In-service performance of emergency shutdown valves and dependent operational relationships in the offshore oil and gas industry

Industrial process plants use emergency shutdown valves (ESDVs) as safety barriers to protect against hazardous events, bringing the plant to a safe state when potential danger is detected. These ESDVs are used extensively in offshore oil and gas processing plants and have been mandated in the design of such systems from national and international standards and legislation. This paper has used actual ESDV operating data from four mid/late life oil and gas production platforms in the North Sea to research operational relationships that are of interest to those responsible for the technical management and operation of ESDVs. The ﬁ rst of the two relationships is between the closure time (CT) of the ESDV and the time it remains in the open position, prior to the close command. It has been hypothesised that the CTof the ESDV is affected by the length of time that it has been open prior to being closed (Time since the last stroke). In addition to the general analysis of the data series, two sub-categories were created to further investigate this possible relationship for CT and these are “ above mean ” and “ below mean ” . The correlations (Pearson's based) resulting from this analysis are in the “ weak ” and “ very weak ” categories. The second relationship investigated was the effect of very frequent closures to assess if this improves the CT. ESDV operational records for six subjects were analysed to ﬁ nd closures that occurred within a 24 h period of each other. However, no discriminating trend was apparent where CT was impacted positively or negatively by the frequent closure group. It was concluded that the variance of ESDV closure time cannot be in ﬂ uenced by the technical management of the ESDV in terms of scheduling the operation of the ESDV.


Introduction
ESDVs are commonly part of safety instrumented systems (SIS), which are employed to safeguard process plants, automatically detecting potentially hazardous events and making the plant safe.SIS are subject to the guideline IEC-61511, "Safety instrumented systems for the process industry".In addition, ESDVs are used for major infrastructure pipelines and in the UK fall under the requirements of, "The pipelines safety regulations 1996, Statutory Instrument 825".In both regulatory frameworks, an ESDV is subject to a periodic, often annual, proof test against a target closure time.
In performing this proof test, test failures can cause additional assessments of suitability to be required.These instances result in a loss of production until the failed ESDV can be brought back into service.Often, on a re-test after a failure, the performance is found to be adequate and the ESDV is returned to service, with no changes made.On these occasions, it is not clear what caused the test failure, as subsequent closure tests have been carried out successfully.This occurs with no servicing or replacement of parts being carried out.Due to the nature of the ESDV, it is a major operation to replace it and often replacements can have an associated lead time of several months, dependent on the components and material grades needed.
The subject of this research project is the North Sea oil and gas industry.After over thirty years in operation, many of the offshore platforms are nearing the end of their production lives.However, many of these platforms are still in operation and are in an operating lifetime region where the reliability of emergency shutdown valves is difficult to quantify.Research project participants are interested in the reliability and operation of ESDVs, specifically in the area of proof testing.Consequently, two research questions have been formulated.Firstly, is the closure time (CT) of the ESDV affected by the length of time that it has been open prior to being closed, i.e., the time since last stroke (TSLS)?Secondly, do multiple ESDV closures in succession improve the CT?Is has been hypothesised that frequent movement of the ESDV can be beneficial against performance degradation mechanisms such as galling and stiction.

