Testing subsea BOPs to the limit

Maersk Drilling's Maersk Viking drillship. image source: Maersk Drilling

Third party, hardware-int-the-loop (HIL) testing has been taken beneath the waves on a subsea MUX BOP. Elaine Maslin reports.

Automation is playing an increasing role in offshore operations. With automation comes software and a need for it to be tested, ideally with its hardware.

When the hardware in question is being installed on a floating production unit, drilling rig or drillship, as a long and complex build program moves towards commissioning, how and when the testing is carried out becomes crucial.

Testing a system as early as possible will enable suppliers and those receiving the systems, to better manage their risks.

Machine and system vendors do test their own software, but third-party hardware-in-the-loop (HIL) testing is helping to increase software reliability and safety, and smooth out the commissioning schedule.

HIL-testing has been adopted by the oil and gas industry for some time, but has only recently been used to test MUX blow out preventers (BOPs), used for deepwater drilling.

The project was undertaken by Norway’s Marine Cybernetics (MC) for Maersk Drilling, Samsung Heavy Industries and the MUX BOP’s manufacturer GE Oil & Gas, ahead of its integration into Maersk Drilling’s latest drillship, Maersk Viking.

The ship is the first of four being built by Samsung, in South Korea. All four have MUX BOPs, which will undergo the same HIL testing by MC.

Maersk Drilling had already been using HIL-testing on dynamic positioning and power management systems. The company saw its benefits and wanted to use the same test concept also for drill floor equipment in 2008. Since then the number of products being tested has grown and now includes subsea systems like BOPs, says Einar Leirvik, operations project manager, at MC.

HIL-testing is a black-box method for testing and verification of control system software. Instead of being connected to the actual equipment, the control system is connected to an HIL simulator, which models of the equipment due to be controlled.

A GE Oil & Gas BOP launching from a moon pool. image source: Cybernetics

This enables systematic and comprehensive control system functionality and failure handling testing, without risk to personnel, equipment or the environment. This includes testing safety-critical software barriers that otherwise cannot be tested before they are needed.

For SHI, this is crucial. Dillip Moharana, senior manager-instrumentation, SHI, Geoje Shipyard, says: “HIL testing means we can thoroughly test the software. Normally, we have to believe the vendor, who is supplying the software, and do not have a mechanism ourselves to 100% check the software before it is commissioned. Introducing third-party HIL testing means the software developed by the vendor can be thoroughly checked and we can make sure it is robust.”

This then reduces the risk that the software could fail during an operation, which could potentially cost millions of dollars in lost revenue due to downtime for fault-finding and corrective work. For a subsea BOP, removing any potential for failure, especially in deep water, is even more important, Moharana says, safety also being critical factor.

For deep water—typically above 1200- 1500m—it is not acceptable to control the subsea valves by direct hydraulic lines between the topside control manifold and the BOP stack. Due to the compressibility of the hydraulic fluid, the time delay becomes too large. To meet deepwater requirements, the BOP stack is typically controlled through a serial copper line, and more recently via fiber optic communication cables.

Redundant programmable logic controller/ microcontrollers subsea, handle this communication. Subsea controllers are also programmed to initiate and execute emergency disconnect sequences, if certain criteria are fulfilled or if commanded by the operator on the ship.

The control system interacts with the BOP and auxiliary systems through a set of input and output (I/O) signals. Inputs are provided by sensors that measure the various physical properties, as well as inputs from operator stations. Based on the inputs and internal states in the control system, the control system calculates control signal outputs to the actuators.

HIL-testing is performed by isolating the control system and its operator stations from its surroundings, and replacing all actual I/O with simulated I/O using an HIL simulator in real time. The HIL simulator imitates the BOP, responds to the commands from the control system, and provides realistic and consistent measurements. The control system cannot sense any difference between the real world and the virtual world in the HIL simulator.

“The earlier you can test as complete a system as possible the better,” says Raj Sen, subsea section manager, electrical controls team, Houston. “What HIL allows is the control system to be tested with the hardware that it is to be interfaced with in the ship at a later date. It gives an additional level of confidence and allows an additional level of risk management up-front in the process.

