SYSTEM AND METHOD FOR TESTING DRILLING CONTROL SYSTEMS

Abstract

A device for the testing of an integrated control system (1) wherein said integrated control system (1) is arranged for controlling a drilling unit (2), said drilling unit (2) arranged for drilling operations, said integrated control system (1) * a drilling control system DCS (3) for controlling a drilling system (7), * said DCS (3) arranged for receiving sensor signals (31) related to said drilling operations and for providing control signals (33) to said drilling system (7) so as for conducting the desired drilling operations, * said DCS (3) arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems, * said device arranged for the testing for errors in said integrated control system (1) resulting from failures in one or more control subsystems within said integrated control system or from failures in the interactions between control subsystems within said integrated control system (1) or from a combination thereof.

Description

The present invention pertains to a system and method for testing drilling control systems on vessels and fixed drilling units arranged for drilling operations. Drilling control systems are influenced both by the vessel on which the drilling systems to be controlled are arranged, and also by the drilling operations to be performed. Drilling systems require large amounts of power. There is thus an interconnection between power management systems of the drilling unit and the drilling control systems. All said systems must correctly interact so as for allowing the proper functioning of the drilling unit as a whole during drilling operations. Although the individual drilling control subsystems, such as top drive, heave compensation, and mud pumps may operate independently their control systems will often need to interact, and there may arise failures from these interactions or from the breakdown of one or more of the components or interconnections therebetween.

Drilling operations are in this context considered to comprise any operation performed during the preparation, drilling and completion of a well from the initial positioning of the drilling unit until the well is ready for production. A malfunction in one of the systems may influence the entirety of systems on the drilling units and may incur major failures, resulting in drilling unit damage or serious environmental consequences. At present there are no test systems that allow testing of the interactions between Dynamic Positioning systems (DP), Power Management Systems (PMS) and Drilling Control Systems (DCS) while testing for situations that might incur potentially dangerous or hazardous situations. It is furthermore advantageous to test control systems while said systems are disconnected from the systems they are intended to control, firstly to avoid damaging the systems, secondly to be able to test for situations that rarely occur and which are highly undesirable as well as potentially destructive. The testing for control system interactions is particularly difficult when multiple control system manufacturers provide control systems to be interconnected in a top level control system. If errors arise, these may result in very costly drilling shutdowns or in the worst case equipment failure. Due to the extremely high costs associated with even minor delays in petroleum production and drilling, it is of major economic and environmental importance to detect potential problems related to the control systems before they arise and take appropriate corrective action.

The present invention seeks to alleviate at least some of the aforementioned problems by simulating at least one or more of the real systems on the drilling unit and furnishing real and/or simulated signals to a plurality of control systems in order to ascertain whether the plurality of interdependent control systems may respond in an adequate manner when provided with different simulated and or real scenarios or a combination of real and simulated scenarios, said scenarios represented by signals. The system according to the invention may also comprise a signal modifying computer arranged for modifying the flow of signals to and fro the real control systems and the simulated physical systems so as for inducing errors and modifications in the signals allowing functional and failure mode testing of a combination of control systems.

BACKGROUND ART

Hardware-in-the-Loop Simulation for Unit Testing

The control and safety systems of a drilling unit may comprise several control systems and safety systems for the different subsystems. Presently, in unit testing of the control system, the control systems and the safety systems that comprise the top level control system, i.e. the drilling control system, are tested individually one at the time.

According to background art, each individual drilling control subsystem is tested in unit testing by arranging the test subject control subsystem in a hardware-in-the-loop simulation. In normal operation, the control subsystem will output actuator control signals that are transmitted to the actuators of the respective drilling subsystem, and the control subsystem will input sensor signals from relevant subsystem sensors. The control subsystem includes at least one computer in which an algorithm calculates output signals to the actuators based on input signals from the relevant sensors and possibly input command signals from an operator. In hardware-in-the-loop testing the drilling control subsystem is disconnected from the drilling system, and is instead connected to a drilling system simulator. In this arrangement the actuator signals that are output from the drilling control subsystem are transmitted to the drilling system simulator. The drilling system simulator will include at least one computer running an algorithm that calculates the sensor signals that would result from the real drilling subsystem given appropriate initial conditions and the actuator output signals received from the control subsystem subject to the test. The purpose of hardware-in-the-loop testing is to investigate whether the drilling control subsystem performs satisfactorily, e.g. with sufficient accuracy, robustness and bandwidth, and if the specified functions of the drilling control subsystem conform to its functional description when the drilling subsystem is controlled by the drilling control subsystem. Moreover, hardware-in-the-loop testing can be used to check whether the drilling control subsystem is capable of appropriately detecting and handling failure situations when controlling its corresponding drilling subsystem.

