Study on Quantitative Evaluation Method for Failure Risk Factors of the High-Temperature and High-Pressure Downhole Safety Valve

Abstract

Downhole safety valves are essential equipment for oil and gas extraction, and it is crucial to carry out a downhole safety valve failure risk evaluation and reliability analysis to ensure the safety of oil and gas production. In order to improve the operation and maintenance management level of downhole safety valves and explore the key failure risk factors of downhole safety valves, this study firstly carries out a Failure Mode and Criticality Analysis of downhole safety valves; identifies the causes of failure of downhole safety valves and the consequences of accidents through the Bow-tie method; and quantitatively evaluates the failure risk factors based on the improved Decision-making Trial and Evaluation Laboratory method and obtains the influence and importance ranking of 14 types of failure risk factors. Specific preventive measures for key failure risk factors are proposed in several aspects: optimising the structural design of downhole safety valves, improving the processing and manufacturing process, setting up an efficient field management team, carrying out equipment operation and maintenance management training, establishing a field failure response mechanism, and setting up an intelligent O&M management platform for downhole safety valves. The research results of this study are conducive to improving the reliability of downhole safety valves, ensuring the safety and integrity of on-site operation and maintenance management, and providing theoretical guidance for the analysis of the risk of failure and operation and maintenance management of downhole safety valves.

1. Introduction

In recent years, safe production has brought more and more attention to the subject of failure risk assessment. The petrochemical industry is a typical high-risk industry, and in order to ensure the safety of oil and gas production, it is imperative to carry out risk analyses and reliability assessments for petrochemical equipment. A downhole safety valve is a safety device installed at a designated location on the tubing in the wellbore, and its main function is to block high-pressure hydrocarbons downhole to prevent blowouts and environmental pollution when the wellhead device is out of control [1]. The reliability of downhole safety valves is directly related to the production safety of oil wells, so it is necessary to carry out research on risk evaluations and reliability analyses of downhole safety valves.

There have been many studies on the design and manufacture of downhole safety valves [2,3,4,5,6,7,8]. However, there are not many studies on the reliability of underground safety valves. Yuan Guohai et al. used numerical simulation to numerically simulate the mechanical properties of downhole safety valves and plotted the performance envelope of downhole safety valves [9]. This study provides theoretical and methodological support for the field application of safety valves. Luo Heng et al. summarised the failures and direct causes of underground safety valves based on the results of field research [10]. Zhang Junliang et al. analysed the reasons for the failure of downhole safety valves in high-sulphur gas wells and proposed corresponding countermeasures [11]. Rausand et al. established an exponential model and a Weibull distributed life model of downhole safety valves, respectively, and investigated the reliability of downhole safety valves as a safety barrier [12]. Busch et al. analysed the relationship between oil and gas well life and downhole safety valve reliability [4]. Zhi Zhang et al. studied the failure forms and risk factors of downhole safety valves for shale gas and established a failure probability calculation method based on the BN model [13]. However, the factors influencing the consequences of downhole safety valve failure have not been investigated, and the use of a Bayesian network model presupposes independence between failure modes and requires an a priori probability of failure based on component failure as the cornerstone of the calculation [14,15]. As a kind of normally open valve, the failure of underground safety valves can only be detected during routine maintenance and inspection, so the real failure time of its components cannot be accurately counted, which leads to the fact that both the Weibull model and the exponential model based on the a priori probability of failure are unable to portray the failure characteristics of underground safety valves in a better way. While the downhole safety valve itself is a very simple object, modelling the reliability of a downhole safety valve as a safety barrier is a complex task that requires a comprehensive understanding of the physical characteristics of the valve and its mode of operation.

In previous petrochemical equipment risk assessment studies, the failure probability or consequence identification of petrochemical equipment has been analysed separately, and very few studies study both at the same time [16,17,18,19], resulting in the inability to comprehensively identify the risk factors and the corresponding consequences of accidents. The Bow-tie method, which was proposed in 1979, integrates the fault tree analysis method and the event tree analysis method, and in recent years it has begun to be applied to risk analysis and reliability management in the field of energy safety at home and abroad and has achieved good results [19,20,21]. In most of the previous studies on quantitative risk evaluation based on expert survey methods, AHP and its improvement methods were used to reduce the subjectivity of expert scoring [22]. However, the AHP method has been questioned by some scholars due to its basic assumption that the relationship between the influence of two factors is reciprocal. In addition, the AHP method determines the reasonableness of the scoring results by consistency test, which is an empirical approach and has no reasonable scientific explanation [23,24]. Expert assessment methods also have a positive effect. The advantage of the expert assessment method is that it allows the combination of different examination methods [25]. Different groups of subjects are studied during the inspection process and different assessment methods are used. In order to achieve quantitative risk assessment, risk evaluation and decision-making models are needed. The DEMATEL method has certain advantages in portraying experts’ evaluation of complex decision-making problems, which has attracted the attention of many scholars [26,27,28]. However, the DEMATEL method has a fuzzy problem in portraying the evaluation results due to the incomplete knowledge of the experts, which makes the evaluation results somewhat subjective. There is a need to improve the traditional DEMATEL model in terms of both group decision making as well as fuzzy evaluation.

Therefore, this study starts from the common features of various types of downhole safety valves, and firstly conducts failure mode impact and hazard analyses and identifies all possible failure modes of downhole safety valves, as well as the causes and impacts of each failure mode. In order to identify the weaknesses of the tool, this study constructs a Bow-tie risk analysis model for downhole safety valves and identify the factors and consequences of downhole safety valve failures. This study constructs a group decision-making decision laboratory analysis method model to achieve quantitative evaluation of downhole safety valve failure risk factors based on fuzzy theory. According to the evaluation results, risk factor countermeasures are proposed from three aspects in combination with the actual site, providing theoretical guidance for the risk analysis and operation and maintenance management of underground safety valve failure.

