Patent Application
20190106965
The embodiments herein relate generally to boring systems and more particularly, to a process for determining real time risk, reliability and loss mitigation potential for ultra-deepwater well control equipment used for offshore drilling operations.
Offshore Drilling operations employ Subsea Well Control Equipment. When this equipment has any form of operational degradation it requires a full system capability and reliability assessment to be completed. A case document must be submitted to any global regulator as a petition to remain in service or secure the well and pull the equipment to the surface for repairs. This process has traditionally taken days or even weeks to complete and threatens the schedule and profitability of drilling operations. The major oil and gas operators suffer great safety, risk, operational and financial losses during these time periods using the traditional methods for assessment and case submission.
Operators and drilling contractors often are forced unnecessarily to suspend operations and pull their well control equipment back to the surface for repairs because they cannot articulate a compelling case to regulators based on the technical facts. Suspending operations and pulling the equipment back to the surface sometimes possesses a greater threat to the operational safety or environmental protection than remaining in service.
Current systems or methods are post-failure based and only address one of the processes required at a time and are subject to significant variations of outcomes (unpredictable results). In addition, other systems or methods are based on subjective opinion rather than a full technical or engineering evaluation. All typically used evaluations today are subject to human emotion and perceived pressures which adds to the confusion and the length of time it takes to generate action plans and final decisions, which leads to unpredictable results. The systems, processes or tools used today cannot be validated because they are fragmented and inconsistent in their delivery.
Some tools used in industry are dismissed post-delivery of their output because they did not deliver the desired outcome of the assessment. Forcing the loss mitigation to be completed using more traditional and time-consuming methods for assessment. It is problematic for the industry to have a tool that can be ignored because of known issues. Still yet, conventional processes can be over assessed and still miss the technical attributes of the system being evaluated. Embodiments of the disclosed invention solve these problems.
In one aspect of the subject technology, a process performed by a computing device simulating risk and loss mitigation in well control equipment for ultra-deepwater drilling, displayed in a user interface system comprises displaying a connection of components in the well control equipment displayed across a plurality of user interface modules; receiving a user selection of one of the components; running a simulation by the computing device evaluating the failure mode for the user selected component; displaying a simulated effect of the user selected component in the failure mode; displaying effects on other components connected to the user selected component in the failure mode; and providing a risk assessment of the evaluated failure mode for the user selected component and for the other components connected to the user selected component.
In another aspect, a computer program product simulating risk and loss mitigation in well control equipment for ultra-deepwater drilling, displayed in a user interface system, comprises a non-transitory computer readable storage medium having computer readable program code embodied therewith. The computer readable program code is configured by a processor to: display a connection of components in the well control equipment displayed across a plurality of user interface modules; receive a user selection of one of the components; run a simulation by the computing device evaluating the failure mode for the user selected component; display a simulated effect of the user selected component in the failure mode; display effects on other components connected to the user selected component in the failure mode; and provide a risk assessment of the evaluated failure mode for the user selected component and for the other components connected to the user selected component.
In yet another aspect, a user interface system for simulating risk and loss mitigation in well control equipment for ultra-deepwater drilling, is disclosed wherein the user interface system is configured to: display a connection of components in the well control equipment displayed across a plurality of user interface modules in the user interface system; receive a user selection of one of the components in a first user interface module; run a simulation by the computing device evaluating the failure mode for the user selected component; display a simulated effect of the user selected component in the failure mode on the first user interface module; display effects on other components connected to the user selected component in the failure mode; and provide a risk assessment of the evaluated failure mode for the user selected component and for the other components connected to the user selected component
The detailed description of some embodiments of the invention is made below with reference to the accompanying figures, wherein like numerals represent corresponding parts of the figures.
In general, embodiments of the present disclosure provide a risk/reliability assessment simulator tool for ultra-deepwater well control equipment used for offshore drilling operations. Aspects of the system take into consideration all of the processes required for loss mitigation using risk/reliability assessment processes. In an exemplary embodiment, the system provides a simulation tool which, through a program module of user interfaces, evaluates equipment and simulates the various potential results from operating the equipment in its current state or under proposed operating conditions.
