Patent Application
20060058929
The present invention relates to a system for acquiring a verifiable control system signature after approval of a marine vessel by testing and/or certification by a class society. Further the invention relates to remote testing of a vessel, and a combination of the two methods, i.e. remote acquisition of a control system signature. Further, a system for remotely controlled testing and vessel simulation is provided.
A control system can generally be seen as a system that provides control signals to a physical process, and that receives measurements from a device or a physical process or possibly from other physical processes. The measurements and an algorithm are used to compute the control signals so that the physical system responds as desired. If the physical process is a motorized vessel, then the control system may receive measurements in the form of a vessel position, course and velocity, and can thereby calculate the control signals to propellers and rudders so that one or more of vessel position, course and velocity are achieved or maintained.
The physical process, in this case in the form of a vessel, may be influenced by external events like a change in wind, waves and current, or by unexpected events like loss of motor power for one or more propellers, or failure in the function of a rudder. It is desired and expected that the control system for the vessel can handle external influence and external events so that the vessel can maintain a safe state. A safe state may for example be that that the vessel maintains the desired position or velocity, or that it avoids undesired positions (to avoid collision or grounding), that it avoids a situation of uncontrolled drift, that it maintains a desired course, etc. Moreover, it is expected that the control system in the case of loss of sensor signals or errors in sensors should not do undesired and unfortunate compensations like a sudden change in ballast pumping in response to loss of a realistic signal in a roll or pitch sensor, or sudden corrections of an apparent error in position.
Measurements to a Control System.
A control system for a ship, with inputs from instruments that give measurements, and with outputs to actuators, like propelling devices, control surfaces and other control devices that are to be given control signals, is shown in
If the vessel is a petroleum drilling vessel or a petroleum production vessel, for example a drilling ship or an drilling platform, a petroleum production ship or a petroleum production platform, the control system may also receive measurements of the heave motion from a heave accelerometer, and output a control signal to an active heave compensation system for a riser, a drill string, cranes, etc. where mechanical equipment can be connected to the seafloor and where it can be important to compensate for the motion of the vessel, in particular heave. A normal use of control systems for petroleum activity at sea is for dynamic positioning of the vessel, that is, that the vessel uses actuators like azimuth thrusters to maintain desired position during drilling or during production of petroleum. A vessel that is moored and may rotate about a rotating turret with mooring lines to the seafloor can also have a control system that gives a varying control signal to propellers or thrusters to assist in keeping the desired position when the vessel is rotated because the direction of the weather or current changes, so that the thrusters contribute with forces to compensate for changes in the tension of mooring lines when the forces turn. In the same way it may be envisaged that that the control system can give control signals to increase or decrease tension in the mooring lines of the same reason.
Problem Related to Testing of the Control System of a Vessel.
A ship inspector can visit a vessel and make an on-board test of the control system. The on-board test may be conducted by disconnecting or connecting sensor systems and monitoring the response of the system in different failure situations. However, to make an entirely realistic test of the vessel in conditions that are to be expected, it would be necessary to wait for or to seek weather situations and sea states that are expected, but rarely occur, or to wait for or to provoke situations that could be expected if certain errors occurred, but that would be dangerous if such situations occurred accidentally or by provocation. It will hardly be considered as an option to expose the vessel to extreme situations, like abnormally large errors in ballast distribution, in order to check if the control system gives control signals for correct compensation of the error. Such kind of tests will normally not be performed.
It would be possible to perform a simulation of sensor data to the control system on-board and monitor which control signals that the control system gives to actuators like propellers, rudders and thrusters, but this would require a local interconnection of the control system to a test system. However such testing is, according to the applicant's knowledge, not known at the time of filing this application. Such interconnecting and testing could be conducted on the vessel, but a disadvantage of visiting the vessel to be tested is often related to a long way of travel for the ship inspector, that the ship inspector must bring equipment for interconnection to the control system inputs for measurements, and equipment for interconnection to the control system outputs for response in the form of control signals that are normally sent to the actuators of the vessel, and in addition a data library that at least has to include the configuration of the actual vessel to be tested. Moreover, the travel time from one vessel that is to be tested and certified to a next vessel can make it difficult for the inspector to perform inspections at a sufficiently high rate, so that the next vessel will have to wait, with the economic disadvantages caused by the waiting, if the vessel cannot be taken into use without being tested and properly certified. It may also cause a concealed physical danger to use a vessel where lack of testing of the control system does not reveal possible errors.
The conclusion of the above is that there is a need for method to verify that a vessel control system has the same response as when it was approved, in order to indicate whether the control system should be retested and re-approved or not after some time or after modifications of any essential part of the ship.
In factory production of a control system it is usual to perform a so-called factory acceptance test (FAT) of the control system (including hardware and software) where the manufacturer feeds simulated sensor data to the control system and monitors which control signals the control system gives as a response to the simulated data. This type of FAT can only reveal errors where measurements from sources that the manufacturer has foreseen to exist, and where the control signals are only related equipment that the manufacturer have foreseen. Thus, it will not be known with certainty how the control system will interact with equipment, systems, configurations or situations that the manufacturer of the control system has not foreseen. In addition, in a FAT the control system will not be tested in the connection where the control system is installed and connected for use on the vessel.
Example of a Practical Problem in Dynamic Positioning.