Marine Cybernetics AS has proposed systems for testing the interactions between dynamic positioning systems (DP) and power management systems (PMS) in a plurality of patent publications such as PCT/NO2005/000138 and PCT/NO2005/000122. However these systems do not comprise the testing of interactions between control systems in use during drilling operations. These control systems present particular difficulties. Thus there is a major difference in both the scope of the patents, the technological area to which the patents are applied and the execution of the proposed methods between the earlier applications by the applicant, and the present invention.

Aker Kvaerner has amongst others proposed simulators for simulating the functioning of the their proprietary Drilling Control And Management System as shown on (http://www.akerkvaerner.com/NR/rdonlyres/65BEFA6C-36EB-4520-8662-1ECC38CCD51A/14056/14DrillingControlMonitoringSystems.pdf). However no indication has been given of the simulation method being able to test for possible interactions or errors, or faults or failures within the control system.

SHORT SUMMARY OF THE INVENTION

The present invention discloses a device for the testing of an integrated control system wherein said integrated control system is arranged for controlling a drilling unit, said drilling unit arranged for drilling operations, said integrated control system comprising

• a drilling control system DCS for controlling a drilling system,
• said DCS arranged for receiving sensor signals related to said drilling operations and for providing control signals to said drilling system so as for conducting the desired drilling operations,
• said DCS arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems,
• said device arranged for the testing for errors in said integrated control system resulting from failures in one or more control subsystems within said integrated control system or from failures in the interactions between control subsystems within said integrated control system or from a combination thereof.

The invention further discloses a method for testing an integrated control system, said integrated control system for controlling a drilling unit during drilling operations, said integrated control system comprising

• a DCS arranged for receiving sensor signals related to said drilling operations and for providing control signals to a drilling system so as for conducting the desired drilling operations,
• said DCS arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems,
• said testing comprising providing erroneous, simulated, real or modified signals, or a combination thereof, to said integrated control system for testing for errors in said integrated control system resulting from failures in one or more control subsystems within said integrated control system or from failures in the interactions between control subsystems within said integrated control system or from a combination thereof.

Additional advantageous embodiments of the invention are disclosed in the attached independent claims.

FIGURE CAPTIONS

FIG. 1 illustrates an integrated control system (1) according to an embodiment of the invention, comprising a drilling control system (3), a power management system (4) and a DP control system (5). The control systems are shown controlling various equipment and systems aboard drilling unit (2), here a vessel (2) on which said vessel (2) is arranged a power plant (6). Actuators (21) for controlling the vessel position are also shown. Various drilling operations and equipment for these operations are indicated, such as pipe handling, drill string heave compensation, draw works, travelling block, top drive, mud pump, heave compensator, the riser, the drill string and the BOP are shown schematically as being part of the drilling system (7).

FIG. 2 illustrates a proposed testing set-up, in which the integrated control system (1) is illustrated comprising the same components as in FIG. 1. In this embodiment of the invention, the drilling unit (2), the power plant (6), and the drilling operations systems (7) are replaced by corresponding simulated units; simulated drilling unit (2’), simulated power plant (6′) and simulated drilling operations (7′) in a so-called hardware-in-the-loop HIL-test configuration.

FIG. 3 illustrates a proposed testing set-up, in which the integrated control system (1) is illustrated comprising the same components as in FIG. 1. In this embodiment of the invention, one or more of the drilling unit (2), the power plant (6), and the drilling operations systems (7) are replaced by corresponding simulated units; simulated drilling unit (2′), simulated power plant (6′) and simulated drilling operations (7′). Between the integrated control system (1) and the real and/or simulated systems controlled by said the integrated control system (1) is arranged a break out box (8) arranged for routing one or more of the signals to and fro the integrated control system (1) to a signal modifying computer (80), where the signals may be modified before being transmitted.

FIG. 4 is an overview over the various equipments and parts of the drilling control system which are simulated according to the invention.

FIG. 5 is an overview of a generic set up for the HIL testing of a DCS according to the invention.

EMBODIMENTS OF THE INVENTION

The invention will in the following be described referring to the attached figures and will describe a number of embodiments according to the invention. It should be noted that the invention should not be limited to the embodiments described in this disclosure, and that any embodiments lying within the spirit of this invention should also be considered part of the disclosure.