Referring first to
Referring to
The simulator system generates on the UI display 100, a simulation of the piece of equipment 110 connected to multiple other elements of the well control equipment system. The back-end of the system may store metadata associated with each element in the well control system. More importantly, the simulator system may, through artificial intelligence and/or stored data, simulate resultant effects on the operating capability of elements in the well control system in response to simulated induced failure on one or more user selected elements of the well control system.
As may be appreciated, well control systems may be large-scale, heavily connected systems with many mechanical elements interconnected to together. As there may be many points of failure, testing and predicting failures through simulation before a system is operated may prevent catastrophic failures. Aspects of the subject disclosure provide multiple UI windows which show a failure induced in one part of the well control system and the results along one or more connected lines in other UI windows displaying other areas of the well control system. Some embodiments organize the system according to control pods which may be differentiated from each other by color or other visual distinction. As will be seen, since control pods are typically running parallel or in close proximity, and eventually in connection to each other in the real world, aspects of the system allow a user to quickly trace issues down a pod line and into an element affected in the adjoining pod.
In an exemplary embodiment, the UI display generates the well control system elements with selectable features that either directly change the element's status (for example, switch a valve from open to closed), which may be seen move visually on screen or may trigger a menu 120 of actions related to the element, which may trigger simulation of resultant effects on screen. Although it is not realistically or reasonably possible to show the moving aspects of the simulator system in static drawings amongst various areas of the well control system, one feature of the system displays in motion, changes occurring along a pod line as one element is activated for failure, stress, or other operating condition. The elements connected to the element under test respond in series according to, (in one embodiment), stored fault tree analysis files which predict the effect of the first element in series, then the aggregate effect on subsequent elements in series with the element under test. The UI 100 may visually display the effects of each element along the line as changes occur in the system.
For elements not viewable in a current UI display, an exemplary embodiment includes a quick link function that allows the user to jump to different areas of the well control system during a simulation. As will be shown in detail below, each element may be designated with a reference number. A jump link may be displayed next to the element and selection of the jump link may switch the UI to display another area of the system and elements connected to the source element of the jump link.
As will be appreciated, as changes to the system occur during a test, aspects of the embodiments allow for and may generate simulator videos which can be made of the system faults and failures and which may be submitted as evidence to regulators for their consideration eliminating the need for regulators to do a manual P&ID (piping and instrumentation diagram) technical review (which is typically out of their core skill set capability). As will be appreciated, considerable time is saved by automating the results for regulators and features described herein will generate substantially improved accuracy in the evaluation of systems when compared to the manual P&ID approach. Aspects reduce confusion and the time needed for a thorough exam of the technical facts of the case being submitted. The risk assessment process has been automated through software programming so the end user only needs to know a component identification number/label on the simulated component or component(s) they have identified as the root cause. The failure mode information is input into the risk assessment form and all other technical information from troubleshooting to a full system specific contingency plan auto populates into a report for review and action. As will be appreciated, these features are nonexistent in any offshore drilling operation today.
The system has all loss mitigation tools embedded into the simulator and are retrievable on at will and on demand. These are reliability block diagrams, family of function block diagrams, fault trees, animated component functional videos, rapid navigation links and troubleshooting guide.
Referring now to
As a preliminary step prior to actual simulation, a proprietary library of components may be installed 202 for the control equipment to be simulated. P&IDs may be shadowed 204 into the simulator environment. P&IDs may be built 206 using components from the library. Each component in the system may be labeled 208 with identification. The components in the system being simulated may be virtually assembled 210 by virtual hydraulic lines from lines stored in the library. In a stored file, the family of functions for each component may be established 212. After P&ID construction, each family of functions may be tested 214 using simulator software. By referencing a stored history of actual test results for element parts, the simulated reaction may be compared 216 to actual verified system response results. Simulator diagnostics may be run 218 to identify connection issues. The process may be repeated 220 for steps 202-218 for each family of functions. Starting with the parent component for a family of functions, all family of function components may be entered 222 into a reporting format (for example, FMECA). All failure modes for every component may be stored 224 for each family.
