A Dynamic Bayesian Pre-Warning Framework for Safety-Critical Barriers in Subsea Production Systems

Abstract

Safety-critical valves in subsea production systems are essential barriers against catastrophic hydrocarbon releases. However, effective risk pre-warning remains challenging under conditions of sparse test data, infrequent failures, and discrete testing intervals, where conventional static thresholds often lead to delayed warnings or excessive false alarms. To address this gap, this study proposes a dynamic Bayesian pre-warning method for safety-critical barriers, in which valve-level test data are interpreted as observable manifestations of barrier health states. A Beta–Binomial conjugate model is employed to recursively update failure probabilities, while an adaptive upper credible bound derived from the posterior distribution is introduced as a self-adjusting warning threshold that explicitly accounts for epistemic uncertainty and data scarcity. This approach enables early detection of emerging degradation while maintaining statistical rigor. The method establishes a hierarchical barrier-oriented warning structure covering two levels: individual safety-critical valves and the overall subsea barrier system. This design enables continuous monitoring of probabilistic barrier state evolution and supports consistent escalation of early warning signals from the individual valve level to the system level. The method is validated using fifteen years of test records (2010–2024) from subsea production systems in a specific offshore oil field, involving over 1200 functional tests of safety-critical valves. The method consistently identifies incipient anomalies earlier than industrial benchmarks and has never triggered a system-level red warning, demonstrating its robustness and operational suitability. By bridging Bayesian inference with integrity management practices, this method offers a principled, data-efficient solution for risk pre-warning in subsea production systems.

1. Introduction

1.1. Background

Subsea production systems (SPSs) are the core infrastructure for deepwater oil and gas developments, where safety-critical valves (SCVs)—including downhole safety valves (DHSVs) and wing and master valves—serve as the primary barriers for well control and pressure containment [1]. The sealing integrity and functional reliability of these valves directly determine the effectiveness of emergency isolation and well control operations [2]. The critical importance of SCVs has been underscored by major offshore accidents, most notably the Deepwater Horizon blowout, where barrier failure resulted in catastrophic consequences [3].

As offshore developments extend into ultra-deepwater and high-pressure environments, SCVs are increasingly exposed to harsh operating conditions that accelerate mechanical wear and seal degradation, thereby posing significant challenges to conventional reliability management practices [4]. High external hydrostatic pressure, low temperatures, corrosive multiphase flow, and frequent actuation cycles accelerate mechanical wear, induce seal degradation, and exacerbate uncertainty in failure mechanisms. For DHSVs and tree valves, functional impairments—such as failure to close, partial leakage, or delayed actuation—pose significant risks to well integrity and system-level safety.

These factors make it increasingly difficult for traditional periodic-test-based strategies to capture the evolving reliability state of safety-critical valves using conventional point-estimate metrics [5]. When test results are sparse, binary, and accumulated over long operating periods, failure probability cannot be reliably inferred without explicitly accounting for uncertainty and evidence accumulation over time [6,7].

Components such as DHSVs and wing and master valves exhibit minimal failure frequencies and are primarily evaluated through periodic proof tests that produce binary results. Under these conditions, conventional frequency-based estimators become unstable and uninformative, especially when zero-failure observations dominate the dataset. Many advanced reliability models assume continuous degradation signals, which are rarely available in routine subsea operations.

From an operational perspective, valve condition management still relies on fixed acceptance thresholds that do not evolve as evidence accumulates. Such static criteria fail to reflect value-specific uncertainty and offer limited support for early warning and risk-informed decision-making at the installation level.

Motivated by these limitations, the present study aims to develop a dynamic risk pre-warning approach that can extract actionable risk signals from sparse test data while remaining compatible with industrial safety-critical barrier management practices. The study proposes a Bayesian posterior-based method that can update valve failure probabilities and generate adaptive early-warning indicators. The framework is designed to stabilize reliability estimation under data scarcity, enable coherent risk interpretation at both valve and system levels, and support practical and operationally meaningful pre-warning decisions.

1.2. Related Works

Bayesian methods have become a dominant approach for reliability assessment and risk prediction in energy infrastructures, particularly under conditions characterized by sparse data, evolving degradation, and strong epistemic uncertainty. Early applications primarily focused on rare-event reliability estimation. Pesinis and Tee [8] introduced the BUS-Subset Simulation framework, effectively coupling Bayesian updating with advanced sampling techniques to evaluate extremely low failure probabilities in corroding pipelines based on in-line test data. Their work highlighted the ability of Bayesian inference to update deterioration models from limited evidence while preserving computational efficiency. Building on this foundation, Leoni et al. [9] demonstrated that the choice of prior distribution exerts a substantial influence on reliability estimates when using beta–binomial Bayesian models, underscoring the necessity of principled prior selection in maintenance decision-making for safety-critical assets. Further studies, such as Li et al.’s hybrid Bayesian network integrated with machine learning for earth-rock dam breach prediction, showcased the scalability of Bayesian graphical models for high-dimensional risk systems where both data-driven patterns and expert knowledge must be combined [10].

A major research direction has centered on dynamic and time-evolving reliability assessment. Dynamic Bayesian networks (DBNs) have been widely employed to capture temporal degradation, failure dependency, and common-cause mechanisms in long-term infrastructure monitoring. Fam et al. [11] applied DBNs to evaluate the integrity of decommissioned wells, incorporating human reliability and dependent failures into a unified probabilistic structure. Chang et al. [12] extended DBN applications to subsea wellhead fatigue analysis, enabling service-life predictions under uncertain environmental loading and fuzzy expert judgments. Also, Liu et al. [13] developed a DBN-based diagnostic framework for subsea Christmas trees, demonstrating the capacity of dynamic inference to trace degradation pathways and support real-time decision-making. Cai et al. [14] showed that combining Bayesian belief networks with dynamic reliability models enables real-time reliability evaluation of subsea BOP systems, identifying fault propagation patterns and critical components as system conditions evolve.