2. Downhole Safety Valve FMECA Analysis

2.1. FMECA Ground Rules

With the development of the industry and the advancement of technology, the complexity of mechanical systems has increased, the cost of equipment has increased dramatically, and the cost of conducting tests has risen considerably. In addition, in order to meet market demands, while continuously improving system performance, simplifying operations, and reducing maintenance costs, product developers must also endeavour to reduce development and production costs and shorten development cycles. As a result, developers usually anticipate failures of the designed product before conducting tests and hope to discover design flaws or weaknesses in the design by similar methods and make modifications. Early accident or failure preconceptions, although they may identify some problems in the design, are not satisfactory due to the lack of a fixed procedure and systematic methodology, and the results of the preconceptions are subject to a high degree of uncertainty. From this, people, through the summary of engineering practice experience, gradually formed the current “failure mode, impact and hazard analysis” systematic failure analysis method. Failure Mode and Criticality Analysis (FMECA) is an analysis of the potential failure modes, causes of failure, and the impact on product function and the fatality of the impact on each component unit (component, assembly, subsystem, system) of a product. Each potential failure mode is categorised according to its severity, from which the weak links and critical components of the system design are identified and corresponding preventive improvement initiatives are taken to enhance product reliability.

FMECA is generally accomplished in two parts: Firstly, identification of failure modes and their effects—Failure Mode and Effects Analysis (FMEA). Secondly, a hazard analysis (CA) classifies the failure modes according to their severity and probability of occurrence. FMEA may have incompatibility issues in analysing the quality level of a product or process [28]. Such issues do not exist in FMECA. Through FMECA, a more comprehensive and systematic check of the design scheme can be carried out before the test, and improvement measures can be taken in time. Compared with the means of “test-modify-test again” to check and improve the system design, especially for the new development of a system with many parts, advanced technology, a complex structure, and high cost, an effective FMECA can play a role in reducing the development costs and shortening the design improvement cycle, thus greatly improving the efficiency of the development stage.

FMECA, with its simple principle, easy operation, and good results, has become one of the most important methods used by the military and other scientific and technological industries for reliability analysis in the product development process. FMECA is one of the main reliability projects specified in the development cycle of many key products in China. Effective FMECA can also promote the development of other reliability work. In addition, the analysis technique based on FMECA technology is also applied to the analysis and assessment of the safety, maintainability, and other related technical fields.

In this report, FMECA is used to perform a reliability analysis of downhole safety valves.

2.2. Hierarchy of Appointments

Considering the working principle of the underground safety valve and the specific functions of the components, the underground safety valve is divided into the agreed levels according to the principle of facilitating FMECA analysis. The “initial engagement level” is the downhole safety valve. The “agreed level” is the subsystems of the downhole safety valve, including the connector part, piston movement part, power spring mechanism, gate switch part, and self-balancing mechanism, and the “lowest agreed level” is the components of the subsystems. The detailed levels of agreement are shown in Figure 1.

2.3. FMECA Risk Evaluation Indicators

2.3.1. Classification of Failure Consequences

Consequence of failure is a measure prescribed for the worst potential consequences of a product failure, and each failure mode and each product analysed can be categorised according to the following expressions for the degree of loss and for the classification of consequences of failure of downhole safety valve components, as shown in

Table 1. Classification of consequences of failure of underground safety valve components.

Failure Consequence Category	Instructions
I	Cause the failure of other equipment or complete loss of function of the subsystem or constitute a safety hazard affecting the functioning of the unit
II	Total loss or serious degradation
III	Resulting in a general downgrading of the work capacity of the module
IV	Result in small or negligible impacts on this module

.

2.3.2. Failure Probability Classification

Based on the probability of occurrence of safety valve component failures, the components are classified into five classes, which are Frequent, Likely, Occasional, Rarely, and Extremely Unlikely. The probability classification of the failure of downhole safety valve components using FMECA is shown in

Table 2. Failure probability classification of downhole safety valve components using FMECA.

Level	Degree	Probability
A	Happens all the time	The probability of this failure mode occurring during the product’s operating period is high. The probability of occurrence of a single failure mode is greater than 20 percent of the total probability of failure of the product during that period.
B	Likely to happen	The probability of this failure mode occurring during the product’s operating period is moderate. The probability of occurrence of a single failure mode is 10 to 20 percent of the total probability of failure of the product during that period.
C	Happen by chance	The failure mode occurs by chance during the product’s operating period. The probability of occurrence of a single failure mode is 1 to 10 percent of the total probability of failure of the product during that period.
D	Rarely happen	The failure mode is unlikely to occur during product operation. The probability of occurrence of a single failure mode is 0.1 to 1 percent of the total probability of failure of the product during that period.
E	Unlikely to happen	The probability of this failure mode occurring during the operation of the product is almost zero. The probability of occurrence of a single failure mode is less than 0.1 percent.

.

2.3.3. Risk Evaluation Index Matrix

According to the risks associated with the failure of safety valve components, the risk severity is divided into four levels. The possibility of risk occurrence is divided into five levels to establish a 5 × 4 risk matrix. The risk evaluation index is generated by the combined weighing of both failure severity and failure probability. The matrix is shown in

Table 3. Risk index matrix.

Risk Index		Severity of Danger Level
		I	II	III	IV
Probability of danger	A	1	3	7	13
	B	2	5	9	16
	C	4	6	11	18
	D	8	10	14	19
	E	12	15	17	20

.