In dynamic positioning of a vessel (4) that is held in desired position of propellers, rudders or thrusters of the tunnel or azimuth type, it may be essential for the operation that the vessel keeps its position within a very small radius from the desired position, e.g. a radius of 2 m. Several events may be undesired. The vessel may experience loss of motor power for one or more propellers or rudders, and have to increase the motor power on the remaining propellers and/or thrusters and perhaps rotate the still functioning remaining rudders or thrusters. One may also experience serious error situations in which the control system loses some of the signals from the connected sensors so that an undesired incident may occur. The inventors have knowledge of an instance in which a vessel, in the actual case a drilling platform, was to be located at a fixed position in the open sea and was drilling to make a petroleum well in the seafloor. The drilling platform was to maintain the desired fixed position by means of so-called dynamic positioning or “DP”, that is, the control system was arranged to keep the vessel in the desired position by means of position measurements and motor power, without the use of mooring lines to the seafloor. The drilling platform was equipped with a double set of DGPS receivers that calculate the geographic position of the vessel based on radio signals received from a number of navigation satellites. In addition the drilling platform was equipped with a double set of hydroacoustic position sensors that measured the position of the vessel with respect to transponders at fixed points on the seafloor. At a given time during drilling, the vessel having riser connection to a wellhead and drill string connection to the drilling hole and actively drilling, an event took place so that the DGPS receivers showed a sudden change in position of about 75 meters, although no such change in position actually had occurred. Such an error may be called a “step change” error. The hydroacoustic sensors continued to indicate a stable position at the desired position over the drill hole. The control system continued to control propellers and rudders so that the drilling platform without interruption was held at the correct dynamic position on basis of the hydroacoustic sensor measurement signals. However, it turned out that after 5 minutes the drilling platform suddenly started to move off towards the desired position according to the then erroneous DGPS signals. It became necessary to discontinue the drilling by effecting associated emergency procedures involving riser disconnection and cutting of the drill string. Such a situation may involve a risk for blow-out of gas and oil, or pollution by spilling of drilling fluid. Such a situation may also present a risk to the vessel and the crew. After a discontinued DP-drilling it may be very expensive to recover continued drilling. The applicants assume that the initial sudden change of the position calculated by the DGPS receivers may have been caused by disturbances in the signal transmission from the GPS satellites to the receivers, or by a situation of having an insufficient number of available satellites. The loss of the DGPS signal may have been ignored by the control system because of quality conditions in the software of the control system requiring that such a calculated position must have been stable during the preceding 5 minutes to be considered to be real. In this way, the designer of the control system may have believed to prevented undesired sudden changes in position due to erroneous signals. However, the new and changed, but nevertheless stable, false position calculated from the DGPS receivers may after 5 minutes have been regarded as stable and was thus considered to be reliable according to the logical program of the control system, and may have been given a higher priority than the measurements provided by the hydroacoustic transponders. This may explain why the control system attempted to control the drilling platform to a new position that the control system had evidently interpreted as the desired position, despite the facts that drilling was in progress and despite the fact that the hydroacoustically measured position indicated that the position should be kept unchanged.
Problems Related to Changed Configurations in a Vessel:
Reprogramming of a Control System
After a control system has been put to use in a vessel there will in many cases be a need for reprogramming or modification of the software in the control system. The purpose for doing this may be a need for changing numerical values related to alarm limits and acceptable variation in a sensor signal in the algorithm of the program, or it can be a need for the introduction of new tests and functions in the control system. When the reprogramming or modification of the software is completed there is a need for testing the control system to see if the changes have given the intended effect, and to investigate if new and unintended errors have appeared as a consequence of the changes. At present, satisfactory test equipment and procedures are not available for the testing of the control systems on a vessel after such changes.
Modifications in an Existing Control System, e.g. when Replacing Cranes.
Marine operations related to oil and gas exploration and production are done by vessels with cranes for installation and intervention on modules on the seafloor. This type of cranes has control systems that compensates for the vertical motion of the vessel. The mode of operation and the function of the crane in safety-critical situations will to a large extent depend on the detailed design of the software of the control system, which will vary from one crane to another. Procedures have been established for the testing of the mechanical design of such cranes. In contrast to this there are no established systems or methods for the testing of the software of the crane control systems. The reason for this is that the response of the crane will depend on the sea state and the motion of the vessel in addition to the mechanical design and the control system of the crane. A required detailed testing of a crane system on a vessel should therefore involve both the dynamics of the vessel including the relevant control systems of the vessel, and in addition, the dynamics of the crane including the control system of the crane.
Repair/Replacement of Sensors for a Control System.
When sensors for a control system are replaced or modified, there is a need for adjustment of alarm limits, for limits for acceptable variations in the sensor signals. It is customary for a control system to have redundant sensor systems so that several sensors may be used to measure the same physical quantity. As an example of this the position of a vessel can be measured by inertial sensors, two or more GPS-receivers and two hydroacoustic sensor systems. From these measurement data the position of the vessel is determined by means of an algorithm in the control system. This algorithm will depend on the properties of the various sensors with respect to accuracy and properties like long term stability versus accuracy under rapid position variations. Replacement or modification of a sensor introduces the need for testing of the total sensor system to investigate whether the resulting new combination of sensors gives acceptable position measurements for use in a control system.
