability study
verifying control system software. Instead of being connected to (HAZOP) and Failure Mode and Effects Analysis (FMEA), but
the actual equipment, the control system is connected to an HIL focuses on the control system software. The system analysis is fol-
simulator, with sophisticated models of the equipment being con- lowed by test design, where test cases are created and prioritized,
trolled. This enables systematic, comprehensive testing of control according to a number of factors. Standard systematic testing
system design philosophy, functionality, and failure handling ca- techniques, such as boundary value analysis, equivalence parti-
pability, both in normal and off-design operating conditions. A tioning, error guessing, scenario testing, state transition testing
key advantage is that testing can be performed at an early stage, and stress testing, are used.
and in a safe test bed, without risk to personnel, equipment, the However, system analysis can only take you so far, if the docu-
well or the environment. In the automotive, avionics and aero- mentation is not sufficiently complete. In this case, exploratory
space industries, HIL testing has been established as a best prac- testing is used. Exploratory testing relies upon the skills of the tes-
tice, to meet the requirements for performance and reliability. ters, their knowledge of the system and the interpretation of pre-
vious test results. In exploratory testing, new tests are constantly
CONCEPT created and used. These tests can be powerful and efficient,
As seen in Fig. 1, a control system interacts with its sur- because they are based on the tester’s continuously increasing
roundings through a set of Input/Output (I/O) communica- knowledge about the testing target system.
tion channels. Inputs are provided by sensors that measure Herein is another key difference between FMEA and HIL
dynamic states and parameters, as well as inputs from operator testing. The FMEA is a desktop study that reveals possible weak
stations and other control systems. Based on its inputs and in- points in the physical design, and points to critical software func-
ternal models, the system calculates control signals that are then tions that deserve increased attention. This provides important
sent to actuators. input to the HIL testing, which is performed by running the actu-
HIL testing isolates the control system, and its operator sta- al control system code. The insight gained from testing and oper-
tions, from its surroundings, and replaces actual inputs with simu- ating the control system in different scenarios during HIL testing
lated inputs from an HIL simulator. The HIL simulator emulates can provide essential information on the functionality and failure
all the control system surroundings, responds to control signals handling capabilities of the control system software, which may
in a realistic manner, and provides realistic, consistent measure- be included in the FMEA.
ments. The control system cannot sense any difference between
the real world and the virtual world in the HIL simulator. THE MPD SYSTEM: EC-DRILL
In HIL testing, the control system is viewed as a black box, The AGR Enhanced Drilling EC-Drill system is an MPD sys-
meaning no first-hand knowledge of the inner workings of the tem that enables the manipulation of the riser level, by pumping
system is necessary. However, a functional description of the sys- returns from the riser up to the rig. This is done with a subsea
tem is needed to establish a proper test scope. In addition, detailed pump module docked on a specially designed and instrumented
knowledge of the system I/O, and the equipment under control, is riser joint, Fig. 2. In addition to these two, key subsea compo-
necessary to develop a sufficiently accurate simulator. nents, the system has a topside counterpart, which includes a
launch and recovery system; control and operator containers;
TESTING PROCESS and an additional operator position.
In the planning phase of the HIL testing process, the most During drilling, the EC-Drill system greatly reduces the need
to manipulate mud weight. Instead, the mud level in the riser can
Fig. 1. HIL testing conceptual setup. Fig. 2. The EC-Drill subsea pump module, docked on the riser.
system systems
Measurements
Sensors
system dynamics
measurements Simulated
sensors
be manipulated freely, allowing the BHP to be controlled, Fig. 3. Table 1 shows examples of tests covered by the program.
The system is based on proven technology from AGR Enhanced A good testing program is important for test efficiency and
Drilling’s Riserless Mud Recovery System (RMR) and Cuttings quality, and feedback from stakeholders is very important for a
Transportation System (CTS).⁶ These systems are in continuous good testing program. The testing program was, therefore, sent
operation worldwide, and have been used to drill more than 500 out to all parties for review before testing began, and several itera-
wells. The capabilities of the first version of EC-Drill were shown tions were made before it was finalized.
in the Gulf of Mexico in 2012.⁷, ⁸, ⁹
Table 1. Tests covered by the program.