The following will be described in terms on a UI display generated for simulating the control equipment under operation and induced failure modes. Quick links (also sometimes referred to as “jump links”) may be created and inserted 226 in association with each element part in the system displayed in the UI. The creation process may refer to metadata files which state which elements are connected to which other elements. A quick link may identify the elements connected to the element receiving the quicklink and include data indicating what other windows/displays show the connected elements and at what position in the window the element is located. A quick link (jump link) is generated within the software by drawing a hydraulic line between components. A command to switch the view between the two components is attached to the link. At this point, the software changes the line into two “links”. One link is cut and moved to another page and inserted where the line needs to “jump” to in order to make hydraulic flow.
For a selected element in the control system being simulated, and for a selected failure mode, the selected elements and connected elements are assessed 228 for symptomology and effect on connected elements. Each failure mode may be documented 230. At the onset of the project, a full list of all components is generated from the software bill of material. That is moved to a spreadsheet or other tracking tool (for example, tables, charts, etc.) and sorted by nomenclature. A “code” may be assigned to each group of components. For example, even though there may be 12 different types of valves, they may all fail in the same manner by either not shifting, loss of fluid, etc. So, each of them may receive the same codename. An operational contingency plan may be developed 232 for every failure mode assessed based on technical merits or capabilities. During simulation, a component under assessment may be changed to the failure state and the stored files may be referenced to determine an outcome. The assessment of every failure mode identified in the control system as a whole may be evaluated. The impact of failure modes on emergency response systems may be determined 234 to ensure it does not affect the Deadman Autoshear automated emergency system. If identified within the assessment as a “YES”, then the failure mode does impact the Autoshear system and if “NO” then there is no impact from the failure mode being assessed. This is to clarify that the failure mode being assessed does or does not impact emergency capabilities. If this system is impacted by any failure mode, the criticality of the failure is adjusted accordingly to match the severity of the impact. Usually a higher criticality with more severe impacts on emergency capabilities forces a re-evaluation of criticality.
An example of Deadman Autoshear in the system is described under the condition of Simultaneous Loss of Hydraulic Power and Electric Power. When the selected MUX pod is hydraulically and electrically active and the Electro Hydraulic Backup System or Deadman Autoshear is in the “Arm” mode, the pilot pressure from the pilot line opens the dual action “Arm” isolation directional control valve (DCV). This allows fluid pressure from the BOP dedicated stack-mounted shear emergency accumulator banks to pressurize the system. A pilot line controls the “Loss of Hydraulic Supply” DCV, and a separate pilot line controls the “Loss of Electric Supply” DCV. Both DCVs are connected in series to control the shear supply pressure; therefore, both DCV pilot pressures have to be lost before the valves will open. If the hydraulic supply pressure and the electric power supply to both MUX pods fail, the following sequence will occur: When in the “Arm” mode, the “Arm/Disarm” SPM valve will remain open. (Loss of pilot pressure from pilot lines does not affect the position of the double-acting DCVs; it will remain in the open position when electric power to the MUX pod pilot valve is lost.) The “Loss of Hydraulic Supply” DCV and the “Loss of Electric Power” DCV together will allow operating pressure to pressurize the emergency response system and fire the Deadman which usually is sequenced as; 1) HP supply un-isolated. 2) Casing Shear Rams are activated; the timing circuit closes the Blind shear rams and 3) all inner choke and kill valves are hydraulically closed to secure the well.
In step 236, during the assessment of every failure mode identified in the system as a whole must be evaluated to ensure it does not affect the Emergency Disconnect Sequence programmed automated emergency system and identified within the assessment as a “YES” it does impact the EDS system or “NO” meaning no impact from the failure mode being assessed. This is to clarify that the failure mode being assessed does or does not impact EDS capabilities. If this system is impacted by any failure mode, the criticality of the failure is adjusted accordingly to match the severity of the impact! Usually a higher criticality with more severe impacts on emergency capabilities forces a re-evaluation of criticality! There may be as many as 8 different programmable EDS sequences that can be assigned. Each may be assessed individually to ensure that there is no impact from the failure mode being assessed.
In step 238, the assessment of every failure mode identified in the system as a whole must be evaluated to ensure it does not affect the Acoustic remotely controlled tertiary emergency system and identified within the assessment as a “YES” it does impact the acoustic system or “NO” meaning no impact from the failure mode being assessed. This is to clarify that the failure mode being assessed does or does not impact acoustic capabilities. If this system is impacted by any failure mode, the criticality of the failure is adjusted accordingly to match the severity of the impact! Usually a higher criticality with more severe impacts on emergency capabilities forces a re-evaluation of criticality! The acoustic systems are usually constructed to manage well control in the event of the loss of control via the primary or secondary controls capabilities, this system is not mandatory but if installed can have significant impacts on well control equipment capabilities, the effects of any failures associated with this system can have a significant impact on the reliability of the well control equipment as a whole.