Repair/Modification/Replacement of Actuators.
After replacement or modification of an actuator, a control system may give a significantly different response for the vessel. The reason for this is that a new or modified actuator may give a different control action to the vessel than what was assumed during the development of the control system. An example of this is in the use of thrusters for dynamic positioning, where the relation between the shaft speed of the thruster and the thrust must be known when the control system is tuned. If a thruster is changed, then the relation between the shaft speed of the thruster and the thrust may be changed, and it will be necessary to test the vessel with the control system to investigate if the system still performs according to specifications.
Thus that there is a need for a more effective testing of vessel control systems, also in the cases where the vessel has been modified from its previous configuration, and where old and new components of the vessel have not been previously combined, and has to be tested in the new combination.
The U.S. Pat. No. 6,298,318 “Real-time IMU signal emulation method for test of guidance navigation and control systems” describes an emulation method for testing of a plane by emulating the motion using a so-called 6 degrees-of-freedom (6 DOF) flight simulator and where signals from a so-called inertial navigation module to a “guidance, navigation and control” system on board the aircraft are generated by simulation. This US patent does not discuss problems related to dynamic positioning of a vessel in drilling operations or some other form of stationary operation, it does not mention the use of cranes, navigation of connected underwater equipment, integration of hydroacoustic positioning equipment, problems related to ballasting, and does not consider ocean waves. A ship will normally not have 6 DOF, but instead has 3 DOF as it has self-restoring action in heave/roll/and pitch motion being a required property of a surface vessel.
The U.S. Pat. No. 5,023,791 “Automated test apparatus for aircraft flight controls” describes an automated test apparatus for the testing of flight control systems of an aircraft as part of an integrated system for testing a plurality of flight control systems. The automated test apparatus includes a system controller having memory for storing programmed instructions that control operation of the automated test apparatus, and for storing resulting flight controls system test data. The automated test apparatus includes a keyboard, a touch-screen, and a tape drive for entering programmed instructions and other information into the automated test apparatus, and for outputting test data from the system controller. Instruments included in the automated test apparatus and controlled by the system controller generate test signals that are input to the aircraft's flight controls system, and monitor resulting test data signals that are produced by the flight controls system. The automated test apparatus is connected by an interface cable to an onboard central maintenance computer included in the aircraft. The central maintenance computer includes a non-volatile memory that is programmed to run onboard tests of the flight controls system, and is controlled by the system controller during testing in accordance with the programmed instructions to run the onboard tests.
U.S. Pat. No. 5,541,863 “Virtual integrated software testbed for avionics” describes a virtual integrated software testbed for avionics which allows avionics software to be developed on a host computer using a collection of computer programs running simultaneously as processes and synchronized by a central process. The software testbed disclosed uses separate synchronized processes, permits signals from an avionics device to be generated by a simulation running on the host computer or from actual equipment and data bus signals coming from and going to actual avionics hardware is connected to their virtual bus counterparts in the host computer on a real-time basis.
U.S. Pat. No. 5,260,874 “Aircraft flight emulation test system” describes an aircraft test system that generates stimuli that emulate the stimuli received by an aircraft when in flight. The aircraft test system includes a number of instruments for generating the number of processor-controllable instruments for generating stimuli received by an aircraft when in flight. The system also includes a number of instruments that monitor the response of the various aircraft components to the stimuli to which the aircraft is exposed. A processor in response to the output signal from the aircraft components directs the stimuli generating instruments to produce stimuli that emulate those received by the aircraft as it moves through the air. The system thus generates an initial set of stimuli similar to what an aircraft would be exposed to when in flight; monitors the response of the aircraft to the stimuli to which it is exposed; and, in response generates an updated set of stimuli to the aircraft. The system also records the response of the output responses of aircraft components so that they could be monitored by personnel charged with insuring that the aircraft is functioning properly. The system can also be used to train flight crews since it can be used to place the aircraft “in the loop” during a flight emulation.
U.S. Pat. No. 6,505,574 “A vertical motion compensation for a crane's load” describes a method and a system for reducing sea state induced vertical motion of a shipboard crane's load using winch encoders, boom angle sensor, turning angle sensor and motion sensor that all feed measurements into a central processor that controls the crane on basis of the measurements and the commands from a crane operator.
A solution to some of the problems described above, is a method for verifying a control system of a vessel, in which said control system in its operative state is arranged for receiving sensor signals from sensors and command signals from one or more command input devices, and in which said control system as a response to said measurements and command signals, provides control signals to said vessel's actuators in order to maintain a desired position, velocity, course or other state of said vessel; in which the method comprises the following novel steps:
Additional steps of the method of the invention are found in the independent claims.
