2010 © Marine Cybernetics

Hardware-In-the-Loop (HIL)
Simulator Testing

Vestre Rosten 77
NO-7075 Tiller, Norway
www.marinecybernetics.com
Securing the integrity of your control systems 20010 © Marine Cybernetics
 Outline

• Why Hardware-In-the-Loop (HIL) testing

• Experiences from independent HIL testing of DP

Systems and Power Management Systems (PMS)

• Independent HIL testing of Drilling Control

Systems (DCS)

• Conclusions

Securing the integrity of your control systems 2010 © Marine Cybernetics

“From sledge hammer to space shuttle…”
Megatrends:
• Technology shift from mechanical to computer-controlled vessels
• Penetration of information and communication technology is increasing with impact
everywhere
• Errors in computer systems are critical for safety and capability to perform marine and
offshore operations

The Digital “Big Bang”

Instruments Communication
and networks HMI
sensors
I/O
SW
Controllers Products
Power Configuration
PC
systems
AUTOMATION
Testing
Application
solutions Remote Internet
Services
MS Windows Integrated
Operational systems
systems Stand-alone
systems

Securing the integrity of your control systems 2010 © Marine Cybernetics

Technology for computer testing has been lagging behind

Independent testing and certification:

• Third party testing and certification of traditional marine
and offshore technology (structures and HW systems) are
a well developed market served by class societies and
independent FMEA consultancies
• Marine Cybernetics enters the market as an independent
test supplier of computer based systems with unique change
Hardware-In-the Loop (HIL) simulator technology
• Independent HIL testing does also serve as input to e.g.
DNV certification

There has been a gap

concerning software until
independent HIL testing was
introduced

Securing the integrity of your control systems 2010 © Marine Cybernetics

Third party HIL testing and verification process
• Vendors develop and test their own software
• Marine Cybernetics performs third party testing and verification of the
software from each vendor, and the integration of the software systems

HIL testing by vendors improves the quality of their own systems, but it
does not replace third party testing and verification

Development Testing
(vendor 1) (vendor 1)

3rd party
Development Testing verification by
Installation
(vendor 2) (vendor 2) HIL testing
and operation
(Marine
Cybernetics)

Development Testing
(vendor 3) (vendor 3)

Securing the integrity of your control systems 2010 © Marine Cybernetics

Hardware-In-the-Loop (HIL) Testing
Functional and black-box testing using simulator technology

• HIL testing is accomplished by connecting a simulation PC in the system’s communication

network.
• Inputs to the equipment under test are simulated.
• The controllers respond as they would in a dynamic environment.
• Simulator responds to output from the controllers as the dynamic system would.
• Software (core SW and/or configuration) errors are exposed.
Securing the integrity of your control systems 2010 © Marine Cybernetics
 Closing the control loop by HIL testing
CyberSea Simulator Target system
Real time
interface

HIL testing of the target system:

1. Functional testing
2. Failure testing
3. Performance testing
4. Known incidents
5. Fit for purpose

Securing the integrity of your control systems 2010 © Marine Cybernetics

Operation
HIL test regime: Earlier, Deeper and Broader
Trouble shooting
during operation
CAT
Tuning and trouble • Integration testing and
Test validation
shooting at Sea
New build / upgrade schedule

• Software testing and

Commissioning Test at Dock integration testing

FAT • Software
Test at Factory testing

Traditional testing regime HIL testing

Securing the integrity of your control systems 2010 © Marine Cybernetics

 Marine Cybernetics Services

Design Software Integration Service

Review Testing Testing Agreement

Securing the integrity of your control systems 2010 © Marine Cybernetics

Software testing of individual control systems

Design Software Integration Service

Review Testing Testing Agreement

Independent HIL testing of individual control systems:

• DP Computer System (DP-HIL)
• Power Management System (PMS-HIL)
• Steering, Thruster and Propulsion Control System (SPT-HIL)
• Drilling Control System (Drill-HIL)

Test sites:
• Vendor site - Test at Factory
• Lab setup using replica hardware
• On board using target hardware

Securing the integrity of your control systems 2010 © Marine Cybernetics

Integration testing of control systems

Design Software Integration Service

Review Testing Testing Agreement

Independent HIL testing of control systems with focus on

physical and functional integration including closing of findings

• HIL testing of DP Systems:

