Drilling Automation: Potential for Human Error

Drilling Automation: Potential forHuman Error

Fionn Iversen, SPE, and Leif Jarle Gressgard, International Research Institute of Starvanger (IRIS);John L. Thorogood, SPE, Drilling Global Consultant LLP; Mohsen Karimi Balov, SPE, Statoil; and Vidar Hepsø, Statoil

Summary

Mode confusion is an automated system behaving differently thanexpected and the operator not being aware of (or not properlyunderstanding) what the system is doing. Mode confusion is well-recognized in the aviation community and has been indicated in anumber of high-profile aviation accidents. As an example, a JASGripen fighter jet crashed during a test flight in the 1980s becausethe pilot tried to manually correct instability while the plane’scomputer was automatically trying to do the same. The potentialfor the same type of problems, and associated safety hazards,arises in drilling-rig operations as a result of the increasing trendfor automation and advisory systems. A simple example could beformation fracturing with an automated downhole pressure-control system when displacing to higher mud weight caused bythe driller relying on the automated system to maintain suffi-ciently low flow rate without having reconfigured the system withthe new mud properties. This paper describes how the use of adrilling support system in different modes and levels of automa-tion may influence the system operator’s performance and risk ofhuman error. The development of a systematic method for detect-ing mode-confusion problems by model checking is central in thisrespect. The test cases have been simulated in a virtual test envi-ronment created at IRIS specifically for such purposes. The testenvironment and test cases are described, and results are reportedand discussed.

Introduction

There is a growing interest in work-process automation in the dril-ling community. Automation efforts are being undertaken bynumerous organizations with the overall objective of producingmore-efficient drilling, thereby leading to a higher rate of success-ful wells drilled per rig. In this way, drilling automation maybeof great benefit in today’s market with dwindling reserves andincreasing exploration activity. In general, however, automationhas also been associated with unforeseen errors, and several acci-dent investigations have attributed causes of catastrophic acci-dents to automation-system usage (Parasuraman and Miller 2004).Although one of the main objectives of automation is to reducehuman error, several studies suggest that the introduction of auto-mated-decision aids does not unilaterally lead to a reduction inhuman error but instead often simply creates opportunities for adifferent class of errors (Skitka et al. 1999).

One important source of error is mode confusion. Mode confu-sion refers to a situation in which a technical system can behavedifferently from the user’s expectation (Bredereke and Lankenau2002), leading to an inappropriate use of the system. This phe-nomenon is well-recognized in the aviation community and hasbeen indicated in a number of high-profile aviation accidents.

On 2 February 1989, the first prototype JAS 39 Gripen crashedon its sixth flight when attempting to land at Linkjoping, south-west of Stockholm. The accident was filmed by Swedish televi-sion and can be seen on Youtube (2010). Pilot-induced oscillation(PIO) as a result of an oversensitive and slow response from the

flight-control system was determined to be the cause. Because oflimitation and delay in rate of change of the wing’s flaps, thepilot’s corrective actions resulted in what is known as a rate-limiter-based PIO. The crosswind was also believed to be a con-tributing factor (Wikipedia 2012). The control system was rede-signed to solve the problem.

Introduction of fly-by-wire systems initially increased the riskof PIO because the number of modes available in these systemscould cause confusion, subsequently resulting in pilot actions thatcould lead to PIO (Amato et al. 1999). As a result, control meth-ods for dealing with such unwanted control instability were devel-oped and applied in fly-by-wire systems. One example of this isusing model predictive controllers to compensate for or suppressrate-limiter-based PIOs (Liang et al. 2006).

The potential for the same type of problem and associatedsafety hazards arises in drilling-rig operations as a result of theincreasing trend for automation (Rommetveit et al. 2008; Ornaes2010) and advisory systems (Cayeux et al. 2012b). On this basis,we proposed the following research question: “Can levels andmodes of automation influence operator performance and increasethe risk of human error?” To answer this question, we performeda study involving a series of tests using an advanced system fordrilling automation in a virtual test environment. The virtual testenvironment consists of a wellbore simulator that provides feed-back to a drilling control system with integrated simulators formachine response. The test drillers, experienced drilling personnelfrom a major drilling contractor, were asked to deal with down-hole incidents, data communication errors, and power failures,while at the same time having to deal with varying and changingautomation-system modes. Our aim was to provide an answer tothe posed question and further suggest how such challenges mightbe met to move toward the goal of a safe and efficient automationof the drilling process.

An overview of the theoretical basis of the study is provided,followed by our hypotheses. The methodological framework isdescribed thereafter, and the results are presented and discussed.The Discussion section also includes a discussion of practicalimplications (lessons learned). Limitations of the study and direc-tions for future research are presented.

Theory

System Modes and Risk of Human Error. A mode can beunderstood as a manner of behaving (Degani et al. 1999). Anautomated system can have several ways of behaving, but at anymoment, only a single mode can be active. The complexity of theproblem also will be related to the levels of automation and sys-tem modes. For the purposes of this paper, we compare the levelsof drilling automation to those described by Sheridan (2002) andfurther discussed by Thorogood et al. (2010), in which levels ofautomation relate to the degree of autonomy of the automatedsystem.

For the automation system applied here, the various functionsmay be deactivated or set to advisory or active modes, therebyrepresenting different levels of automation. In addition, the activemodes for the various functions may vary in degree or level ofautomation (i.e., degree of autonomy). As an example of fullyautomated sequences, running pipe in hole autonomously onceactivated by driller or system may be considered a higher level ofautomation than envelope protection, which simply constrains

Copyright VC 2013 Society of Petroleum Engineers

This paper (SPE 151474) was accepted for presentation at the IADC/SPE DrillingConference and Exhibition, San Diego, California, USA, 6–8 March 2012, and revised forpublication. Original manuscript received for review 8 June 2012. Revised manuscriptreceived for review 15 October 2012. Paper peer approved 23 October 2012.

March 2013 SPE Drilling & Completion 45

driller control functions. The mode of the complete system at anytime subsequently may be considered to be the combined modesettings of the system functions at that time, which may consist ofvarying levels of automation for the individual system functions.Thus, any change in the mode of any individual function will alsorepresent a change in the overall system mode. Varying levels ofautomation during an operation are exemplified for one of the testcases presented in the Method section.

Two main categories of error are caused by mode confusion—error of omission and error of commission. The latter error typerefers to errors that occur when the human operator “takes anaction that is appropriate for one mode of the device when it is, infact, in a different mode” (Sarter 1996). This is the classic type ofmode error, which requires operator action to occur. However,studies of more advanced automation in the aviation industry findthat errors of omission are the dominant form of errors (Levesonet al. 1997). In these situations, the operator fails to detect andreact to an undesired system behavior that he or she did not ex-plicitly invoke. Because the mode or behavioral changes are notexpected, the operator is less likely to pay attention to the relevantindications at the right time to detect the mode change or unde-sired behavior (Leveson et al. 1997).