The invention is illustrated in the enclosed drawings in
a
1 illustrates a vessel simulator in a remote simulator location, with a logger where both are connected through a first real-time interface at the simulator location, with one or more communication channels for real-time control, simulation and logging, to one or more real-time interfaces for real-time control, simulation and logging which further is connected to a control system, e.g. a control and monitoring system on at least one vessel. The simulator location can be e.g. at a laboratory in a so-called class society on land, like Det Norske Veritas, American Bureau of Shipping, Germanischer Lloyd, Lloyd's Register, or another class society. Alternatively, the simulator device may be arranged on board the ship to be tested, in order to prevent potential errors due to signal transfer delay, either due to delays in computer communication, or electromagnetic propagation delay due to distance.
a
2 illustrates at the left side of the sheet a test sequence T0 of artificial measurements of e.g. position, course, velocity, wind direction etc., and at the right side a resulting response S0 from the control system from this test sequence T0. The artificial measurements of the test sequence T0 are in this illustration simply “signal present” or “signal absent”, which is the crudest approximation, although relevant. At the right side of the sheet is illustrated a set S of control system output responses to a test sequence, not necessarily the illustrated test sequence in this figure.
a
3 is similar to
a
4 is a more realistic image of possible simulated test signals, showing the above mentioned absent/present signals, step change signals, rapidly changing continuous signals and slow drift signals, and time periods during which several errors occur more or less simultaneously or mutually superposed.
a
5 is a model for a comparison and decision process for determining whether the control system's response has changed or not when comparing control signals between the initial test signature and a later control signal acquisition of the control system.
b illustrates a vessel having a control system of which one or more of the real sensor signals are replaced by simulated sensor signals over a communication line to and from a test laboratory, and in which one ore more of the control signals from the control system to the actuators of the vessel are sent back over the communication line to the test laboratory, preferably instead of being sent to the actuators of the vessel.
c illustrates a vessel where a set of sensors for pitch, roll, wind speed, wind direction, GPS position sensors, DGPS position sensors, hydroacoustic position sensors, etc., normally arranged to provide measurements to the control system of the vessel, being replaced by simulated measurements from a remote test system via one or more communication lines. The control system responds to the simulated measurements. The response would normally give control signals to the actuators of the vessel, like e.g. propellers, rudders, tunnel thrusters, azimuth thrusters. The response is instead sent via a communication line to a remote test laboratory where a vessel simulator e.g. in the form of an algorithm calculates a the dynamic behaviour of a simulated vessel in response to the control signal from the remote control system in the vessel, and sends the new state of the vessel back to the remote system, for a new response in the form of updated control signals, etc.
1.1 Description of the Vessel and Control System, General.
The invention will now be described with reference to some embodiments of the invention illustrated in the drawings enclosed. The invention includes a system for and a method for testing of a control system (2) on a vessel (4), e.g. a ship, a drilling platform, a petroleum production platform, in real time over a communication channel (6), as shown in an overview in
Below a brief description is given of the system illustrated in
The system according to the invention is arranged for the testing a control system (2) in a vessel (4), of which the control system (2) is arranged to control and monitor the vessel (4). The system comprises the following features:
The control signals (13) include signals (13a, 13b, 13c) in the form of shaft speed (13a, 13b) for one or more propellers (16) or thrusters (17), and rotation angles (13c) for rudders (18) or thruster (17) and possibly other actuators like ballast pumps, or cranes.
The sensors (8) may comprise one ore more devices selected from numerous different devices, of which some are mentioned below:
In a preferred embodiment of the invention the system is provided with a switch (15a) arranged to disconnect one or more sensor signals (7) from the signal line (12) to the control system (2). In addition, the system according to the invention can be equipped with a second switch (15b) arranged to disconnect one or more of the command signals (10) from the signal line (11) to the control system (2), and also equipped with a third switch (15c) arranged to disconnect one or more of the control signals (13) from the signal line (14) from the control system. In this way the switches (15) can be used to fully or partially isolate the control system (2) from signals to and from the rest of the vessel. The control system (2) should of course still be connected to the regular electrical power supply on board.
The system implies in the normal manner that the dynamic parameters (5) of the vessel may enter into the algorithm (31) of the control system (2) for the computation of the control signals (13) to the actuators (3).
The system may be arranged so that the remote test laboratory (40) is equipped with a simulator (30R) with an algorithm (32) arranged to simulate the state of a vessel on basis of an initial state represented by completely or partially simulated measurements (7, 7′) and control signals (13, 13′) from the control system (2), but an equivalent simulator (30L) may be arranged locally on board the ship to prevent communication delay problems.
The communication line (6) may be arranged for sending of one or more simulated sensor signals (7′) from the remote test laboratory (40) which is further arranged to be connected to and disconnected from a first real-time interface (6a), on the remote test laboratory (40). Similarly, the communication line (6) is arranged to be connected to, and disconnected from, a second real-time interface (6b) on the vessel (4). The second real-time interface is arranged for being connected through the switch (15a) to the signal line (11) to the control system (2). In a preferred embodiment of the invention, the communication interface (6b) is connected via a local vessel simulator computer (30L) to said switch (15a), as illustrated in
The test system may comprise the use of a remotely arranged simulator computer (30R) in said remote test laboratory (40) for transmitting said simulated sensor signals (7′) and said simulated command signals (9′) via said communication line (6) to said local simulator (30L) on said vessel, and receiving said control signals (13′) from said local simulator computer (30L) via said communication line (6).
The test system may also comprise the use of a remotely arranged test manager (33) in said remote test laboratory (40) for transmitting an initial value of said simulated state (50′), a time sequence of said simulated command signals (9′), and simulated values for sea state, current, wind speed and wind direction via said communication line (6) to said local simulator (30L) on said vessel, and receiving said control signals (13′) from said local simulator computer (30L) via said communication line (6), where said local simulator (30L) is connected to said control system (2) so that said control system acquires said simulated sensor signals (9′) and said simulated command signals (9′) from said local simulator (30L) and outputs said control signals (13′) to the local simulator (30L).