The present invention discloses a device for the testing of an integrated control system (1) wherein said integrated control system (1) is arranged for controlling a drilling unit (2). The drilling unit (2) may be a floating drilling platform, a drilling ship, a moored floating unit, thruster and DP controlled floating units, semi-submersibles, or any kind of floating installation arranged for marine drilling operations. The device according to the invention may further comprise a fixed installation on or offshore such as fixed platforms, land based drilling units or similar fixed systems wherein no DP system is required. Said drilling unit (2) is arranged for drilling operations, for which operations a plurality of control systems controlling the different aspects of the operations is required. This plurality of control systems may be called an integrated control system (1), and comprises at least a drilling control system DCS (3) for controlling a drilling system (7). A power management system PMS (4) for controlling a power plant (6) may in some embodiments of the invention be considered as a part of the integrated control system (1). The power plant (6) should provide sufficient power to the drilling systems (7) such that the drilling operations may be conducted in a satisfactory and safe manner. The DCS (3) is arranged for receiving sensor signals (31) related to the drilling operations, and for furnishing drilling control signals (33) to the drilling systems (7) such that the required drilling operations are performed. The DCS (3) should in an embodiment of the invention furnish drilling power control signals (32) to the PMS (4) stating the energy requirements of the drilling systems (7). The device according to the invention is arranged for testing for errors in the integrated control system resulting from interactions between the components of the integrated control system (1).

There are some differences between a land based or fixed drilling unit and a floating drilling unit (2) as is evident, however the differences lie mainly in the number of interactions between systems, not in the nature of the testing as such. As the present invention pertains to the testing of the interactions of systems arranged on a drilling unit (2), both embodiments are encompassed within this disclosure.

Drilling control systems (3) may be installed on new generation drilling units (2) or retrofitted to existing drilling units (2). The control systems are mainly software based and may be arranged in the proximity or inside the driller's dog house (driller cabin). Some of the most common drilling control systems in use today are, “Cyberbase”, by National Oilwell Varco, “Digital Drilling Control System” (DDCS), by OEM, “Drilling Control and Monitoring System”(DCMS)/“Drillview” by Aker Kvaerner and “On Track”, by Sense EDM.

A further possibility according to the invention is to furnish a test system wherein the integrated control system (1) is tested after installation by furnishing a specified test sequence to it. The responses may be stored and at a later point in time, the system may be retested to establish whether the integrated control system (1) responds in a similar manner as upon the first testing. This test may be performed to establish whether unforeseen changes have occured in the system or upon having changed elements within the control system or the like.

Drilling control systems (3) control a plurality of functions of the drilling system (7) which is highly complex. A description of some of the main components of the drilling system is described in the following. The adequate functioning of all operations of the drilling systems, as well as all possible interactions between the drilling control sub systems are tested for and verified according to the invention.

The top drive is essentially a motor arranged for rotating the drill pipe, usually being electrically driven. The top drive should provide rotational torque to the drill pipe in either direction. It should set drilling torque during drilling operations and also provide required make-up torque when joining pipe joints between adjoining pipe lengths. The rotating speed of the pipe during drilling should be set by the top drive.

The top drive should also run the top drive pipe handler where said top drive pipe handler controls a plurality of other drill string operations such as opening and closing the remote operated valve the I.BOP, opening and closing the elevator, swinging the elevator bails in and out, making and breaking the top drive swivel connection to and from the string, and may also comprise equipment for lifting or lowering, or affixing or detaching the top drive swivel from the string.

The top drive control system should receive top drive sensor signals and furnish control signals to the top drive system, for the top drive system to provide amongst others correct rotation direction of the string, desired speed, to carefully control the rotational speed of the string, and to provide the desired drilling torque or make-up torque. In “stall out” situations, the top drive control system should provide control signals to ramp down torque setting automatically over approximately 10 second period after the driller sets torque down to 0. Further the top drive control system should not allow the rotation of the top drive when joining pipes or when braking using the torque wrench.

As is clear the top drive control system furnishes a large amount of control signals, and receives a large amount of sensor signals, all of which should be adequately handled. Many incidents have occurred due to incorrect handling of signals, such as uncontrolled back-spin of the drill-string. As an example a drill string was stuck at 2300 metres true vertical depth (TVD). Before the string was to be pulled loose, the torque had to be released from the string. The torque was approximately 25000 lbs/ft. This action should be done fairly quickly. The torque was set to “0” in the drilling control system, which released the power immediately on the string, and the string rotated uncontrollably backward. This caused the loss of the bottom-hole-assembly and almost disconnected the top-drive from the string, resulting in the loss of one and half days rig-time for fishing operations. Systems were designed to prevent this uncontrolled back-spin, using a ramp down function, however it was shown that these did not perform adequately due to the safety function in the top drive control system.

Heave compensating systems are mission critical components of the drilling systems (7). The systems are arranged for keeping either a constant weight on bit, or keeping a constant tension on bit. There are two types of heave compensating systems;

• Active heave compensating systems,
• Passive heave compensating systems,

Active systems may be top or crown mounted or a part of the draw-work. The active systems may use a vertical reference unit to sense heave, and react according to the sensed heave. The passive systems are usually top-mounted or comprised in the draw work system. Heave compensation systems may comprise either pneumatic or hydraulic compensation systems arranged for dampening the heave movements of both the drill string and equally importantly the riser. The control system for the active heave compensation system should receive sensor signals from the vertical reference unit and should provide control signals controlling valves on the drill string compensator, increase or decrease the pressure in the drill string compensator, open and close air pressure vessels or hydraulic pressure vessels, activate and deactivate the drill string compensator. In addition to these basic functions of the heave compensating systems, the heave compensation control system may also control bypass valves in connection with the string.

