World Oil
®
Originally appeared in
SPECIAL FOCUS: MANAGED PRESSURE DRILLING
Independent HIL testing brings systematic,
effective verification of MPD systems
Independent HIL testing was proven to
be a systematic, effective method for
assessing control system software for MPD
applications, and served as a key element in
qualifying a new technology.
ŝŝBJØRNAR VIK, Marine Cybernetics; JOHN-MORTEN GODHAVN
and ESPEN HAUGE, Statoil; and ERLEND MJAAVATTEN, AGR
Enhanced Drilling
Managed pressure drilling (MPD) systems are becom-
ing more automated, allowing for improved pressure ma-
nipulation and providing the ability to drill previously
undrillable wells.
However, the increased automation and complexity of con-
trol system software means that verification efforts should be
more rigorous. While traditional risk analysis is both useful and
necessary, verification through hardware-in-the-loop (HIL)
testing has the advantage of testing actual running code. A thor-
ough testing process also increases the knowledge about, and
confidence in, the control system.
This article describes the verification performed during the
development of the new EC-Drill MPD system. EC-Drill, devel-
oped by AGR Enhanced Drilling, is a system with a subsea pump
module that was designed to control BHP, by managing the level
of the drilling fluid in the riser. The system incorporates new con-
trol capabilities, and initial usage was planned for first-quarter
2014, in a subsea field offshore Norway.
The subsea pump module is a central part of the EC-Drill system.
38 MARCH 2014 / WorldOil.com
MARCH 2014 issue, pgs 39-42. Posted with permission.
BACKGROUND
EC-Drill represents an advance in MPD technology for float-
ing drilling rigs. It controls downhole pressure accurately, pro-
vides fast detection of influx and losses, and enables the drilling
of previously undrillable wells. These advances are made possible
by employing new control system software that manages the mud
level in the riser.
The mud column is the primary safety barrier for drilling,
the secondary being the blowout preventer (BOP). Much focus
has been put on BOP reliability. An example is the minimum
safety integrity level (SIL) defined for BOP functions on the
Norwegian Continental Shelf (NCS), while there are no such
requirements for the mud column.¹ The decision not to have
any minimum SIL requirements is explained by arguing that the
BOP can be regarded as the safety system for the mud column,
and that the impact of the instrumented systems monitoring re-
liability of the mud circulation system is marginal.¹ The latter
argument may have been true, when it was written, but, with
increased levels of automation, the MPD software has become
more critical, as MPD systems automatically control the pres-
sure exerted by the mud column. This is supported by a recent
article written by Det Norske Veritas, which has experienced
considerable demand for third-party evaluation of recently in-
troduced MPD systems.² This is particularly true, if the mud
weight is so low that an error in the MPD or rig systems, e.g., a
power loss, can lead to an underbalanced situation.
In the technology qualification prior to the EC-Drill system’s
use on the NCS, Statoil and AGR Enhanced Drilling agreed to
have a comprehensive third-party verification of the control sys-
tem software. To this respect, Marine Cybernetics was contracted
to perform HIL testing, to expose the full capability and robust-
ness of the software. This was the first HIL test for an MPD sys-

tem, but Marine Cybernetics has previously tested several drill-
ing control systems, BOP control systems, and a large number of
maritime control systems.³, ⁴
WHAT IS HIL TESTING?
HIL testing is an efficient black-box method for testing and
verifying control system software. Instead of being connected to
the actual equipment, the control system is connected to an HIL
simulator, with sophisticated models of the equipment being con-
trolled. This enables systematic, comprehensive testing of control
system design philosophy, functionality, and failure handling ca-
pability, both in normal and off-design operating conditions. A
key advantage is that testing can be performed at an early stage,
and in a safe test bed, without risk to personnel, equipment, the
well or the environment. In the automotive, avionics and aero-
space industries, HIL testing has been established as a best prac-
tice, to meet the requirements for performance and reliability.
CONCEPT
As seen in Fig. 1, a control system interacts with its sur-
roundings through a set of Input/Output (I/O) communica-
tion channels. Inputs are provided by sensors that measure
dynamic states and parameters, as well as inputs from operator
stations and other control systems. Based on its inputs and in-
ternal models, the system calculates control signals that are then
sent to actuators.
HIL testing isolates the control system, and its operator sta-
tions, from its surroundings, and replaces actual inputs with simu-
lated inputs from an HIL simulator. The HIL simulator emulates
all the control system surroundings, responds to control signals
in a realistic manner, and provides realistic, consistent measure-
ments. The control system cannot sense any difference between
the real world and the virtual world in the HIL simulator.