A simulated command input device (10′) may be arranged remotely for sending of simulated command signals (9′) from the remote test laboratory (40) over the real-time interface (6a), and over the communication line (6) and over the real-time interface (6b) to the control system (2). In a preferred embodiment of the invention, a simulated or test command input device (10′, 43) may be arranged locally on board the ship for generating and sending of simulated command signals (9′) directly to the control system (2). In a preferred embodiment of the invention used for signature response acquisition, simulated command signals (9′) may be included in a test series (T0) comprising simulated sensor signals (7′) and simulated command signals (9′) as explained below. Locally, a local test signal source (41L) may be arranged at or near the vessel (4) to be tested, for providing said artificial measurements (7′) or artificial commands (9′) to the control system (2).
A control signal logger (42) is used for recording a response (S0) from the control system (2) upon the given artificial measurement signal sequence (T0). The same control signal logger (42) may also be used for recording a later response (S1, S2, S3, . . . ) to said given sequence (T0), or, of course, other measurement sequences (T1, T2, T3, . . . ) being real or artificial. A memory (44) may be connected to the test signal source (41R/41L) for storing the test sequence (T0) used for establishing said control system signature response (S0), or/and for storing later test sequences (T1, T2, T3, . . . )
The system may be arranged so that all of or parts of the algorithm (31) in the control system (2) can be modified, calibrated, or replaced, locally or over a communication line (6) from a remote test laboratory. According to the invention the ship and/or the test laboratory includes a data logger (15) for logging of the response (13′, 19′) from the control system (2) to the measurements (7, 7′).
1.2 Description of a Method for Testing of the Control System.
The system described above may be arranged to be used in a method for testing of a control system (2) in a vessel (4). The control system (2) includes control and monitoring of the vessel (4) with control signals (13) to one or more actuators (3).
The method for testing the control system may comprise the following steps:
According to a preferred embodiment of the method the method will then include simulation in a remote simulator (30R) in the test laboratory (40) or in a local simulator (30L) by means of an algorithm (32) of a new dynamic state of a vessel model (4′) on basis of the control signals (13′). In this way a test on the control system (2) can be performed from the remote test laboratory (40) on a vessel independently of where the vessel is placed in the world. If simulation does not occur locally at or near the ship, the simulation algorithm must take into account the time delay caused by the use of the communication line (6). To avoid time delay errors the remote computer (30R) may transmit the data (7′, 9′) to be used for a simulation via the communication line (6) to the local simulation computer (30L) at the vessel, as shown in
According to the above method the remote test laboratory (40) that is involved in the testing of the control system can be located on land, and the vessel (4a, 4b, 4c, . . . ) that is tested is a long distance from the test laboratory, typically between 1 and 20000 km, and where the vessel (4a, 4b, 4c, . . . ) that is tested may be situated in a nearby harbour, in a distant harbour, in a dock or in a yard, at anchor, or in the open sea.
When the testing of the control system is completed, the communication line between the vessel and the remote laboratory is disconnected, and the regular sensor signals and the regular command signals to the control system are reconnected, and the control signals from the control system are reconnected to the actuators, for normal operation of the control system in the vessel.
According to the preferred embodiment of the invention the sensor signals (7) includes one or more of the following sensor parameter from sensor (8):
According to the preferred embodiment of the invention the control signals (13) include signals (13a, 13b, 13c) in the form of shaft speed of one or more propellers (16) or thrusters (17), and angles for rudders (13c) or thrusters (17) and possibly other control devices to achieve one or more of desired position (9a), course (9b), velocity (9c).
The method can be used to calculate control signals to one or more propellers (16a, 16b, 16c, . . . ), and control devices (18) may include one or more rudders (18a, 18b), and it may include one or more thrusters (17).
The command input device (10) will include one or more of the following items: a position specification device (10a), a steering wheel (10b), a velocity specification device (10c), or a device for specification of desired inclination angle, pitch angle, heave compensation, etc. (10x) that give a command signal (9) of one or more of desired position (9a), desired course (9b), and desired velocity (9c) or another desired state (9x), e.g. desired roll angle, desired pitch angle, desired heave compensation, etc.
According to a preferred embodiment of the invention, the method may include that the remote test laboratory (40) is used to verify that the control system (2) on basis of the simulated sensor signals (7′) in the test, and possibly remaining real sensor signals (7), the simulated command signals (9′) and possibly remaining real command signals (9) gives control signals (13, 13′) that will lead to an acceptable response (S) and resulting in the control system (2) being certified on basis of the test.
The dynamic parameters (5) of the vessel may involve the mass (m), the axial moments of inertia, the mass distribution of the vessel, and the hull parameters that describe the geometry of the hull, as explained below. Disconnection of the sensor signals (7) from the sensors (8) to the control system (2) can be done by means of a switch (15a) on the signal line (12). The disconnection of command signals (9) from the command input devices (10) to the control system (2) can be done by means of a switch (15b) on the signal line (11).
Failure situations could be tested by disconnection of one or more of selected sensor signals (7) or command signals (9) at the time to simulate breakdown of components, and where the response of the control system (2) in the form of control signals (13, 13′) and status signals (19, 19′) are logged in a logger (15), either locally or in the test laboratory (40). However, such testing would be laborious and difficult to repeat at a later occasion for verification.