Bayesian methods have also been applied to prediction and health assessment domains where uncertainty quantification plays a central role. Milner et al. [15] used Bayesian Poisson and binomial models to estimate GNSS satellite failure likelihoods while providing quantified confidence bounds essential for high-integrity applications. Ochella et al. [16] introduced Bayesian neural networks with Monte Carlo dropout to predict remaining useful life (RUL), explicitly isolating aleatoric and epistemic uncertainties to generate interpretable predictions for sensor-monitored systems. Shayakhmetova et al. [17] integrated Bayesian updating into digital twin architectures, allowing failure probabilities of industrial equipment to be iteratively revised as new sensor data arrive—an approach especially relevant for predictive maintenance in complex offshore environments.

Another growing trend relates to hybrid Bayesian risk-informed maintenance and test optimization. Bhatia et al. [18] developed a dynamic risk-based test methodology that fuses real-time degradation indicators with reliability models to update test intervals adaptively instead of relying on static industrial thresholds. Han et al. [19] proposed a hybrid dynamic framework combining support vector regression and dynamic Bayesian networks to model risk evolution in offshore safety-critical equipment, emphasizing human error propagation and system-level degradation. Morato et al. [20] expanded this concept by integrating DBNs with partially observable Markov decision processes, enabling optimal test and maintenance policies for deteriorating structures under uncertainty and yielding notable life-cycle cost reductions. Yu et al. [21] introduced fuzzy Bayesian network modelling, enhanced by analytic hierarchy process weighting, to evaluate pipeline failure likelihood where historical fault data are scarce, demonstrating that Bayesian reasoning remains effective even when expert-based or imprecise information dominates.

Previous studies consistently show that Bayesian approaches, spanning classical hierarchical risk models, posterior updating schemes, dynamic Bayesian networks, and more recent Bayesian deep learning methods, offer a rigorous basis for uncertainty quantification, knowledge updating, and predictive maintenance in safety-critical engineering systems.

Despite this progress, three limitations remain unresolved for safety-critical valves in subsea production systems. First, dynamic-Bayesian-network-based approaches [11,12,13,14] provide powerful dependency modelling but require rich conditional-probability specifications and, in practice, continuous condition-monitoring signals that are generally unavailable for downhole safety valves and wing/master valves, which are exercised only through periodic proof tests producing binary outcomes. Second, Bayesian deep learning and remaining-useful-life frameworks [15,16] are designed for sensor-rich systems and cannot be directly deployed on sparse, annually aggregated proof-test data. Motivated by these gaps, the present study proposes a lightweight Beta–Binomial conjugate framework that (i) is data-efficient under binary, sparse annual tests, (ii) supplies an adaptive upper credible bound that evolves with accumulated evidence, and (iii) integrates Bayesian posteriors with prescribed industrial limits through a barrier-weighted green/yellow/red dual-threshold scheme, so that probabilistic risk information can be directly consumed by current subsea well-integrity workflows [22,23].

2. Methodology

Failures of safety-critical valves in subsea production systems are rare and observed under limited annual testing, hence introducing substantial statistical uncertainty when conventional frequency-based metrics are applied.

To overcome this limitation, the present study proposes a unified probabilistic methodology that integrates Bayesian inference, risk pre-warning, and barrier-oriented hierarchical aggregation. The proposed methodology enables robust estimation of valve failure probability, dynamic identification of degradation states under posterior uncertainty, and consistent propagation of risk indicators from individual valves to the system level. This section focuses on the statistical principles and mathematical derivations underlying the proposed approach. The corresponding system architecture is organized using the three-layer structure presented in Section 2.4.

2.1. Bayesian Model for Individual Valves

As the fundamental building block of the proposed methodology, valve-level failure probability estimation must remain reliable under extremely sparse failure observations. Valve failures in offshore installations are typically rare on an annual basis. In many years, the failure count $x$ is very small, often only 0 or 1 for individual valve types, reflecting the sparsity of failure events. Under such data sparsity, classical frequency estimators based on the failure fraction $FF=x/n$ can be unstable. To address this limitation, we adopt a conjugate Beta–Binomial model to obtain robust posterior inferences [24,25].

The choice of the Beta distribution as the prior is directly tied to the nature of the observation process. Because each annual proof test of a safety-critical valve produces only two possible outcomes, the number of annual failures given a fixed number of tests is naturally described by a binomial likelihood, in which the probability parameter is a proportion bounded on the interval from zero to one. This immediately excludes distributions supported on unbounded positive reals, such as the gamma, Weibull–Gnedenko, or lognormal distributions, which are better suited to modelling continuous failure times rather than bounded failure probabilities. Among the distributions supported on the unit interval, the Beta distribution is the conjugate prior of the binomial likelihood, yielding a closed-form Beta posterior and ensuring both computational efficiency and transparent recursive updating—essential properties for dynamic, year-by-year pre-warning under sparse data.

Let a valve undergo $n$ independent tests each year, with $x$ failures. Denote its true but unknown annual failure probability by $p$ The likelihood is:

$$x\mid p\sim \mathrm{B}\mathrm{i}\mathrm{n}\mathrm{o}\mathrm{m}\mathrm{i}\mathrm{a}\mathrm{l}(n,p)$$

(1)

where $x$ is the observed number of failures, $n$ is the number of tests, and $p$ is the true failure probability. To encode engineering judgment for rare events, we specify a Beta prior:

$$p\sim \mathrm{B}\mathrm{e}\mathrm{t}\mathrm{a}({\alpha }_0,{\beta }_0)$$

(2)

where ${\alpha }_0,{\beta }_0$ are prior shape parameters reflecting prior belief about valve reliability.