Below is an example of a hypothetical programmed sequence and the actions the system will take during the firing of the EDS.
The Acoustic Backup System consists of both surface and stack-mounted components. The Original Equipment Manufacturer (OEM) furnishes the stack-mounted electrohydraulic assembly; others may supply the surface components and subsea electronic assemblies. The stack-mounted Acoustic pod is an acoustically controlled, electrohydraulic unit located on the lower (BOP) Stack. The Acoustic Control pod may be designed to activate the following BOP stack functions in the event normal control from the MUX Pods are inoperative:
Riser Connector Primary Unlock
Riser Connector Secondary Unlock
All Stabs Retract
Upper Blind Shear Rams Close
Casing Shear Rams Close
Lower Blind Shear Rams Close
Upper Pipe Rams Close
Lower Pipe Rams Close
Arm and Disarm
All of these functions are directly related to either primary well control capability or an EDS Emergency Disconnect Sequence.
In step 240, every failure mode identified in the system as a whole must be evaluated to ensure it does not affect the entire systems capability to maintain its in service status. This is identified within the assessment as a “YES”, a stack or LMRP Pull is required, or “NO” meaning no impact from the failure mode being assessed has not degraded capabilities to a point that industry and/or regulatory minimum capabilities have been breached. This is to clarify that the failure mode being assessed does or does not impact a clear and well-studied minimum capability the system must maintain to remain in service.
The method may additionally generate 242 reliability block diagrams. In step 244, some embodiments generate troubleshooting decision trees that may be used by the system to provide guidance on failure modes of elements. The process may build a system library of all completed simulations and results. In step 248, all of the needed risk communication documents including the report form must be capable of being retrieved on demand for rapid assessment. For every function all of the relevant documents pertaining directly to that function may be attached via a quick link directly to the function button on the HMIs (Human Machine Interface) (user interface shown in
The following describes specific features of the UI 100 and additional features and windows in the simulator system of the present invention.
Referring now to
Referring to
Control panels may be found for example, under the tab MMI. There are five panels, as shown in menu 500 of
Referring now to
In some embodiments, the process references a stored table that indicates an element status and the effect on the control system. Depending on the element selected, the process references the information associated with the element and triggered status. Table 1 shows an exemplary reference table for the control system depicted. It will be understood that similar elements in other systems may behave differently depending on their connection to other elements in the overall system.
Referring now to
Referring now to
Referring now to
Wellhead Connector Primary Unlock Readback
Wellhead Connector Secondary Unlock Readback
Wellhead Connector Lock Pressure Readback
LMRP Disconnect Pressure
Riser Connector Unlock Pressure Readback
Riser Connector Lock Pressure Readback
Referring now to
Referring now to
Referring now to
In the exemplary embodiment shown, the two control pods are identical. The schematics are set up in the following logic: The solenoids appear on the first two pages and the directional valves appear on the next two pages. The LMRP functions are on P1 and P3; the Stack functions are on P2 and P4. The break in the lines on P1 corresponds to the same break on P3 and similarly between P2 and P4. The exception to this layout are the functions in the external pod, which are at the bottom of sheet P2 on each pod. This external pod includes both the solenoids and directional valves. The external pod contains the functions for the Inner and Outer Lower Kill Valves. The relationship between elements is depicted by the arrows originating from a row of elements in one pod and terminating in a row of elements in a connected pod. As can be seen, for example, LMRP solenoids in the top row of P1 affect LMRP valves in the top row of P3. Other relationships can be gleaned from the arrows depicted.
Referring now to
all the wellbore components open;
the side outlet valves closed;
the regulators set to:
WH—750 PSI
LA—1500 PSI
UA—1500 PSI
Manifold—1500 PSI
Manual in Conduit Package—3000 PSI;
the subsea accumulators charged to a precharge at 1200 PSI;
both Conduits selected; and
Yellow Pod is selected.