The testing should ensure that the heave compensation control system reacts appropriately with respect to the opening and closing of all valves, in controlling the active drill string compensator, and also in operating the drill string compensator in emergency shutdown situations. If the hydraulic power or electrical power fails several undesirable situations may arise, ranging from nuisances to disasters. If the drilling bit is at the sea bed and there is loss in heave compensation, or if the heave compensation does not perform adequately, the drill string might get stuck which is problematic. If however one performs well head work, and the drill string gets stuck, the drill string could break resulting in drilling shutdown, and possibly drill string loss.

The draw works system comprises several brakes, gears and clutches arranged for increase and decrease hook speed. It should further control the operation of the main and emergency brakes. Optionally it should control an electrical brake, such as an induction brake from 0-100%. If the draw works have a plurality of gears, the draw works control system should controlling the shifting of gears, e.g. between low and high. The draw work control systems may also comprise emergency stop systems for preventing the travelling block from colliding into the crown block. When functioning properly, the draw work control system should amongst others adequately control the speed of the draw-works, the brakes, the travelling block and the gear changes, and prevent the draw works from operating when emergency brakes are applied. An example of the results of a draw work brake failure is given below:

It was found that by operating the draw work at high loads the draw work brake did not activate fast enough. This lead to diverter housing underneath the rotary being stripped down, due to the load being lowered 1 meter before the brakes were activated. This resulted in the diverter housing below the rotary table being dragged down, and the loss of 14 days of rig time for repairs. This was due to a lack of communication between the subsystem contractors before modifying the so-called driller's chair.

Mud pump systems are arranged for controlling the circulation and density of mud during drilling. A failure in the mud pump systems may result in the bit being damaged or in blow-out situations. The mud pump control system should be able to control the mud pumps to ramp or down the pumping rate, or control the mud pressure. The mud pump control system should also ensure that mud is pumped in the correct direction and also the mud pump rate. If certain pressure thresholds are reached the mud pump control system should not command a halt but automatically ramp down the pump speed.

A separate class of drilling operation control systems may be classified as the pipe handling control system equipment. There are several sub-systems that can be categorized under pipe-handling equipment:

• Horizontal & Vertical pipe handlers (guide/racking arms)
• Horizontal to vertical pipe handlers
• Manipulator arms
• Elevators
• Slips (air/hydraulic operated)
• Iron roughneck, M/U torque, Rig tong/Eazy Torque, Remote operated CSG tongs

These systems are all controlled by different control systems regulating the movement of the movable parts of the pipe handling equipment, and the control systems should in general control and verify the movements, the positioning and the torques required for the pipe handling operations. The different operations and the control of them, although relatively simple, should be tested for errors.

In the background art the BOP and diverter are not controlled by the integrated drilling control system. However the BOP should be controlled at all times during drilling to prevent potentially dangerous situations from occurring. Thus one may consider the BOP control system as being part of the overall integrated control system when drilling, and it should provide control signals for opening and closing valves and receiving signals indicating valve position, receiving pressure signals for providing command signals for adjusting pressure on manifold and annular preventers. The same applies for controlling the choke manifold. BOP control is essential for avoiding potential blow-outs.

Anti-Collision Control Systems

There are basically two control systems for Anti-collision; Anti collision system are designed to prevent the travelling block with the top drive from colliding with other pipe handling equipment inside the derrick. These systems are provided with proximity sensors and/or the calculation of the position of the travelling block. Crown saver and floor saver systems are designed to prevent the travelling block from either, hitting the sheaves on top of derrick, or hitting the drill floor. These systems are based on calculations of height, weight and speed on block and top drive and proximity sensors.

The basic function of both these control systems is to continuously furnish sensor signals providing the driller an overview over the position of all involved components and to furnish alarms to all operators of the racking system as well as to the driller when some components are in danger of collision. Some systems may also comprise systems allowing the bypass of some components out of the system. Accordingly the anti collision system should amongst others adequately be able to:

• continuously define where the travelling block and top drive are situated,
• continuously define the travelling block speed and the top drive speed,
• continuously define total weight of the travelling block and top drive system,
• continuously define where all racking and stabbing arms and iron roughneck are situated,
• furnish alarms to all operators of the racking system and the driller when some components are in danger of collision,
• discontinue operation of components in danger of collision with the travelling block and top drive, and release the draw-work clutch, and possibly reduce the travelling block and top drive speed by using electrical brake or finally stop the travelling block and top drive with the emergency brake,
• prevent lifting of drill string compensator when travelling block and top drive are in danger of collision underneath the crown.