In HIL testing, the control system is viewed as a black box,
meaning no first-hand knowledge of the inner workings of the
system is necessary. However, a functional description of the sys-
tem is needed to establish a proper test scope. In addition, detailed
knowledge of the system I/O, and the equipment under control, is
necessary to develop a sufficiently accurate simulator.
TESTING PROCESS
In the planning phase of the HIL testing process, the most
Fig. 1. HIL testing conceptual setup.
Vessel, vessel systems,
Normal operation environment
Control signals
Actuators
Control
I/O
system
Measurements
Sensors
HIL testing HIL simulator
Control signals Simulated
actuators
Control
Simulated
I/O
system
measurements Simulated
sensors
MANAGED PRESSURE DRILLING
relevant documentation is collected, to get an overview of the
system, define interfaces, decide which components to include in
the laboratory, and which components to simulate.
The planning phase is followed by the preparations phase,
where system analysis and test design are the key activities.
The system analysis is similar to a hazard and operability study
(HAZOP) and Failure Mode and Effects Analysis (FMEA), but
focuses on the control system software. The system analysis is fol-
lowed by test design, where test cases are created and prioritized,
according to a number of factors. Standard systematic testing
techniques, such as boundary value analysis, equivalence parti-
tioning, error guessing, scenario testing, state transition testing
and stress testing, are used.
However, system analysis can only take you so far, if the docu-
mentation is not sufficiently complete. In this case, exploratory
testing is used. Exploratory testing relies upon the skills of the tes-
ters, their knowledge of the system and the interpretation of pre-
vious test results. In exploratory testing, new tests are constantly
created and used. These tests can be powerful and efficient,
because they are based on the tester’s continuously increasing
knowledge about the testing target system.
Herein is another key difference between FMEA and HIL
testing. The FMEA is a desktop study that reveals possible weak
points in the physical design, and points to critical software func-
tions that deserve increased attention. This provides important
input to the HIL testing, which is performed by running the actu-
al control system code. The insight gained from testing and oper-
ating the control system in different scenarios during HIL testing
can provide essential information on the functionality and failure
handling capabilities of the control system software, which may
be included in the FMEA.
THE MPD SYSTEM: EC-DRILL
The AGR Enhanced Drilling EC-Drill system is an MPD sys-
tem that enables the manipulation of the riser level, by pumping
returns from the riser up to the rig. This is done with a subsea
pump module docked on a specially designed and instrumented
riser joint, Fig. 2. In addition to these two, key subsea compo-
nents, the system has a topside counterpart, which includes a
launch and recovery system; control and operator containers;
and an additional operator position.
During drilling, the EC-Drill system greatly reduces the need
to manipulate mud weight. Instead, the mud level in the riser can
Fig. 2. The EC-Drill subsea pump module, docked on the riser.
Dynamic
systems
Simulated
dynamics
World Oil / MARCH 2014 39
MANAGED PRESSURE DRILLING
be manipulated freely, allowing the BHP to be controlled, Fig. 3.
The system is based on proven technology from AGR Enhanced
Drilling’s Riserless Mud Recovery System (RMR) and Cuttings
Transportation System (CTS).⁶ These systems are in continuous
operation worldwide, and have been used to drill more than 500
wells. The capabilities of the first version of EC-Drill were shown
in the Gulf of Mexico in 2012.⁷, ⁸, ⁹
Fig. 3. Pressure gradients, when drilling with EC-Drill.
STATOIL INVOLVEMENT
Statoil has, for some years, applied automatic MPD operations
successfully in the North Sea on fixed platform rigs, and has a keen
interest in supporting development of a viable MPD technology
to be used on floating drilling rigs.⁵ The EC-Drill solution was
preferred over the backpressure MPD solutions, largely because
of the decrease in rig heave-induced BHP variations; no concern
regarding riser pressure rating; the use of overbalanced mud den-
sity; and no risk of RCD failure. AGR Enhanced Drilling and
Statoil have collaborated closely to specify system requirements
for the first use of EC-Drill on the NCS, and Statoil has partly
funded this development.
AGR Enhanced Drilling decided to develop a new control sys-
tem to meet the increased requirements for the EC-Drill system,
especially with respect to fault tolerance and redundancy. The
control system is a vital part of EC-Drill, as it governs the BHP
and supervises the volume balance, among other functions.