Type of tests Test cases
Fig. 3. Pressure gradients, when drilling with EC-Drill. Functional tests Operational modes, such as manual/auto-
matic modes and change of pressure setpoints
Drilling procedures, such as startup/shut down
of rig pumps, increase/decrease riser level and
tripping in/out
Influx and loss detection
Equipment failures VSD failures
Subsea pump and motor failures
Valve failures
Signal failures Loss of communication
Sensor failures
Loss of power to control system components
Network storm to stress the network
communication
TESTING LAB
An HIL testing lab was built in Trondheim, Norway, and it in-
cluded both topside and subsea control system modules from AGR
Enhanced Drilling, and necessary interface to the Marine Cyber-
STATOIL INVOLVEMENT netics HIL simulator. In this project, the well, riser, drilling equip-
Statoil has, for some years, applied automatic MPD operations ment and subsea pump were included in the HIL simulator, Fig. 4.
successfully in the North Sea on fixed platform rigs, and has a keen An interface and commissioning test was performed, before
interest in supporting development of a viable MPD technology the HIL testing started. The purpose of this test was to verify all
to be used on floating drilling rigs.⁵ The EC-Drill solution was I/O addressing, ensure that all functions in the EC-Drill control
preferred over the backpressure MPD solutions, largely because system could be operated, and verify correct behavior and feed-
of the decrease in rig heave-induced BHP variations; no concern back from the HIL simulator.
regarding riser pressure rating; the use of overbalanced mud den-
sity; and no risk of RCD failure. AGR Enhanced Drilling and Fig. 4. EC-Drill system and the components simulated for the HIL
Statoil have collaborated closely to specify system requirements test.
for the first use of EC-Drill on the NCS, and Statoil has partly
funded this development.
AGR Enhanced Drilling decided to develop a new control sys-
tem to meet the increased requirements for the EC-Drill system,
especially with respect to fault tolerance and redundancy. The
control system is a vital part of EC-Drill, as it governs the BHP
and supervises the volume balance, among other functions.
The new control system has been designed in accordance
with governing industry standards and Statoil’s technical re-
quirements, and AGR Enhanced Drilling and Statoil have veri-
fied the technical solutions in an extensive testing and qualifica-
tion program. In this program, the technology readiness level
is assessed, and a plan is developed to mature the technology.
The HIL testing by a third party was a part of this program, as
it was used to partially qualify the new control system before
going offshore. The idea is to avoid spending rig time to make
the control system work properly, and to increase the system’s
safety level and confidence.
the functionality and robustness of the control system soft- provements, based on findings, and in the detailed walk-through
ware, as extensively as possible. During testing, any discrep- of the control system in a safe environment. This, in turn, facili-
ancy from the expected testing result was noted by the test tated constructive discussions between the tester, customer and
operator, and filed as testing observations for further analysis. supplier, ultimately leading to a better, safer control system.
Any issues that were found to require more thorough testing REFERENCES
were noted, and new exploratory tests were created to be run 1. OLF 070, “Recommended guidelines for application of IEC 61508 and IEC 61511 in the Norwegian
petroleum industry,” Norsk Olje og Gass, 2004.
at the end of testing. 2. Handal, A., S. Øie and M. L. Lundteigen, Det Norske Veritas AS, “Risk assessment targets well control
This software test was completed in 10 days, with both AGR functions of MPD operations,” Drilling Contractor, July 2013.
3. Pedersen, T. and Ø. Smogeli, “Experience from Hardware-in-the-loop testing of drilling control sys-
Enhanced Drilling and Statoil present at all times. Every third tems,” SPE paper 163509-MS, SPE/IADC Drilling Conference and Exhibition, Amsterdam, March
day, all parties met for a summary meeting to discuss testing 2013.