A classic example of an error of commission is the fatal acci-dent to an Air Inter flight in France in January 1992 (Hourizi et al.2001) that killed all but six of the passengers and the entire crew.When the surviving cockpit voice recorders were retrieved fromthe wreckage, it was found that the crew had shown no sense ofpanic during the final moments of the flight, had attempted noevasive action, and had, apparently, been entirely unaware that acrash was imminent, until an altitude alarm had sounded 200 ftabove ground level, too late to avoid impact. No mechanical fail-ure could be identified as leading directly to the crash, nor wasany significant human malpractice to blame. The consensus wasthat an incorrect input to the autopilot was central to the eventsleading to the disaster. The pilot and copilot had been refused per-mission to land on their first approach, and they were about tomake a second attempt using vectors from air traffic control. Bothpilot and copilot were overloaded—correcting their lateral course,getting the landing gear down, running through the predescentchecklists, and entering an appropriate rate of descent. The pilotentered a vertical descent speed of 3,300 ft/min instead of anangle of 3.3� through a dual-function knob on the autopilot con-trol panel. The desired entry would have given the correct rate ofdescent whereas the error led to a steep descent, culminating inthe plane crashing into a mountainside short of the airfield.There were two critical errors in this case. First, the pilot enteredan apparently correct value although not appreciating the data-entry mode to which the panel was set. Then, both crew mem-bers failed to notice the unplanned rapid descent until shortlybefore impact. In essence, they were surprised by the behaviorof the airplane. This incident illustrates how rapidly situationawareness may be lost. The crew was so focused on dealing withan unexpected situation that their normal operating routines,such as cross-checking, broke down. Their immersion in theproblem had distracted them from observing other potential indi-cators of a problem, such as the anomalous vertical-speed indi-cations, excess speed, and inconsistent readings from thenavigation systems.

Several sources of mode confusion exist that may affect therisk of human error. An important factor in this respect is that anincrease in system autonomy is accompanied by an increase indelay between the user input and system-behavior feedback. Theoperator is thus kept “out of the loop” from the processes andactivities of the system (Mouloua et al. 2011). This effect may befurther enhanced by the fact that modes may change as a result ofsensor information concerning environment and system variablesas well as input by one or multiple human operators. In systemswith high levels of autonomy and complexity, there may also be alarge number of indications of the status and behavior of the sys-tems, distributed over several displays in different locations. Inother words, the complexity of the interaction between modes has

increased. As a consequence, it becomes difficult to maintainmode awareness, which again increases the potential for failing todetect and recover from errors (Sarter et al. 1997).

Performance

The performance of the overall system, consisting of the drillingcontrol system and the driller, is to be evaluated and related to theset mode for the various automation functions selected, whichmay again represent varying levels of automation. As a result ofthis evaluation, the benefits and risks of applying the various func-tions may be assessed, and recommendations for the optimizationof functions and procedures related to the application of such au-tomation may be derived.

Performance is to be measured as a function of such variablesas detectability of system failure, detectability of unwanted pro-cess behavior, detection time and decision time for such situa-tions, accuracy of control, confidence in system, and resultingprocess efficiency.

The main hypotheses to be addressed in the analysis are thefollowing:� Understanding/Ease of Operation—Higher levels of automa-

tion cause an increased risk of operator error; too much freedomof choice increases risk of system handling error.� Efficiency—Higher levels of automation lead to increased

process efficiency.� Confidence and learning—System experience increases the

driller’s confidence.� Competency—Use of advanced system automation requires

a new type of driller.

Method

Experimental Design. The tests were performed with a rig simu-lator and support center together in test facilities built to conductsuch testing (Cayeux et al. 2012a, b). The integrated automationsystem was configured differently for the various test cases, pro-viding variations in both type and degree of automation. Toacquaint the test personnel with the test environment, we first putthem through a training course, which is described next.

In the tests, the participants were asked to perform varioustasks with varying degrees of complexity, handle challenges, andmake decisions. The six test cases, designated A through F, arepresented in Tables 1 and 2. The order in which the scenarioswere performed was organized to compensate for learning, fa-tigue, and carry-over effects. This was accomplished by dividingthe drillers into two groups; the first group (Group 1) performedthe test cases in the sequence A,B,C,D,E,F, whereas the secondgroup (Group 2) ran the sequence D,E,F,A,B,C.

The participants were observed during the test sessions, andtheir decisions and responses to the various events were recorded.Multiple measures of human performance were applied. Extensiveamounts of data were collected, including simulator logs thatdocumented the state of drilling equipment and wellbore at anygiven time and events associated with the human/system interface(e.g., operator actions, audio-video recordings, process expertcomments, and rating scales of different kinds).

In addition, we also carried out interviews with the participants(combined with debriefing after the experimental sessions) toobtain the participants’ explanations of their behavior and the ra-tionale underlying the decisions they made. The interviews fol-lowed a predefined interview guide and were conducted on a one-to-one basis. The data-collection process was conducted by theexperimental staff at the IRIS, which includes members with com-petence within both the field of human factors and the technologi-cal aspects. All test phases, consisting of training, running ofscenarios, data collection, and subsequent analysis, were carriedout by IRIS personnel, ensuring independence of both process andresults.

Test Environment. The test environment, described by Cayeuxet al. (2012a), contains a virtual drilling rig (Fig. 1), with drilling

46 March 2013 SPE Drilling & Completion

control stations connected to programmable-logic controllers(PLCs) simulating drilling-machinery response. A dynamic wellsimulator calculates downhole response with output from themachinery simulators in the PLCs. The rig floor and derrick arevisualized on a screen in front of the drilling control stations.

Behind the drilling control stations, separated by a glass win-dow, there is a room for controlling the test situation and observingthe driller’s actions directly and the drilling operation indirectly bymeans of monitoring displays and control system screens (Fig. 2).In a test scenario, operational support may be provided from thisstation.

The automation system has been tested and used for training inthis environment before offshore piloting, which is described byIversen et al. (2009) and Larsen et al. (2010). In this testing, ex-tensive feedback was provided by drillers, which resulted in sys-tem functionality modifications. These modifications were madeboth to make the system more applicable for the driller and toadhere to existing operational procedures.

Drilling Challenges. Drillstring movement and drilling-fluidflow rate in the well both affect the pressure in the wellbore. Theupward motion of the drillstring causes a suction effect known asswab, which causes a reduction in wellbore pressure. Correspond-ingly, downward motion of the drillstring causes a pressureincrease in the well, known as surge. The surge and swab pressureeffects are mainly a function of drillstring velocity, geometry ofdrillstring and wellbore, and drilling-fluid rheology. Cuttings inthe well also may have an effect.

The circulation of drilling fluid in the well causes pressureincrease as a function of flow rate, geometry, drilling-fluid rheol-ogy, and wellbore-wall roughness. The downhole pressure (whencirculating fluid in the well) may be expressed as the equivalentcirculating density (ECD). Put simply, a drilling fluid with a den-sity equivalent to the ECD would give an equal hydrostatic pres-sure. Knowing the value of the ECD when circulating makes iteasier for the driller to judge how to adjust the drilling-fluiddensity.

In the openhole part of the wellbore, the available pressurewindow is defined by the wellbore-collapse pressure and forma-tion pore and fracture pressures—all properties of the exposedformation. Normally, conventional drilling operations will avoidbreaching these pressure limits because this may result in a loss ofwell control.