The posterior distribution is:

$$p\mid x,n\sim \mathrm{B}\mathrm{e}\mathrm{t}\mathrm{a}({\alpha }_0+x, {\beta }_0+n-x)$$

(3)

where the posterior remains Beta-distributed after observing $x$ failures in $n$ tests. The posterior mean and variance are:

$${\mu }_p={\displaystyle \frac{{\alpha }_0+x}{{\alpha }_0+{\beta }_0+n}}$$

(4)

$${\sigma }_p^2={\displaystyle \frac{({\alpha }_0+x)({\beta }_0+n-x)}{({\alpha }_0+{\beta }_0+n{)}^2({\alpha }_0+{\beta }_0+n+1)}}$$

(5)

where ${\mu }_p$ is the expected failure probability after updating with observed data and ${\sigma }_p^2$ quantifies posterior uncertainty.

To estimate an upper bound on the near-term failure probability, the tail probability γ is adaptively determined from the posterior distribution. Equation (6) computes the coverage probability of the interval.

$$[{\mu }_p-3{\sigma }_p, {\mu }_p+3{\sigma }_p]$$

(6)

where ${\mu }_p$ and ${\sigma }_p$ are the posterior mean and standard deviation. The uncovered tail probability is:

$$\gamma =1-\mathrm{P}\mathrm{r}({\mu }_p-3{\sigma }_p\le p\le {\mu }_p+3{\sigma }_p)$$

(7)

The parameter γ represents the posterior mass outside the approximate 3σ interval and is used to define the adaptive credible bound. Equation (8) gives the Bayesian upper credible limit. pT is:

$$p_T=F_{\mathrm{Beta}({\alpha }_0+x, {\beta }_0+n-x)}^{-1}(1-\gamma )$$

(8)

where $F_{\mathrm{Beta}}^{-1}$ denotes the inverse cumulative distribution function of the posterior Beta distribution. This approach ensures that the credible bound reflects the actual posterior uncertainty rather than relying on a fixed confidence level.

Compared with $FF=x/n$, the indicator $p_T$ accounts for prior knowledge, data sparsity, and posterior uncertainty, and is therefore better aligned with subsea safety barrier reliability assurance for rare and critical events [26,27].

2.2. Dynamic Early Warning Classification

To accurately reflect both the degradation trajectory of safety-critical equipment and the minimum safety requirements mandated by industry, the proposed warning criteria integrate data-driven uncertainty assessment with prescribed industrial limits. These two dimensions are jointly considered to ensure the resulting warning signals remain reliable, timely, and operationally meaningful, thereby supporting precise interpretation of degradation trends and enabling the prompt activation of alarms and response measures when necessary.

Equation (9) gives a framework that defines the dynamic warning thresholds by combining the industrial limit and Bayesian estimate into a unified dual boundary criterion.

$$\{\begin{array}{c}{p}_{W,\mathrm{up}}=max(p_T, p_{\mathrm{ind}}),\\ p_{W,\mathrm{low}}=min(p_T, p_{\mathrm{ind}}).\end{array}$$

(9)

where $p_{\mathrm{ind}}$ is the industrial admissible failure probability, and $p_T$ is the Bayesian adaptive upper bound. Here, $p_{W,\mathrm{up}}$ serves as the Level II (upper) warning threshold, whereas $p_{W,\mathrm{low}}$ represents the Level I (lower) threshold. The paired boundaries capture both the data-inferred deterioration risk and the strict industrial admissibility requirement.

Based on these thresholds, the equipment condition is classified into three dynamic warning levels given in Equation (10).

$$\mathrm{Risk} \mathrm{Level}=\{\begin{array}{cc}\mathrm{Green},& p_{\mathrm{new}}\le \mathrm{m}\mathrm{i}\mathrm{n}(p_T, p_{\mathrm{ind}}),\\ \mathrm{Yellow},& p_{\mathrm{new}}\in \left(\mathrm{m}\mathrm{i}\mathrm{n}\right(p_T, p_{\mathrm{ind}}), \mathrm{m}\mathrm{a}\mathrm{x}(p_T, p_{\mathrm{ind}}\left)\right),\\ \mathrm{Red},& p_{\mathrm{new}}\ge \mathrm{m}\mathrm{a}\mathrm{x}(p_T, p_{\mathrm{ind}}).\end{array}$$

(10)

A Green status indicates normal. Yellow reflects emerging degradation that warrants closer monitoring, and Red denotes a critical state requiring immediate maintenance intervention. By explicitly integrating industrial constraints with Bayesian uncertainty quantification, this dual threshold strategy provides a robust, transparent, and defensible basis for dynamic pre-warning of safety-critical components, even under sparse or highly variable test data.

2.3. Overall System-Level Risk Pre-Warning for Safety-Critical Barriers

Operational safety on offshore installations depends on the collective performance of multiple valve types serving different barrier functions. In this study, three primary types are considered: downhole safety valves (DHSVs), wing and master valves (W&M Leak) associated with leak-tightness, and wing and master valves (W&M Closing) related to closing functionality. For each type $i$, Equation (11) expresses the type-level risk index $R_i$ as the arithmetic mean of the valve-level upper credible limits:

$$R_i={\displaystyle \frac{1}{n_i}}{\sum }_{j=1}^{n_i}{p}_{T,j}$$

(11)

where $p_{T,j}$ denotes the posterior upper credible limit of valve $j$ in type $i$, and $n_i$ is the number of valves within the type. This aggregation approach directly reflects the average risk of valves within the same functional group.

The specific numerical values of the weights are derived through the expert-judgment-based weighting procedure for risk-influencing factors (RIFs) established in the Barrier and Operational Risk Analysis (BORA-Release) methodology [28]. The procedure comprises four steps: (i) the most important factor is identified through general discussions with platform personnel and analysts; (ii) the most important factor is assigned a relative weight of 10; (iii) the remaining factors are compared with the most important one on the relative scale 10–8–6–4–2; and (iv) the reasonableness of the resulting allocation is evaluated. The weights are then normalized so that their sum equals one. Applying this procedure, the DHSV—acting as the primary (innermost) well barrier under the two-barrier philosophy of NORSOK D-010—is identified as the most important factor and assigned a relative weight of 10. The two secondary-barrier functions (W&M leak-tightness and W&M closing functionality) are each judged to have approximately half the operational importance of the DHSV and are assigned a relative weight of 5. Normalization yields $w_{\mathrm{DHSV}}$ = 10/(10 + 5 + 5) = 0.5 and $w_{\mathrm{Leak}}$ = $w_{\mathrm{Closing}}$ = 5/(10 + 5 + 5) = 0.25.

