VÖRNTEC
Technical Case Study
Anomaly Detection
in Offshore Well
Operations
AI-powered cascade detection validated against 32.8M real SCADA observations from a major offshore operator.
Document details
Dataset scale32.8M observations
Sensor channels24 SCADA signals
Fault classes9 labelled types
OperatorAnonymised
Confidential
This document presents VÖRNTEC's validation of an AI-powered anomaly detection pipeline applied to operational SCADA telemetry from a major offshore oil and gas operator. It covers dataset composition, signal types, equipment context, processing methodology, fault classification, and quantified outcomes.
Inputs
SCADA telemetry32,872,250 observations
Sensor channels24 signals
Signal typesPressure / Temp / Flow
Valve state variables11 state variables
Choke apertures2 control variables
Labelled fault classes9 types
Outputs
$8M/yr
Recovered production value
Per operated asset cluster at $75/bbl reference price
146t CH₄
Methane emissions avoided annually
Via early detection and next-day intervention
vorntec.com Confidential — investor and customer use only
02
The Dataset Origin, composition and what makes it credible
Origin & Context

The dataset originates from real SCADA telemetry recorded across multiple offshore oil wells operated by a major production company. Data was captured at one-minute intervals across 24 sensor channels, spanning normal operations and nine confirmed fault categories. Well identifiers are fully anonymised.

The dataset contains real, simulated, and drawn instances. Only real instances were used for primary model validation, ensuring no synthetic contamination of evaluation metrics.

Composition
Total observations32,872,250
Normal rows (Class 0)12,158,183
Anomalous rows (Classes 1–9)20,714,067
Sensor channels24
Sampling interval1 minute
Labelled fault types9
Real labelled instances1,119
Simulated instances1,089 — excluded from evaluation
Key Finding
63% of all monitored time corresponds to an active fault condition.

The majority accumulate silently without triggering any existing alarm. Undetected faults are not the exception — they are the operational baseline of an unmonitored production system.

Distribution by observation count
Normal Operation (Class 0) 37.0%
All Fault Classes (1–9) 63.0%
Note on class imbalance

Extreme imbalance — up to 1:500 between rarest and most frequent fault class. Addressed via balanced evaluation sets at validation and test. Training used normal data only for the unsupervised detection layer.

VÖRNTEC Dataset Overview 02 / 08
03
Data Types & Equipment All 24 monitored signals and their physical context
Physical Process Sensors
Pressure — 10 channels
P-PDGPermanent Downhole Gauge
P-TPTTubing Pressure Transducer
P-MON-CKPUpstream — production choke
P-JUS-CKPDownstream — production choke
P-MON-CKGLUpstream — gas-lift choke
P-JUS-CKGLDownstream — gas-lift choke
P-ANULARAnnular pressure
P-MON-SDV-PUpstream — SDV production
PT-PProduction wing valve
P-JUS-BSService pump downstream
Temperature — 4 channels
T-PDGDownhole Gauge
T-TPTTubing Pressure Transducer
T-MON-CKPUpstream — production choke
T-JUS-CKPDownstream — production choke
Flow Rates — 2 channels
QGLGas-lift injection [m³/s]
QBSService pump flow [m³/s]
Valve & Actuator States
Safety Valves — 3
ESTADO-DHSV
Downhole Safety Valve
Unplanned closure → full shutdown + CH₄ venting
ESTADO-SDV-P
Production Shutdown Valve
Isolates the production flowline
ESTADO-SDV-GL
Gas-Lift Shutdown Valve
Cuts gas injection line
Wellhead Tree — 4
ESTADO-M1
Production Master Valve (PMV)
Primary production isolation
ESTADO-M2
Annulus Master Valve (AMV)
Annulus line isolation
ESTADO-W1
Production Wing Valve (PWV)
Production tree branch
ESTADO-W2
Annulus Wing Valve (AWV)
Annulus tree branch
Crossover — 2
ESTADO-PXO
Pig Crossover Valve
Pigging operations
ESTADO-XO
Crossover Valve
Line routing configuration
Choke Apertures — 2
ABER-CKP
Production Choke [% open]
Primary flow control — key regime variable
ABER-CKGL
Gas-Lift Choke [% open]
Controls gas injection volume
Operating Regime Logic
What is a regime?

