The growing complexity of process control systems has substantially increased the pressures faced by E&P companies worldwide.

The task of protecting and managing this type of software should not be underestimated when considering the phenomenal growth and sophistication of the software-based controls used on these vulnerable and often remote assets.

The software installed by such operators is responsible for an installation’s ability to produce as well as the quality of the end product. And with ever-growing demands set out by regulations, standards, and guidelines governing the industry, the challenges in protecting and managing this software have never been greater.

However, despite the growing importance of managing the safety, integrity, and security of these hidden assets, this requirement is frequently overlooked. A staggering 90% of UK production companies do not have secure back-ups for all of their process-critical software.

Before looking to address these concerns, operators must identify the challenges that they face in managing such software.

Compliance

The E&P industry is faced with the task of complying with a growing list of standards and regulations governing the inspection of aging facilities and life extension. These standards call for secure backups of code and documents; configuration management, including change control and fault logging; user password management; security of information; and audit trails.

With no effective system in place to take control of these responsibilities, there is a significantly heightened risk of operators failing to comply with such standards. Any such failure is a cost to the bottom line, so compliance must be recognized by companies as one of the major challenges that should be addressed.

Disaster recovery

What price would an E&P company place on an unplanned shutdown of more than one hour? What about a day?

Many companies barely think about the software for their process automation systems until something goes wrong and they need to find the right version and reinstall the software from media such as CDs, often kept in unlocked drawers or workshop filing cabinets. These CDs can be corrupted or lost, meaning a company's entire process software for that system is completely gone, with the potential to cause serious problems. CDs and similar storage methods are not reliable media for long-term storage, especially in an industrial process environment.

Integrators do not always retain copies of all the software they supply to companies on systems handover. If it’s software that isn’t effectively or safely backed up, special arrangements will be required to ship new software to the unit, adding yet more expense to an already costly delay in production. Operators need to consider how they can remove the risks before disaster strikes.

CD ROMs are not an effective form of media storage for critical software systems.

Security

Ensuring that the right person will always have access to the right information at the right time is critical to guaranteeing the effective management of software.

One of the most important software management issues facing the E&P industry is the number of people who have access to software changes and the security governing that access. Without that security in place, process control systems can become subject to unsafe changes being made without being logged, leaving no audit trail for other users. In the event of a fault, how is anyone else supposed to identify backups to that software?

Change, faults, and bypass management

Effectively managing any changes to the software of an asset is crucial to ensuring that operators can optimize the lifespan of that asset and identify any problems or faults before they occur. Without seeing the entire audit trail of an asset, this can become a very difficult task.

When a change is required to an existing or developing asset, it is vital that the request is thoroughly checked out for safety, functionality, and requirements compliance before it is implemented. Changes should not be carried out blindly and without the correct procedures being exercised.

Changes are often a result of a fault occurring in the system, and although faults do not always result in a change to the software or to documents, they should still be logged.

Even if a change is not necessary, a documented log of the fault helps form the audit trail and also records the symptoms and corrective action used to recover the system.

The same applies to temporary bypasses installed. These also need recording and managing to ensure they remain in place for the minimum amount of time and that the risks of having them installed are monitored and reviewed regularly.

The valuable data gathered through effective management needs to be stored for later use and will act as a knowledge base for root cause analysis in the event of recurring faults. This helps decrease the diagnosis time, which minimizes downtime and increases productivity.

Controlling change

Given that the adoption of process control software is only likely to increase within the E&P industry, the effective management of this software is a critical part of any operator’s overall asset management responsibilities. However, these are responsibilities that are all too often little understood. Furthermore, the issues of not effectively managing software assets are rarely addressed until it’s too late.

Asset Guardian has created a toolset that helps manage the software that runs automated process control systems. The solution addresses the issues facing operators. It helps maintain compliance with a bewildering set of industry guidelines and directives, provides backup in the event of a shutdown, enables the secure management of software, and helps manage change and maximize the productivity of aging assets.

If E&P companies are to recognize the importance of effectively managing their hidden assets, they need to start with an understanding of the issues that that they face.