Background
The analysis and quantification of critical valve failure rates have long been of interest in the oil and gas industry for the prediction of problems that would impact plant uptime and production [1], such as subsea isolation valves.Similarly, failure modes of other safety critical valves such as pressure relief valves have been previously investigated [2].In addition, environmental factors and the impact that they have on a SIS, as well as safety critical equipment and developing hazards have been studied [3].
In the consideration of environmental factors, there have been methods proposed for estimating probability of failure on demand (PFD) that account for the environmental conditions [4].The importance of barriers such as SIS against identified hazards, with the assessment of their adequacy [5], is also of interest to industry regulators.
Wider society also has a concern about the operation of these safety systems, as exact consequences of failure to prevent hazards can only be partially estimated, as considered by Boakye [6].This consideration affecting the health, shelter and environment capabilities described by Boakye brings forward the realisation and illustrates the potential of hazard consequences for oil and gas operations.
The importance of maintenance and proof test of ESDVs cannot be understated, the study conducted by Zhu [7] challenges the current system of functional test in a review of shutdown system workflows.Similarly, there is a large amount of interest in predictive maintenance systems using Industry 4.0 technologies [8].Also, in the validation of proof tests of logic solvers, a checklist is proposed to ensure that all aspects of the logic solver and the ESDV interface are adequately covered [9].In the assessment of the performance of safety systems carried out by Andrews and Fecarotti [10], some minor recognition of the problem of degradation in valve performance during service is given.In this study [10], the degradation of closure time (CT) is linked to the mean time to failure (MTTF).Among the proposed risk indicators against major hazards for offshore installations [11], over half of the indicators are based on ESDV and valve technology.Similarly, as a future concept for dynamic barrier management, use of real operating data, including includes sensor data and condition monitoring, may be applied to ESDV technology [12].This approach is also proposed for intelligent sensors by Mkhida et al. [13], however, it was reported that a potential weakness exists in the IEC-61508 standard where a potentially high rate of safe failures does not lead to a lower PFD result.
Condition monitoring of safety barriers with reliability degradation due to ageing is investigated by Xing et al. [14].Where a case study regarding a high consequence scenario is covered.The performance impact of degradation due to ageing is equally applicable to ESDVs.Xing et al. concluded that time dependant failure is a key influencer of the dynamic behaviour for business continuity and production uptime.This is not possible with the existing level of sensors in current ESDV equipment.However, this is perhaps an area of future work, with the potential levels of sensor integration possible with Industry 4.0.
While safety instrumented systems, such as ESDVs, are in the operational and maintenance phase of the functional safety lifecycle, there is a recognition that the assumptions made and the methods used in the design and engineering phase may not be appropriate [15].In the study carried out by the industry regulator, The UK Health and Safety Executive (HSE) [16], the focus has been on the riser ESDV.Riser ESDVs are intended to isolate flow to the offshore platform from production flowlines.These riser ESDVs are very similar to the ESDVs used in normal service to protect the processes on the offshore platforms, commonly referred to as topside ESDVs.This research was carried out with reference to KP4 which is a UK HSE initiative to mitigate the effects of aging offshore assets.As well as this industry approach, KP4, other methods for condition assessment and useful life prediction, beyond the original design lifetime have been proposed [17].The operation of ESDVs in degraded service is also of interest to those operating this type of equipment in other industries, such as national infrastructure [18].Specifically for ageing of oil and gas fields, there is particular concern that age related failures may add to the demand rates for safety instrumented systems [19].In the initial phases of oil and gas lifecycle operations, such as drilling, the management of essential service valve characteristics has been investigated using Industry 4.0 technologies [20].Likewise, the intelligent diagnosis of process equipment items such as transfer pumps have been reviewed [21], generally on a larger scale in the management for oilfield investments [22] using Industry 4.0 technologies.
Quantitative analysis of degradation in SIS components, such as ESDV, is reported by Zhang, Barros and Liu [23].Wu [24] extended the methods available from IEC-61508, including specific methods for the ESDV time dependent failures.Furthermore, leakage is an issue that affects most types of valves, including the quarter turn ball valve that is normally used for ESDV service.Several methods are available to estimate the leakage rate, such as built up back pressure testing and non-destructive acoustic recognition testing [25].This is of interest in maintaining the overall integrity and operation of the ESDV.The quarter turn ball valve is used in blowdown applications, as referred to in the simulation presented by Shafiq [26] and also in the comparison in fire protection capability for pressure vessels on offshore oil and gas installations [27].This reinforces the case that this type of ESDV and the quarter turn ball valve as its basis, is used extensively in safety applications across the oil and gas industry.
Socio-essential energy infrastructures, such as oil and gas operations which are needed to fuel the de-carbonisation of the future are the subject of the work by Alderson et al. [28].This study assesses the impact of climate driven causes to improve hazard outcomes.Their findings indicated that novel training exercises, including the use of simulations and games with increasing exposure to surprise elements, help strengthen adaptiveness and improve outcomes.This becomes increasingly relevant to SIS in mid and late equipment life, as climate change potentially accelerates the equipment ageing process and, in some cases, may bring about failure types that have not been previously encountered.
It is therefore evident that a comprehensive understanding of the mid and late life operation of the ESDV as an operating part of any safety instrumented function is of great importance to oil and gas industry operators, maintainers and regulators.