The anti-collision control should system should also amongst others control the following brake systems:

• Main brake; normally a band brake two separate band with an equalizer bar in-between on the draw work drum.
• Emergency brake; Disc brake & band brake will be actuated with a mechanically spring loaded actuator package, (failure safe). In normal operation will the hydraulic pressure keep those spring package open.
• Other brake systems may be envisaged such as an electrical brake fitted directly on the draw work main shaft.

A typical shut down draw work sequence might be to release the clutch, actuate the electrical brake and engage the emergency brake.

There are a plurality of situations which may arise if one or more of the sensors or control signals or interconnections between the two, or the control algorithms are faulty or the signal lines are defunct. The examples given below are in no way exhaustive, and merely give an indication of the failures likely to occur. It should be noted that any errors resulting from failures, failure modes, or functional faults of the systems or any combination thereof should be tested according to the method of the invention.

A failure in the proximity position sensors may result in components that may be operated in sectors where the top drive swivel travelling block may be run, without any warnings for the operators. In order to prevent this situation from occurring separate and independent sensor systems may be arranged, however if the control system incorrectly interprets the signals or failure alarms are not issued or neglected, collision may occur.

In situations in which the travelling block and top drive systems are extended when one or more components are in unsafe zones collisions may occur. Collisions may also occur when the travelling block and top drive systems are in the well center.

In case of the electrical drive work failing, the drive work emergency brake is unable to stop the travelling block before collision with drilling floor, crown block or racking arms. This may evidently also occur when using conventional non-electrical drive work brakes.

The drive work emergency brake may break down resulting in that the travelling block and top drive swivel hitting the drill floor even after the emergency brake has been engaged. This will result in damage to the travelling block and top drive swivel.

If the drill string compensator is raised when the travelling block and top drive swivel is close to the crown the travelling block may hit the crown block.

Drilling Control System Test

A HIL-test package, for HIL-testing of the drilling control software and control systems has been developed. This software comprises the main drilling equipment such that the drilling control systems and subsystems may be driven and tested. The sub-systems with dynamics and failure modes that are included in the drilling simulator comprise:

• Top Drive, Draw Work, Mud Pumps, Pipe handling equipment with sub systems, Heave compensating equipment, and possibly BOP systems.

The testing according to the invention comprises functional tests, that is verification of computer system functions and modes and failure tests, i.e. testing of computer system detection and handling of failure modes. A possible HIL-configuration according to the invention is shown in FIG. 2.

Further to the device embodiment of the invention defined in claim 1, the invention is also embodied as a method for testing an integrated control system (1), said integrated control system (1) for controlling a drilling unit (2) during drilling operations, said integrated control system (1) comprising

• a DCS (3) arranged for receiving sensor signals (31) related to said drilling operations and for providing control signals (33) to a drilling system (7) so as for conducting the desired drilling operations,
• said DCS (3) arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems,
• said testing comprising providing erroneous, simulated, real or modified signals, or a combination thereof, to said integrated control system (1) for testing for errors in said integrated control system (1) resulting from failures or faults in one or more control subsystems within said integrated control system or from failures or faults in the interactions between control subsystems within said integrated control system (1) or from a combination thereof.

According to an embodiment of the invention, a so-called FMEA (Failure mode and effect Analysis) may be conducted. An FMEA test procedure involves leaving at least some of the control systems in place in the control loop, but routing some of the signals to and from the integrated control system out of the system to a signal modifying computer (80) wherein said signal modifying computer modifies one or more of said signals routed thereto and transmitting said signals back to the required systems to be controlled. In this manner the signals may be modified such that the real signals may be given bias, delays, changes in amplitude, changes in voltage and so forth. This kind of testing is well-adapted when testing control systems having relatively slow responses. A possible FMEA test type configuration is indicated in FIG. 3.

In the device according to the invention, the integrated control system (1) may comprise a power management system (4) for controlling a power plant (6), wherein said DCS (3) is arranged for receiving sensor signals (31) related to said drilling operations and providing control signals (32) to said PMS (4) stating the energy requirements of said drilling system (7), for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said power management system PMS (4).

Such errors may arise when said power plant (6) is not able to provide adequate power to the drilling operations (7), when there are errors in the transmission of signals, there is faulty wiring, there are incompatibilities between the signal DCS (3) and the PMS (3), there are faults or failures in either sensors, receivers, signal lines, the control systems and the like.

The drilling control system may draw energy from the same power system as does the DP actuators when the drilling control system is arranged on a drilling vessel (2). Therefore, further to the above, the integrated control system (1) may comprise a dynamic positioning control system DP (5), wherein said DP control system (5) is arranged for providing DP power control signals (51) to a power management system PMS (4), said DP control system (5) arranged for controlling the positioning of said drilling vessel (2) by furnishing positioning control signals (52) to actuators (21) of said drilling vessel (2), said DP power control signals (51) stating the energy requirements of said actuators (21), said actuators (21) arranged for receiving power from said power plant (6), said device for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3), said power management system PMS (4), and/or said DP (5).

