OTC 15341 Risk-Based Total System Review of Integrated Active Heave Hoisting System

Wael Abouamin (Det Norske Veritas), Gerry Lansdell (GlobalSantaFe), Knut Haga (National Oilwell)
Copyright 2003, Offshore Technology Conference This paper was prepared for presentation at the 2003 Offshore Technology Conference held in Houston, Texas, U.S.A., 58 May 2003. This paper was selected for presentation by an OTC Program Committee following review of information contained in an abstract submitted by the author(s). Contents of the paper, as presented, have not been reviewed by the Offshore Technology Conference and are subject to correction by the author(s). The material, as presented, does not necessarily reflect any position of the Offshore Technology Conference or officers. Electronic reproduction, distribution, or storage of any part of this paper for commercial purposes without the written consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of where and by whom the paper was presented.

To avoid these scenarios a proactive approach was utilized for the new GlobalSantaFe Deepwater Drilling vessels (Development Driller I and II). An independent third party was engaged to conduct a total system review of the integrated active heave hoisting system with the intention of issuing a Fit for Purpose statement. DNVs Offshore Standard DNVOS-E101 Drilling Plant, October 2000 was used as a measure to evaluate the integrated hoisting system against. 2. Achievements Some codes and standards have been developed to help ensure that the design of drilling systems meets a minimum standard (e.g. DNVs Offshore Standard DNV-OS-E101 Drilling Plant, October 2000). Unfortunately the development of technology outpaces the rate at which these standards are generated. Furthermore, economic pressures and competition force companies into adopting and including technology advancements as fast as they surface. Tools such as failure mode and effects analysis1 (FMEA) and other risk assessment practices should be used to proactively identify shortcomings that may have otherwise gone unnoticed. Furthermore, these tools offer excellent opportunities for design optimization with respect to lifecycle costs. Since so much is at stake with these modern systems (asset value and cost of an accident or unplanned rig downtime) often system designers are confronted with making million dollar decisions. Through quantification and factual understanding of the costs of a design change and benefit of the change, sound economic decisions can be made. Risk assessment practices are about anticipating failures (and their consequences) and taking planned, rehearsed steps to improve the system and to protect stakeholders interests. It is about coordinating and integrating all the processes across various disciplines and contractors, and presenting a confident image to the outside world. The risk management process initiated by GlobalSantaFe and National Oilwell has enhanced the understanding of the integrated hoisting system major risk drivers and how these could affect the performance of the system. Through this insight, GlobalSantaFe and National Oilwell (and other vendors) have been able to develop suitable risk strategies and action plans to manage and mitigate potential threats and exploit potential opportunities, and thereby increase the likelihood of developing a system with high reliability.

Abstract This paper demonstrates the positive results of conducting a risk-based total system review of an Integrated Active Heave Hoisting System used on Deepwater Drilling Vessels. This was accomplished by carrying out a failure mode and effect analysis (FMEAs) study on the major subsystems of the Hoisting System with focus on the interaction of all the components and their integration into one system. The analysis was carried out with significant involvement from the rig owner, the designers/manufacturers, and an independent third party each providing extensive input to the study, thus providing a broader spectrum of opinions and knowledge of the entire system. The results of this study are multifold: a significant reduction of the risk of major accidents due to component failures within the system, an increased reliability and availability of the system, improved rig owner understanding of the system (and thus informed decisions on equipment usage and on the establishment of operating limits of the system and the rig), and an overall increase of confidence in the system provided. 1. Introduction The average day rate of modern deepwater drilling and production mobile offshore units ranges between $200k and $300k. That translates to roughly $10,000 per hour. There are major economic losses when the rig loses uptime. Accidents and equipment failures can significantly affect uptime depending on the effect on personnel, environment, equipment, the well, etc. The consequence costs can escalate from the tens of thousands of dollars into the hundreds of millions or more.

OTC 15341

3. The Challenge The last ten years the drilling industry has seen a technical revolution going from local and manual operation of machinery to advanced computer controlled and screen operated systems in interaction with field instruments and machinery. Such modern sophisticated pieces of machineries come at a price: complexity. With complexity comes an increased requirement for design reviews, failure analysis and integration of sub systems to reduce the probability of failure or shutdown of the system. The integration of the Hoisting System sub systems becomes even more essential when several vendors provide the sub-systems. Each vendor has to have the same understanding of the importance and consequences of single point failures in their sub system to the overall system. To ensure a consistent overall safety level of the system, all the sub-systems are to be subjected to the same level of scrutiny. Critical control signals, command signals, sensors, manmachine interface, etc. all need to be evaluated as part of one complete system. This system integration is often complicated due to the commercial agreements between the customer and each vendor. The vendors requirements for confidentiality will also add to the complexity of a proper system integration process. The Hoisting System is indispensable to any drilling rig (onshore or offshore); the system becomes even more essential when it is an active heave drawworks, providing the block hoisting and lowering functions as well as heave compensation. Such combined functions require lower tolerance for stop of operation. This lower tolerance increases the requirement to avoid single point failures for all parts of the system, from the mechanical machinery to the power supplies and operator system and the integration between all these sub systems. This system integration more often than not tends to be overlooked as a part of the overall system design. The reason to this is most likely several, but the commercial relationship between the various vendors and the Buyer have proved to be a complicating factor. 4. Results The review has contributed to several technical and operational improvements of the system. Main achievements are: increased safety and availability of the integrated hoisting system highlighting interactions between sub systems and identify and evaluate the safety critical items increased safety and availability by studying each sub system to identify single point failures leading to loss of the sub-systems or overall integrated hoisting system