According to the risk index of the safety valve parts obtained from the risk matrix, the corresponding processing principle is established. The treatment principles of downhole safety valves for different values of the risk index are shown in

Table 4. Treatment principles corresponding to risk indexes.

Risk Index	Severity of Danger Level	Principles of Treatment
1~5	Very high	Unacceptable and measures must be taken to eliminate or reduce it to an acceptable level
6~9	High	Conditional acceptance and targeted measures
10~17	Moderate	Acceptable after review or approval
18~20	Low	Acceptable

.

2.4. Analysing Results

By performing FMECA on the safety valves, we clarified the consequences caused by each failure mode and the severity of the consequences. Also, based on the repairability of the failure, we categorised the failure modes in order to design improvement measures.

By analysing the evaluation of the consequences of failure, probability of failure, and risk index of safety valve components and the principles of treatment, the FMECA table of safety valve components was obtained. It is shown in

Table 5. FMECA for upper joint.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
1	101	Upper Joint	Connection of the upper fuel line and the line	Break off	Plastic fracture at joints under tensile and torsional loads	Downhole safety valve disconnected from upper tubing	None	None	Signal detection	Improved design of joints; improved materials and machining processes	Ⅰ	E	15
				Adhesive wear of joints	Excessive torque during cocking	Adhesive wear on step surfaces	Unable to connect upper casing	None	On-the-spot observation	Clean thread and step surfaces and apply thread grease	IV	E	17
				Connection failure	Severe plastic deformation due to striated tooth occurrence	Thread failure	Unable to remove upper casing	None	On-the-spot observation	The use of qualified lubricants, new joints are broken in before being allowed to be put into use	IV	D	19
				Perforated	Corrosion of connectors by corrosive substances	Failure of joint seals	Leakage	Difficulty in opening valves	Signal detection	The joints are made of corrosion-resistant materials	Ⅲ	D	19

,

Table 6. FMECA for middle joint.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
2	102	Middle Joint	Connection of the upper fuel line and the hydraulic control line	Break off	Mechanical properties of the joint are not up to standard or the load exceeds the permissible stress	Broken connector joints	None	Valve failure	Signal detection	Improved design of joints; improved materials and machining processes	Ⅰ	E	12
				Adhesive wear of joints	Excessive torque during cocking	Adhesive wear on step surfaces	Unable to connect upper and lower joints	None	On-the-spot observation	Clean thread and step surfaces and apply thread grease	Ⅲ	E	17
				Connection failure	Severe plastic deformation due to striated tooth occurrence	Thread failure	Unable to remove upper casing	None	On-the-spot observation	The use of qualified lubricants, new joints are broken in before being allowed to be put into use	Ⅲ	E	17
				Perforated	Corrosion of connectors by corrosive substances	Failure of joint seals	Leakage	Difficulty in opening valves	Signal detection	The joints are made of corrosion-resistant materials	Ⅳ	D	19

,

Table 7. FMECA for lower joint.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
3	103	Lower joint	Connecting intermediate joints and lower casing	Break off	Plastic fracture at joints under tensile and torsional loads	Broken connector joints	None	Valve failure	Signal detection	Improved design of joints; improved materials and machining processes	Ⅰ	E	12
				Adhesive wear of joints	Excessive torque during cocking	Adhesive wear on step surfaces	Unable to connect upper casing	None	On-the-spot observation	Clean thread and step surfaces and apply thread grease	Ⅲ	E	17
				Connection failure	Severe plastic deformation due to striated tooth occurrence	Thread failure	Unable to remove upper casing	None	On-the-spot observation	The use of qualified lubricants, new joints are broken in before being allowed to be put into use	Ⅲ	E	17
				Perforated	Corrosion of connectors by corrosive substances	Failure of joint seals	Leakage	Difficulty in opening valves	Signal detection	The joints are made of corrosion-resistant materials	Ⅲ	D	19

,

Table 8. FMECA for piston and hydraulic control line.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
4	201	Piston	Transmitting pressure to the spring	Piston jam	High piston friction leads to wear on the outer surface	Unable to transmit hydraulic pressure	Unable to compress the spring to its intended position	Inability to open or close valves	Pressure detection	Regular inspections and high-quality lubricant changes	Ⅱ	A	3
				Piston Broken	Stress fatigue of the plunger due to alternating stresses	Unable to transmit hydraulic pressure	Inability to promote the centre tube	Valve fails to open	None	Replacement of safety valves	Ⅲ	D	14
				Corrosion and wear of hard sealing surfaces	Wear caused by oil or relative motion	None	Hydraulic oil leakage, system pressure drop	Difficulty in opening valves	Signal detection	Regular replacement of hydraulic oil and safety valves	Ⅳ	C	18
5	202	Hydraulic control line	Conveying oils and fluids	Blockage	Clogging of hydraulic lines by impurities	Unable to transmit hydraulic pressure	Inability to promote the centre tube	Inability to open or close valves	Signal detection	Enhanced cleaning and regular filter replacement	Ⅱ	D	10

,

Table 9. FMECA for hydraulic control line joints.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
6	203	Hydraulic control line joints	Connecting the hydraulic control line and the corresponding connector	Joint unplugged	Poor parameter design, poorly designed joints and sleeves, low buckle volume	Disconnection	Leakage in hydraulic lines	Valve fails to open	Signal detection	Assembly check before going down the shaft to ensure reliability of connections and improve design	Ⅱ	D	10
				Connector bursts	System pressure exceeds permissible joint pressure	None	Leakage in hydraulic lines	Valve fails to open	Signal detection	Prevents pressure exceeding the permissible joint pressure	Ⅱ	E	15
				Oil seepage at buckling point	Large deviation of the inner diameter of the hose and the outer diameter of the steel wire layer, uneven thickness and aging deformation of the inner rubber layer	None	Leakage in hydraulic lines	None	Human observation	Strengthen the control of joint parts and improve the processing technology	Ⅳ	B	16
7	204	Sealing component	Sealing piston	Reduced strength and elasticity of seals	High temperatures and corrosion cause seals to harden and crack	Fluid leakage at the piston	Hydraulic oil leakage; in severe cases the system pressure drops	Difficulty in opening valves	Signal detection	Regularly check piston seals; replace safety valves in severe cases	Ⅲ	D	14