• DP Computer System (DP-HIL)
• Power Management System (PMS-HIL)
• Steering, Thruster and Propulsion System (SPT-HIL)
• HIL testing of Drilling Systems:
• Drilling Control System (Drill-HIL):

Test sites:
• On board using target hardware
• Lab setup using replica hardware

Securing the integrity of your control systems 2010 © Marine Cybernetics

Life-cycle services to secure safe and
efficient operation
Design Software Integration Service
Review Testing Testing Agreement

• Software change risk assessment

• Assessment of updates and changes
• Logging of Software version and configurations
• Helpdesk: support during trouble shooting, problems, and incident
investigations
• Verification testing (i.e. annual/periodic/continuous)
• Reduced trouble and off-hire time during Annual DP Trial
• Less destructive testing
• On-demand Software testing before onboard upgrades

Securing the integrity of your control systems 2010 © Marine Cybernetics

 References
Vendors:

Yards:

Vessel owner:

E&P companies:

Securing the integrity of your control systems 2010 © Marine Cybernetics

66 New buildings/Retrofits

19 Platform Supply Vessels (PSV)

11 Anchor Handling Tug Supply (AHTS)

4 Emergency Rescue Recovery Vessels (ERRV)

15 Offshore Construction Vessels

• ROV, Diving, IMR, Well intervention

10 Drilling Vessels

1 Seismic Vessel

5 Shuttle Tankers

Securing the integrity of your control systems 2010 © Marine Cybernetics

Service agreements and annual DP trials using
HIL testing

4 Platform supply vessels (PSV)

1 Anchor Handling Tug Supply (AHTS)

1 Drilling Vessel

Securing the integrity of your control systems 2010 © Marine Cybernetics

 Findings statistics from HIL testing
Test results of 47 DP & 15 PMS projects

Securing the integrity of your control systems 2010 © Marine Cybernetics

Findings statistics from HIL testing

Securing the integrity of your control systems 2010 © Marine Cybernetics

 Third Party Testing and Verification of
Drilling Control Systems

HIL Simulator

Securing the integrity of your control systems 2010 © Marine Cybernetics

 Test scenarios
Drill-HIL Testing
Operational
- Operation modes
- Operator commands
- Vessel motion
- Well and drill string

Control system
failures
- Computer failure
Drive - I/O failure
- Network failure

Equipment failures
- Sensor failures
- Drive failure and
blackout
C•
CyberSea - Hydraulic actuator
failures
Roughneck - Brake failures
- Failure of auxilliaries
• Vessel Simulator
Top drive Pipe handling
- Electric failures
- Bit or drill string stuck
DrawWork machines - Valves stuck or does not
follow command
CyberSea Drilling HIL Simulator

CyberSea
CyberSea .
Vessel
Power .
Simulator
Plant .
incl.
Simulator .
Riser
Securing the integrity of your control systems 2010 © Marine Cybernetics
Interface HIL simulator - Drilling control system

Interfaces all relevant IO for each machine or system to the HIL simulator

• Draw work with VSD

• ∼ 1500 hardwired and serial IO
signals

Hardwired IO
Serial IO (e.g. Profibus DP, SSI encoders) • Top Drive with VSD:
• ∼ 600 hardwired and serial IO signals

HIL simulator
• Pipe handling machines (each):
• ∼ 30 - 300 hardwired and serial IO
signals

Securing the integrity of your control systems 2010 © Marine Cybernetics

Test scope
Typical number of tests for each machine / system (project dependent)

∼ 10% are test of functions

• ∼ 200 tests for Draw work / VSD
∼ 90% are test of functions
• ∼ 150 tests for Top Drive / VSD while simulating a failure

• ∼ 150 tests for complex pipe handling machines

• ∼ 40 – 100 tests for simpler pipe handling machines

• ∼ 100 tests for heave compensating system

• ∼ 100 tests for anti-collision system

Securing the integrity of your control systems 2010 © Marine Cybernetics

 Characterization of Brownfield upgrades

Brownfield upgrades are upgrades where parts of the drilling equipment is

kept as so-called legacy systems

Drillers
Cabin

Drilling Control Network (UDP/TCP/IP)

PLC Computers PLC Computers

Legacy New Equipment

Systems

Challenge:
Insufficient test methods have lead to delays in installation

Securing the integrity of your control systems 2010 © Marine Cybernetics

Independent HIL testing of Brownfield upgrades
Configuration:
• All computers are set up and connected with the driller’s chair and the HIL simulators of
the legacy systems and the new drilling equipment.
• 3D graphics are used for testing of anti-collision.