Cuttings loads in the wellbore and wellbore irregularities maycause excessive forces on the bottomhole assembly (BHA) anddrillpipe, which can lead to damage on the drillstring and BHAelements. Such situations may also lead to blockage of the well-bore and Stuck pipe. Stuck-pipe situations may lead to furtherdamage on equipment when attempting to free the pipe and canalso lead to a well-control situation as a result of fracturing causedby pressure buildup, if the well is packed with cuttings. Unex-pected increases in pump or standpipe pressure and unexpectedaxial or rotational forces, affecting hookload and topdrive torque,may indicate such a situation.

Automation System. The automation system has been describedthoroughly (Iversen et al. 2009). The system works as an aid tothe driller, and it is integrated into the drilling control system,which controls the topdrive, mud pumps, and drawworks. Systemautomation is enabled by integrated advanced dynamic processmodels providing continuous optimization and diagnostics withrespect to the typical drilling challenges described previously,through use of predictive calculations.

The system functionalities may be summarized as follows:� Safeguarding. This is analogous to envelope protection as

applied in aviation (Briere and Traverse 1993)]. Constrainingdrillstring movement up and down with respect to swab and surgelimits, and drilling-fluid flow rate in the well with respect toresulting downhole pressure limits. Two choices for setting surge/swab envelope limits may be applied:envelope continuously cal-culated on the basis of system state and envelope set by driller.� Safety Triggers. Automated limiting or mediating action on

unexpected deviation from predicted hookload or torque trends orunexpected deviation from expected pressure values.

TABLE 1—OVERVIEW OF TEST CASES: SEQUENCE MODES RELATE TO APPLIED MODES IN TESTa

Case A Case B Case C Case D Case E Case F

Specified

sequence ops

Trip 2 set up,

2 set down

Auto start

pumps, rev/min,

drill, friction test

Auto start

pumps, rev/min,

drill, repeat

Trip out five

stands

Auto start

pumps, rev/min,

Ream out

manually

Sequence

1 5,4,7 5,4 2 (3) 5,4 3

Initial well state Bit just above

TD, static

Bit just above

TD, static

Bit just above

TD, cuttings

Bit just above

TD, cuttings

Bit just above

TD, cuttings

Bit just above

TD, cuttings

Incident

triggered/

configuration:

None Screens to black

during friction

Freeze SPP

before second

start pumps

Minimal set fixed

surge/swab

envelope

Fracture and

loss resulting

from unknown

depleted region

Simulated cut-

tings buildup:

Erratic hookload/

torque, then

bridge/packoff

Solution N/A Deactivate test,

rev/min, manual

circ, pick up

Deactivate auto

system rev/min,

manual circ

Increase fixed

envelope

manually (up to

calculated

range)

Notice losses.

Halt operations

and flow check.

Notice varying

hookload/torque.

Circulate clean.

Material

available

Printed DCS

screenshots

Main challenge Trip efficiently

using advisory

Deactivate auto-

mation blindly

and set to safe

ops mode

Notice stuck

SPP. Deactivate

auto system and

set to safe ops

Notice slow trip-

ping velocity.

Adjust

accordingly.

Notice losses Notice cuttings

buildup

indications

Particular risk Differential

stickingaAbbreviations: DSC¼Drilling Control System; SPP¼ standpipe pressure; TD¼ total depth; circ¼ circulate; ops¼operations.

� Semiautomated Sequences. Semiautomated startup of mudpumps.� Automated Sequences. Automated friction test, reciproca-

tion, and reaming.� Warnings. Warnings are given on the unexpected or deviat-

ing behavior of drillstring mechanics or well pressure.

� Visualization. Envelope limits and triggers are displayed inthe driller’s user interface (Fig. 3).

Any automated sequence may, at all times, be overridden, in-terrupted, or deactivated by the driller.

The existing functions span multiple levels of automation(Thorogood et al. 2010). To be able to discriminate more clearlybetween levels of automation, the functions have been designedto stay within the bounds of successively higher levels of automa-tion, which is described in the following.

Applied Modes in Test. The initial modes that were applied inthe test cases are described here.

1. Pure Advisory. Visualization safeguard envelopes andsafety-trigger setpoints. No active input to the controls from thesystem.

2. Active Manually Set Surge/Swab Safeguards With Auto-matic Mechanical Safety Triggers. Safeguarding with driller-adjusted fixed-envelope setpoints. Mechanical safety triggers active.Calculated-safeguards envelope providing advisory informationonly.

3. Active Automatically Calculated Surge/Swab SafeguardsWith Automatic Mechanical Safety Triggers. Safeguarding withautomatically calculated envelope. Mechanical triggers active.

4. Active Mechanical and Pressure Safety Triggers. Whenoff-bottom.

TABLE 2—TEST-EVALUATION VARIABLESa

Variable

no. Case A Case B Case C Case D Case E Case F

1 Safeguarding

envelope

exceeded

Too high ROP

causing interrupt

Too high ROP

causing interrupt

Joystick operat-

ing error

Too high ROP

causing inter-

rupt/packoff

Joystick operating

2 Swabbed influx Joystick operating

Joystick operat-

ing error

Keypad operat-

ing error

Joystick operat-

ing error

Keypad operating

3 Fractured well Keypad operating

Keypad operat-

ing error

Mech. limits

exceeded

Keypad operat-

ing error

Torque limits

exceeded

4 Ave. Time per

stand (seconds

out of slips to in

slips)

Automation

deactivated

Pumps shut

down on packoff

Adjusted driller’s

limits

Torque limits

exceeded

Setdown weight

limits exceeded

5 Total trip time

outþ in

(seconds)

Stuck when trying to

go down to drill

Setdown weight

exceeded

Prompt required Setdown weight

limits exceeded

Erratic hookload

noticed

6 Joystick operat-

ing error

Torque exceeded

going down to

bottom

Pipe lowered on

packoff

Adjust to auto

envelope

velocity

Fracture/loss

noticed

Mediating on erratic

hookload

7 Keypad operat-

ing error

Used auto ROP DrillTronics*

deactivated

resulting from

overpull

Flow rate

reduced/pumps

off as mediating

action

Suggest cleaning

8 Stuck pipe Stuck pipe Reset gain Monitored gain Packoff occurred

(mechanical trigger

activated)

9 Exceed hook-

load limit

Exceed hookload

Overrun limits Suggest flow

Pipe lowered after

simulated packoff

as mediating

measure

10 Flow rate during

friction test

Monitored gain Time to react to

11 Moderating flow rate Ave. trip time per

12 Suggested closing

13 Mediating rev/min

14 Mediating pickupaAbbreviations: ROP¼ rate of penetration; BOP¼ blowout preventer.

* Automation system.

Fig. 1—Driller’s workstation.

5. Semiautomatic Pump Startup With Safety Triggers.6. Semiautomatic Pump Startup Without Pressure Trigger.7. Automated Friction Test With Safeguards and Safety

Triggers.In addition, incidents induced by the test experimentalist, as

shown in the following, were intended to provoke mediatingactions by the driller (e.g., reconfiguration or override of initiallyset system modes). The safeguards and triggers, although activated,were not continuously applicable (e.g., surge/swab safeguards andhookload triggers are programmed so they do not affect actual dril-ling of new hole). Possible solutions to the triggered incidents arediscussed in the description of test cases in the following.