Failure situations can also be tested by changing measurements or by generating disturbances in selected sensor signals (7′), or by generating external disturbances like weather, wind, electrical noise, atmospheric noise or acoustic noise to the measurements (7′). Such disturbances may be sent from the remote test laboratory (40) to the control system (2) in the vessel (4), and where the response of the control system (2) in the form of control signals (13, 13′) and status signals (19, 19′) are logged on a logger (15) in the test laboratory (40).
According to a preferred embodiment of the method according to the invention new software for the control system (2) in the vessel (4) can be transmitted from the test laboratory (40) over the communication line (6).
After the execution of the method according to the invention, in which the test laboratory (40) on basis of the test of the control system (2) and the test results can approve the control system (2), the test laboratory (40) can certify the control system (2) for use in regular operation of the vessel (4).
One of the advantages of the proposed remote testing according to the invention is that one will have a much larger flexibility in the testing of the software and the control system (2) in its entirety under simulated failure situations and under a simulated extensive spectrum of weather loads than what would be the case under conventional testing and certification. At the same time, one avoids the disadvantages and limitations of previously used methods for testing of vessel control systems, namely travel distance, time consuming travels, high cost of travel, time for rigging of equipment for testing, etc. With the proposed invention it is possible to test and certify far more vessels than previously, with a lower number of operators. Moreover, the quality of the testing will be improved as the automatic test execution improves the repeatability of the tests.
1.3 Example of Testing of a Control System on a Drilling Vessel.
The present invention can be used to test if a control system as mentioned above will indeed function in a safe and reliable way. One may imagine the following example: It is desired to test a control system (2) in a drilling vessel (4) as illustrated in
The control system (2) may then be regarded as a “black box” (2) where a change is simulated in at least one of the sensor signals (7) to the “black box” (2), and where the “black box” (2) responds with a control signal (13). In the case of the drilling vessel (4) mentioned in the introduction, where there was an error in the DGPS signals, one would experience after 5 minutes that the control system (2) would suddenly attempt to control the propellers, thrusters and rudders of the vessel (4) in order to move the vessel to a new position that the control system would suddenly regard as correct because it had been given as stable and wrong for 5 minutes.
1.4 The Motion of a Vessel and the Simulation of this Motion.
The motion of a vessel (4) is described in terms of the velocity of the ship in surge, sway and yaw, by the position of the centre of mass, and by angles in roll, pitch and yaw, see
The following procedure can be used to compute the motion of a vessel (4, 4′) as given by the state (50, 50′) over a time interval from u0 to uN: Suppose that the motion of the vessel is given in terms of the state (50′) at the initial time instant u0, and the forces and moments are calculated at this time instant. The acceleration and angular accelerations of the vessel at time u0 can then be computed from the equations of motion for the vessel (4, 4′). Then numerical integration algorithms can be used to calculate the motion of the vessel as given by the state (50, 50′) at time u1=u0+h, where h is the time step of the integration algorithm. For a vessel the time step h will typically be in the range 0.1-1 s. When the motion (50, 50′) of the vessel (4, 4′) at time u1 is computed, the forces and moments at time u1 can be computed, and the acceleration and angular acceleration at u1 are found from the equations of motion. Again, using numerical integration the motion (50, 50′) of the vessel at time u2=u1+h is computed. This procedure can be repeated at each time instant uk=u0+h*k until time uN is reached.
The waves that act on a vessel are described as a sum of wave components where one wave component is a sinusoidal long-crested wave with a given frequency, amplitude and direction. For a given location at sea the prevalent distribution of amplitude and frequency of the wave components will be given by known wave spectra like the JONSWAP or ITTC spectra, where the intensity of the wave spectrum is parameterised in terms of the significant wave height. The resulting forces and moments acting on the vessel will be a function of the amplitude, frequency and direction of the waves, and of the velocity and course of the vessel. Forces and moments from wind will be given by wind speed, wind direction, vessel velocity and the projected area of the ship above the sea surface as a function of the vessel course relative to the wind direction. Forces and moments from current will be given by the current speed, current direction, the projected area of the hull under the sea surface, and by the vessel velocity and course relative to the current direction.
1-5 Dynamic Positioning—DP:
In dynamic positioning, so-called DP, the vessel (4) is controlled in three degrees of freedom (DOF). The desired position in x and y and in course are given as inputs from an operator using keyboard, roller ball, mouse or joystick on a control panel (10). A control system (2) is used to compute the required actuator forces in the surge and sway directions, and the actuator moment about the yaw axis so that the vessel achieves the desired position and course. The control system (2) also includes actuator allocation, which involves the computation of propeller forces, rudder forces and thruster forces corresponding to the commanded actuator forces and moments. The control system (2) is implemented through the running of an algorithm (31) on a computer on board the vessel (4). This algorithm (31) compares the desired position (9a) and course (9b) with the measured position and course (7a, 7b), and of basis of this the algorithm computes the required actuator forces and moments using control theory and found in textbooks. In addition the algorithm includes an allocation module where propeller forces, rudder forces and thruster forces are computed. The position and course are measured by DGPS sensors, gyrocompasses, hydro-acoustic sensor systems where transponders are laced on the sea floor, and taut-wires where the inclination of a taut wire fixed on the sea-floor is measured.