An operating regime is the unique combination of valve states and choke settings at a given moment — defining which flowlines are active, whether gas lift is running, and how the choke is set.

Why it matters for detection

Physical sensor ranges differ significantly across regimes. A pressure reading normal under gas-lift production may be anomalous during crossover. All normalisation is regime-conditional — ensuring anomaly detection is relative to current operating mode.

Construction

ESTADO-* variables map to integers (0 = closed, 1 = open). ABER-* apertures are discretised to binary or ternary. The concatenated string uniquely identifies the regime. Sparse regimes (<50k samples) are consolidated into a General Regime bucket, yielding approximately 11 distinct regimes.

Example regime string
ESTADO-M1=1, M2=0, ABER-CKP=1, CKGL=0
VÖRNTEC Data Types & Equipment 03 / 08
04
Fault Classification 9 anomaly classes — cause, proportion and severity
# Fault Type Proportion % Time Sev.
0 Normal Operation12,158,183 rows
37.0% —
7 Scaling in PCK7,864,945 rows
23.9% High
8 Hydrate — Production Line4,809,035 rows
14.6% Crit
4 Flow Instability3,689,683 rows
11.2% Med
9 Hydrate — Service Line2,635,372 rows
8.0% High
3 Severe Slugging684,352 rows
2.1% Crit
5 Rapid Productivity Loss439,408 rows
1.3% High
2 Spurious DHSV Closure277,001 rows
0.8% Crit
1 Abrupt BSW Increase236,794 rows
0.7% Med
6 Quick PCK Restriction77,477 rows
0.2% Med
Fault Descriptions
7 — Scaling in PCK
Mineral deposits progressively narrow choke bore. Throughput declines gradually — undetected for weeks without monitoring.
8 — Hydrate — Production Line
Gas/water crystals block the flowline. Full production loss; clearing requires blowdown with CH₄ venting.
4 — Flow Instability
Irregular multi-phase flow. Reduces efficiency; known precursor to severe slugging events.
9 — Hydrate — Service Line
Blockage in auxiliary lines. Impairs chemical injection and support operations.
3 — Severe Slugging
Large periodic pressure oscillations in the riser. Equipment trips and accelerated mechanical wear.
5 — Rapid Productivity Loss
Well underperforms at unchanged choke settings. Indicates reservoir change or internal restriction.
2 — Spurious DHSV Closure
Safety valve closes without command. Full shutdown; controlled blowdown required.
1 — Abrupt BSW Increase
Sudden rise in water/sediment fraction. Degrades fluid quality; precursor to damage.
6 — Quick PCK Restriction
Abrupt choke closure creates strong pressure and flow transients across the system.
VÖRNTEC Fault Classification — Classes 0–9 04 / 08
05
Processing Methodology From raw SCADA telemetry to anomaly signal
01
Temporal Ingest & Split
Chronological ordering maintained throughout. Strict train / val / test / holdout split with no data leakage. Training uses normal data only. Val and test sets are 50/50 balanced across all fault classes for unbiased evaluation.
Zero leakageChronological order
02
Regime Classification
Valve states (ESTADO-*) and choke apertures (ABER-*) are discretised and concatenated into a per-observation regime string. Regimes with fewer than 50,000 samples are consolidated into a General Regime bucket, yielding approximately 11 distinct regimes.
ESTADO-* + ABER-*~11 final regimes
03
NaN Handling
Forward-fill then backward-fill per channel. Regime variables filled with mode or zero. Physical sensor variables imputed using per-regime medians from training data. Regime and ops variables are treated entirely independently throughout.
Forward / backward fillPer-regime imputation
04
Regime-Aware Normalisation
Physical sensors normalised as (x − μᵣ) / σᵣ, statistics computed from normal training observations within each regime only. Global fallback for sparse regimes. Regime variables (discrete states, apertures) are never normalised.
μ/σ from train-normalRegime-conditional
05
MinMax Scaling + Outlier Capping
Physical sensors scaled to [0, 1] using MinMaxScaler fitted on training data only. Values capped at the 1st–99th training percentile, suppressing extreme sensor transients that would otherwise inflate anomaly scores.
Fit on train only1st–99th percentile cap
06
Feature Engineering
Derived features computed after all normalisation: per-channel rate-of-change (delta), cross-sensor pressure differentials, and rolling window statistics. Applied only to validated ops variables with no remaining NaN values.
DeltasPressure ratiosRolling stats
VÖRNTEC Data Processing Pipeline 05 / 08
06
Detection Architecture Three-layer cascade — detection decoupled from classification