The overall system mode may be represented by the combinedmodes of the applied functionalities, as suggested by the Societyof Petroleum Engineers Drilling Systems Automation TechnicalSection (SPE DSATS - http://communities.spe.org/TechSections/drlgauto/default.aspx), in which levels of automation of systemfunctions may be grouped as follows, in a hierarchy that is spe-cific for the purpose and system described here:

System Functionality Levels. Level of Automation. Off 0;Advisory I; Auto Envelope Protection (Safeguards) II; Auto Inter-rupt (Safety Trigger) III; and Active Autonomous Sequence IV.

Figs. 4 and 5 are visualizations of the state or mode of the sys-tem, showing which functions are active or applied to the currentprocess. In these graphs, known as radar or spider charts, thespokes, also known as radii, represent automation functionalities,whereas the data length on each spoke corresponds to the level ofautomation of that particular function.

Incidents Induced for Test Cases. For the various test cases, thefollowing problems to be solved by the operational team aresimulated:� Loss of Communication with Failure of Sensor. Standpipe

pressure fixed, simulated by freezing the SPP, resulting in a fixedSPP displayed on the driller’s screen and potential triggering ofmitigating action caused by deviation of pressure from expectedvalues.� Loss of Power to Driller’s (Drilling Control System)

Screens. Screens to blank, simulated by switching them off. Thiswas performed during a critical fully automated sequence, asdescribed in the following cases.� Nonoptimal System Configuration. Narrow-set fixed surge/

swab envelope setpoints achieved by setting fixed surge/swab ve-locity limits well within the calculated envelope range, resultingin unnecessarily slow tripping operations.� Unknown Depleted Zone. Erroneous calculated pressure en-

velope. A depleted zone was set up which was not accounted forin the calculated envelope for surge, swab, and ECD. Thisresulted in increased risk of fracturing.� Cuttings Buildup. Potential bridging or packoff simulated

by increasing mechanical frictional forces in the well, startingwith simulated excessive variations in hookload and torque, andending with simulated stuck pipe if the driller did not take anyaction.

In addition to these incidents triggered by the system experi-mentalist, further incidents could occur as a result of the driller’sactions. These are described in Cayeux et al. (2012a).

Fig. 2—Test environment showing simulator and support station with visual contact.

Fig. 3—Driller’s interface on drilling-control system. Keypad on right with automation system functions. Envelope limits displayedas red arrows in screen. Image courtesy of National Oilwell Varco. Courtesy of National Oilwell Varco.

Driller Training and Preparation. The test drillers were trainedon the drilling automation system in the rig simulator directly beforethe test. A training sequence was developed for the drillers to gothrough, covering all functionalities of the system, as described inthe preceding text. After the driller was successful in runningthrough the sequence in the simulator, the training was consideredcompleted.

The test drillers were made aware of all possible events orincidents that could be triggered in the simulator (e.g., influx,losses, cavings, packoff, stuck pipe, irregular gauge, washout,plugged nozzles). The automated safeguards and safety triggersshould help prevent most of these events, but unknown properties(e.g., unexpected depleted or high-pressure zones, stringers) couldcause incidents because the automation system would not knowabout them.

Test Cases. The six test cases to be performed by the test drillersare described in Table 1. System modes sequences, with number-ing corresponding to the “applied modes” listed in the precedingtext, are shown for each case in the table. The initial state of thewell for each sequence is also specified, and details regarding thevarious induced challenges are described that cover ideal solu-tions, particular risks, and available material which may behelpful.

Performing the Test Sequences. The test personnel includeddrillers, toolpushers, and other senior drilling personnel. Two testdrillers participated for each day of testing, alternating betweenperforming test sequences in the simulator and being interviewedby IRIS social- sciences personnel. During the running of the sce-narios, two IRIS personnel were in the rig at all times: one experi-mentalist and one observer who also communicated with the testdrillers when necessary.

The test cases were evaluated by use of a set of evaluation var-iables for each test case, which is presented in Table 2. Test varia-bles were either Boolean, with value true (1) or false (0), or time-related, measured in seconds. The evaluation variables were madeto cover the following aspects: time to perform operation; degreeof success in performed operation; degree of error when perform-ing operation; degree of support required; and response time tounexpected or unwanted behavior or situation.

Presentation of Results

The measurements taken during testing are presented in Figs. 6through 12, showing evaluation-variable results, and in Figs. 13through 17, showing drilling-process time logs. The evaluation-variable results are presented as time values, showing group meanand standard deviation, and as Boolean values, showing groupmean occurrence of the variable event. Results are presented indi-vidually for Group 1 and Group 2, and also as a total for all testdrillers. The time values and imposed incidents or effects may bediscerned from the drilling-process time logs. Results obtainedthrough observation and interviews performed by IRIS social-sci-ences personnel are presented and applied in the discussion andanalysis below.

Only a few of the test drillers were familiar with the drilling-control system used during the testing. As a result of this, moretime than anticipated was required for training on the drilling-control system, in addition to the required training in the use ofthe automation system. This lack of experience with the drilling-control system had an effect on the results for at least some of thetest drillers.

Because of some challenges experienced with the simulator,there were a limited number of valid tests for each test case,which may be seen by the number of valid time logs. No valid testwas performed for Test Case C. For the remaining test cases, there

Surge / swab envelope protection

Mechanical safety triggers

Pressure envelope protection

Auto pump shutdown (safety

trigger)Auto friction test

Auto pump resume

Auto reciprocation

Friction test with circulation

Auto pump resume

Auto reciprocation

Friction test completed / interrupted

Fig. 5—Left: Auto friction test running with active safeguards and safety triggers (corresponding to Mode 6). Right: If the mechani-cal safety triggers or the driller interrupts the test, the system mode is changed; only flow safeguarding and triggers apply.

Auto pump resume

Auto reciprocation

Drilling

Auto pump resume

Auto reciprocation

Pull off bottom

Fig. 4—Left: Drilling with active safeguards and safety triggers (corresponding to Mode 4). Right: The driller stops drilling andpulls the pipe up; the mode is changed.

were three to eight valid tests for each case in total, with one tofour valid tests for the two groups. Time logs are not presentedfor all valid tests.

To gather a more complete set of data for thorough statisticalanalysis, a prolonged period of testing would be required. Thiscould be performed either in an extensive test setting, whichwould require a very large budget, or as prolonged monitoring ofcommercial drilling operations, in which data collection would becomplicated because of lack of influence on occurring events.However, the authors believe that the obtained results, althoughstatistically inconclusive, are important as part of the learning pro-cess required for successful adaptation of automation in the dril-ling process.

Discussion

Each of the claims stated in the hypotheses presented earlier arehere discussed on the basis of the test results. From the analysis,suggestions are made of how to facilitate automation in whichbenefits are clearly seen, whereas modifications to existing philos-ophy and functionality are suggested in which the automation isnot seen to provide benefit.

The analysis presented here is of a qualitative nature, and italso is based partly on feedback from the test drillers from inter-views and communication during tests. Lessons learned throughthe testing (covering the test environment and method of perform-ing the test) are presented for future reference.