Objectives
In order to research the factors that affect proof testing, it is important to understand the behaviour and performance of the ESDV in the industrial setting.For this goal, two specific research questions have been formulated, namely: (1) Is the closure time of the ESDV dependent on the time that it has remained in the open position prior to the command to close?(2) Do frequent successive closures over a short number of hours improve the closure time?
Although the performance of the opening/closure of the ESDV can contain useful information such as indicating problems with the actuator (e.g., leakage), for these research questions the opening stroke performance has been omitted for brevity, also the closing stroke is of most interest in safety applications.

Methodology
An important aspect for the safe continued operation of ESDVs is the comparison of the actual operating time to the pre-determined target closure time.This is the time available for the ESDV to close in order to prevent the envisaged hazard.Target closure times are often set using estimation from records of plant operation, calculated using process simulation software or arbitrarily set in performance standards.When set in performance standards, these closure time targets are assigned to cover a large number of different ESDV applications and sizes, so the target is suitably easy to meet, in some cases less than 1 min for full closure.Critical, high consequence, safety applications tend to have calculated target closure times set, often with a difficult to meet target due to the convergence of developed system pressure and equipment design limitations in the scenarios considered.In this study, target closure time for each of the ESDVs considered was not provided by the project participants.This has a limitation on the output from this study, as pass and fail criteria for each ESDV cannot be stated, which is of principal interest to the operators of process operations and safety systems.Instead, this study has concentrated on investigating the relationship between the closure time and the time spent in the open position, and also the effect on closure time of frequent closures.
Many factors can affect the performance of ESDVs in service and these include aspects of design and operation.For instance, the valve type and actuation type, especially where the cleanliness of the hydraulic system needs to be maintained to a high standard to prevent clogging of exhaust ports.Aging assets generally give rise to concerns with supportability and obsolescence, none more so than in safety applications involving ESDVs.Large valve sizes, as employed in riser valve service, can also cause specific in-service issues due to large breakout torques required and the vulnerability of components at this point in the process to erosion and friction from production fluid sand.The problem of large breakout torques is also present in high pressure applications.Additionally, high differential pressure can negatively affect valve seals.The role of ongoing operational maintenance and the application of lubrication while in service are also factors to be considered, but this is believed to have negligible impact on the overall performance, due to the high percentage uptime of these production systems and the scarcity of skilled personnel to carry out greasing and flushing tasks.On reflection of these general issues affecting ESDV performance, they can be considered in this study as factors affecting the in-service performance of ESDVs in the following ways.Ageing of ESDVs is a factor in this study as all the subjects have been assumed to have been in service for in excess of 25 years, which in many cases is outside the normal service life of this type of industrial equipment.Industry participants that provided data for this study have not provided any accompanying service records for these ESDVs, so no information was available on any historic failures and subsequent repair.In terms of any mandated testing of ESDV operation, it is understood from the project participants that generally the ESDVs from the plants providing the operational data have been tested at a six-month full closure regime, though this might not be applicable to all ESDVs universally.Process fluids can have a major impact on the ESDV performance and reliable operation over time.Based on the data shown in Table 1, it is evident that the majority of the ESDVs (four out of six) are in hydrocarbon gas service.This is considered a "clean" service by industrial standards within the field of upstream oil and gas, indicating that the service is not highly abrasive or erosive and the fluids would not carry much entrained sand or solids.The remaining two ESDVs are employed in riser valves for which they produced oil service.These may be considered to have a higher amount of entrained solids that would have a negative impact on the ESDV internal parts and seals, as well as inducing friction when accumulated in closely mated sealing surfaces and internal moving parts.All the subject ESDVs come from early North Sea era offshore platforms, as such they will benefit from a good level of environmental protection from natural elements such as salt laden air, sea spray and weather.This is in opposition to the more modern and current design philosophies for offshore platforms of minimal and open structures, designed for a large amount of natural ventilation.Finally, ESDVs investigated in this study are part of the wellhead, separation and gas processing modules in a typical offshore oil and gas processing plant, their duty of operation would only be to intervene in the case of a process upset or for process isolation purposes.
The data analysed has been collected from four separate oil and gas producing offshore platforms in the North Sea, the average age of which is thirty-three years.A total of 479 specific ESDV datasets have been received from the project participants.In each case, information has been exported from the process plant control system into a format that is suitable for analysis.
For the initial research question, the analysis focuses on a small number of ESDVs to provide a greater level of specific detail as shown in Table 1.These ESDVs were selected from a larger group which provided the most complete datasets and were considered the most credible.The analysis is then carried out for a greater number of ESDVs and the general results are reported.The pressure class stated for each valve in Table 1 defines the range of operating pressures and the maximum pressure that the specific piping system can work within, referring to ANSI/ASME B16.5.In addition, the process media listed in Table 1 are described below: HC gas e hydrocarbon gas phase fluids, minimally processed (1/2 stages of separation) condensate bearing gas.