,

Table 10. FMECA for spring and switchboard.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
8	301	Spring	Promotion of centre tube	Spring breakage	High piston friction leads to wear on the outer surface	Inability to promote the centre tube	Centre tube rollback	Failure to open the valve	Signal detection	Check the working condition of the spring and replace it when appropriate	Ⅲ	B	9
				Spring fatigue relaxation	Stress fatigue of the plunger due to alternating stresses	Reduced elasticity on the centre tube	Centre tube rollback	Affects valve action	Signal detection	Pre-tension the spring and replace it when appropriate	Ⅲ	C	11
				Corrode	Wear caused by oil or relative motion	Reduced elasticity on the centre tube	Centre tube rollback	Affects valve action	Signal detection	Apply antirust substance to the spring and replace it in case of severe condition	Ⅱ	E	15
9	302	Switchboard	Push balls and valves	Damage to sealing surface	Clogging of hydraulic lines by impurities	Increased friction with the casing and inability to open the valve	Affects ball and valve motion	Difficulty in opening valves	Signal detection	Apply antirust substance to the spring and replace it in case of severe condition	Ⅲ	B	9
				Deformity	High downhole pressure	Increased friction with the casing and inability to open the valve	Affects ball and valve motion	Impurities from scratching prevent the valve from closing completely	None	The surface of the centre tube is shot peened to improve surface hardness	Ⅲ	C	11
				Impurity jamming	Impurities or crystals on sealing surface	Increased friction with the casing and inability to open the valve	Affects ball and valve motion	Affects valve motions	Signal detection	Use corrosion-resistant alloy to make the centre tube and replace it in case of seriousness	Ⅲ	D	14

,

Table 11. FMECA for switch and torsion spring.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
10	401	Switchboard	Close the channel	Damage to sealing surface	Corroded gate or fluid impact	Leakage	Plate and seat cannot seal completely	Valve leakage	Signal detection	Spray anti-corrosion coating on the surface of the valve plate and replace it in time	Ⅰ	B	2
				Deformity	High downhole pressure	Leakage	Valve seal failure	Valve fails to seal	Signal detection	Choose the right model and increase the size appropriately	Ⅰ	D	8
				Impurity jamming	Impurities or crystals on sealing surface	Leakage	Plate and seat cannot seal completely	Valve leakage	Signal detection	Improved centre tube design to avoid fluid shock when opening the valve	Ⅱ	D	10
11	402	Torsion spring	Driving the gate to close	Torque reduction	Long-term exposure of springs to corrosive fluids	Leakage	The gate cannot be retracted	The valve fails to seal the well	Signal detection	Increase design size and replace periodically	Ⅰ	D	8
				Break off	Plastic deformation due to alternating stress and eventual fracture	Leakage	The gate cannot be retracted	The valve fails to seal the well	Signal detection	Regular replacement	Ⅰ	E	12
				Corrode	Corrosion in humid environments	Leakage	The gate cannot be retracted	The valve fails to seal the well	Signal detection	Improved materials, regular replacement	Ⅰ	E	12

,

Table 12. FMECA for pin and valve seat.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
12	403	Pin	Connecting the gate to the valve seat	Break off	Load exceeding permissible stress	Unable to connect the gate	Dislodged gate	The valve fails to seal the well	Signal detection	Improved processing and regular replacement	Ⅱ	D	10
				Corrode	Corrosion in humid environments	Pin outer diameter decreases, strength decreases	Dislodged gate	Affects valve action	Human observation	Use of qualified lubricants, regular maintenance	Ⅰ	E	12
13	404	Valve seat	Balance the upper and lower pressure and form a seal with the valve plate	Blockage	The gap between the valve seat and the lower fitting is blocked by impurities	None	Upper and lower pressures are not balanced when the valve is opened	Valves failing to open	Signal detection	Regularly open and close the valve to ensure that the counterbalance valve can properly relieve the pressure	Ⅱ	B	5

and

Table 13. FMECA for steel ball springlets.

Number	Code	Name	Function	Failure Mode	Failure Reason	Impact			Test Method	Improvements and Measures	Severity Level	Probability Level	Risk Assessment	Note
						Local Impact	Impact on Higher Levels	Final Impact
14	501	Steel ball	Controls the balance of pressure on the top and bottom of the gate	Corrode	Corrosion in corrosive environments	Leakage from sealing with the inner cone of the valve seat	Impact on valve sealing function	Leakage	Signal detection	Selection of corrosion-resistant materials	Ⅲ	C	11
				Surface scratching	Centre tube edge scratches	Unable to seal high-pressure downhole	Inability to balance upper and lower pressure	Leakage	Signal detection	Improved design of the lower outer edge of the centre tube	Ⅲ	D	14
				Ball deformation	Deformation under downhole pressure	Unable to seal high-pressure downhole	Inability to balance upper and lower pressure	Leakage	Signal detection	Shot peening of the surface and selection of high-strength materials	Ⅲ	D	14
15	502	Springlets	Push steel balls	Spring fatigue relaxation	Long-term force on springs	Loss of elasticity	None	None	Signal detection	Pre-tensioned and replaced in a timely manner	Ⅳ	B	16
				Corrode	Corrosion in corrosive environments	Corrosion in corrosive environments	None	None	Signal detection	Surface coated with antirust substance	Ⅳ	C	18

.