Higher Levels of Automation Cause an Increased Risk of

Operator Error. In some of the cases of operating error, clearlythe errors were caused by the lack of experience in using the dril-ling-control system. However, there is an indication of increasedjoystick or keypad operating error for higher levels of automation,which is illustrated by Cases B, D, and E (Figs. 8 through 11).Furthermore, if Cases B and E, with fully automated sequences(Figs. 8 and 11), are compared with the Cases A, D, and F with alower degree of automation (Figs. 6, 9, and 12), then the indica-tion is even stronger. Subsequently, these results indicate a corre-lation between higher levels of automation and increased risk ofoperator-handling error. One may speculate that the cause of theseerrors is the problem of understanding the state of the system atall times. This may be directly related to Billing’s axioms for au-tomation in aviation (Billings 1996) and discussed in relationshipto drilling automation in Thorogood (2012).

Another aspect to be considered is the effect of higher levelsof automation on the risk of unwanted incidents. In the cases inwhich automation was applied, all except Case A, all drillersstayed within the calculated surge/swab and ECD envelopes.

0Too high ROP causing interrupt

Joystick operating error (bool)

Keypad operating error (bool)

Automation deactivated

Stuck when trying to og down to drill

Torque exceeded going down to bottom

Used auto ROP

Pipe stuck

Exceed hookload limit

Flowrate during friction test

Medating flowrate

Suggest mediating close BOP

Mediating RPM

Mediating pick up

0,10,20,30,40,50,60,70,80,9

Semi auto pump resume, drill, friction test

Group 1

Group 2

Overall

Fig. 8—Results Test Case B. Run six times. Mode sequence 5, 4, 6: Semiauto pump startup, Active safety triggers, Auto frictiontest. Incident: Driller’s screens to blank.

Ave. Time per stand (from out of slips to in slips)

Manual tripping

Group 1

Group 2

Combined

Fig. 7—Results Test Case A; mean time out of slips.

00,10,20,30,40,50,60,70,80,9

Safeguardingenvelopeexceeded

Swabbedinflux

Fracturedwell

Joystickoperating

Keypadoperating

Pipe stuck Exceedhookload

Manual tripping

Group 1

Group 2

Overall

Fig. 6—Results Test Case A. Run six times. Mode 1: Pure advisory. No incident imposed.

Calculated hookload and torque limits were however exceededfor many of the automation cases, with torque limits breached andpipe stuck when going down to drill for Case B (Fig. 8; drillingwith friction tests), and a packoff occurring for Case F (Fig. 12;ream out). For the comparable cases for drilling (Case B; drillingwith friction tests, and Case E; start pumps and drill), Case B canbe seen to show a higher frequency of breaching safety limits, inwhich Sequence B contains higher levels of automation than CaseE. This may indicate again that the complexity of the use of addi-tional automation functions could lead to increased risk of opera-tor error. In general, the test drillers reported through theinterviews that the automation led to reduced workload comparedwith manual operations: Running on the limits of the systemmade them able to keep track of other aspects of the operation.

However, they also reported that automation systems can lead toincreased stress and workload if well-functioning communicationprocesses are lacking in abnormal situations.

There may be the case that the frequency of errors would dropoff as the drillers become more experienced in using the system. Itis the authors’ belief that this will be the case. To study this effectfurther, the authors would suggest continuing the monitoring useof the system once it has been commercially deployed. However,to achieve safe and efficient implementation of automation sys-tems, it is important to take into account such challenges as areseen here, when initially bringing automation onto the drilling rig.This also applies to the challenges seen in the further discussion.

Too Much Freedom of Choice Increases Risk of Operator

Error. Cases D and F address this issue, in which the challengein Case D is for the driller to realize that the manually set limitsfor the drillstring velocity envelope are preconfigured unnecessa-rily low when he is tripping. For Case F, the challenge is to con-figure correctly the settings for reaming, to avoid packoff, andsubsequently achieve a successful reaming sequence.

For Case D, five out of six test drillers required significantprompts before adjusting the manually configured tripping veloc-ity limits to a reasonable value. However, not everybody adjustedthe controls to apply the optimal limits calculated by the automa-tion system. Although this was not an error, it showed that whenthe drillers were allowed to configure the system themselves, theywere often more conservative than the automated system. Further-more, the required prompting is in accordance with research, indi-cating that people generally follow advice from automationsystems. In this case, the error corresponds to the misuse of auto-mation through error of omission—not taking appropriate actiondespite other signals indicating that the automation system iswrong and that an action should be taken.

Ave. triptime per stand

Tripping out with active safeguards

Group 1

Group 2

Combined

Fig. 10—Results Test Case D; trip time per stand.

0Too high ROP causing interrupt / packoff

Joystick operating error (bool)

Keybad operating error (bool)

Torque limits exceeded

Setdown weight limits exceeded

Fracture / loss noticed

Flowrate reduced / pumps off as mediating...

Monitored gain

Suggest flowcheck

0,10,20,30,40,50,60,70,80,9

Semi auto pump resume, drill

Group 1

Group 2

Overall

Fig. 11—Results Test Case E. Run four times. Mode sequence 4, 5: Semiauto pump startup, Active safety triggers. Average reac-tion time to simulated fracture and loss: 315 6 204 seconds. Incident: Fracture and fluid loss because of unknown depleted region.

00,10,20,30,40,50,60,70,80,9

Joystickoperating

Keypadoperating

Mech. Limitsexceeded

Adjusteddriller's limits

Promptrequired

Adjust toauto

envelopevelocity

Drilltronicsdeactivated

due tooverpull

Resetgain

Overrunlimits

Monitoredgain

Tripping out with active safeguards

Fig. 9—Results Test Case D. Run six times. Mode sequence 2, 3: Manual set surge/swab safeguards, Autocalculated surge/swabsafeguards. Average trip time per stand: 184 6 36 seconds. Incident: Manually configured minimal drillpipe velocity envelope.

Driller 1 Driller 2 Driller 3

Fig. 13—Case A logs. Trip 2 stands up, 2 stands down. No imposed incident.

0Joystick operating error (bool)

Keypad operating error (bool)

Torque limits exceeded

Setdown weight limits exceeded

Erratic hookload noticed

Mediating on erratic hookload

Suggest clean hole

Packoff occured (mechanical trigger activated)

Pipe lowered after simulated packoff as mediating measure

0,10,20,30,40,50,60,70,80,9

Ream out

Group 1

Group 2

Overall

Fig. 12—Results Test Case F. Run four times. Mode number 3: Autocalculated surge/swab safeguards. Incident: Simulated cuttingsbuildup and packoff.

However, most of the drillers commented it was not easy to real-ize that they were running on reduced limits, because this was notpossible to see on their screens (Fig. 3). Continuous feedback con-cerning the difference between operating speed and system speedlimits was therefore suggested by the test drillers. It was furtherstrongly suggested that the screens should be adaptive to the type ofprocedure being performed, so that the driller at all times got onlythe information that was necessary and relevant. Related to this,there were situations in which the operators had to use two screens tokeep track of all relevant data for a specific operation. The feedbackfrom the drillers in these cases was that it is preferable to present rel-evant data on one single screen and switch between various “screenmodes” depending on the activities that are to be performed.