The new control system has been designed in accordance
with governing industry standards and Statoil’s technical re-
quirements, and AGR Enhanced Drilling and Statoil have veri-
fied the technical solutions in an extensive testing and qualifica-
tion program. In this program, the technology readiness level
is assessed, and a plan is developed to mature the technology.
The HIL testing by a third party was a part of this program, as
it was used to partially qualify the new control system before
going offshore. The idea is to avoid spending rig time to make
the control system work properly, and to increase the system’s
safety level and confidence.
HIL TESTING OF THE EC-DRILL SYSTEM
Good preparations are the key to a successful HIL test. Thor-
ough system analysis and test design were performed, based on:
documentation from AGR Enhanced Drilling; Statoil require-
ments; standards and guidelines; and risk assessment documents.
40 MARCH 2014 / WorldOil.com
Table 1 shows examples of tests covered by the program.
A good testing program is important for test efficiency and
quality, and feedback from stakeholders is very important for a
good testing program. The testing program was, therefore, sent
out to all parties for review before testing began, and several itera-
tions were made before it was finalized.
Table 1. Tests covered by the program.
Type of tests Test cases
Functional tests Operational modes, such as manual/auto-
matic modes and change of pressure setpoints
Drilling procedures, such as startup/shut down
of rig pumps, increase/decrease riser level and
tripping in/out
Influx and loss detection
Equipment failures VSD failures
Subsea pump and motor failures
Valve failures
Signal failures Loss of communication
Sensor failures
Loss of power to control system components
Network storm to stress the network
communication
TESTING LAB
An HIL testing lab was built in Trondheim, Norway, and it in-
cluded both topside and subsea control system modules from AGR
Enhanced Drilling, and necessary interface to the Marine Cyber-
netics HIL simulator. In this project, the well, riser, drilling equip-
ment and subsea pump were included in the HIL simulator, Fig. 4.
An interface and commissioning test was performed, before
the HIL testing started. The purpose of this test was to verify all
I/O addressing, ensure that all functions in the EC-Drill control
system could be operated, and verify correct behavior and feed-
back from the HIL simulator.
Fig. 4. EC-Drill system and the components simulated for the HIL
test.
TEST CONDUCTION
After initial control system software was downloaded from
AGR Enhanced Drilling, to the laboratory, software test 1
(SWT1) commenced. The main goal for SWT1 was to verify

the functionality and robustness of the control system soft-
ware, as extensively as possible. During testing, any discrep-
ancy from the expected testing result was noted by the test
operator, and filed as testing observations for further analysis.
Any issues that were found to require more thorough testing
were noted, and new exploratory tests were created to be run
at the end of testing.
This software test was completed in 10 days, with both AGR
Enhanced Drilling and Statoil present at all times. Every third
day, all parties met for a summary meeting to discuss testing
observations. In the summary meetings, each recorded test re-
sult was processed and discussed. The nature of the test result
was concluded; each software failure was given a severity grade
and categorized as a finding; and actions for following up each
finding were planned. This included priorities and deadlines for
updates. After testing was completed, a final summary meeting
was set up to conclude upon all items.
The second test, software test 2 (SWT2), was started after
AGR Enhanced Drilling finished updating its control system soft-
ware, based on the agreed actions from SWT1. The main objec-
tive of SWT2 was to re-test items found during SWT1, to check
if they had been fixed and were working as intended. Additional
spot checks were carried out, to verify that system functionality
and robustness were preserved, and to check for any unintended
consequences from fixing the items after SWT1.
OUTCOME OF TESTING
In this project, AGR Enhanced Drilling and Statoil were ac-
tive participants throughout the testing process. In general, the
value of an HIL test is not just seen in the ability to make system
improvements, based on findings. The HIL test also:
• Gives insight and understanding of software barriers, haz-
ards, failure modes and effects
• Helps implement procedures and training, to handle dis-
covered software weaknesses
• Assures that the system operates correctly under certain
conditions.
Even though the new control system has gone through ex-
tensive testing of a more traditional character, such as Extended
Factory Acceptance Testing (EFAT) and Site Integration Test-
ing, the HIL lab was available at an earlier stage than much of the
equipment required for doing full-scale testing in the workshop.
The schedule for the EC-Drill project was very tight, and the HIL
testing helped bring potential issues and misunderstandings to
the table at an early stage. The test laboratory can be re-used for
new projects, and for the testing of future upgrades to the EC-
Drill system.