4. Pivano, L. and Ø. Smogeli, “Independent HIL testing of DP systems—A life-cycle perspective,” First
observations. In the summary meetings, each recorded test re- Brazilian Conference on Dynamic Positioning, Rio de Janeiro, April 2013.
sult was processed and discussed. The nature of the test result 5. Godhavn, J.-M., “Control requirements for high-end automatic MPD operations,” SPE paper 119442,
SPE/IADC Drilling Conference and Exhibition, Amsterdam, 2009. Journal version: Control require-
was concluded; each software failure was given a severity grade ments for automatic managed pressure drilling system, SPE Drilling & Completion, Vol. 25, No. 3, pp.
and categorized as a finding; and actions for following up each 336-345, September 2010.
6. Stave, R., R. Farestveit, S. Høyland, P. O. Rochmann and N. L. Rolland, “Demonstration and
finding were planned. This included priorities and deadlines for qualification of a riserless dual gradient system,” SPE paper 17665, Offshore Technology Conference,
updates. After testing was completed, a final summary meeting Houston, May 2005.
7. Mir Rajabi, M., K. Toftevag, R. S. Stave and R. Ziegler, “First application of EC-Drill in ultra-deepwa-
was set up to conclude upon all items. ter—Proven subsea managed pressure drilling method, SPE paper 151100, 2012.
8. Ziegler, R., P. Ashley, R. F. Malt, R. Stave and K. R. Toftevåg, “Successful application of deepwater
The second test, software test 2 (SWT2), was started after dual gradient drilling (SPE 164561),” 2013.
AGR Enhanced Drilling finished updating its control system soft- 9. Ziegler, R., M. S. A. Sabri, M. R. B. Idris, R. Malt and R. Stave, “First successful commercial applica-
tion of dual gradient drilling in ultra-deepwater GOM,” SPE paper 166272, 2013.
ware, based on the agreed actions from SWT1. The main objec-
tive of SWT2 was to re-test items found during SWT1, to check BJØRNAR VIK has worked at Marine Cybernetics since
if they had been fixed and were working as intended. Additional 2004, and as a principal engineer since 2007. He also
spot checks were carried out, to verify that system functionality serves as an adjunct associate professor at the
Department of Engineering Cybernetics at the
and robustness were preserved, and to check for any unintended Norwegian University of Science and Technology
consequences from fixing the items after SWT1. (NTNU). He holds MS and doctorate degrees, both from
the Department of Engineering Cybernetics at NTNU.
Even though the new control system has gone through ex- ERLEND MJAAVATTEN is AGR Enhanced Drilling’s
tensive testing of a more traditional character, such as Extended control system development manager. He joined the
Factory Acceptance Testing (EFAT) and Site Integration Test- company in 2009, and has a background in subsea
boosting systems, oil spill management systems and
ing, the HIL lab was available at an earlier stage than much of the other marine automation systems. Mr. Mjaavatten holds
equipment required for doing full-scale testing in the workshop. an MS degree from the Department of Engineering
Cybernetics at NTNU.
The schedule for the EC-Drill project was very tight, and the HIL
testing helped bring potential issues and misunderstandings to
the table at an early stage. The test laboratory can be re-used for
new projects, and for the testing of future upgrades to the EC-
Drill system.
CONCLUSIONS
MPD solutions are advancing quickly. New systems, such as
EC-Drill, enable drilling of deeper, more challenging wells, due to
accurate and fast pressure control. However, the new systems also
rely more on control system software, which means that verifica-
tion of the functionality and robustness of this software is critical.
Extensive and early verification is important to reduce rig com-
missioning and non-productive time during operations.
In this project, independent HIL testing has proven to be a
systematic, effective method for assessing the control system soft-
ware, and was key in the technology qualification process. The
main added value from the HIL testing was both in system im-
Article copyright © 2014 by Gulf Publishing Company. All rights reserved. Printed in U.S.A.
World Oil / MARCH 2014 41
Not to be distributed in electronic or printed form, or posted on a website, without express written permission of copyright holder.