For Case F, ream out with simulated cuttings buildup, half ofthe test drillers noticed erratic behavior of torque and hookloadand managed to avoid subsequent packoff though adjustment ofreaming parameters. Cleaning the hole was even suggested. How-ever, the fact that only two of four drillers handled the situation in agood way suggests that confidence in automation (even the driller’sown set limits) may increase the risk of not noticing unwantedbehavior.

Higher Levels of Automation Lead to Increased Process

Efficiency. One measure of this could be the extent to which thedrillers were willing to run on the optimal calculated surge/swablimits in both Case A, manual tripping with advisory withoutimposed incident, and Case D, tripping out with active safeguardsand low preset manual limits. For Case A, most drillers seemed toadhere to the advisory limits, although some exceeded themslightly. The optimal mean trip time per stand was slightly lessthan 50 seconds for this case. The reason for the high mean timeper stand and the large standard deviation (Fig. 7) was that halfthe drillers tripped well within the calculated limits. It may beconcluded that this advisory function may lead to a safer opera-tion, but not that it improves trip rates.

The average trip time per stand derived for Case D (Fig. 10)represents the total time divided by the number of stands tripped.These values are significantly larger than mean trip time per standgiven for Case-A results. However, the main contributing factorto time for Case D is the low driller’s velocity limits set initially,which five of six drillers failed to spot. The automation is not con-tributing to increased tripping rates for this case, resulting fromerror of commission.

Driller 1 Driller 2

Driller 3 Driller 4

Driller 7 Driller 8

Fig. 14—Case B logs. Autostart pumps, drill, auto friction test; Screens to blank during friction test indicated by dashed line.

So, in reviewing Cases A and D, one cannot conclude that ad-visory or safeguarding functionality leads directly to increased ef-ficiency. However, this type of functionality does help to avoidunwanted incidents. Therefore, without forced optimization, thebenefits of safeguarding are primarily a safer process. However,the testing of such automated optimization functionality should beperformed separately because such advanced levels of automationmay lead to other problems.

Another important measure of increased process efficiency isthe driller’s ability to detect and solve system and process prob-lems. Cases E and F present such problems to the driller. For CaseE, with semiautomatic pump resume and subsequent drilling withunknown depleted zone causing fracturing and loss, all test drill-ers eventually noticed the losses. However, two of the drillers didnot notice the losses before starting the drilling, although it shouldhave been possible to spot during pump startup. So, improved pro-cess observation achieved through enhanced automation (by let-ting the driller focus on the process instead of on drilling control)is not clear in this case. It was not easy for the driller to spot whatwas going on. This may have been both resulting from too muchfaith in the control system and having to deal with too muchinformation.

Again for Case F, ream out with simulated cuttings buildup,only two of four drillers noticed an increased variation in hook-load and torque and subsequently adjusted to avoid packoff. So, afocus on the automation system when performing the reaming,possibly including setting driller’s limits to control reaming rate,may have distracted attention from the monitoring of the actualprocess. This suggests that a lower level of automation, with morecontrol for the driller, seems to be less beneficial than a higherdegree, allowing the driller to focus on the process.

The potential problem of a too highly automated system lead-ing to the driller not paying attention to what is going on, becausethe system is controlling the process, has not been addressed inthe reported study, but should be addressed in future testing. Thisexcessive trust in the automated system is a well-recognized prob-lem in aviation (Thorogood et al. 2010).

System Experience Increases the Driller’s Confidence and

Performance. In the test sequences, the cases were staggered toanalyze the effect of increasing familiarity with the functions ofthe system, and thereby making more effective use of it. This alsowould provide a measure of the driller’s confidence in the system

Fig. 15—Case D logs. Trip out 5 stands; Driller’s trip limits configured low. Reconfiguration observable through increased triprates.

because one could study the degree to which the driller was rely-ing on the system to help him. Group 1 of the drillers performedthe sequence from A through F, whereas Group 2 performed test-ing in the order D, E, F, A, B, C.

Judging by typical errors of keypad or joystick handling, ex-cessive pipe loads, and breach of safeguard envelope, the resultsfor Group 2 show no particular trend. However, the analysis ofthese numbers for Group 1 indicates increased performance, withthe sequence of total handling errors as follows: 25% for Case A,15% for Case B, 25% for Case D, 13% for Case E, and 0% forCase F. This series indicates improved system handling perform-ance through the test.

Finally, for Case D, all drillers ran close to the calculated swablimits in the cases in which they adjusted the driller set limits out-side of the automatically calculated envelope, indicating trust inthe automation system.

Use of Advanced Automation Systems Requires a New Type

of Driller. Because only a few of the test drillers were familiarwith the drilling-control system applied, the test results do notgive a clear picture on this point. There was, however, a clear var-iation in test results, which could indicate that a certain expertiseexceeding that of most drillers could be beneficial. Key factorshere are a good understanding of the downhole process and typi-

cal indications of unstable or unwanted situations, a proper under-standing of operational procedures (in particular, for system andprocess exception handling), and an attention to detail, includinghaving the ability to focus on the relevant parameters. All thisrequires a good understanding of the system and process state atany time.

During the development of automation systems, the compe-tency requirements for drillers will increase. The current system,based on learning through apprenticeship as a crew member, willprove inadequate because of the increasingly complex drillingenvironment and modern control systems. Comprehensive train-ing will become increasingly essential in several areas:� Much deeper education and increased competency in down-

hole phenomena (e.g., torque/drag, hydraulics, wellbore pressuremanagement, and well control)� In-depth understanding of the design and operation of auto-

mated drilling-machinery control systems� Knowledge of the operating principles underlying advanced

systems for controlling downhole operations� Familiarization with and interpretation of increasingly so-

phisticated display systems and diagnosis of potential downholeproblems� Protection against the consequences of human error through

training and demonstrated competency in the nontechnical skillsassociated with Crew Resource Management

Driller 3 Driller 4

Driller 7 Driller 8

Fig. 16—Case E logs. Autostart pumps, drill; Unexpected depleted region causing fracture and loss. Temporal grid resolution 2minutes. Losses observable in active volume.

In the future, Thorogood (2012) predicts that drillers and theirsupervisors will become subject to training, competency assess-ment, and certification of qualifications in a way that is analogousto the training structure in commercial aviation, especially in rela-tion to theoretical knowledge, simulator time, and then a focus onthe job “type-rating” training. Although a generic qualification

may be issued at the conclusion of training, this will have to befollowed with rig-type and area-specific training, testing, andqualification with periodic skills tests and requalification.

