Third Party HIL Testing of Safety Critical Control System Software on Ships and Rigs
Authors: Smogeli Oyvind , Skogdalen Jon Espen 
Published: May 2011

Abstract
The drilling industry is characterized by a rapid and up front technology development to conquer larger water and drilling depths. The level of automation has been steadily increasing over several decades, growing from manually operated sledgehammer technology to space-age computer-based integrated automation systems. These automation systems are essential for the safety, reliability, and performance of the vessels. Examples are the Dynamic Positioning (DP) systems, drilling systems, Power management systems, BOP control systems and crane control systems. Examples of incidents and accidents that may be caused by failures in these systems are loss of position due to drive-off or drift-off, complete or partial black-out, failure of Emergency Disconnect (EDC), damage to the well, and possibly fire/explosion as a secondary effect of a failure.
Most of the automation systems on today's vessels are put into operation without independent testing. This is a paradox considering that a single control system may be more complex than all the mechanical systems onboard. It is also a paradox that the automation systems often contain safety-critical failure handling functionality that may be difficult or dangerous to test onboard the real vessel, and therefore is not properly tested until it is activated during an emergency situation.
Hardware-In-the-Loop (HIL) testing is a well proven test methodology from automotive, avionics, and space industries, and is now also gaining recognition in the marine and offshore industries. The aim of this paper is to clarify what HIL testing is, how third party HIL testing can be applied to safety critical control system software on drilling ships and rigs, and why this is an important contribution to safety, reliability and profitability of offshore operations.

Introduction
Control system software is an essential and integrated part of all modern vessels. From small embedded control systems on panels and sensors to the vastly complex DP computer system, software constitutes an inherent part of a multitude of safetyand mission-critical automation systems. These automation systems are often collections of hardware and software from different vendors. To achieve optimal safety and performance, all the hardware and software components must work as an integrated system. For the complete DP system, this includes the position reference systems and sensors, the DP computer system, the power plant including the power management system (PMS), the thruster remote control systems, and the local thruster control systems, as well as all the auxiliary systems needed for electric, mechanical, and hydraulic power, lubrication, cooling, ventilation, and fuel.
As opposed to for example modern cars and airplanes, which are produced in identical numbers of thousands, almost every vessel is unique when it comes to equipment and configuration. In a new-building project it is the yard that assumes the role of system integrator, attempting to harmonize and coordinate deliveries from multiple control system vendors. The yard's main focus, however, usually is on mechanical completion. The result is that, although all physical equipment is installed and running and all wiring is correctly finalized, the integrated software functionality may not have received much attention until the final sea trial phase of the delivery. At this stage, there is usually no time to carry out software testing beyond testing of the main control system functionality. Most of this testing is usually done by the control system vendors themselves, without focus on the integrated functionality between different vendors.