Riser e unprocessed well fluids mainly liquid with evolving gas phase.
Oil e liquid phase, minimally processed (1/2 stages of separation), with evolving gas.
All the ESDVs analysed are installed with open and closed position limit switches which are used to show the status of the ESDV in the plant control system.The status of these limit switches are date/time stamped and logged and it is this information that is the basis for the data analysis.As part of the pre-processing routine, data was made uniform in structure and content prior to the onset of the investigation.
The first step taken in screening of the input data is to sort tagged information into separate files.Spreadsheet files were used together with Matlab scripts to ensure consistency and reduce human errors in this operation.Fig. 1 shows the type of information that has been provided by the project participants, this data is in the format exported from the process plant control system, with date and time stamps, tag and equipment state.
Once the data for a specific tagged ESDV was placed in one file, the data was then sorted chronologically, and duplicate rows were removed.It was at this point that the data was used to provide the closing time from the open to close status by a closure detection algorithm.The algorithm detects a character string containing a confirmed "open" position as the of the closing sequence.Then, character strings containing the "travel" or "moving" condition were searched for as a successive condition, together with the confirmed "closed" condition to calculate the closure time.This three-state successive search provides the most stringent rule set in detecting full ESDV open to close stroke.Two-state successive searches were used in the development of the final algorithm, however in this case the possibility of the ESDV not being fully open at the start of the sequence does exist, therefore this two-state successive search pattern was not used, and the three-state successive pattern was selected instead.
The algorithm ran continuously to process all the available tagged data collected from the plant control system.In total, 479 individual ESDV datasets were identified.The first step in processing this data was to assess the overall confidence for each particular ESDV dataset.This involved quantifying several aspects of the data for comparison amongst the datasets collected.The factors assessed are: (1) A set minimum number of open/closing transitions, seven (Considered a minimum to provide a meaningful correlation).( 2) The number of transitions recorded in excess of 600 s (Considered too long to be a credible ESDV closure).( 3) An average non-zero transition time.
The content of the datasets may be affected by factors such as power blackouts affecting the recording equipment or loose components or connections in the limit switch assemblies.The result of this confidence screening process is that from the initial 479 datasets, items with zero confidence factors were removed.This meant that a total of 33 ESDV datasets remained for analysis.Of these 33 datasets, six datasets with the highest confidence factors have been taken forward for detailed analysis as shown in Fig. 2. The confidence factor was determined by calculating the ratio of closing transitions to opening transitions since this referred to the completeness of the dataset.
Once the datasets are assessed for confidence, the analysis aims to address the research questions introduced earlier, namely: To address the first point, from the confirmed "open" and the "travel" or "moving" states, it is possible to determine the time period that the ESDV has been in the open position prior to closing, referred to as TSLS.For a given ESDV dataset, the series of TSLS values is correlated against the series of closure times.Pearson's assessment of correlation is used as the basis for this part of the rðA; BÞ ¼ A i ¼ Input array independent variable, TSLS.
As part of the analysis, the closing stroke times have been divided into two groups, above mean closure times and below mean closure times.This has been done to assess the sensitivity of each of these groups in the correlation analyses, (i.e., do higher closure times or lower closure times have a greater correlation to TSLS?).
For the analysis on the second question relating to the effect of successive closures over a short number of hours, the records within the dataset are analysed to search for date/timestamps that have a close proximity.This is defined as within a 24 h period of the previous closure, and this can result in extended series of closures within multiples of 24 h periods.
Several assumptions have been made to carry out the abovementioned analysis which are listed below: (1) The effect of process line pressure is negligible as these plants are continuously operated and only shut down for annual or biennial maintenance, during which time valves are not used.(2) None of the ESDVs analysed have received major maintenance that would improve their performance and that the ESDVs have not been replaced during the analysed time span.(3) None of the ESDVs are fitted with equipment that carries out online partial closure testing.These partial closures are automatically discounted by the detection algorithm.(4) Closures with excessively long closure times, longer than 600 s, are not valid and these have been removed from the dataset.
This analysis approach has been selected largely due to the volume and type of data received from the project participants.The data has required careful handling and transposition to make it suitable for calculation purposes, while preserving the fidelity and digital system artefacts attached to the ESDV records (status tags).The individual ESDV transition records have run into hundreds of rows; thus, an automated scripted solution has been created and utilised within Matlab.This has been split into multistage processing to ease verification of the data processed within each stage.
In terms of hypothesis testing, these two research questions are investigating the alternate hypothesis.The null hypothesis has been established through interviews with experienced ESDV field technicians.The null hypothesis is that the closure time of ESDVs is negatively affected when the ESDV is kept in the open position for extended periods.The alternate hypothesis investigated in this study is that CT is independent of TSLS.