3. Failure Analysis of Downhole Safety Valve Based on Bow-Tie

Firstly, through FMECA analysis, data on the failure modes, impacts, and severity of safety valve components are obtained, and the corresponding risk evaluation is also carried out. However, there is no effective model to explain the relationship between failure modes and failure effects, and between risk assessment and preventive measures. There are relatively few studies on the failure risk of downhole safety valves. In order to explore the failure risk factors and failure consequences of downhole safety valves, this study categorises the downhole safety valve composition structure into five subsystems. These include the joint part, the piston movement part, the power spring mechanism, the gate switch part, and the self-balancing mechanism.

3.1. Bow-Tie Method

The Bow-tie method uses a combination of accident tree (FTA) and event tree (ETA) [21]. It consists of five main components, which are accident hazard sources, preventive measures, top-level events, recovery measures, and accident consequences. Figure 2 shows the structure of the model. In the model, preventive measures refer to the measures set up in advance to prevent the occurrence of downhole safety valve failure events. The top-level event is the downhole safety valve failure, and the recovery measures refer to the emergency rescue measures taken after the failure occurs, as well as the approaches taken in order to return to normal. The consequences of the incident are the multifaceted effects of the failure. The combination of preventive and restorative measures forms a safety barrier to reduce the overall risk and consequences of the risk, and both realise the reduction in the probability of failure and the impact of consequences from the source of failure to the end. The model can clearly obtain the specific factors that lead to the failure of downhole safety valves and the corresponding consequences, and organically combine the accident prevention and recovery measures to ensure the safety of downhole safety valve operations. Therefore, this study applies the model to the failure risk factor analysis of downhole safety valves.

3.2. Bow-Tie Failure Model for Downhole Safety Valves

In previous studies, most of the failure consequences of underground safety valves have been classified into four categories, which are failure to open, closure failure, premature closure, and seal leakage. However, seal leakage is essentially a consequence of closure failure. In addition, since downhole safety valves are mostly installed in shallow locations downhole, the weight of the pipe string hanging below the valve body is high. This places high demands on the reliability of the threads at the joints. Not only do they need to meet structural reliability but they also need to be corrosion resistant, as well as have high sealing performance. Therefore, this paper classifies the consequences of downhole safety valve failure into four types: inability to open, closure failure, early closure, and disconnection. The Bow-tie model of different types of downhole safety valves with common causes of failure is established, as shown in Figure 3.

The event codes for these are shown in

Table 14. Downhole safety valve fault tree event table.

Designator	Events	Designator	Events	Designator	Events
M1	Seal leaks	C5	Piston failure	X6	Pin failure
M2	Failure to close	C6	Upper connector connection failure	X7	Torsion spring failure
M3	Failure to open	C7	Intermediate joint connection failure	X8	Steel ball failure
M4	Early closure	C8	Lower connector connection failure	X9	Spring failure
M5	Connection failure	X1	Material defects	X10	Ground pipe rupture
C1	Damage to valve seat, valve body	X2	Improper handling during installation	X11	Blocked ground pipes
C2	Corrosion	X3	Seal surface damage or foreign objects	X12	Pipeline pull off
C3	Failure of executing agency	X4	Failure of anti-corrosion measures	X13	Hydraulic oil circuit seal failure
C4	Ground control unit failure	X5	Corrosive environments	X14	Overload or substandard performance

.

4. Quantitative Assessment of Downhole Safety Valve Failure Risk

The causes and consequences of downhole safety valve failures were effectively identified by the Bow-tie method, and in order to identify the key failure factors, this section carries out a quantitative downhole safety valve failure risk assessment based on the Decision-making Trial and Evaluation Laboratory (DEMATEL) method. The method obtains the degree of influence of each factor on other factors and the degree of being influenced by analysing the logical relationship and direct influence relationship between each factor so as to obtain the centrality and causality of each factor [27]. The method uses expert experience and knowledge to analyse and judge the interaction relationship between risk factors in the system, which can achieve a deterministic analysis of the risk factor relationships of downhole safety valves.

4.1. Improving the DEMATEL Method

4.1.1. Modelling the Cluster Decision

Let the set of indicators be $V=\{v_1,v_2,\cdots ,v_n\}$. n represents the total number of risks of failure. The group of experts involved in decision making are $E=\{e_1,e_2,\cdots ,e_m\}$. The number of experts is represented. A rubric set is an ordered set of linguistic variables consisting of multiple elements representing the criteria for expert evaluation, whose mathematical expression is $S=\{s_1,\cdots ,s_r,\cdots ,s_g\}$, where $s_r$ represents the language variable corresponding to the rth element. The five linguistic variables of no influence, little influence, little influence, great influence, and great influence are used in this study to indicate the interaction between the factors, so g is taken as 5.

In order to understand the problem of fuzziness and uncertainty in deterministic evaluation methods, based on fuzzy theory, this study fuzzified the qualitative evaluation by means of triangular fuzzy numbers. The linguistic variable $s_r$ can be calculated by the following equation.

$$Def(s_r)=\left\{\max \left(\frac{r-2}{g-1},0\right),\frac{r-1}{g-1},\min \left(\frac{r}{g-1},1\right)\right\}$$

(1)

The fuzzy numbers obtained are shown in

Table 15. Linguistic variables corresponding to triangular fuzzy numbers.