1-6 Testing of a Vessel's Control System.
Different failures of marine control systems, e.g. DP systems have been recorded together with the conditions that lead to the specific failure situations. As an example of this a sudden and stable error of 75 m on the GPS receivers has lead to serious failure situations in the form of a so-called drive-off for a drilling vessel under DP control where the vessel suddenly left the desired position, and emergency actions like disconnection of the riser and cutting of the drill string had to be executed. Another example is the sudden loss of an acceleration measurement signal in heave compensation, in which case the system cannot give an accurate compensation of the heave motion of the vessel and potentially difficult situations can occur if the load is in the wave zone or close to the sea floor during installation of the load at a specific place at the seafloor, or in heave compensation of a drilling riser with a rotating drilling string arranged between the vessel and a well through the seafloor.
Consider a situation in the combined form of a vessel's location, speed or course, actual weather, actual sea state, a sequence of errors in one or more sensor signals, and a sequence in command input signals that has previously resulted in a recorded failure situation. Such a situation may be reproduced for testing purposes to see if the control system to be tested is capable of handling the situation without ending in a control system failure.
A proposed approach according to an embodiment of the invention is to test a control system (2) for a given vessel by running the control system with inputs in the form of simulated sensor signals (7a′, 7b′, . . . ) and simulated command input signals (9a′, 9b′ . . . ), and in which the outputs of the control system (2) in the form of control signals (13a, 13b, . . . ) are used as control signals to the simulated vessel model (30). A test scenario for the control system is generated in the form of a sequence of test cases that are to be tested for the given vessel. Each test case is given by a specified sea state, specified wind speed (7d′) and wind direction (7d′), specified water current speed (7k) and current direction (71), and a predetermined sequence of command input signals (9a′, 9b′, 9c′, . . . ). In addition, each test case may involve a sequence of predetermined errors that are added to the simulated sensor signals (7a′, 7b′, 7c′, . . . ), e.g. an additional step change of 75 m in one or more DGPS receivers (see
For each test case in the sequence of the test the input sensor signals, the input command signals and the resulting control signals are logged, and based on analysis of the logged test data it is decided if the control system performed satisfactorily in the test, and on basis of this the control system may be approved or not approved, and possibly certified on basis of this.
2-1 Acquisition of a Signature of a Control System
Introduction.
Consider a control system (2) that has been tested and approved and certified by a classification company, e.g. Det Norske Veritas. This testing and certification may take place at several points of time, please refer to
To establish whether possible modifications actually have been made to a control system (2) after approval or certification, it is proposed to establish a control system output reference “signature” S0 after the testing is completed and the ship is approved, and store said signature S0 for comparison with later tests of the system. The method will be described in detail below.
A signature S0 is established according to a preferred embodiment of the invention by generating a preferably predetermined sequence T0 of one or more artificial sensor signals (7a′, 7b′, . . . ) and input command signals (9a′, 9b′, . . . ) for use as inputs to the control system (2) instead of the real sensor signals (7a, 7b, 7c, . . . ) and real input command signals (9a, 9b, 9c, . . . ), and recording the resulting output from the control system (2) as a signature (S0) in the form of control signals (13a, 13b, 13c, . . . ), that in this case preferably may not be sent to the actuators (17, 18, 19). In a preferred embodiment, this original signature (S0) is then a complete time section history of the control signals.
Later Tests.
To test whether a control system (2) has been modified, the same input sequence T0 is input to the control system (2) at some later times (t1, t2, t3, . . . ), and resulting output in the form of control signals (13a, 13b, 13c, . . . ) are recorded as new system responses or “signatures” (S1, S2, S3, . . . ). For determining whether said control system (2) has changed or been modified, a comparison must be made between the original signature (S0) and the new signatures (S1, S2, S3, . . . ).
2-3 Establishing a Control System Signature, Detailed.
In more detail, a preferred embodiment of the invention comprises a method for verifying a control system (2) of a vessel (4). The control system (2) in its operative state is arranged for receiving sensor signals (7) from sensors (8) and command signals (9) from one or more command input devices (10). The control system (2), as a response to said measurements (7) and command signals (9), provides control signals (13) to the actuators (3) of said vessel in order to maintain a desired position, velocity, course or other state of said vessel (4). The method is characterised by the following steps:
The method has the purpose of, at a later time (t1, t2, t3, . . . ), using the same given test sequence (T0) input to said control system (2), and recording a later response (S1, S2, S3, . . . ) from said control system (2), and determining whether said later response (S1, S2, S3, . . . ) is generally similar to said signature response (S0) to verify that said control system (2) is unchanged, or whether said later response (S1, S2, S3, . . . ) is significantly different from said signature response (S0) to indicate that said control system (2) has been changed.
2-4 Comparison with “Signature” S0.
The later acquired system response S1 is, according to the invention, compared to the original system response or “signature” S0. If there is little difference between S0 and S1, then the systems is considered to be unchanged, and there is no need for a new test for renewed approval or certification. If there is a significant difference between S0 and S1, then it is concluded that the control system has been modified, the approval or certification is no longer valid, and a new approval/certification test should be conducted. To determine what is a significant difference one must consider several limitations realistically: The signatures S0 and S1, and later system responses, may contain some noise and high frequency components, as will the test sequence T0, so acquired system responses will never be exactly equal. Below follows an outline of a method to compute the difference.