Relationship between CT and TSLS
In analysing the dependence of the closing stroke time on the time period that the ESDV was held in the open position prior to the close command, reference is made to the TSLS value that is related to each of the closures.In order to test for a relationship between the CT and the TSLS, Pearson's correlation coefficient was used to assess the relationship between the data series representing CT and TSLS.The TSLS value series plotted against CT for ESDV142 is shown in Fig. 3 as a typical example.
Considering the convention used by Evans [29] to describe the absolute measure of Pearson's correlation coefficient, shown in Table 3, the quantitative information in Table 2 has been supplemented with a description.
In the summary of the information in Table 2, there is mainly a weak or very weak correlation between the closure time of the ESDV and the time that the ESDV was in the open position prior to the command to close.There is one isolated instance of a 'moderate' relationship with the 0.53 value for above mean closures for ESDV-160, however this does not help provide a finding applicable to the wider group.The same application, actuation media and pressure class are present in other ESDV datasets which produce much lower correlation results.In addition, the general correlation and the below mean correlation remain within the 'very weak' and 'weak'  categories.Therefore, the isolated instance for ESDV-160 is not considered further.
Considering the data from the other ESDV datasets, the general correlation coefficients calculated for the larger group of non-zero confidence factor datasets (33) are shown in Fig. 4.This demonstrates that there are low levels of correlation between these parameters for a larger group of ESDVs.The group of ESDVs analysed in this case consisted of the thirty-three non-zero confidence factor ESDVs from four different offshore platforms.
As evident in Fig. 4, the level of correlation between closure time and TSLS remains low across the larger group of ESDVs.Most values remain in the classifications of "weak" or "very weak".There are two outliers, indicating opposite correlation, direct and inverse, however when considered together they do not bring any meaningful finding to the overall correlation relationship.Therefore, detailed analysis of the results demonstrates no relationship between the ESDV closure time and the time that the ESDV has been open before being commanded to close (i.e.TSLS).Thus, the response to the first research question is negative.The correlations between the closure time and TSLS are almost exclusively weak or very weak, demonstrating little or no meaningful relationship.As such, based on the range of ESDVs investigated, it could be concluded that ESDVs do not benefit from any periodic closure or partial movement to maintain a target closure time.

