 |
| The subsea pump module is a central part of the EC-Drill system. |
|
Managed pressure drilling (MPD) systems are becoming more automated, allowing for improved pressure manipulation and providing the ability to drill previously undrillable wells.
However, the increased automation and complexity of control system software means that verification efforts should be more rigorous. While traditional risk analysis is both useful and necessary, verification through hardware-in-the-loop (HIL) testing has the advantage of testing actual running code. A thorough testing process also increases the knowledge about, and confidence in, the control system.
This article describes the verification performed during the development of the new EC-Drill MPD system. EC-Drill, developed by AGR Enhanced Drilling, is a system with a subsea pump module that was designed to control BHP, by managing the level of the drilling fluid in the riser. The system incorporates new control capabilities, and initial usage was planned for first-quarter 2014, in a subsea field offshore Norway.
BACKGROUND
EC-Drill represents an advance in MPD technology for floating drilling rigs. It controls downhole pressure accurately, provides fast detection of influx and losses, and enables the drilling of previously undrillable wells. These advances are made possible by employing new control system software that manages the mud level in the riser.
The mud column is the primary safety barrier for drilling, the secondary being the blowout preventer (BOP). Much focus has been put on BOP reliability. An example is the minimum safety integrity level (SIL) defined for BOP functions on the Norwegian Continental Shelf (NCS), while there are no such requirements for the mud column.¹ The decision not to have any minimum SIL requirements is explained by arguing that the BOP can be regarded as the safety system for the mud column, and that the impact of the instrumented systems monitoring reliability of the mud circulation system is marginal.¹ The latter argument may have been true, when it was written, but, with increased levels of automation, the MPD software has become more critical, as MPD systems automatically control the pressure exerted by the mud column. This is supported by a recent article written by Det Norske Veritas, which has experienced considerable demand for third-party evaluation of recently introduced MPD systems.² This is particularly true, if the mud weight is so low that an error in the MPD or rig systems, e.g., a power loss, can lead to an underbalanced situation.
In the technology qualification prior to the EC-Drill system’s use on the NCS, Statoil and AGR Enhanced Drilling agreed to have a comprehensive third-party verification of the control system software. To this respect, Marine Cybernetics was contracted to perform HIL testing, to expose the full capability and robustness of the software. This was the first HIL test for an MPD system, but Marine Cybernetics has previously tested several drilling control systems, BOP control systems, and a large number of maritime control systems.³, ⁴
WHAT IS HIL TESTING?
HIL testing is an efficient black-box method for testing and verifying control system software. Instead of being connected to the actual equipment, the control system is connected to an HIL simulator, with sophisticated models of the equipment being controlled. This enables systematic, comprehensive testing of control system design philosophy, functionality, and failure handling capability, both in normal and off-design operating conditions. A key advantage is that testing can be performed at an early stage, and in a safe test bed, without risk to personnel, equipment, the well or the environment. In the automotive, avionics and aerospace industries, HIL testing has been established as a best practice, to meet the requirements for performance and reliability.
CONCEPT
As seen in Fig. 1, a control system interacts with its surroundings through a set of Input/Output (I/O) communication channels. Inputs are provided by sensors that measure dynamic states and parameters, as well as inputs from operator stations and other control systems. Based on its inputs and internal models, the system calculates control signals that are then sent to actuators.
 |
| Fig. 1. HIL testing conceptual setup. |
|
HIL testing isolates the control system, and its operator stations, from its surroundings, and replaces actual inputs with simulated inputs from an HIL simulator. The HIL simulator emulates all the control system surroundings, responds to control signals in a realistic manner, and provides realistic, consistent measurements. The control system cannot sense any difference between the real world and the virtual world in the HIL simulator.
In HIL testing, the control system is viewed as a black box, meaning no first-hand knowledge of the inner workings of the system is necessary. However, a functional description of the system is needed to establish a proper test scope. In addition, detailed knowledge of the system I/O, and the equipment under control, is necessary to develop a sufficiently accurate simulator.
TESTING PROCESS
In the planning phase of the HIL testing process, the most relevant documentation is collected, to get an overview of the system, define interfaces, decide which components to include in the laboratory, and which components to simulate.
The planning phase is followed by the preparations phase, where system analysis and test design are the key activities. The system analysis is similar to a hazard and operability study (HAZOP) and Failure Mode and Effects Analysis (FMEA), but focuses on the control system software. The system analysis is followed by test design, where test cases are created and prioritized, according to a number of factors. Standard systematic testing techniques, such as boundary value analysis, equivalence partitioning, error guessing, scenario testing, state transition testing and stress testing, are used.
