Drilling Automation: Potential for Human Error

Mode confusion is an automated system behaving differently than expected and the operator not being aware of (or not properly understanding) what the system is doing. Mode confusion is wellrecognized in the aviation community and has been indicated in a number of high-profile aviation accidents. As an example, a JAS Gripen fighter jet crashed during a test flight in the 1980s because the pilot tried to manually correct instability while the plane’s computer was automatically trying to do the same. The potential for the same type of problems, and associated safety hazards, arises in drilling-rig operations as a result of the increasing trend for automation and advisory systems. A simple example could be formation fracturing with an automated downhole pressurecontrol system when displacing to higher mud weight caused by the driller relying on the automated system to maintain sufficiently low flow rate without having reconfigured the system with the new mud properties. This paper describes how the use of a drilling support system in different modes and levels of automation may influence the system operator’s performance and risk of human error. The development of a systematic method for detecting mode-confusion problems by model checking is central in this respect. The test cases have been simulated in a virtual test environment created at IRIS specifically for such purposes. The test environment and test cases are described, and results are reported and discussed.