To account for the relative importance of each barrier type, weights $w_i$ are assigned $w_{\mathrm{DHSV}}=0.5$, $w_{\mathrm{Leak}}=0.25$, $w_{\mathrm{Closing}}=0.25$. The overall system-level risk index $R_{\mathrm{s}\mathrm{y}\mathrm{s}}$ is then obtained as the weighted sum of the type-level indices given in Equation (12):

$$R_{\mathrm{s}\mathrm{y}\mathrm{s}}=\sum _{i=1}^3 w_i{R}_i$$

(12)

Consistent with the dual-threshold warning principle used for individual types, the system-level indicator is evaluated against aggregated lower and upper warning limits. Equation (13) defines the system-level thresholds.

$$p_{\mathrm{sys},\mathrm{low}}=\sum _{i=1}^3{w}_i p_{i,\mathrm{low}}, { p}_{\mathrm{sys},\mathrm{up}}=\sum _{i=1}^3{w}_i p_{i,\mathrm{up}},$$

(13)

where $p_{i,\mathrm{low}}$ and $p_{i,\mathrm{up}}$ correspond to the lower and upper boundaries of type $i$, respectively.

Based on the aggregated limits, the overall system condition is classified as:

$$\mathrm{System} \mathrm{Level}=\{\begin{array}{cc}\mathrm{Green},& R_{\mathrm{sys}}\le p_{\mathrm{sys},\mathrm{low}},\\ \mathrm{Yellow},& p_{\mathrm{sys},\mathrm{low}}<R_{\mathrm{sys}}<p_{\mathrm{sys},\mathrm{up}},\\ \mathrm{Red},& R_{\mathrm{sys}}\ge p_{\mathrm{sys},\mathrm{up}}.\end{array}$$

(14)

Through this formulation, installation-level warning decisions are derived in a manner fully consistent with the Bayesian–industrial dual-threshold scheme established for valve diagnostics.

In summary, system-level risk is calculated by the weighted aggregation of valve-level Bayesian posterior upper credible limits, using the arithmetic mean within each valve type and the specific barrier weights applied in this study. Prior selection and sensitivity analysis of key parameters, prior parameters, and weights are considered to ensure robustness. Calibration of the warning system can be assessed using reliability diagrams or Brier scores to verify alignment between predicted risk levels and observed outcomes.

2.4. Three-Layer Architecture of the Bayesian Risk Early Warning System

Given the operational context and challenges outlined in Section 1 and the statistical foundations established in Section 2.1, Section 2.2 and Section 2.3, this section introduces a three-layer architecture for the Bayesian risk early warning system applied to SCVs in SPSs. The architecture integrates multi-year test records with Bayesian inference and uncertainty classification, providing a structured pathway from raw test data to operational risk signals at both valve and installation levels. The layered design allows sparse and heterogeneous observations to be processed in a systematic and robust manner, ensuring a reliable early-warning performance under low-frequency failure conditions. Figure 1 presents the three-layer architecture, illustrating how information flows from data input through Bayesian risk quantification to system-level warning generation.

2.4.1. Data Structuring and Pre-Processing Layer

Maintenance and test records in SPS operations are intrinsically heterogeneous. While sampling intervals are irregular, documentation practices vary across operators, cycle identifiers are occasionally missing, and annotations often follow local conventions rather than standardized formats. These characteristics hinder direct probabilistic modelling and may bias subsequent Bayesian inference if not properly addressed. To establish a reliable statistical foundation, a dedicated data structuring and pre-processing layer is introduced.

Within this layer, raw records are transformed into a unified data schema that captures test timestamps, numbers of tests and failures, valve types, and maintenance actions. Data consistency is enforced through systematic checks on identifier uniqueness, admissible value ranges, and the chronological ordering of test cycles. When test histories indicate continuity, minor gaps in cycle indices are conservatively reconstructed using forward filling or limited interpolation to avoid introducing artificial trends. Consequently, the posterior uncertainty propagated into subsequent Bayesian analyses predominantly reflects genuine operational variability rather than artifacts arising from data inconsistencies.

The output of this layer is a chronologically ordered, valve-level event sequence enriched with functional classification. These structured sequences constitute the direct input to the Bayesian updating procedure described in Section 2.1.

2.4.2. Bayesian Updating Layer

The Bayesian updating layer applies a Beta–Binomial formulation at the level of individual valves to generate time-evolving risk indicators with explicit uncertainty representation. Successive test results are incorporated through recursive updating, progressively refining the posterior distribution of the annual failure probability $p$. From this posterior, the framework derives the mean, variance, and an adaptive upper credible limit $p_T$, as defined in Equation (8). Together, these quantities balance sparse observations against prior information.

This recursive structure allows long-term historical evidence to be accumulated without destabilizing estimates during extended periods with zero or near-zero observed failures, a common feature of offshore safety-critical components. Conventional frequency estimators often fluctuate sharply under such conditions, obscuring underlying trends. In contrast, the posterior evolution produced here preserves statistical stability while remaining sensitive to emerging degradation. The simultaneous availability of central tendency and uncertainty bounds improves interpretability and supports earlier recognition of adverse reliability shifts.

By implementing the Bayesian formulation introduced in Section 2 at the valve level, this layer delivers uncertainty-aware risk indicators that feed directly into subsequent classification and aggregation steps.