As noted by Cayeux et al. (2009), major challenges are associ-ated with the industrialization of these complex model-based sys-tems in the areas of system setup and the continuing management

Driller 4

Driller 7

Driller 8

Fig. 17—(a) Case F logs. Ream out 2 stands; erratic hookload/torque imposed. Stuck pipe simulated if no mediating action on drill-er’s part. Vibrations caused by cuttings problems visible in surface torque; (b) Case F logs. Ream out 2 stands; erratic hookload/torque imposed. Stuck pipe simulated if no mediating action on driller’s part. Vibrations caused by cuttings problems visible insurface torque.

of database integrity. To enable the broad implementation of auto-mated drilling, new work processes and routines for ensuring datacorrectness and data quality must be established. This is espe-cially important for last-minute changes of configuration data andupdates of these during drilling. Checklist procedures and verifi-cation applications for the parameters used for advisory and auto-mation agents will be important to build trust to such systems.Access control for changes to parameters and logging of changeswill be necessary to ensure safe operations for automated systems.New roles and responsibilities will have to be defined and agreedupon. Standardization and aggregation of data supported by newwork processes and tools will enable the use of intelligent advi-sory and machine control systems and training simulators forautomated drilling.

Conclusions

In general, the test results indicate a correspondence between pro-cess automation and increased risk of operator-handling error.The qualitative analysis performed, together with feedback pro-vided by test drillers, suggests the following:• Well-functioning communication processes are required to

avoid increased stress and workload. Developing efficient newwork processes and routines and clarifying roles and responsi-bilities are essential in achieving good communicationprocesses.

• Providing the operator with data and information (concerningwhat happens and why) is of key importance. More adaptivecontrol-system interfaces are required for this, presenting in-formation relevant to the ongoing operation and system state.Understanding on the driller’s behalf also requires a good knowl-edge of the automation system being applied and of downholephenomena. Such competency may be achieved through trainingand experience.

• Confidence in the automation system increases the risk of notnoticing unwanted behavior. Again, training, combined withappropriate and adequate information presented to the driller,may help reduce this risk.

• It is not uncommon for system operators to follow the systemenvelope limits even though they may perceive the limits to bewrong. Such a situation may be a result of poor system configu-ration or system error, and it can be avoided through good workprocesses and driller proficiency, which are described in thefirst two points of this list.

• It is not clear from the results that safeguarding functionality,which has the primary purpose of helping avoid unwantedincidents, also leads to increased efficiency in a well withoutoperational challenges. But such functionality will help avoidincidents in more-complex wells and thereby reduce downtimeor nonproductive time.

• A higher level of automation, with less direct control for thedriller, seems to be more beneficial than a lower degree becauseit allows the driller to pay more attention to process behavior.This requires sufficient information available to allow for aproper understanding of the system state and downhole process.More testing with higher levels of automation is required todetermine what level or levels may be ideal.

• The test results suggest that additional training beyond the cur-rent norm for drillers could be beneficial in enhancing perform-ance. The authors believe this is a key criterion for achievingsuccessful application of automated systems.A final lesson is that a familiar environment and good knowl-

edge of the drilling control system on the part of the test drillersare important elements in achieving successful tests with relevantresults. These elements are of key importance in further testingfor the development of good drilling automation systems.

References

Amato, F., Iervolino, R., Scala, S. et al. 1999. Actuator Design for Aircraft

Robustness versus Category II PIO. In Proceedings of the 7th Mediter-ranean Conference on Control and Automation (MED99) (Haifa,

Israel, 28–30 June). http://med.ee.nd.edu/MED7-1999/med99/papers/

MED163.pdf (downloaded 4 June 2012).

Billings, C.E. 1996. Human-Centered Aviation Automation: Principles

and Guidelines. NASA Technical Memorandum 110381, Moffet Field,

California: Ames Research Center. http://ntrs.nasa.gov/archive/nasa/

casi.ntrs.nasa.gov/19960016374_1996036711.pdf (downloaded 4 June

2012).

Bredereke, J. and Lankenau, A. 2002. A Rigorous View of Mode Confu-

sion. In Computer Safety, Reliability, and Security, Proceedings of the21st International Conference, SAFECOMP (Catania, Italy, 10–13

September), ed. S. Anderson, M. Felici and S. Bologna, 19–31. Berlin/

Heidelberg: Springer.

Briere, D. and Traverse, P. 1993. AIRBUS A320/A330/A340 Electrical

Flight Controls; A Family of Fault-Tolerant Systems. In Fault-Toler-

ant Computing. FTCS-23. Digest of Papers, Proceedings of theTwenty-Third International Symposium on Fault-Tolerant Computing

(Aerospatiale, Toulouse, France, 22–24 June) 616–623. IEEE Confer-

ence Publications. http://dx.doi.org/10.1109/FTCS.1993.627364.

Cayeux, E. and Daireaux, B. 2009. Early Detection of Drilling Conditions

Deterioration Using Real-Time Calibration of Computer Models: Field

Example from North Sea Drilling Operations. Paper SPE 119435 pre-

sented at the SPE/IADC Drilling Conference and Exhibition, Amster-

dam, The Netherlands, 17–19 March. http://dx.doi.org/10.2118/

119435-MS.

Cayeux, E., Daireaux, B., Dvergsnes, E.W. et al. 2012a. Advanced Dril-

ling Simulation Environment for Testing New Drilling Automation

Techniques. Paper SPE 150941 presented at the IADC/SPE Drilling

Conference and Exhibition, San Diego, California, 6–8 March. http://

dx.doi.org/10.2118/150941-MS.

Cayeux, E., Daireaux, B. and Saelevik, G. 2012b. Early Symptom Detec-

tion Based on Real-time Evaluation of Downhole Conditions: Princi-

ples and Results from Several North Sea Drilling Operations. Paper

SPE 150422 presented at the SPE Intelligent Energy International,

Utrecht, The Netherlands, 27–29 March. http://dx.doi.org/10.2118/

150422-MS.

Cayeux, E., Dvergsnes, E.W., and Iversen, F. 2009. Real-time Optimiza-

tion of the Drilling Process—Challenges in Industrialization. Paper

SPE 119650 presented at the SPE/IADC Drilling Conference and Ex-

hibition, Amsterdam, The Netherlands, 17–19 March. http://

dx.doi.org/10.2118/119650-MS.

Degani, A., Shafto, M., and Kirlik, A. 1999. Modes in Human-Machine

Systems: Constructs, Representation, and Classification. Int. J. Avia-tion Psychology 9 (2): 125–138. http://dx.doi.org/10.1207/s15327108

ijap0902_3.

Hourizi, R. and Johnson, P. 2001. Beyond mode error: Supporting strate-

gic knowledge structures to enhance cockpit safety. In Blandford, A.,

Vanderdonkt, J., and Gray, P. (Eds.), People and Computers XV -

Interaction without frontiers. Joint Proceedings of HCI2001 andICM2001, Lille: Springer Verlag.

Iversen, F.P., Cayeux, E., Dvergsnes, E.W. et al. 2009. Offshore Field

Test of a New System for Model Integrated Closed-Loop Drilling Con-

trol. SPE Drill & Compl J. 24 (4): 518–530. http://dx.doi.org/10.2118/

112744-PA.

Larsen, H.F., Alfsen, T.E., Kvalsund, R. et al. 2010. The Automated Dril-

ling Pilot on Statfjord C. Paper SPE 128234 presented at the IADC/

SPE Drilling Conference and Exhibition, New Orleans, Louisiana, 2–4

February. http://dx.doi.org/10.2118/128234-MS.