Drilling Control Network (UDP/TCP/IP)
PLC Computers
HIL Simulator of Legacy
Systems
Marine Cybernetics HIL Simulator
Drillers Advantages:
Cabin • Interconnection to legacy systems
is extensively tested
• Allows for testing in a simulator
environment that may cause
PLC Computers collisions or damage to equipment
in real
• Testing is done before and during
installation, in parallel with
commissioning, and after
commissioning
HIL Simulator of New Equipment
• High availability of test lab through
all phases of the project

Securing the integrity of your control systems 2010 © Marine Cybernetics

Example of targeted functions to be HIL tested
Draw work

• Command and monitoring • Dolly position compensation (in

• Alarm and messaging functionality crown saver)
• Mode change control • Gear shift control
• Command abortion/canceling • Torque limiting
• Sensor and feedback monitoring • Feed-off mode:
and integrity check • Constant weight on bit mode
• Hoist / Lower travelling block • Constant rate of penetration
(main motors) mode (fast and slow mode)
• Hoist / Lower travelling block • Constant TD motor torque
(feedoff motors) mode
• Regenerative brake control • Constant mud pump
• Eddy current brake control pressure
• Disc brake control • Hand mode (bypassing anti-
• Crown saver collision)
• Floor saver (soft and hard) • Start/stop /supervision of
• Tool compensation (in floor saver) auxiliaries
• Raised floor (in floor saver) • Emergency stop
• Power limitation / reduction
• Compliance to documentation

Securing the integrity of your control systems 2010 © Marine Cybernetics

Failures can be activated while testing functions
Draw work

• PLC equipment • Eddy current brake

• PLC power supply failure • Command signal effectuation failure
• Operator station power supply failure • Failure on status, measurement and
• Network communication failure feedback to control system
• IO unit failure • Brake function failure
• CPU failure Example of
• Electric system failure
• Sensors simulated failure:
• Cooling system failure
• Encoder failures • freeze value
• Auxiliary system failure
• Proximity switch failure • fail to zero
• Draw work variable speed drives
• Load cell failure • broken wire
• Command signal effectuation failure
• Failure on other sensors • Failure on status, measurement and
• Disk brake feedback to control system
• Command signal effectuation failure • Drive controller failure
• Failure on status, measurement and feedback to • Rectifier failure
control system • Inverter failure
• Brake function failure • DC bus failure
• Hydraulic system failure • AC power supply failure
• Auxiliary system failure • Transformer failure Example of
• Gear shift system • Brake resistors failure simulated failure:
• Command signal effectuation failure • Motor failure • rapid or slow
• Failure on status, measurement and feedback to • Cooling system failure increasing
control system • Lubrication system failure temperature
• Hydraulic system failure • Load sharing failure • increase in
• Auxiliary system failure cooling system
pressure
Securing the integrity of your control systems 2010 © Marine Cybernetics
Example of targeted functions to be HIL tested
Anti-collision / zone management system

• Monitoring
• Alarm and messaging functionality
• Prevent machine from entering other machines zone
• Stop machine if other machine is entering the zone
• Normal mode
• Anti-collision release (machine to ignore stop commands from anti-collision system)
• Anti-collision ignore (machine to be ignored by other machines)
• Stop of machines on non-healthy position data
• Compliance to documentation

Securing the integrity of your control systems 2010 © Marine Cybernetics

Conclusions
• Third party testing, verification and certification of mechanical systems
and structures are well established in the maritime and offshore industries

• The impact and complexity of software based systems are increasing in

the maritime and offshore industries

• Traditional testing, verification and certification is not sufficient for

software based systems

• It has been demonstrated in more than 50 DP and PMS HIL projects that
findings are identified and closed as a result of independent HIL testing,
many of them being critical with potentially serious consequences

• Third party HIL testing of drilling control system is proposed for new
buildings and Brownfield upgrades

• Good cooperation with all involved parties – vendors, yards, owners, end-
users and class important securing the success of systems and vessels

Securing the integrity of your control systems 2010 © Marine Cybernetics