2-5 Computing a Difference.
The following computation method may in a preferred embodiment of the invention be used to determine the difference between said control system's original response (S0) recorded at time to, and a later response (S1) recorded at t1, which may be on the order of week, months or years after t0. The control signals are recorded at time instants u1, u2, . . . un . . . , uN, with intervals in the order of seconds during the test initiated at time t0 to establish the original response S0, or during the test initiated at time t1 to establish the response S1. For each time instant u1, u2, . . . un . . . , uN, the control system will output several control signal comprising control channel signals like (13a, 13b, 13c, . . . . 13K), which we may call a multidimensional signal. The multidimensional values of the sequence S0 at time un is denoted
S0(un,1,un,2,un,3,un,4, . . . ,un,m, . . . ,un,K),
in which the first subscript n in un is one time instant, and the second subscript 1, 2, 3, 4, . . . m, . . . , K indicate control channel signals like (13a, 13b, 13c, . . . , 13m, . . . , 13K). In the same way the multidimensional values of S1 at the time instant un is
S1(un,1,un,2,un,3,un,4, . . . ,un,m, . . . ,un,K).
To remove high frequency components of the sequences S0 and S1 that can have a random nature, the sequences S0 and S1 are low pass filtered. The filtered version of S0 is called SF0, at a time un denoted
SF0(un,1,un,2,un,3,un,4, . . . , un,m, . . . ,un,K),
and the filtered version of S1 is called SF1 at the time un denoted
SF1(un,1,un,2,un,3,un,4, . . . ,un,m, . . . un,K)
The difference between S0 and S1 is then characterized in terms of RMS value for the difference between SF0 and SF1. This may be computed as follows:
in which consideration must be taken that each of the measurements SF0((u1)) and SF1((u1)) generally are multidimensional as described above.
Differences between S0 and S1 control signal parameters like engine power command output, rudder angle command output, thruster angle command output, and so on, should be given weights according to their actual nature.
The RMS can be viewed as a weighted mean value of the difference between the two sequences SF0 and SF1. If the RMS(S0, S1) is larger than some threshold value, e.g. 0.01 or 1%, then there may be a significant probability that the control system has been modified or altered, and a new test should be conducted for approval or certification. Else, if RMS(S0, S1) is less than the threshold value, then the system is considered to be unchanged, and the approval and/or certification may be considered to be valid. To further improve the quality of the comparison, the alarm and event lists associated with S0 and S1 may be analysed qualitatively.
3-1 Establishing Signatures for Individual Parts of the Control System
The method described above for the generation of a signature can be used to generate a signature for an entire control system, or expanded to a set of integrated control systems. An alternative approach is to generate a set of signatures where each signature is related to the performance of the control system in relation to a specific set of sensors or to a specific function of the control system. The procedure is then to generate a predetermined sequence TG10 of artificial sensor signals (7a′, 7b′, 7c′ . . . ) from sensor group 1 of one or more sensors and recording the resulting output as a signature SG10 in the form of control signals (13a, 13b, 13c, . . . ), where the signature SG10 related to sensor group G1. Then it is generated a predetermined sequence TG20 of artificial sensor signals from sensor group 2, and the resulting outputs are recorded as a signature SG20 related to sensor group 2. Proceeding in this way, the sequential input of the input sequences (TG10, TG20, TG30, . . . ) and recoding of the corresponding outputs will establish signatures (S10, S20, S30, . . . ) for the sensor groups G1, G2, G3, . . . that have been defined. Sensor group G1 may be GPS receivers, sensor group G2 may be the hydroacoustic position sensors, sensor group G3 may be a combination of GPS and hydroacoustic sensors, etc.
In addition, a set of input sequences TC10, TC20, TC30, . . . of artificial command input signals (9a′, 9b′, . . . ) are generated to test the system with respect to different combinations C1, C2, C3 . . . of command input signals. The resulting outputs are recorded as the signatures SC10, SC20, SC30 . . . in the form of control signals (13a, 13b, 13c, . . . ), where the signatures SC10, SC20, SC30, . . . are related to the combinations C1, C2, C3 . . . of command input signals.
Then as described above in the case of a single signature for the entire system, the control system can be tested at a later times (t1, t2, t3, . . . ). In the test numbered n there will be input sequences TG1n, TG2n, TG3n, . . . and TC1n, TC2n, TC3n, . . . leading to responses SG1n, SG2n, SG3n, . . . and SC1n, SC2n, SC3n, . . . . Then by comparing SG1n, SG2n, SG3n, . . . and SC1n, SC2n, SC3n, . . . with the signatures SG10, SG20, SG30, . . . and SC10, SC20, SC30 . . . and noting which responses that differ from the original signatures it is possible to determine which sensor group, or which combination of input signals, that lead to a change in signature. If it is computed as explained above that SG1n differs from SG10, then the control system has been altered, and the change in the control system is related to sensor group G1, etc. If it is computed as explained above that SC1n differs from SC10, then the control system has been altered, and the change in the control system is related to the combination C1 in input command signal, etc.
Components List:
| Number | Date | Country | Kind |
|---|---|---|---|
| 2004 0674 | Feb 2004 | NO | national |