2.4.3. Risk Classification Layer

While Bayesian updating provides detailed probabilistic information at the individual valve level, operational decisions require higher-level abstraction. This layer aggregates valve outputs into type-level risk indices for DHSVs, W&M Leak, and W&C Closing. Each type index is computed as the mean of the posterior upper credible limits of valves within the group. Type indices are then combined through weighted aggregation to form a system-level risk indicator, with weights reflecting the relative importance of each barrier type. The system-level indicator is evaluated against green–yellow–red dual thresholds, translating probabilistic information into actionable early warning signals while preserving traceability to individual valve categories. This approach supports both routine monitoring and strategic maintenance under sparse failure conditions.

3. Case Study

This study evaluates a dynamic Bayesian risk classification and pre-warning methodology using test data on barriers in subsea production systems.

3.1. Dataset Description

The analysis focuses on three valve categories that jointly sustain the integrity of the well barrier system: DHSVs, W&M Leak, and W&M Closing. Each type performs a distinct safety role and is governed by different operational demands and degradation pathways. This heterogeneity makes the dataset particularly suitable for assessing a framework intended to extract reliable risk signals from sparse and irregular failure observations.

DHSVs act as the primary barrier within the wellbore, isolating the reservoir from surface facilities under abnormal conditions, while wing and master valves provide complementary protection for well operation and emergency shut-in. Despite differences in accessibility, degradation of the safety-critical barriers cannot be directly monitored through routine operational data: DHSV deterioration is inherently unobservable, and wing and master valves degrade gradually through mechanisms such as seal wear, internal leakage, and actuator deterioration. As a result, periodic functional testing remains the most reliable method for assessing valve health and performance.

The dataset is drawn from the Risk Level in the Petroleum Activity program administered by the Petroleum Safety Authority Norway [29]. This program systematically collects functional testing and reliability information for SCVs in subsea production systems on the Norwegian Continental Shelf. It is widely regarded as an authoritative source for barrier performance assessment and regulatory oversight. Proof-test results within this program are aggregated and reported annually, reflecting established practices in offshore integrity management rather than continuous condition monitoring.

Consistent with this structure, the present study examines annual test records from 2010 to 2024 for a representative subsea production system in a specific offshore oil field. For each year, the dataset records the number of valves tested in each type together with binary outcomes indicating either normal performance or failure. The data capture annual operational exposure and observed failures, without providing high-resolution degradation trajectories or continuous monitoring signals.

The records include valve type identifiers, test outcomes, and associated test cycle information. Figure 2, Figure 3 and Figure 4 present the annual proof-test results for DHSVs, W&M Leak, and W&M Closing over the study period. The number of valves tested varies from year to year, reflecting changes in operating conditions, maintenance strategies, and asset configuration. Across most of the observation window, failures are rare events, often limited to only a few occurrences among hundreds of tested valves. This pronounced sparsity highlights the low-frequency nature of SCV failures in offshore operations and underscores the analytical challenge that motivates the use of Bayesian inference in subsequent sections.

These data characteristics directly inform the methodological choices made in Section 2 and Section 3. The dataset provides the empirical foundation for the valve-level and system-level analyses presented in Section 3.2 and Section 3.3 , where Bayesian updating, dynamic risk quantification, and uncertainty early warning are applied to capture the long-term evolution of valve reliability and the collective performance of the well barrier system.

3.2. Valve-Level Warning Results

Bayesian inference was adopted to address limitations of frequency-based indicators, particularly their sensitivity to small sample sizes and zero-failure years. By incorporating prior knowledge and observed test outcomes, the Bayesian updating model produces annual posterior distributions of the failure probability $p$. The posterior upper credible bound, denoted as $p_T$, serves as a conservative reliability indicator that accounts for both observed failures and epistemic uncertainty. Compared with simple failure fraction (FF), $p_T$ provides smoother trajectories and credible intervals, reducing volatility and avoiding overly optimistic interpretations in years with no observable failures.

3.2.1. Test Data Characteristics of the Three Valve Categories

The dataset consists of annual test counts and observes failures for three valve categories: DHSV, W&M Leak, and W&M Closing. To capture both cross-sectional distributional features and year-to-year variability, Figure 5 presents the failure fraction using combined boxplot and violin plot representations, while Figure 6 depicts a heatmap of annual failure fractions by valve type and calendar year.

Figure 5 shows clear contrasts in failure behaviour across the three categories. DHSV exhibits the highest failure fraction, with typical values clustering around 3–4%. Its inter-quartile range is noticeably wider compared with the other categories, and the median is correspondingly higher. The violin plot shows valve failure data concentrate around the median, accompanied by elongated upper tails that signify sporadic years with elevated failure levels rather than uniformly poor performance. This pattern suggests a baseline level of vulnerability interrupted by occasional adverse conditions.

W&M Leak displays a lower central failure fraction, close to 1%, yet the distribution is not uniformly compact. The violin shape extends upward in the earlier years, and the boxplot identifies several outliers, shown as open circles above the upper whisker, indicating intermittent peaks despite an otherwise moderate failure tendency. These features imply that early operational periods were more unstable, even though the long-term average remains comparatively low. In contrast, W&M Closing records the lowest failure fractions below 1%. Its boxplot is tightly concentrated, and the violin plot shows most of the density near the lower bound. The presence of sharp infrequent fluctuations reflects the statistical impact of rare closing-function failures, which can abruptly inflate the failure fraction when the number of tests is small.

The temporal dimension, highlighted in Figure 6, reinforces these observations. DHSV maintains a relatively continuous band of moderate failure fractions over time, with visibly warmer colours between 2016 and 2020 and a local maximum around 2018–2019. This sustained elevation suggests a period of increased failure occurrence rather than isolated anomalies. W&M Leak shows greater variability in the earlier years, with warmer cells around 2017 to 2018, followed by a transition to cooler tones. This shift indicates an improvement in reliability as operational experience accumulated. W&M Closing remains dominated by the darkest colour range throughout most of the timeline, consistent with its low average failure fraction. However, isolated lighter cells, such as those observed in 2017, confirm that even a single failure can produce a noticeable effect under low test counts.