${\mathit{S}}_{\mathit{r}}$	Fuzzy Numbers
$S_1$	(0, 0, 0.25)
$S_2$	(0, 0.25, 0.5)
$S_3$	(0.25, 0.5, 0.75)
$S_4$	(0.5, 0.75, 1)
$S_5$	(0.75, 1, 1)

.

In summary, the proposed cluster decision model can be characterized by $\{V,E,S\}$.

4.1.2. Group Decision DEMATEL Modelling

Using Equation (1) above to fuzzify each linguistic variable in $D^{(p)},(p\in \{1,\dots ,m\})$, a fuzzified initial judgement matrix can be obtained as follows:

$$D^{(p)}=\left(\begin{array}{cccc}0& d_{12}^p& \cdots & d_{1n}^p\\ d_{21}^p& 0& \cdots & d_{2n}^p\\ ⋮& ⋮& & ⋮\\ d_{n1}^p& d_{n2}^p& \cdots & 0\end{array}\right)$$

(2)

where each element in $D^{(p)}$ is expressed in terms of the triangular fuzzy number $d_{ij}^p=(l_{ij}^p,m_{ij}^p,r_{ij}^p)$.

In order to clarify the fuzzy numbers, the CFCS method proposed by Opricovic et al. is introduced in this study [29]. The initial judging matrix clarification processing steps are

Step 1: Standardized methods

$$\begin{array}{c}{r}_j^{p\max }=\underset{j}{\max }{r}_{ij}^p,l_i^{p\min }=\underset{j}{\min }{l}_{ij}^p\\ {\mathsf{\Delta }}_{\min }^{\max }=r_i^{p\max }-l_i^{p\min }\end{array}$$

(3)

Step 2: Matrix standardization

$$\{\begin{array}{l}x{l}_{ij}^p=\frac{\left[l_{ij}^p-l_i^{p\min }\right]}{{\mathsf{\Delta }}_{\min }^{\max }};\hfill \\ x{m}_{ij}^p=\frac{\left[m_{ij}^p-l_i^{p\min }\right]}{{\mathsf{\Delta }}_{\min }^{\max }};\hfill \\ x{r}_{ij}^p=\frac{\left[r_{ij}^p-l_i^{p\min }\right]}{{\mathsf{\Delta }}_{\min }^{\max }}.\hfill \end{array}$$

(4)

Step 3: Upper and lower border whitening values

$$\begin{array}{c}xl{s}_{ij}^p=x{m}_{ij}^p/\left(1+x{m}_{ij}^p-x{l}_{ij}^p\right)\\ xr{s}_{ij}^p=x{r}_{ij}^p/\left(1+x{r}_{ij}^p-x{m}_{ij}^p\right)\\ x_{ij}^p=\left[x{l}_{ij}^p\left(1-x{s}_{ij}^p+xr{s}_{ij}^p\cdot xr{s}_{ij}^p\right)\right]/\left(1-x{s}_{ij}^p+xr{s}_{ij}^p\right)\end{array}$$

(5)

Step 4: Calculate $D^{(p)}$ whitening values for each element

$$d_{ij}^p=\min \left(l_{ij}^p\right)+x_{ij}^p{\mathsf{\Delta }}_{\min }^{\max }$$

(6)

When combining expert opinions, this study defaults to the expert opinions with the same weight and uses the method of taking the average to obtain combined multi-expert opinions. When the objective factors such as experts’ experience, education, and knowledge level differ greatly, different weight values can be assigned according to the actual situation. In summary, the method of obtaining the direct influence matrix is

$$F_d=\frac{1}{m}\sum _{p=1}^m{d}_{ij}^p$$

(7)

4.1.3. Building a Comprehensive Impact Matrix

The sum of each row of the direct matrix $F_d$ and its maximum value, divided by each element of $F_d$, gives the regularization matrix $X$. The combined impact matrix $T$ can be created from the following equation:

$$T=X{(E-X)}^{-1}$$

(8)

where E is the unit matrix.

4.1.4. Calculation of the Fourth Degree

Based on the combined influence matrix, the combined influence of each risk factor in the course of the failure event can be obtained from Equations (9) and (10), as well as the degree of influence $Y$, the degree of being influenced $B$, the degree of centrality $Y+B$, and the degree of cause $Y-B$.

$$Y=\sum _{j=1}^n{t}_{ij},i=1,2,3,\cdots ,n$$

(9)

$$B=\sum _{i=1}^n{t}_{ij},j=1,2,3,\cdots ,n$$

(10)

The centrality represents the importance of the risk factor in the failure of the subsurface safety valve, and the causality is used to distinguish whether the risk factor is a cause or effect factor in the system. A comprehensive analysis of the degree of influence of each risk factor on the failure of the subsurface safety valve based on the four aspects of influence, affectedness, centrality, and causality enables a ranking of the importance of the set of risk factors for the failure of the subsurface safety valve and a causal classification.

4.2. Quantitative Assessment of the Failure Risk of Subsurface Safety Valves

In order to linguistically evaluate the degree of influence between risk factors for subsurface safety valve failure, six relevant professionals from research units and drilling and production sites were invited to form an expert decision-making group.

Table 16. Results of an expert evaluation.