Leveson, N., Pinnel, L.D., Sandys, S.D. et al. 1997. Analyzing Software

Specifications for Mode Confusion Potential. 132–146. In Proceedingsof the Workshop on Human Error and System Development (Glasgow,

United Kingdom, 19–22 March). http://citeseerx.ist.psu.edu/viewdoc/

summary?doi¼10.1.1.40.8704 (downloaded 4 June 2012).

Liang, X.-H., Yamada, K., Sakamoto, N. et al. 2006. Model Predictive

Controller Design to Suppress Rate-Limiter-Based Pilot-Induced

Oscillations. Transactions of the Japan Society for Aeronautical andSpace Sciences 49 (166): 239–245. http://dx.doi.org/10.2322/tjsass.

49.239.

Mouloua, M., Hancock, P., Jones, L. et al. 2011. Automation in Aviation

Systems: Issues and Considerations. In Handbook of Aviation Human

Factors, second edition, ed. J.A. Wise, V.D. Hopkin, and D.J. Garland.

Boca Raton: CRC Press.

Ornaes, J.I. 2010. Closed-Loop Control for Decision-Making Applications

in Remote Operations. Paper SPE 126907 presented at the IADC/SPE

Drilling Conference and Exhibition, New Orleans, Louisiana, 2–4 Feb-

ruary. http://dx.doi.org/10.2118/126907-MS.

Parasuraman, R. and Miller, C.A. 2004. Trust and Etiquette in High-

Criticality Automated Systems. Communications of the ACM 47 (4):

51–55. http://dx.doi.org/ 10.1145/975817.975844.

Rommetveit, R., Bjørkevoll, K.S., Ødegard, S.I. et al. 2008. eDrilling used

on Ekofisk for Real-Time Drilling Supervision, Simulation, 3D Visual-

ization, and Diagnosis. Paper SPE 112109 presented at the SPE

Intelligent Energy Conference and Exhibition, Amsterdam, The Neth-

erlands, 25–27 February. http://dx.doi.org/10.2118/112109-MS.

Sarter, N.B. 1996. Cockpit Automation: From Quantity to Quality, from

Individual Pilot to Multiple Agents. In Automation and Human Per-

formance: Theory and Applications, first edition, ed. R. Parasuraman

and M. Mouloua, 267–280. Mahwah: Erlbaum/CRC Press.

Sarter, N.B., Woods, D.D., and Billings, C.E. 1997. Automation Surprises.

In Handbook of Human Factors & Ergonomics, second edition, ed. G.

Salvendy, 1926–1943. New York: Wiley.

Sheridan, T.B. 2002. Humans and Automation: System Design andResearch Issues. Santa Monica, California: Wiley Interscience.

Skitka, L.J., Mosier, K.L., and Burdick, M. 1999. Does Automation Bias

Decision-Making? International J. Human-Computer Studies 51 (5):

991–1006. http://dx.doi.org/10.1006/ijhc.1999.0252.

Thorogood, J.L. 2012. Automation in Drilling: Future Evolution and Les-

sons from Aviation. Paper SPE 151257 presented at the IADC/SPE

Drilling Conference and Exhibition, San Diego, California, 6–8

March. http://dx.doi.org/10.2118/151257-MS.

Thorogood, J., Aldred, W.D., Florence, F. et al. 2010. Drilling Automa-

tion: Technologies, Terminology, and Parallels with Other Industries.

SPE Drill & Compl 25 (4): 419–425. http://dx.doi.org/10.2118/

119884-PA.

Wikipedia. 2012. Accidents and incidents involving the JAS 39 Gripen (29January 2012 revision), http://en.wikipedia.org/wiki/Accidents_and_

incidents_involving_the_JAS_39_Gripen.

YouTube. 2010. JAS 39 Gripen crash (rare alternate angle) due to pilot-

induced oscillation on February 2 1989 (27 September 2010). http://

www.youtube.com/watch?v¼k6yVU_yYtEc.

Fionn Iversen works as a research adviser in the Drilling andWell Modeling group of IRIS in Bergen, Norway, where he hasbeen employed since 2002, spending a period in manage-ment of the IRIS subsidiaries Drilltronics and Drillscene. Iversenholds a PhD degree in materials science and engineering

from the Norwegian University of Science and Technology(NTNU). With IRIS, he has worked on modeling and studies ofdrilling processes, covering drilling hydraulics, well control,conventional drilling, managed-pressure drilling, and under-balanced drilling. In recent years, Iversen’s focus has been onproject management and development related to real-timeapplications, covering model integrated drilling-process moni-toring and control automation. He sits on the SPE Drilling andCompletions Advisory Committee and is an associate editor ofSPE Drilling and Completion.

Leif Jarle Gressgard is a senior researcher at IRIS in Bergen, Nor-way. He holds a PhD degree in information managementfrom the Norwegian School of Economics. Gressgard’s primaryresearch interests are in the fields of automation systems anddecision support, organizational learning and safety, innova-tion and creativity management, and computer-mediatedcommunication.

John Thorogood is an independent technical adviser to oper-ators, service companies, and research institutes in the areasof technology, technical policies, drilling automation, remote-area exploration projects, and Arctic operations. He hasresearched human-factor issues associated with the com-mand and control of drilling operations. Thorogood workedwith BP in many parts of the world, including deepwater andfrontier exploration operations in Sakhalin, the Faroe Islands,the UK sector of the North Sea, and in Norway. He is the authorof more than 40 papers and holds BA and PhD degrees fromCambridge University. Thorogood has served on the Board ofDirectors of SPE, is a member of the SPE Editorial Review Com-mittee, and is a member of the SPE/IADC Drilling ConferenceProgram Committee. He is the recipient of the 2011 SPE Inter-national Drilling Engineering Award.

Vidar Hepsø holds a PhD degree in social anthropology fromNTNU. He has worked as a researcher and project manager inStatoil for more than 20 years. Through his work, Hespø has stud-ied crane operators, process and production engineers, reservoirspecialists, and drilling operators and experts. His main interestsand publications are within emerging collaborative practicesenabled by new information and communication technology.In addition to Hespø’s position at Statoil, he is Adjunct Professor atthe Center for Integrated Operations at NTNU.

Mohsen Karimi Balov is a lead researcher in drilling and welltechnology at the Rotvoll Research Center and is an activityleader in Automated Drilling Systems in Statoil. Balov earnedan MSc degree in petroleum exploration from Chalmers Uni-versity and an MSc degree in earth sciences from StockholmUniversity.

Drilling Automation: Potential for Human Error

Documents

Transcript of Drilling Automation: Potential for Human Error

sensors + automation

Drilling Day 3 - PDF4PRO

Automation Guide - IBM

automation irrigation system

Introduction to Directional Drilling

AUTOMATION FILE

Drilling Terms and Abbreviations

ANDRITZ Automation

Automation - Lenze

ADVANCED DRILLING SYSTEMS

Drilling in Serpentine Sea

Automation - RS Components

DAE Drilling & Drilling Fluids Technology - Punjab Skills ...

error analysis

Industrial Automation

Bench drilling tools

Valmet Automation - Energynomics

Underbalanced Drilling Operations

Automation Components

Message Name Error Code Error Description - IceGate