However, system analysis can only take you so far, if the documentation is not sufficiently complete. In this case, exploratory testing is used. Exploratory testing relies upon the skills of the testers, their knowledge of the system and the interpretation of previous test results. In exploratory testing, new tests are constantly created and used. These tests can be powerful and efficient, because they are based on the tester’s continuously increasing knowledge about the testing target system.
Herein is another key difference between FMEA and HIL testing. The FMEA is a desktop study that reveals possible weak points in the physical design, and points to critical software functions that deserve increased attention. This provides important input to the HIL testing, which is performed by running the actual control system code. The insight gained from testing and operating the control system in different scenarios during HIL testing can provide essential information on the functionality and failure handling capabilities of the control system software, which may be included in the FMEA.
THE MPD SYSTEM: EC-DRILL
The AGR Enhanced Drilling EC-Drill system is an MPD system that enables the manipulation of the riser level, by pumping returns from the riser up to the rig. This is done with a subsea pump module docked on a specially designed and instrumented riser joint, Fig. 2. In addition to these two, key subsea components, the system has a topside counterpart, which includes a launch and recovery system; control and operator containers; and an additional operator position.
 |
| Fig. 2. The EC-Drill subsea pump module, docked on the riser. |
|
During drilling, the EC-Drill system greatly reduces the need to manipulate mud weight. Instead, the mud level in the riser can be manipulated freely, allowing the BHP to be controlled, Fig. 3. The system is based on proven technology from AGR Enhanced Drilling’s Riserless Mud Recovery System (RMR) and Cuttings Transportation System (CTS).6 These systems are in continuous operation worldwide, and have been used to drill more than 500 wells. The capabilities of the first version of EC-Drill were shown in the Gulf of Mexico in 2012.7, 8, 9
 |
| Fig. 3. Pressure gradients, when drilling with EC-Drill. |
|
STATOIL INVOLVEMENT
Statoil has, for some years, applied automatic MPD operations successfully in the North Sea on fixed platform rigs, and has a keen interest in supporting development of a viable MPD technology to be used on floating drilling rigs.5 The EC-Drill solution was preferred over the backpressure MPD solutions, largely because of the decrease in rig heave-induced BHP variations; no concern regarding riser pressure rating; the use of overbalanced mud density; and no risk of RCD failure. AGR Enhanced Drilling and Statoil have collaborated closely to specify system requirements for the first use of EC-Drill on the NCS, and Statoil has partly funded this development.
AGR Enhanced Drilling decided to develop a new control system to meet the increased requirements for the EC-Drill system, especially with respect to fault tolerance and redundancy. The control system is a vital part of EC-Drill, as it governs the BHP and supervises the volume balance, among other functions.
The new control system has been designed in accordance with governing industry standards and Statoil’s technical requirements, and AGR Enhanced Drilling and Statoil have verified the technical solutions in an extensive testing and qualification program. In this program, the technology readiness level is assessed, and a plan is developed to mature the technology. The HIL testing by a third party was a part of this program, as it was used to partially qualify the new control system before going offshore. The idea is to avoid spending rig time to make the control system work properly, and to increase the system’s safety level and confidence.
HIL TESTING OF THE EC-DRILL SYSTEM
Good preparations are the key to a successful HIL test. Thorough system analysis and test design were performed, based on: documentation from AGR Enhanced Drilling; Statoil requirements; standards and guidelines; and risk assessment documents. Table 1 shows examples of tests covered by the program.
| Table 1. Tests covered by the program. |
|
|
A good testing program is important for test efficiency and quality, and feedback from stakeholders is very important for a good testing program. The testing program was, therefore, sent out to all parties for review before testing began, and several iterations were made before it was finalized.
TESTING LAB
An HIL testing lab was built in Trondheim, Norway, and it included both topside and subsea control system modules from AGR Enhanced Drilling, and necessary interface to the Marine Cybernetics HIL simulator. In this project, the well, riser, drilling equipment and subsea pump were included in the HIL simulator, Fig. 4.
 |
| Fig. 4. EC-Drill system and the components simulated for the HIL test. |
|
An interface and commissioning test was performed, before the HIL testing started. The purpose of this test was to verify all I/O addressing, ensure that all functions in the EC-Drill control system could be operated, and verify correct behavior and feedback from the HIL simulator.