“At the end of the complete cycle, the quality of the product remains the same, it is just a matter of timing, when you are managing the risks out. We are allowing the customer to focus on the ship building and the assembly, instead of dealing with supplier products at the final stages of a build, in the final cycle.”

A non-disclosure agreement was agreed upfront, and MC presented a list of necessary documentation to be able to develop the simulators, write the test program and prepare the interfaces to be used between the BOP control system and the simulators.

Einar Leirvik, operations manager at Marine Cybernetics.

“We have to do a thorough analysis of the system to understand how it works and how it is built up,” Leirvik says.

“When we get this overview we start on the process of preparing the test program and the simulators based on the vendor documentation. In this particular project we also arranged a workshop with Maersk Drilling to look into which areas should be more focused and which should have less priority, he says.

“HIL-testing is the best way to test how the control system is handling failures. We are stressing the system by introducing various failures from the simulators and then verifying that the control system response to those failures is acceptable. Today, there is no other test methodology covering this in such a comprehensive and detailed manner than the HIL testing.”

MC used its own technology platform CyberSea to create the HIL simulators.

The simulators were programmed and configured according to the piping and instrumentation diagrams, electrical schematics, IO-lists (listing instrumentation input and outputs), and general arrangement drawings, received from GE Oil & Gas, using Matlab and Simulink. The simulators can run on standard laptops.

The majority of the tests are “failure tests,” where the control system’s ability to handle failures in various operational modes is tested. Failures range from sensor and command signal failures to mechanical failures, or loss of power or communication.

The functionality of the system was also tested by writing “function tests” to verify that the system operates in accordance with its functional description, operator manuals and so on. Once written, the test program was agreed by all the parties.

A separate team at MC prepared the hardware and communication drivers, or interfaces, to be able to communicate between the BOP control system and the simulators. On this system, both hardwired signals and serial communication were used. All interface equipment was prepared at MC’s facilities in Norway before being shipped and tested at GE Oil & Gas’ facilities in Houston. It was then ready to start HIL-testing on the actual control system hardware, following GE Oil & Gas’ own internal testing.

The control system and the simulators were connected to each other and put through HIL-commissioning before the HIL test could start. Acceptance criteria was being able to operate all functions from the BOP control system and verify correct behavior and feedback from the simulators. Commissioning lasted five days.

L-R Einar Leirvik-Marine Cybernetics, In Sung Lee-Maersk Drilling, Dillip Moharana-Samsung Heavy Industries, Geir Hamre-Marine Cybernetics, Michal Bury-Maersk Drilling. image source: Marine Cybernetics.

The first phase of testing lasted 10 days. If results were unclear, or a party wanted verification of the observed result, re-tests were performed. When testing was complete, the parties met before a test result report was issued by MC.

“By conducting HIL-testing of the BOP control system all parties have contributed to increased offshore safety,” Leirvik says. “Co-operation between the stakeholders is essential and both GE Oil & Gas, Maersk Drilling and Samsung have been very supportive.”

By March 2014, MC has in total signed contracts for 10 BOP’s to be HIL-tested. Several BOP-HIL projects are ongoing now while four projects are already completed.

Marine Cybernetics’ (MC) founders saw an opportunity to introduce HIL testing to the maritime and offshore industry. Professors Thor I. Fossen, Asgeir J Sørensen, Olav Egeland and Tor Arne Johansen, from the Norwegian University of Science and Technology in Trondheim, Norway, founded the company in 2002.

Einar Leirvik, operations project manager, at Marine Cybernetics says: “The founders had been involved in control system development and they saw that the testing did not keep up pace with the software development and the use of software. Software was moving into all aspects of marine operations and the testing was not keeping up. So they looked at how other industries were testing their critical software.”

MC introduced HIL testing for upstream systems and developed its CyberSea technology, which incorporates software development and modeling of physical systems such as hydrodynamics, electro-mechanical systems, hydraulics, and sensors and can be used to test systems from any control system manufacturer.

The first product was Dynamic Positioning (DP) HIL. Since then, MC has developed HIL testing for use on a wide variety of equipment, including Power Management Systems, Drilling and Pipe Handing Equipment and Emergency Shutdown systems.