As the DP (5) the PMS (4) and the DCS (3) may in many situations all be interconnected in order for assuring the required operation of the drilling vessel in an integrated control system (1). The integrated control system (1) is in an embodiment of the invention tested with regard to all faults and failures that may occur while operating an integrated control system (1) comprising the three mentioned control systems. The DP (5) and the DCS (3) both send power control signals to the PMS (3), and there may also be some interactions directly or indirectly between the DP(5) and the DCS(3).

The integrated control system (1) may comprise a dynamic positioning control system DP (5), wherein said DP (5) is arranged for controlling the position of said drilling vessel (2), and wherein said device is arranged for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said DP (5).

In the device according to the invention said integrated control system (1) may be disconnected from the vessel (2) and connected to a vessel simulator (100) such that said system is tested in a hardware-in-the-loop configuration such as indicated in FIG. 1.

In the device according to the invention at least one or more of the signals are received by said integrated control system (1) are real and wherein one or more of said real signals are modified in a signal modifying computer (80) before being furnished to said integrated control system (1), for the failure mode and functional mode testing of said integrated control system (1).

The system and device according to the invention is well-adapted to testing integrated control systems (1) after the entire control system (1) has been installed on location. A particular problem with such systems is that there may be a plurality of sub-contractors who deliver different parts of the control structure for the DCS (3) or the integrated control system (1). Although each separate part of the integrated control system (1) may have been exhaustively tested before delivery, these tests are not able to disclose errors due to interactions between the various components in the system if they have been delivered by different vendors. It is an object of the invention to analyse the integrated control systems ability to detect and handle such errors. A separate problem arises if parts of the integrated control system needs to be replaced or modified after installation, as even though the system may have performed in an adequate manner before the changes, the addition or modification of system components may destabilise the system, or introduce errors which have not been envisaged. it is an object of the present invention to resolve these problems. The modification of parts of the integrated control system may comprise the updating or replacement of parts of the control software or hardware, or even entire portions of the control system itself.

If one or more of the physical components controlled by the integrated control system (1) is replaced there will be a need to verify whether the new apparatus may be smoothly integrated into the control superstructure, and it is an object of the present invention to test whether the integrated control system functions adequately after replacement of soft of hardware.

As is clear the testing device according to the invention may serve as a device for testing of each component of the integrated control system as well as serving as for the testing of the portions of the integrated control system as such. As it is possible to simulate all the different portions of the integrated control systems it is evident that all portions apart from one may be simulated such that the device may serve as a testing device for a single device within the integrated control systems. The flexibility of the device is of major practical importance, and will furthermore easily allow the addition of further simulators to the system, for the simulation of additional parameters.

In an embodiment of the invention, several simulators may be part of the testing device, wherein each simulator simulates different operations. This allows the distribution of the testing to several simulators, thus allowing the simulation to run in real time without risk of lag. In this embodiment of the invention the simulators may be geographically distributed such that it is possible to connect a simulator to the control unit to be tested without moving the physical control unit. The simulators will in this embodiment of the invention run concurrently such that the feedback signals and the control signals from the other simulators will correspond internally. In this embodiment of the invention, the device may be considered as being a distributed test system for an integrated control system (1), wherein portions of the test system are not located in the same area. The intercommunication between the simulators may be controlled by a central communication unit, or the signals may be distributed by other known means.

As has been mentioned the test targets may be tested being isolated or connected to and controlling the real systems in an FMEA mode. The different test modes allow different testing algorithms and thus should also encompass different functionalities. The simulators for test of isolated systems should comprise functions for simulating the real systems such as drilling equipment, vessel power systems, vessel movements and the like, wherein these systems are arranged for taking commands from and giving feedback to the tested control systems. In an embodiment of the invention, one might also simulate other control systems interacting with the tested control system. In this manner subportions of the command structure may be tested, or links in a command chain or the like.

The simulators for FMEA mode testing should simulate signal failures in signals, often command and feedback systems between controllers. This may be performed by manipulating one or more of the signals as described above.

In FMEA mode the control systems may also be operable for commands such that the system to some degree may test the human machine interface of the control systems. This kind of testing allows more realistic testing of the faults and errors an operator may incur in the systems, and may prove very valuable. There are many situations which might be difficult to envisage happening in any normal circumstance that a human being inexperienced or unlucky might incur. There should be the possibility of testing for such errors as well, a possibility that the present invention thus allows.

The HIL simulator should test for the correct configuration of the Human Machine interface (HMI). This may typically include testing whether the control system presents correct feedback at the correct place in the HMI. This may also include testing whether the operator input results in the desired action.