CONCLUSIONS
MPD solutions are advancing quickly. New systems, such as
EC-Drill, enable drilling of deeper, more challenging wells, due to
accurate and fast pressure control. However, the new systems also
rely more on control system software, which means that verifica-
tion of the functionality and robustness of this software is critical.
Extensive and early verification is important to reduce rig com-
missioning and non-productive time during operations.
In this project, independent HIL testing has proven to be a
systematic, effective method for assessing the control system soft-
ware, and was key in the technology qualification process. The
main added value from the HIL testing was both in system im-
Article copyright © 2014 by Gulf Publishing Company. All rights reserved.
Not to be distributed in electronic or printed form, or posted on a website, without express written permission of copyright holder.
MANAGED PRESSURE DRILLING
provements, based on findings, and in the detailed walk-through
of the control system in a safe environment. This, in turn, facili-
tated constructive discussions between the tester, customer and
supplier, ultimately leading to a better, safer control system.
REFERENCES
1. OLF 070, “Recommended guidelines for application of IEC 61508 and IEC 61511 in the Norwegian
petroleum industry,” Norsk Olje og Gass, 2004.
2. Handal, A., S. Øie and M. L. Lundteigen, Det Norske Veritas AS, “Risk assessment targets well control
functions of MPD operations,” Drilling Contractor, July 2013.
3. Pedersen, T. and Ø. Smogeli, “Experience from Hardware-in-the-loop testing of drilling control sys-
tems,” SPE paper 163509-MS, SPE/IADC Drilling Conference and Exhibition, Amsterdam, March
2013.
4. Pivano, L. and Ø. Smogeli, “Independent HIL testing of DP systems—A life-cycle perspective,” First
Brazilian Conference on Dynamic Positioning, Rio de Janeiro, April 2013.
5. Godhavn, J.-M., “Control requirements for high-end automatic MPD operations,” SPE paper 119442,
SPE/IADC Drilling Conference and Exhibition, Amsterdam, 2009. Journal version: Control require-
ments for automatic managed pressure drilling system, SPE Drilling & Completion, Vol. 25, No. 3, pp.
336-345, September 2010.
6. Stave, R., R. Farestveit, S. Høyland, P. O. Rochmann and N. L. Rolland, “Demonstration and
qualification of a riserless dual gradient system,” SPE paper 17665, Offshore Technology Conference,
Houston, May 2005.
7. Mir Rajabi, M., K. Toftevag, R. S. Stave and R. Ziegler, “First application of EC-Drill in ultra-deepwa-
ter—Proven subsea managed pressure drilling method, SPE paper 151100, 2012.
8. Ziegler, R., P. Ashley, R. F. Malt, R. Stave and K. R. Toftevåg, “Successful application of deepwater
dual gradient drilling (SPE 164561),” 2013.
9. Ziegler, R., M. S. A. Sabri, M. R. B. Idris, R. Malt and R. Stave, “First successful commercial applica-
tion of dual gradient drilling in ultra-deepwater GOM,” SPE paper 166272, 2013.
BJØRNAR VIK has worked at Marine Cybernetics since
2004, and as a principal engineer since 2007. He also
serves as an adjunct associate professor at the
Department of Engineering Cybernetics at the
Norwegian University of Science and Technology
(NTNU). He holds MS and doctorate degrees, both from
the Department of Engineering Cybernetics at NTNU.
JOHN-MORTEN GODHAVN joined Statoil in 2001, and
currently works as an MPD specialist in Houston. He holds
MS and doctorate degrees in engineering cybernetics
from the Norwegian University of Science and
Technology (NTNU). Since 2010, Mr. Godhavn has been
an adjunct professor at the Department of Petroleum
Engineering and Applied Geophysics at NTNU.
ESPEN HAUGE joined Statoil as a senior researcher in
2013. He works with deepwater drilling, and his research
interests are in MPD and automated drilling. Mr. Hauge
holds MS and doctorate degrees in engineering
cybernetics from the Norwegian University of Science
and Technology (NTNU).
ERLEND MJAAVATTEN is AGR Enhanced Drilling’s
control system development manager. He joined the
company in 2009, and has a background in subsea
boosting systems, oil spill management systems and
other marine automation systems. Mr. Mjaavatten holds
an MS degree from the Department of Engineering
Cybernetics at NTNU.
Printed in U.S.A.
World Oil / MARCH 2014 41