TEST CONDUCTION
After initial control system software was downloaded from AGR Enhanced Drilling, to the laboratory, software test 1 (SWT1) commenced. The main goal for SWT1 was to verify the functionality and robustness of the control system software, as extensively as possible. During testing, any discrepancy from the expected testing result was noted by the test operator, and filed as testing observations for further analysis. Any issues that were found to require more thorough testing were noted, and new exploratory tests were created to be run at the end of testing.
This software test was completed in 10 days, with both AGR Enhanced Drilling and Statoil present at all times. Every third day, all parties met for a summary meeting to discuss testing observations. In the summary meetings, each recorded test result was processed and discussed. The nature of the test result was concluded; each software failure was given a severity grade and categorized as a finding; and actions for following up each finding were planned. This included priorities and deadlines for updates. After testing was completed, a final summary meeting was set up to conclude upon all items.
The second test, software test 2 (SWT2), was started after AGR Enhanced Drilling finished updating its control system software, based on the agreed actions from SWT1. The main objective of SWT2 was to re-test items found during SWT1, to check if they had been fixed and were working as intended. Additional spot checks were carried out, to verify that system functionality and robustness were preserved, and to check for any unintended consequences from fixing the items after SWT1.
OUTCOME OF TESTING
In this project, AGR Enhanced Drilling and Statoil were active participants throughout the testing process. In general, the value of an HIL test is not just seen in the ability to make system improvements, based on findings. The HIL test also:
- Gives insight and understanding of software barriers, hazards, failure modes and effects
- Helps implement procedures and training, to handle discovered software weaknesses
- Assures that the system operates correctly under certain conditions.
Even though the new control system has gone through extensive testing of a more traditional character, such as Extended Factory Acceptance Testing (EFAT) and Site Integration Testing, the HIL lab was available at an earlier stage than much of the equipment required for doing full-scale testing in the workshop. The schedule for the EC-Drill project was very tight, and the HIL testing helped bring potential issues and misunderstandings to the table at an early stage. The test laboratory can be re-used for new projects, and for the testing of future upgrades to the EC-Drill system.
CONCLUSIONS
MPD solutions are advancing quickly. New systems, such as EC-Drill, enable drilling of deeper, more challenging wells, due to accurate and fast pressure control. However, the new systems also rely more on control system software, which means that verification of the functionality and robustness of this software is critical. Extensive and early verification is important to reduce rig commissioning and non-productive time during operations.
In this project, independent HIL testing has proven to be a systematic, effective method for assessing the control system software, and was key in the technology qualification process. The main added value from the HIL testing was both in system improvements, based on findings, and in the detailed walk-through of the control system in a safe environment. This, in turn, facilitated constructive discussions between the tester, customer and supplier, ultimately leading to a better, safer control system. 
REFERENCES
- OLF 070, “Recommended guidelines for application of IEC 61508 and IEC 61511 in the Norwegian petroleum industry,” Norsk Olje og Gass, 2004.
- Handal, A., S. Øie and M. L. Lundteigen, Det Norske Veritas AS, “Risk assessment targets well control functions of MPD operations,” Drilling Contractor, July 2013.
- Pedersen, T. and Ø. Smogeli, “Experience from Hardware-in-the-loop testing of drilling control systems,” SPE paper 163509-MS, SPE/IADC Drilling Conference and Exhibition, Amsterdam, March 2013.
- Pivano, L. and Ø. Smogeli, “Independent HIL testing of DP systems—A life-cycle perspective,” First Brazilian Conference on Dynamic Positioning, Rio de Janeiro, April 2013.
- Godhavn, J.-M., “Control requirements for high-end automatic MPD operations,” SPE paper 119442, SPE/IADC Drilling Conference and Exhibition, Amsterdam, 2009. Journal version: Control requirements for automatic managed pressure drilling system, SPE Drilling & Completion, Vol. 25, No. 3, pp. 336-345, September 2010.
- Stave, R., R. Farestveit, S. Høyland, P. O. Rochmann and N. L. Rolland, “Demonstration and qualification of a riserless dual gradient system,” SPE paper 17665, Offshore Technology Conference, Houston, May 2005.
- Mir Rajabi, M., K. Toftevag, R. S. Stave and R. Ziegler, “First application of EC-Drill in ultra-deepwater—Proven subsea managed pressure drilling method, SPE paper 151100, 2012.
- Ziegler, R., P. Ashley, R. F. Malt, R. Stave and K. R. Toftevåg, “Successful application of deepwater dual gradient drilling (SPE 164561),” 2013.
- Ziegler, R., M. S. A. Sabri, M. R. B. Idris, R. Malt and R. Stave, “First successful commercial application of dual gradient drilling in ultra-deepwater GOM,” SPE paper 166272, 2013.
|