HIL-Simulator Specifications.

In order for allowing the various functionalities of the testing device according to the invention the HIL-simulator should fulfil a number of criteria. The HIL-simulator should function in real time such that there is little lag in the signal treatment. This is of importance such that the testing occurs in a realistic manner.

The simulator should in an embodiment of the invention be the main signal hub such that the input and output signals from the test target should be routed to and from the HIL-simulator, and not to the real system. In this configuration the control system will respond to feedback signals directly from the HIL simulator or simulators. At the same time the control system to be tested will command the HIL simulators such that it should not in principle be able to distinguish the HIL simulator from the real system.

The HIL simulator should furnish consistent feedback to all systems being connected to it also when simulating failure modes on signals and on equipment. This should include situations wherein signal failure modes affecting feedback or command signals to and from the test target are simulated. In effect this implies that when failure mode on one or more feedback signals are simulated the simulator should run unaffected of this simulated error. Thus solely the one or more signals being simulated as malfunctioning should be affected, whereas the other signals should remain unaffected.

This further implies that when failure modes on simulated equipment typically having a simultaneous and dynamic effect on several feedback systems are to be simulated one should in fact be able to do so. The simulator, being part of the testing device according to the invention is thus able to simulate how the failure affects the system, and further to furnish relevant feedback signals to the control system or systems being tested. This further implies that there should be consistency between the signals in order for allowing the realistic testing.

Examples of the necessary consistency between the signals may include

• Proximity sensor feedback and position measurement feedbacks
• Consistency between status of electric power systems and ability of variable speed drives to follow commands
• Consistency between VRU sensors and riser tension sensors
• Consistency between status of hydraulic systems and ability of hydraulic systems to follow commands
• Commanded torque and tension feedback.
• This list is evidently non-exclusive as there are a large number of other signals that should show consistence as is evident to a person skilled in the art.

There are also various required failure modes one should be able to simulate which may comprise

• Loss of power to electric motors
• Loss of hydraulic pressure to actuators
• Brake failure
• Move or rotation of equipment inhibited

This list is evidently non-exclusive as there are a large number of other failure modes that should be simulated as is evident to a person skilled in the art. Evidently several of the failure modes should be able to be simulated concurrently, as should other scenarios which are envisageable. A combination of the different failure situations may also be simulated according to the invention.

There are a large number of signal failures one should be able to simulate such as those listed below:

• Inconsistency in digital feedback signals
• Inconsistency in analogue feedback signal
• Inverted digital signal
• Frozen digital signal
• Flicking digital signal
• Frozen analog signal
• Noise on analogue signals
• Drift in analogue signals
• Offset on analogue signals
• Fails to maximum /out of range
• Fails to minimum/out of range

This list is evidently non-exclusive, and as is evident several should be able to be simulated concurrently.

According to an embodiment of the invention the signals to and from the simulator or simulators and the control system may be interfaced either by hardwire, by bus interface, by a combination thereof or by any other suitable signal transfer means as is known to a person skilled in the art.

As shown in FIG. 4 the device for testing of the DCS may comprise a large number of subsystems wherein one or more may be used concurrently. In an embodiment of the invention, the system as such is modular such that features which have not been added as of yet may be added a later point in time. FIG. 5 shows a generic test set up for HIL testing of a drilling system. The number of switches, PC's, interfaces and systems to be tested may evidently be varied according to need.

The invention thus presented will thus be able to test an integrated control system arranged for controlling a drilling unit (2).

Claims

1. A device for the testing of an integrated control system (1) wherein said integrated control system (1) is arranged for controlling a drilling unit (2), said drilling unit (2) arranged for drilling operations, said integrated control system (1) comprising

a drilling control system DCS (3) for controlling a drilling system (7),

said DCS (3) arranged for receiving sensor signals (31) related to said drilling operations and for providing control signals (33) to said drilling system (7) so as for conducting the desired drilling operations,

said DCS (3) arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems,

said device arranged for the testing for errors in said integrated control system (1) resulting from failures or faults in one or more control subsystems within said integrated control system or from failures or faults in the interactions between control subsystems within said integrated control system (1) or from a combination thereof.

2. The device of claim 1, wherein said integrated control system (1) further comprises a power management system (4) for controlling a power plant (6), wherein said DCS (3) is arranged for receiving sensor signals (31) related to said drilling operations and providing control signals (32) to said PMS (4) stating the energy requirements of said drilling system (7), for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said power management system PMS (4).