Relationship between CT and successive closures
The next research question was whether successive closures over a short number of hours can improve the ESDV closure time.The same subjects used in the previous section were analysed regarding the frequency of successive closures.The algorithm that was used for the analysis was modified to seek closure times that occurred within a 24 h period of each other.For each ESDV the frequent closure series were generated and recorded as depicted in Table 4.
The 3D stem plots of the frequent closure groups for each ESDV are also shown in Figs.5e10.The x-axis shows the month/year, yaxis shows the closure order and z-axis shows the CT.
In review of Figs.5e10, it can be seen that in each closure order, there is not a consistent trend on CT, the CT is not consistently increasing or decreasing through the closure order.Considering this finding, this helps to corroborate the findings of the previous section, where no appreciable levels of correlation between CT and TSLS were found.In response to the first question, maintaining a target closure time is the prime measure of confidence and fitness for service for an ESDV, either for pipeline riser valve service or as part of a SIS under IEC-61511.Under both regimes, the CT is demonstrated in a proof test, and it is in the scheduling and management of proof testing that the outputs of this investigation are thought to be valuable.In the investigation between CT and TSLS, the aim was to discover if there is a stable and reliable relationship that may become the basis for maintaining a target CT.If successfully demonstrated, the specifics of a single ESDV may then be investigated for detailed analysis.Based on the results of this study, where there is at best a consensus of a "weak", or "very weak" relationship between CT and TSLS, it can be concluded that there is not a clear alternative to the current regime of scheduling proof testing based on probability calculations.
The second research question is whether successive closures over a short number of hours improve the closure time.From the initial group of six ESDVs, groups of closures taking place over a 24h interval have been found from the operating records available.The intent in this part of the investigation was to determine if there was a significant trend or profile impacting CT.According to the results presented in Figs.5e10, it is apparent that there is not a consistent relatable trend through the order of closures.This information is considered useful in dealing with proof test results that do not meet the target as further closures, without other intervention/maintenance activities, do not necessarily indicate better results.
In most of the ESDVs studied in this investigation (4 out of 6), there is a variance in the CT over the time that the ESDV is in service.The results presented in this paper show that the technical management of the ESDV is not able to influence the CT performance by manipulating the frequency of operation of the ESDV.Therefore, it can be concluded that CT variance of the ESDV depends on factors outside of those that the technical management of the ESDV can influence.Whilst the factors that do affect the CT are of interest to all in the sphere of operation and verification of major accident hazard barriers, the findings of this study demonstrate that these do not include the frequency of operation of the ESDV.
However, it should be stressed that the findings of this study require further qualification before this information can be used to inform decisions on the operational management and testing of ESDVs.Firstly, ESDVs should be managed and tested within their legislative area, either pipeline regulations or functional safety.Secondly, the findings stated in this paper should not be used to extend test frequencies beyond the boundaries of existing accepted and mandated practices.

( 1 )
Is the closure time of the ESDV dependent on the time that it has remained in the open position prior to the command to close?(2) Do frequent successive closures over a short number of hours improve the closure time?

Fig. 1 .
Fig. 1.Typical input SOE (sequence of events) data from plant control system.

Table 1
ESDVs employed for detailed analysis of valve CT vs TSLS.

Table 2
Correlation values between CT and TSLS.
Fig. 4. General correlation between CT and TSLS for multiple ESDVs.