This is provided to allow a quicker start up than the normal process.
Normal Simulation
The normal simulation process begins with all valves in their inactivated state except for the “Autoshear Control Valve Supply” (Solenoid #15). That solenoid is activated at initialization, as it is wired on the vessel to be activated always. The background of the UI panels will be in a gray state until a pod selection is made. All buttons will be in a gray state until a selection is made.
It is recommended that initial set up be completed following normal rig training. Once a pod is selected, the background color of the UI panels will change color to blue or yellow corresponding to the pod selected. The simulator will take time to start up from a normal position. This is caused by the simulator filling accumulator bottles, lines, etc. Allow the regulator gages to become steady and the flow meters to stop before assuming the system is stable.
Referring now to
Examples showing what a user sees in a UI by clicking on an element, for example, a valve is shown in
In addition, the UIs are configured with features that show how the user can simulate failure modes. This feature allows for the user to show the effects in the system of a failure in one or more components. This can also lead to ensuring that a single failure does NOT affect the system capabilities. To simulate a failure, the user may access the home tab in UI 1200 (
Failure Analysis
The purpose of the Failure Analysis tab (
Highlight Tools
Referring now to
Within the Master File and accessible from each UI panel is a Risk Report Button. This link will access the report form to be used when required. Clicking on the Risk Report button brings up a new window (which may be shown as a spreadsheet for example). Each component and line within the Master Simulation File has a unique identifier number; the Component ID Number, associated with it. Most individual components begin with an HXXX and Assembled items begin with ASBXXX. These numbers are used in the FMECA database report. If a component has a failure, the unique identifying number in the Component ID field of the Report may be entered. Once the Component ID is entered, it may take a few seconds, but the Component Failure Mode drop down menu will be populated with options for that component. Selecting the failure will autogenerate the report.
Referring to
Referring now to
As will be appreciated by one skilled in the art, aspects of the disclosed invention may be embodied as a system, method or process, or computer program product. Accordingly, aspects of the disclosed invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “user interface,” “module,” or “system.” Furthermore, aspects of the disclosed technology may take the form of a computer program product embodied in one or more computer readable media having computer readable program code embodied thereon.
Aspects of the disclosed invention are described above (and/or below) with reference to block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a computer system/server, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
A computer system/server may represent for example the machine providing functions related to simulating operating modes and failure modes when acting in the role of the providing the process. The computer system/server may also represent for example the machine providing functions related to storage of data including for example the status of an element/component and the projected state of the control system that occurs in response to a change in state of one of the elements/components selected in a user interface.
The components of the computer system/server may include one or more processors or processing units, a system memory, and a bus that couples various system components including the system memory to the processor. The computer system/server may be for example, personal computer systems, tablet devices, mobile telephone devices, server computer systems, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, dedicated network computers, and distributed cloud computing environments that include any of the above systems or devices, and the like. The computer system/server may be described in the general context of computer system executable instructions, such as program modules, being executed by the computer system. The computer system/server and auditing process(es) may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.
The computer system/server may typically include a variety of computer system readable media. Such media could be chosen from any available media that is accessible by the computer system/server, including non-transitory, volatile and non-volatile media, removable and non-removable media. The system memory could include one or more computer system readable media in the form of volatile memory, such as a random-access memory (RAM) and/or a cache memory. By way of example only, a storage system can be provided for reading from and writing to a non-removable, non-volatile magnetic media device. The system memory may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of storing element/component definitions, element/component identifications, pointers attached to a jump link that trigger a jump to a connected component from the module displaying the jump link, simulating an effect on a component in response to a user selected change in the component, simulating effects on components connected to the selected changed component, and generating reports of the control system showing component performance under simulated induced failure modes.
Persons of ordinary skill in the art may appreciate that numerous design configurations may be possible to enjoy the functional benefits of the inventive systems. Thus, given the wide variety of configurations and arrangements of embodiments of the present invention the scope of the invention is reflected by the breadth of the claims below rather than narrowed by the embodiments described above.
This application claims benefit under 35 U.S.C. § 119(e) of U.S. Provisional application having Ser. No. 62/479,644 filed Mar. 31, 2017, which is hereby incorporated by reference herein in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62479644 | Mar 2017 | US |