3. The device of claim 2, wherein said integrated control system (1) further comprises a dynamic positioning control system DP (5), wherein said DP control system (5) is arranged for providing DP power control signals (51) to a PMS (4), said DP control system (5) arranged for controlling the positioning of said drilling unit (2) by furnishing positioning control signals (52) to actuators (21) of said drilling unit (2), said DP power control signals (51) stating the energy requirements of said actuators (21), said actuators (21) arranged for receiving power from said power plant (6), said device for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3), said power management system PMS (4), and/or said DP (5).

4. The device of claim 1, wherein said integrated control system (1) further comprises a dynamic positioning control system DP (5), wherein said DP (5) is arranged for controlling the position of said drilling unit (2), and wherein said device is arranged for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said DP (5).

5. The device of claim 1, wherein said integrated control system (1) is disconnected from the vessel (2) and connected to a vessel simulator (100) such that said system is tested in a hardware-in-the-loop configuration.

6. The device of claim 1, wherein at least one or more of the signals received by said integrated control system (1) are real and wherein one or more of said real signals are modified in a signal modifying computer (80) before being furnished to said integrated control system (1), for the failure mode and functional mode testing of said integrated control system (1).

7. The device of to claim 1, wherein said DCS (3) is arranged for controlling at least one or more of the following units for drilling operations:

top drive equipment,

draw work equipment,

mud pump equipment,

pipe handling equipment,

drill string heave compensating equipment,

riser heave compensating equipment, and

blow-out preventer valve equipment.

8. The device of claim 1, wherein said DCS (3) is arranged for controlling an anti-collision system, said anti-collision system comprising one or more of the following:

a crown saver

a floor saver

pipe handling equipment.

9. The device of claim 1 wherein said DCS (3) is arranged for controlling an active heave compensating system.

10. The device according to claim 1 wherein the testing device comprises a plurality of subsidiary test devices.

11. A method for testing an integrated control system (1), said integrated control system (1) for controlling a drilling unit (2) during drilling operations, said integrated control system (1) comprising

a DCS (3) arranged for receiving sensor signals (31) related to said drilling operations and for providing control signals (33) to a drilling system (7) so as for conducting the desired drilling operations,

said DCS (3) arranged for controlling a plurality of drilling operations and comprising a plurality of control subsystems,

said testing comprising providing erroneous, simulated, real or modified signals, or a combination thereof, to said integrated control system (1) for testing for errors in said integrated control system (1) resulting from failures or faults in one or more control subsystems within said integrated control system or from failures or faults in the interactions between control subsystems within said integrated control system (1) or from a combination thereof.

12. The method of claim 11 wherein said integrated control system (1) further comprises a power management system PMS (4) controlling a power plant (6), said power plant (6) providing power to said drilling system (7);

said DCS (3) receiving sensor signals (31) related to said drilling operations and providing control signals (32) to said PMS (4) stating the energy requirements of said drilling system (7), for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said power management system PMS (4).

13. The method of claim 12 wherein said integrated control system (1) further comprises a dynamic positioning control system DP (5), wherein said DP control system (5) provides DP power control signals (51) to said PMS (4), said DP control system (5) for controlling the position of said drilling unit (2) by furnishing positioning control signals (52) to actuators (21) of said drilling unit (2), said DP power control signals (51) stating the energy requirements of said actuators (21), said actuators (21) receiving power from said power plant (6), for errors resulting from interactions between said drilling control system DCS (3), said power management system PMS (4), and/or said DP (5).

14. The method of claim 11 wherein said integrated control system (1) further comprises a dynamic positioning control system DP (5), wherein said DP (5) is arranged for controlling the position of said drilling unit (2), for testing said integrated control system (1) for errors resulting from interactions between said drilling control system DCS (3) and said DP (5).

15. The method of claim 11, wherein said integrated control system (1) is disconnected from the drilling unit (2) and connected to a vessel simulator (100), replacing real sensor signals 0 with simulated sensor signals ( ) using a desired initial state of said vessel simulator (100), said vessel simulator (100) responding to control signals from said integrated control system (1), such that said integrated control system (1) is tested in a hardware-in-the-loop configuration.

16. The method of claim 11, wherein at least one or more of the signals received by said integrated control system (1) are real and wherein one or more of said real signals are modified in a signal modifying computer (80) before being furnished to said integrated control system (1), for the failure mode and functional mode testing of said integrated control system (1).

17. The method of to claim 11, wherein said DCS (3) controls at least one or more of the following units for drilling operations:

top drive equipment,

draw work equipment,

mud pump equipment,

pipe handling equipment,

drill string heave compensating equipment,

riser heave compensating equipment.

18. The method of claim 11, wherein said DCS (3) is arranged for controlling an anti-collision system, said anti-collision system comprising one or more of the following:

a crown saver

a floor saver

pipe handling equipment.

19. The system of claim 11 wherein said DCS (3) is arranged for controlling an active heave compensating system.

20. The system of claim 11 wherein said drilling unit (2) is a fixed or floating drilling unit arranged for drilling wells on- or offshore.