increased safety and availability by identifying the need for an improved operator message system giving an improved distinction between safety critical alarms, status information, and more extensive explanation to required actions. increased availability by improving the failure detection (using advanced PLC logic or additional instrumentation), by adding instrumentation and PLC logic to eliminate false failure detection, and by adding parallel instrumentation to allow maintenance during operation. increased awareness of the criticality of all items in the system to the overall performance of the integrated system increased safety and availability by identifying the main issues for maintenance

5. System Description The Integrated Active Heave Hoisting System as defined in the study covers all the subsystems necessary to enable hoisting/lowering and heave compensation of the Drawworks hook load (e.g. Drill string, BOP, Riser etc). The Drawworks Control System controls the speed of the Drawworks drum based on the requested speed from the operator, signals from the Motion Reference Units measuring the heave of the vessel and the power available from the Power Plant System. Based on these inputs the overall speed required to handle both hoisting/lowering and heave compensation is calculated and given to the Variable Speed Drive System that controls the AC-motors on the Drawworks. The motors are used both to provide hoisting power and for dynamic braking of the load. To enable the regenerative power due to the motor braking, a resistor system is provided as part of the Variable Speed Drive System. A hydraulic operated disc brake system is provided for emergency and park braking. The main subsystems of the Integrated Active Heave Hoisting System are: Drillers Control System (Sense Technology) Drawworks Control System (National Oilwell) Mechanical System (National Oilwell) Variable Speed Drive System (VSDS) (ABB Industri) Vessel Power Management (Kongsberg-Simrad) System (PMS)

Figure 1 gives a very simplistic view of the system

OTC 15341

PMS

Drillers Control System

DW Control System

The methodology chosen to carry out this analysis involved a series of failure mode and effect analysis (FMEA) sessions precluded by a Hazard Identification (HAZID) session. The HAZID session were used to identify the main components or subsystems of the integrated hoisting system and the interfaces between these, and also the main hazards (or failure categories) on the overall system in case of failures. These results were then used as input to the FMEA sessions

VSDS

Mechanical System

A separate FMEA session was carried out on each of the major subsystems; in some cases several sessions were required to capture the full depth and detail associated with each system. 7. FMEA Participants Including the designer, the Rig Owner, and an independent 3rd party proved to be a very effective format to carry out the FMEA sessions. Each party provided a fresh perspective and point of view to the discussion that would have otherwise been incomplete without the active participation of the three (3) parties (Figure 3).

Figure 1- Simple Block Diagram of the DW Hoisting System

The drillers control system includes the operators control chair (the main man-machine interface) and the control system associated with receiving commands from the operator, operator displays, communication with the drawworks control system, critical signals to and from the operators control chair, etc. The drawworks control system (DW) includes all the critical sensors, the main (and backup) drawworks control system PLCs, the logic behind the programming, the critical command and control signals sent to/from the drawworks control system, the interaction with the mechanical systems, etc. The mechanical system includes the main drawworks mechanical components (drum, main shaft, motor mounts, gears, lubrication system, etc.) and mechanical brake components (hydraulic circuit, interface to DW control system, solenoid valves, control valves, etc.) The variable speed drive system (VSDS) includes the main frequency converters for the electric motors, the regenerative resistor system. The VSDS control system including the drill floor power management (related to the hoisting system), the critical command and control signals sent to/from the VSDS. The vessel power management system (PMS) included the power supply (including some of the major electrical components) to the VSDS (and thus the drawworks motors), the power management philosophy as it relates to the Integrated Active Heave Hoisting System. 6. The Analysis Failure mode and effect analysis (FMEA) 1 studies can be very effective tools to analyze complex systems and point out design faults. They can be particularly effective when analyzing control systems and the interaction between several subsystems.

Designer

Balanced Discussion

Rig Owner

3rd Party

Figure 3- Balanced Participation

The designer brought his/her thorough knowledge and understanding of the system being analyzed. The designers input was essential to the success of the study. The rig owner contributed the usage of the equipment/system in real life situation. The rig owners input was particularly useful when evaluating the effect on the rig and its crew, i.e. the reaction of the driller to alarms, operational procedures that mitigated the effects of failures, the magnitude of the maintenance burden on rig personnel, etc.

OTC 15341

The 3rd party brought an independent, view to the technical discussion. This served to facilitate and stimulate the brainstorming dialogue. Also technical experience from previous studies and accident investigations proved to be useful input to the sessions. 8. FMEA Format FMEA is a structured brainstorming technique focused on identifying potential failures and their effects on a specific system. The methodology breaks down systems into specific components, which are in turn analyzed one by one. All components and their failure modes are defined on specific FMEA worksheets. During the work session each component and its failure mode is analyzed with regards to the effect on the system, detection of the failure and if any safeguards are in place to avoid or minimize the effect. Figure 2 displays a flow chart indicating the thought process of the sessions.