The system separates anomaly detection from fault annotation by design. Detection (Layers 1–2) requires no labelled fault data and can be deployed immediately with any operator. Annotation (Layer 3) is an optional enrichment layer that improves progressively as labelled fault history accumulates.

LAYER 01
Detect
Statistical + Isolation Forest
"Identify what does not look normal"
Flags deviations from the trained baseline using an Isolation Forest — a model that scores observations by how easily they can be isolated from the normal distribution. Short path length = anomalous. Operates entirely unsupervised with no fault labels required.
DATA REQ.Normal operation only
OUTPUTAnomaly score [0 → 1]
THRESHOLDCalibrated on validation set
KEY BENEFITZero fault labels needed
→
LAYER 02
Classify
Supervised Annotation
"Name the fault type"
Confirmed anomalies are forwarded to a supervised layer that assigns a specific fault class (1–9) and confidence score using historical incident labels. Decision Tree and Logistic Regression — interpretable, auditable, and fast.
DATA REQ.Historical labelled incidents
OUTPUTFault class + confidence
MODELSDecision Tree + Log. Regression
KEY BENEFITImproves over time
→
LAYER 03
Alert
Operator Notification
"Right information, right time"
A prioritised alert is delivered with fault type, anomaly score, affected sensor channels, and recommended action window. Integrates with SCADA dashboards, Microsoft Teams, and REST APIs. Designed to minimise alarm fatigue.
CONTENTFault class + severity + channels
TIMINGNext-day intervention window
INTEGRATIONSCADA / OPC-UA / REST API
KEY BENEFITNo false-alarm fatigue
SCADA Data In → Regime Classification → L1 Statistical Filter → L2 Isolation Forest → L3 Supervised Annotation → Operator Alert Out
VÖRNTEC Cascade Detection Architecture 06 / 08
07
Validated Outcomes Impact estimated from observed fault distribution and industry loss rates
$8M/yr
Recovered production value
Annual recovery per operated asset cluster at $75/bbl, 75% same-day intervention, based on validated fault proportions and industry production loss benchmarks.
146t CH₄
Methane emissions avoided annually
Prevented by early detection of hydrate blockages, spurious DHSV closures, and slugging events that would otherwise require blowdown venting.
75%
Same-day fault resolution
Baseline modelling assumption: 75% of detected faults addressed within 24 hours of alert generation, preventing cumulative production loss from compounding.
Fault-level impact breakdown
Fault Type % Time Primary Loss Mechanism Est. Value CH₄ Sev.
Scaling in PCK 23.93% Gradual throughput loss via progressive choke narrowing $4.2M Low High
Hydrate — Production Line 14.63% Full blockage; production loss + CH₄ blowdown required $2.1M + 82t Crit Crit
Flow Instability 11.22% Efficiency degradation and accelerated equipment wear $0.9M Low Med
Hydrate — Service Line 8.02% Indirect impact: injection and support operations disrupted $0.4M + 38t High High
Spurious DHSV Closure 0.84% Unplanned shut-in; controlled depressurisation required $0.3M + 26t Crit Crit

Estimates based on observed fault proportions and published offshore production loss rates at $75/bbl. Figures represent order-of-magnitude illustration, not contractual projections.

VÖRNTEC Outcomes — Economic & Emissions Impact 07 / 08
VÖRNTEC
AI-Powered SCADA Anomaly Detection
vorntec.com
32.8M
Observations
9
Fault Classes
$8M
Recoverable /yr
146t
CH₄ Avoided
Confidential — for investor and customer use only