Taken together, these patterns expose the inherent limitations of frequency-based metrics. The failure fraction can react disproportionately to isolated events and may falsely imply negligible risk in years with zero observed failures. Such sensitivity to sample sizes and rare outcomes complicates longitudinal interpretation and obscures underlying uncertainties. These shortcomings provide a direct rationale for adopting Bayesian updating, which moderates volatility, preserves information across years, and yields reliability estimates that explicitly account for uncertainty rather than masking it behind point values.

3.2.2. Bayesian Updating Results

To examine whether the proposed single-valve early warning framework can deliver stable and interpretable warning signals under realistic data sparsity, the annual failure fraction is treated as the primary observational input and analysed through a Beta–Binomial conjugate Bayesian updating scheme. At year $t$, the underlying failure level is represented by a posterior distribution $p_t\sim \mathrm{B}\mathrm{e}\mathrm{t}\mathrm{a}(a_t,b_t)$, with parameters updated recursively, where the posterior of year $t-1$ serves as the prior for year $t$ and the annual test outcomes $(x_t,n_t)$ are assimilated via Beta–Binomial conjugacy.

The complete year-by-year rolling prior–posterior parameter updates for all three failure modes are summarized in

Table 1. Rolling Beta prior–posterior updating for three failure modes.

Year	DHSV		W&M Leak		W&M Closing
	Prior	Posterior	Prior	Posterior	Prior	Posterior
2010	Beta(p|1,1)	Beta(p|5, 144)	Beta(p|1, 1)	Beta(p|3, 203)	Beta(p|1, 1)	Beta(p|2, 290)
2011	Beta(p|5, 144)	Beta(p|10, 314)	Beta(p|3, 203)	Beta(p|6, 541)	Beta(p|2, 290)	Beta(p|4, 622)
…	…	…	…	…	…	…
2017	Beta(p|36, 1124)	Beta(p|43, 1285)	Beta(p|19, 2061)	Beta(p|23, 2351)	Beta(p|12, 1984)	Beta(p|14, 2218)
…	…	…	…	…	…	…
2023	Beta(p|74, 2079)	Beta(p|80, 2255)	Beta(p|41, 3906)	Beta(p|44, 4278)	Beta(p|21, 3763)	Beta(p|23, 4243)
2024	Beta(p|80, 2255)	Beta(p|85, 2430)	Beta(p|44, 4278)	Beta(p|47, 4716)	Beta(p|23, 4243)	Beta(p|25, 4631)

The ellipsis (...) denotes the omitted intermediate years (2012–2016 and 2018–2022).

. This distributional representation moves beyond conventional point estimators that reduce system behaviour to a single observed proportion. Instead, it yields three complementary quantities that jointly support early warning decisions: the posterior mean ${\mu }_t$ as an estimate of the central failure tendency, the 95% posterior credible interval $[{\mathrm{c}\mathrm{i}\_\mathrm{l}\mathrm{o}\mathrm{w}}_t,{\mathrm{c}\mathrm{i}\_\mathrm{h}\mathrm{i}\mathrm{g}\mathrm{h}}_t]$ to characterize uncertainty under limited observations, and a deliberately conservative measure of potential upside risk, denoted as the Bayesian adaptive upper bound $p_T$.

In the present implementation, $p_T$ is derived from the posterior mean and standard deviation. This quantity is not intended to replace the credible interval, but rather to provide a cautious tail-oriented indicator that supports risk-averse decision making. Under rolling updating, both the credible interval and $p_T$ naturally become more stable as evidence accumulates, reflecting progressive uncertainty reduction over time.

3.2.3. Individual Barrier Warning Results

Meaningful warning requires a management threshold that is both operationally interpretable and externally grounded. A failure fraction limit of 0.02 is therefore adopted, corresponding to the industrial guideline safety boundary defined within the RNNP (Risikonivå i norsk petroleumsvirksomhet, Risk Level in the Norwegian Petroleum Activity) project for selected safety-critical equipment. This threshold represents the accepted upper bound of tolerable failure performance in the studied operational context and is shown as an orange dashed line in Figure 7, Figure 8 and Figure 9. Relative to this benchmark, the framework generates color-coded warning signals at a yearly resolution for individual valves. Warning escalation occurs when the posterior mean exhibits sustained exceedance, or when uncertainty and conservative tail measures jointly indicate an increased concern. Conversely, lower alert levels are maintained when the posterior mean remains below the threshold and the associated uncertainty contracts as additional evidence accumulates.

The visualization strategy directly reflects this logic. In Figure 7, Figure 8 and Figure 9, bars represent the observed annual failure fractions, the grey shaded band corresponds to the 95% posterior credible interval, red dashed markers indicate the conservative bound $p_T$, and the 0.02 threshold is overlaid on the same axis. This unified presentation ensures that warning signals are actionable and traceable to their underlying statistical evidence.

The results show a clear and stable risk stratification at the single-valve level. For the DHSV, the posterior mean remains consistently above 0.02 throughout 2010–2024 and stabilizes around the low-to-mid 3% level under rolling aggregation. indicating a persistent elevation in failure propensity rather than isolated random excursions. The credible interval is relatively wider in early years and contracts as evidence accumulates, while still supporting an elevated risk relative to the industrial limit. The conservative bound $p_T$ remains above the industrial limit and becomes progressively tighter and smoother over time, consistent with reduced posterior uncertainty under cumulative evidence. Taken together, the posterior mean, uncertainty band, and tail indicator converge toward a consistent yellow warning for DHSV, in agreement with the yearly risk labels and supporting mitigation prioritization.