Risk Factors	Risk Factors
	${\mathit{X}}_1$	${\mathit{X}}_2$	${\mathit{X}}_3$	${\mathit{X}}_4$	${\mathit{X}}_5$	${\mathit{X}}_6$	${\mathit{X}}_7$	${\mathit{X}}_8$	${\mathit{X}}_9$	${\mathit{X}}_{10}$	${\mathit{X}}_{11}$	${\mathit{X}}_{12}$	${\mathit{X}}_{13}$	${\mathit{X}}_{14}$
$X_1$	$S_1$	$S_1$	$S_1$	$S_2$	$S_2$	$S_5$	$S_5$	$S_5$	$S_5$	$S_3$	$S_1$	$S_1$	$S_1$	$S_4$
$X_2$	$S_1$	$S_1$	$S_3$	$S_2$	$S_1$	$S_2$	$S_2$	$S_1$	$S_2$	$S_1$	$S_1$	$S_1$	$S_1$	$S_4$
$X_3$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$
$X_4$	$S_1$	$S_1$	$S_3$	$S_1$	$S_1$	$S_4$	$S_4$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$
$X_5$	$S_1$	$S_1$	$S_1$	$S_5$	$S_1$	$S_4$	$S_5$	$S_3$	$S_4$	$S_1$	$S_1$	$S_2$	$S_2$	$S_1$
$X_6$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$
$X_7$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$
$X_8$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_3$
$X_9$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_4$	$S_1$	$S_1$	$S_1$
$X_{10}$	$S_1$	$S_1$	$S_1$	$S_1$	$S_3$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_3$
$X_{11}$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_4$	$S_1$	$S_1$	$S_1$	$S_1$
$X_{12}$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_3$	$S_1$	$S_1$	$S_1$	$S_1$
$X_{13}$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$
$X_{14}$	$S_1$	$S_1$	$S_1$	$S_1$	$S_1$	$S_5$	$S_1$	$S_4$	$S_1$	$S_1$	$S_1$	$S_1$	$S_3$	$S_1$

shows the results of the evaluation by one of the experts, where the data in row $i$ and column $j$ indicate the degree of influence of risk $X_i$ on risk $X_j$.

Each member of the expert group completed a linguistic evaluation result form for each of the 14 risk factors. The six evaluation result forms were processed according to the group decision method proposed above, and Python was used to program the data, while the ranking order numbers of the centrality and cause degrees of each risk factor were calculated. The results of the calculation of the four degrees of risk factor indicators are shown in

Table 17. Four-degree indicators of risk factors.

Risk Factors		Four Degree Indicator
	Degree of Impact $\mathit{Y}$	Degree of Being Influenced $\mathit{B}$	$\mathbf{Centrality}\mathit{Y}+\mathit{B}$	Sort by Centrality	$\mathbf{Degree}\mathbf{of}\mathbf{Cause}\mathit{Y}-\mathit{B}$	Reason Degree Ranking
$X_1$	4.22	0.14	4.36	4	4.08	1
$X_2$	3.18	0	3.18	6	3.18	4
$X_3$	1.10	0.89	1.99	12	0.21	9
$X_4$	4.33	1.1	5.43	2	3.23	3
$X_5$	3.56	0	3.56	5	3.56	2
$X_6$	0.78	1.65	2.43	11	−0.87	12
$X_7$	0.81	1.65	2.46	9	−0.84	11
$X_8$	0.98	1.98	2.96	8	−1	13
$X_9$	5.13	2.21	7.34	1	2.92	5
$X_{10}$	0.83	0.61	1.44	13	0.22	8
$X_{11}$	0.78	0.61	1.39	14	0.17	10
$X_{12}$	0.65	1.78	2.43	10	−1.13	14
$X_{13}$	2.37	0.68	3.05	7	1.69	6
$X_{14}$	2.82	1.7	4.52	3	1.12	7

, from which it can be seen that the degree of influence and logical relationship of each factor is clearly represented.

The centrality portrays the importance of each risk factor in the use of the subsurface safety valve. In ascending order of magnitude, spring failure $X_9$, failure of corrosion protection $X_4$, overload or substandard performance $X_{14}$, material defects $X_1$, corrosive environment $X_5$, and improper operation during installation $X_2$ all have a centrality greater than 3.0 and are ranked in the top six. The results obtained were verified with the field staff of the Mill Creek project in the Southwest Oil and Gas Field in Chuanzhong Oil and Gas Mine and were basically in line with the current statistics of risk factors for subsurface safety valve failure. Also, the findings of this study are in general agreement with those of Zhang Zhi et al. [13]. These risk factors seriously threaten the normal opening and closing function of subsurface safety valves. These high-risk factors need to be eliminated or reduced during the design, processing, installation and operation, and maintenance phases of safety valves. For some key risk factors that cannot be eliminated due to the design principle of the subsurface safety valve system itself, such as ball failure $X_8$, spring failure $X_9$,overload or substandard performance $X_{14}$, etc., it is necessary to focus on the dynamic change trend of key risk factors during the operation and maintenance phase, formulate a reasonable health monitoring plan and maintenance and repair system for the subsurface safety valve, and take reasonable disposal measures before the risk factors occur to avoid the occurrence of subsurface safety valve failures, which can have serious consequences.

The degree of causality reflects the interaction between the risk factors of the subsurface safety valve. Positive values indicate causative factors such as material defects $X_1$, corrosive environment $X_5$, corrosion protection failure $X_4$, etc. Negative values indicate consequential factors, whose probability of occurrence is influenced by other factors, which often occur together with causal factors in the event of failure of a safety valve, leading to more severe failure and consequences.