9. System Definitions The first task for the team was to define the Integrated Active Heave Hoisting System main functions. The four (4) main functions agreed on were: 1. 2. 3. 4. Hoist Lower Hold/Stop/Park Heave Compensate

These four (4) functions were to be carried out at the rated load and within the operational parameters of the integrated hoisting system. The ability of the Integrated Active Heave Hoisting System to accomplish these four (4) main functions without jeopardizing life, property, or investment were the driving factors in assessing the consequences of failures to components, signals, logic faults, human error etc. The next step was to divide the system in question into individual components. The level of detail desired will dictate the number of components bunched together and defined as well. Defining the function of the component was essential to the analysis. This step established the role of the component in the overall system and helped the team determine the effect of its failure on the overall system. A thorough detailed description makes reviewing the FMEA spreadsheet later a trouble-free process. Establishing failure modes and failure causes was the next step in the FMEA process. The failure modes provided a description of how a component failed, i.e. n, no signal sent, valve does not open, etc. These modes were based on standard predefined modes. The failure causes provided a description of the source of the failure, i.e. overheat, instrument fault, corrosion, contamination, etc. 10. Failure effect levels The failure effects or consequence categories were analyzed on three (3) levels:

Components

Failure Detection

Function Failure Mode Failure Cause Failure Effect

Safeguards

Ref. to Test Procedure

Recommendation

Figure 2- FMEA Thought Process Flow Chart

Some questions answered are: How can each part conceivably fail? What mechanisms might produce these modes of failure? What could the effects be if the failures did occur? Is the failure in the safe or unsafe direction? How is the failure detected? What inherent provisions are provided in the design to compensate for the failure?

Local Failure Effect System Failure Effect Global Failure Effect

The local failure effect is the effect on the individual component (or group of components). This was to establish the sphere of influence of the failure. The system failure effect is the effect on the particular system that the component is a part of. This was used to determine the cascading effects of failure to the system.

OTC 15341

Finally, the global failure effect evaluated the consequences on the entire integrated hoisting system and possibly to the rig. This was important to analyze in order to evaluate the true ultimate consequence of any component failure. 11. Failure Effects Categories The Global Failure Effects are divided into three (3) consequence categories: 1. 2. 3. Loss of Control Loss of Heave Compensation Shutdown (loss of Uptime)

Evaluating existing safeguards was the next stage of the FMEA process. It was imperative to consider the safeguards that the designer(s) and/or rig owner had in place to either prevent the failure from occurring, reduce the probability of the failure occurring, or minimize the consequences. Verifying the functionality of safeguards or features in the system was another essential issue that was captured. This was done by ensuring that a reference to a test procedure (or commissioning procedure) existed to link it back to the FMEA spreadsheet. 13. Recommendations Reducing (or eliminating) the number of single point failures, leading to any of the three defined failure categories, was a major goal of the review team. As issues began surfacing through the sessions, recommendations and action items were assigned, aimed at modifying the system or the operation of the system to achieve the goal of no single point failures. The proactive approach undertaken by the owner has significantly reduced the risks associated with equipment failures, human error, and shutdowns. This forward-thinking risk management plan has increased safety, increased equipment availability, increased rig uptime, and re-affirmed investor confidence in the owner. 14. Acknowledgement: The authors of this paper would like to express our appreciation to everybody involved in the study, particularly Rolf Meier (GlobalSantaFe), Elisabeth Molvik (National Oilwell), Remi Eriksen (DNV), Alf Henry Aker (DNV), Kjell Fotland (DNV), Jan Roger Hellerud (Kongsberg-Simrad), Eirik Mathiesen (Kongsberg-Simrad), Douglas Rainer (ABB), Jarle Dyrdal (SenseTechnology) and Petter Tollefsen (Hydralift). 15. References

Loss of Control is any single point failure leading to dropped load, unintentional movement leading to a collision, unintended movement leading to a safety hazard, or any other unintended movement leading to engaging the emergency braking system. Loss of Heave Compensation is any single point failure leading to loss of active heave compensation during any of these operations: Well Testing Stuck Drill Pipe Landing BOP Landing Casing Pulling BOP Well Completions Work Over Operations Emergency Disconnect Well Control Procedures

Shutdown is any single point failure leading to a shutdown of the Integrated Hoisting System. The main effect of this consequence would be loss of uptime and thus jeopardizing the investment in the rig and the Integrated Hoisting System. 12. Failure Detection and safeguards Documenting the detection of failures (if any) was the next step in the process. Failure detection was an essential aspect of the analysis since it determined whether or not the operator(s) were aware that a failure had occurred.

/1/

British Standard, "Reliability of systems, equipment and components Guide to failure modes, effects and criticality analysis (FMEA and FMECA), BS 5760, Part 5: 1991.