By contrast, both W&M Leak and W&M Closing exhibit posterior means that remain largely below the 0.02 threshold, corresponding to green alert states. The framework does not interpret a low mean as an absence of risk; the credible intervals and $p_T$ still provide transparent information about tail behaviour in certain years, justifying continued monitoring rather than complacency. As more test data accumulate, the credible intervals progressively contract. For W&M Leak, this contraction is accompanied by a noticeable tightening of $p_T$ in later years, while W&M Closing shows a more pronounced reduction in uncertainty after 2021. These trends indicate increasing stability and diminishing risk as empirical evidence strengthens. The framework does more than assign green or yellow labels; it substantiates each alert state through distribution-based statistical evidence, integrating central tendency, uncertainty, and conservative tail assessment into a coherent decision basis.

The framework is inherently capable of issuing red alerts because it operates directly on the full posterior distribution rather than on point estimates alone. A Red signal would be triggered under stronger exceedance conditions, such as the credible interval shifting entirely above the 0.02 threshold or the exceedance probability surpassing a predefined criterion. During the evaluated period, these stringent conditions were not met for the studied valve and failure modes. As a result, the observed outcomes predominantly manifest as yellow for the DHSV and Green for W&M Leak and W&M Closing. This behaviour indicates that, for the given single-valve dataset, the framework differentiates risk modes robustly and escalates warnings only when the statistical evidence genuinely supports heightened concern.

3.3. Overall Barrier System Warning Results

Figure 10 illustrates the evolution of the system-level weighted risk indicator derived from the aggregation scheme defined in Section 2. Unlike valve-level diagnostics, this indicator reflects the collective condition of the safety barrier system and encodes the functional importance of different valve types through weighted integration.

From 2010 to 2013, the system indicator remains within the green zone with limited interannual variation, indicating a stable barrier condition at the installation level. Beginning in 2014, the indicator transitions into the yellow warning state and remains elevated until 2020. This shift occurs gradually rather than as a response to isolated extreme observations, demonstrating that the warning escalation is driven by accumulated probabilistic evidence rather than short-term fluctuations.

The sustained yellow period reflects the dominant contribution of critical barrier functions within the weighted aggregation. Persistent elevation in the risk estimates of high-importance valve categories propagates coherently to the system level, even when other categories remain relatively stable. This behaviour confirms that the framework captures structurally meaningful degradation patterns instead of producing purely statistical artifacts.

After 2020, the system indicator declines smoothly and returns to the green zone, suggesting a stabilization of aggregated risk rather than an abrupt recovery. Throughout the entire study period, the indicator remains below the red threshold, indicating that the posterior evidence does not support a critical system-level state under the adopted dual-threshold criteria. The results show that the framework differentiates sustained degradation from a genuine escalation while avoiding spurious critical alerts.

Overall, the system-level results demonstrate that the proposed Bayesian framework can translate sparse valve test data into stable, interpretable installation-level warning signals, supporting long-term situational awareness and risk-informed decision-making in offshore safety-critical systems.

4. Discussion

4.1. Performance Characteristics of Bayesian Dynamic Thresholds

The system-level results show that the aggregated risk indicator remains below the red threshold throughout the entire observation period, including intervals characterized by prolonged yellow warnings, as illustrated in Figure 10. This outcome should not be interpreted as a tendency toward risk underestimation. However, it reflects a deliberate and methodologically consistent feature of the proposed Bayesian dynamic threshold framework when applied to safety-critical subsea barrier systems.

Subsea production systems are designed and operated under a conservative barrier philosophy, in which individual component degradation is tolerated without immediate loss of system integrity. Safety-critical valves are expected to accommodate isolated failures or performance deterioration, given the high cost, limited accessibility, and operational risk associated with offshore intervention. Within this context, system-level criticality is, by design, a low-frequency condition that should only be declared when supported by persistent and internally consistent evidence of barrier deterioration. A warning scheme that frequently escalates to a red state in response to short-term variability or isolated adverse outcomes would conflict with established integrity management principles and could diminish operator confidence in critical alarms.

The Bayesian dynamic thresholding strategy addresses this challenge by embedding uncertainty directly into the escalation logic. Rather than relying on fixed industrial limits or point estimates of failure fraction, the framework evaluates full posterior distributions that explicitly reflect epistemic uncertainty arising from sparse test data as well as aleatoric variability in valve performance. Under this formulation, transient adverse observations increase posterior uncertainty and manifest as sustained yellow warnings, signaling heightened vigilance without prematurely declaring loss of barrier integrity. Escalation to red is reserved for situations in which posterior evidence consistently indicates a systemic degradation of protective function.

The sensitivity of the framework to the credible-interval parameter n further illustrates its operational robustness. Type-level heatmaps and corresponding line views presented in Figure 11 and Figure 12 show that the confidence interval (CI) metric 1 − γ increases monotonically with increasing n, rising from approximately 0.70 at n = 1 to around 0.95 at n = 2, and approaching near-saturation values between 0.99 and 1.00 for n ≥ 3. This variation primarily affects the absolute confidence level rather than inducing artificial temporal trends. Over the period 2010–2024, the trajectories remain smooth and largely stationary within each valve type, with only modest year-to-year variation, most apparent at n = 1, as further evidenced by the line views in Figure 12. This behavior indicates that, under annual binary proof-test regimes, the Bayesian updating mechanism produces a stable posterior uncertainty structure that resists overreaction to short-term observational noise.

At the system level, this stabilizing effect is reinforced through aggregation. The fixed-weight CI map in Figure 13, together with the system-level confidence curve in Figure 14, shows that the weighting scheme of 0.5/0.25/0.25 reduces type-specific fluctuations and produces a smoother system confidence trend over time. From a barrier-management perspective, this behavior aligns with the expectation that system-level warnings should be resilient to isolated component events and should only reflect coherent degradation across the barrier envelope. The resulting rarity of red states enhances, rather than undermines, the credibility of the warning framework. When a red alert is triggered, it carries a clear implication of statistically substantiated system-level risk rather than a response to short-term fluctuation.

Figure 13. System CI (1 − γ) heatmap.

Figure 13. System CI (1 − γ) heatmap.

Figure 14. System CI (1 − γ) vs. year with varying n.