4.3. Critical Failure Factor Prevention

Analysis of failure factors of downhole safety valves: Firstly, the failure modes of key components are obtained through FMECA, and the failure severity level is formulated; maintenance decisions are formulated for subsequent maintenance; then, the failure modes of each component are brought into the Bow-tie model to screen out the failure causes with the greatest impact; and finally, the causes of failure are quantitatively evaluated through the DEMATEL method. The results of the quantitative evaluation of failure risk are crucial for improving the reliability of downhole safety valves. For the key failure risk factors screened in the previous section, effective measures should be taken to prevent and respond to them in the operation and maintenance management of downhole safety valves. In order to improve the reliability of downhole safety valves, the following aspects should be improved and strengthened:

(1)

From the results of the four-degree calculation in the DEMATEL method, it can be seen that the factor that has the greatest influence on the degree of centrality is spring failure. Existing safety valve designs have technical objective defects, resulting in downhole safety valves not meeting the design life indicators. Most of the existing designs rely only on the spring to push the centre tube to open the safety valve, and there is no corresponding redundancy design; once the spring fails, it will directly lead to the failure of the downhole safety valve. Therefore, optimising the structural design of downhole safety valves and improving the manufacturing process have the greatest impact on the service life of safety valves. Design and manufacturing determines the upper limit of the reliability of the downhole safety valve. Underground safety valve design and manufacturing involves: mechanical, hydraulic, sealing, fluid, materials, and other professional disciplines; determining the impact of complex factors; consideration of the sealing and reliability of the piston movement part with high temperature and high pressure; and a need to solve the gate switch part of the hard sealing problem. Also, the joint part of the thread machining accuracy has a direct impact on the performance indicators of the underground safety valve. At present, there is still a big gap between domestic downhole safety valve design experience and proprietary inspection equipment and that of foreign countries, and further research and development efforts are needed.

(2)

Based on the analysis results of the Bow-tie method, it can be seen that the main failure modes of downhole safety valves are opening failure and closing failure. It is necessary to set up a high-efficiency field management team, continuously carry out equipment operation and maintenance management training, and establish a field failure response mechanism. In case of failure to open, it is necessary to strictly implement opening operation procedures and, at the same time, ensure the pressure balance between the top and bottom of the safety valve, and if necessary, cooperate with the fracturing pump to balance the oil pressure. For the failure of closure, on the one hand, it is necessary to cancel the operation in the tubing and carry out well risk assessment, and at the same time, it is necessary to formulate monitoring measures, so as to avoid major catastrophic accidents due to the failure of the safety barrier. Field research found that tubing leakage and tubing gas stringing are also two common failure modes in the field. Pipeline cascading is caused by sealing problems in the piston dynamic sealing components, resulting in the leakage of sulphur-containing natural gas in the pipeline through the piston sealing components to the control pipeline and the sulphur-containing natural gas displacing the hydraulic oil and then entering the control cabinet tank or the manual pump on the ground. In view of these failure modes, field management personnel should actively modify the equipment and establish corresponding management countermeasures; at the same time, they should continue to carry out training on downhole safety valves and ancillary systems and continuously improve the field operation level and emergency response capability.

(3)

An intelligent operation and maintenance management platform for downhole safety valves should be established. As the downhole safety valve arrangement needs to be lowered into the wellhead, it can not be detected by manual inspection the first time a fault occurs. At present, the field mainly relies on control pressure and oil pressure monitoring data to manually judge the operation status of downhole safety valves. This is a very traditional and inefficient way of equipment management. The rapid development of computers in recent years has provided a new solution for the health monitoring of mechanical equipment. When the downhole safety valve fails, relying on artificial intelligence algorithms to process the signal data, the mechanical failure hidden in the weak signal fluctuations can be detected in time. The application of information technology in the intelligent operation and maintenance management of underground safety valves should be actively explored to achieve visual, scientific, and intelligent management of underground safety valves.

5. Conclusions and Discussion

5.1. Conclusions

Downhole safety valves provide essential safety barriers for oil and gas extraction, and downhole safety valve failure risk analysis is crucial to ensure the safety of oil and gas production operations. In this study, we firstly completed the FMECA and obtained the failure modes, failure impacts, and severity levels of the 15 components of the safety valve, determined based on the Bow-tie method. Quantitative failure risk assessment of downhole safety valves was carried out by improving the DEMATEL model. Finally, from the perspective of design and manufacturing and operation and maintenance management, a method of preventing the failure factors of downhole safety valves was proposed. The main conclusions are as follows:

(1)

Based on the FMECA method, the failure modes, failure impacts, and severity levels were obtained for five subsystems and fifteen components, including the safety valve connector part, the piston movement part, the power spring mechanism, the gate switching part, and the self-balancing mechanism. The FMECA table (shown in Table 5, Table 6, Table 7, Table 8, Table 9, Table 10, Table 11, Table 12 and Table 13) was obtained to classify the failure modes and facilitate the design of improvement measures.

(2)

The Bow-tie method clearly revealed the causes of failure and the consequences of accidents caused by downhole safety valves, laying the foundation for quantitative risk analysis. When a failure occurs, site managers can quickly locate the cause of the failure and take appropriate measures according to the Bow-tie model of the downhole safety valve.

(3)

The group DEMATEL model based on fuzzy theory was improved, the language scoring method was adopted, the evaluation results of multiple experts were integrated, and the subjectivity of the expert evaluation results was eliminated. We identified six high-risk failure influencing factors of downhole safety valves such as spring failure, failure of corrosion control measures, overloading or substandard performance, material defects, corrosive environments, improper operation at the time of installation, and so on, which provides theoretical guidance to the formulation of on-site management measures.

(4)

In order to eliminate or minimise the risk of failure of downhole safety valves, risk prevention measures were proposed from the perspectives of designing and manufacturing, as well as operation and maintenance management, which provide certain references for further improving the design theory of downhole safety valves, as well as improving the integrity management level.

5.2. Discussion

There are many types of downhole safety valves which are affected by different working conditions, different types of products in the failure mechanism, and failure risk factors on the existence of a certain degree of variability. Therefore, the failure factors summarised in this study inevitably have limitations and need to be further improved and optimised in different use scenarios. The significance of this study is to provide theoretical guidance for the failure risk analysis and operation and maintenance management of downhole safety valves.