Figure 14. System CI (1 − γ) vs. year with varying n.

The results also provide practical guidance for selecting the parameter n. Larger values of n maximize CI, driving 1 − γ toward saturation. This behaviour may reduce discrimination between years or valve categories, a tendency that can be observed in Figure 11, Figure 12, Figure 13 and Figure 14. Smaller values preserve sensitivity to short-term variation and yield lower confidence coverage and slightly greater apparent variability. In this case, n functions as a conservative parameter, allowing practitioners to balance stability, sensitivity, and interpretability in accordance with operational risk tolerance and alarm philosophy.

For clarity, the role of n in Equations (6)–(8) can be made explicit by restating those equations in the generalised form [μ_p − n·σ_p, μ_p + n·σ_p], γ(n) = 1 − Pr (μ_p − n·σ_p ≤ p ≤ μ_p + n·σ_p), and p_t(n) = $F_{\mathrm{Beta}}^{-1}$ (1 − γ(n)), so that n = 3 recovers the baseline case used in the main analysis and the sensitivity study in this section corresponds to sweeping n ∈ {1, 2, 3, 4, 5}.

From a practical deployment standpoint, the selection of n can be guided by the operational role of the warning system. A value of n = 1 corresponds to a coverage of approximately 68% and is appropriate only for early-detection, screening-type applications in which a higher rate of provisional alerts is acceptable. A value of n = 2 corresponds to approximately 95% coverage and is recommended as the default choice for routine integrity monitoring. A value of n = 3 corresponds to approximately 99% coverage and is recommended for safety-critical decisions in which missed alarms are unacceptable. Values of n ≥ 4 saturate the coverage and reduce the discrimination between years and valve categories, and are therefore not recommended for monitoring use.

4.2. Limitations and Assumptions

Several limitations of the present study warrant careful consideration. At first, the framework relies on annual test records expressed as binary test results. While this representation reflects prevailing industrial practice for subsea valve monitoring, it constrains temporal resolution and precludes explicit modelling of continuous degradation mechanisms. Risk warning is therefore inferred indirectly through probabilistic updating rather than through direct linkage to physical deterioration processes.

Secondly, system-level aggregation is performed using predefined weighting factors that represent the relative safety significance of different valve categories. While these weights are grounded in established barrier philosophy and engineering judgement, they introduce a degree of subjectivity. Alternative weighting strategies, including data-driven calibration or sensitivity-informed optimization, may produce different system-level risk trajectories and merit further investigation.

Thirdly, the aggregation procedure assumes conditional independence among valve categories. In operational settings, common-cause failures, shared environmental stressors, or organizational influences may introduce dependencies that are not captured in the current formulation. Accounting for such dependencies can improve model fidelity. This may increase data requirements and computational complexity, which may not be justified under severely sparse observation regimes. A natural extension that partly relaxes this assumption is a Beta–Binomial over-dispersed compound model, in which residual within-type dispersion beyond the binomial variance is absorbed through an additional dispersion parameter while the year-to-year Bayesian conjugacy is preserved. This extension is identified as a priority item for future work once additional valve-level metadata supporting common-cause modelling become available [30].

Furthermore, the analysis is performed at the annual level, which is a direct consequence of the RNNP reporting convention used in this study and is consistent with current subsea integrity-management practice. As a result, the temporal resolution of the framework is one year, and gradual degradation occurring between successive test intervals cannot be resolved. When operators maintain per-cycle records internally, the same Beta–Binomial conjugate update can be applied at the cycle level by treating each individual proof test as a Bernoulli trial; this finer-grained extension is identified as a direct avenue for future work once cycle-resolved data become accessible [29].

Lastly, operating conditions, maintenance strategies, and asset configuration are in principle highly relevant explanatory variables that can influence valve reliability. The public RNNP dataset used in this study aggregates test outcomes at the field/year level and does not release such per-test covariates, for confidentiality reasons. The proposed Beta–Binomial framework is, however, structurally compatible with covariate extensions: the conjugate layer can be embedded into a hierarchical Bayesian logistic regression in which the log-odds of failure are modelled as a linear function of operating and maintenance covariates while preserving the conjugate recursive structure for the random-effect component. This extension is identified as the next research step once covariate-level data become accessible.

5. Conclusions

This study proposes a dynamic Bayesian pre-warning method for safety-critical barriers in subsea production systems as a solution to the long-standing challenges posed by sparse test data, rare failures, and strong epistemic uncertainty. By integrating Bayesian posterior updating with industrial safety limits and hierarchical risk aggregation, the combined framework establishes a probabilistic workflow for risk warning.

The study results are summarized as follows:

(1)

A statistically robust risk representation for sparse data is achieved. The Beta–Binomial Bayesian model provides stable and interpretable estimates of valve failure probability under severe data scarcity. Compared with conventional failure fraction indicators, the posterior distribution preserves historical evidence, reduces random volatility, and explicitly quantifies uncertainty, making it more suitable for safety-critical barriers.

(2)

An adaptive and conservative early-warning indicator is introduced. The posterior upper credible bound offers a principled measure of potential risk escalation by accounting for both observed failures and remaining uncertainty. Its adaptive nature avoids reliance on fixed confidence levels and ensures that warning thresholds evolve consistently with accumulated evidence.

(3)

A dual-threshold strategy effectively links Bayesian inference with industrial practice. By combining the Bayesian risk indicator with prescribed industrial acceptance limits, the proposed green–yellow–red classification scheme delivers warning signals that are statistically justified and operationally meaningful. This design enables the direct use of probabilistic risk indicators in operational integrity management decisions.

(4)

A hierarchical aggregation mechanism enables coherent system-level risk interpretation. Valve-level risk indicators are consistently propagated to valve types and system levels through weighted aggregation, reflecting the relative importance of different safety barriers. The resulting system-level index captures long-term degradation trends without being overly sensitive to isolated events, in line with the established safety barrier philosophy of subsea production systems.