The invention will be described with particular reference to emergency shut down valves which are used, for example, in processing industries such as oil refineries or oil rigs, the valve being provided in an oil pipeline, the arrangement being such that in the event of an emergency, the valve will close. However, the emergency valve may be an emergency isolation valve which in an emergency shuts down and isolates part of a process or an emergency blow down valve which in an emergency opens to pass air or other fluid to, for example, blow down the process.

Whilst we shall describe the invention with particular reference to valves for use in isolating the flow of oil, it will be understood that other valves controlling the flow of other fluids comprising a liquid or gas may be tested by means according to the invention.

One of the difficulties with such emergency valves is that particularly where an oil refinery or oil rig is in continuous operation, in view of the cost of shutting any particular line whilst carrying out maintenance work, the emergency valves are not moved between maintenance intervals, which may be several years. As a consequence, over that period of time, because of the deposit of dirt or other material, the valve may become stuck and not be operable in an emergency. It is highly desirable to be able to test the valves at more frequent intervals to ensure that they are operable and it is preferable to test for proper operation of the valve and to test for example to determine the degree of deposit of dirt or other material without closing down the oil pipeline in which they are mounted.

Emergency valves comprise a variety of forms, for example, gate valves, butterfly

valves, rotary or ball valves. The emergency valve is operated by an actuator. One method of operation of the actuator uses hydraulic or gas pressure to retain the valve in its normal, eg closed, position. In the case of a single acting actuator when the emergency valve is to be shut, the hydraulic or gas pressure is released and a metal spring or other mechanism closes the valve. In the case of a double acting actuator, the pressure medium controlling the actuator is redirected to close the valve. The application of the hydraulic or gas pressure is normally controlled by one or more electrically controlled solenoid valves, the electrical signal (voltage) being provided by an electrical control line. Any interruption of the electrical signal operates the solenoid valves to release or divert the hydraulic or gas pressure and hence closes the valve.

In another arrangement the actuator is an electric motor controlled by an electrical signal on a control line.

When testing the operation of an emergency valve, it is common practice for the emergency valve to be operated in a slower controlled manner for reasons of apparent safety. Thus where for example the valve is operated pneumatically, there is provided a proportional controller which allows the release of successive small amounts of gas which allows small controlled movements of the actuator. There is also provided a position detector which detects the position of the valve stem or other part of the valve.

In practice if the emergency valve is stuck, the controller releases gas until movement is detected by the position detector. As the emergency valve, when operating under emergency conditions, evacuates all of the gas substantially instantaneously. this test, which slowly releases the aas, does not replicate those conditions. Whilst this test may enable some observation of the operation of the valve and hence some sense of any difficulties there may be in its operation, it is not an accurate test of the operation of the emergency valve in an emergency at full speed. Furthermore, only very limited information may be ascertained from the position detector.

We shall describe hereafter an arrangement in which the emergency shut down valve may be tested for operation by only partially stroking (closing) the valve to a predetermined point and no further, it being ascertained that so long as the valve begins to close, it is not necessary to close it fully since the initial movement of the valve is only necessary to prove that the valve is free to move and provides evidence that the valve would close completely.

We shall also describe an arrangement in which the pressure or flow of pneumatic or hydraulic fluid into or out of the actuator may be measured which allows analysis of the signature and hence detailed information as to whether the actuator/valve assembly is operating satisfactorily.

We shall also describe an arrangement in which, whilst partially closed, other aspects of the valve may be tested, for example, the flow of fluid through the valve.

We shall also describe an arrangement which can be provided without adding to or altering the pneumatic or hydraulic components of an existing emergency valve and can hence be readily retrofitted to an existing valve, unlike the prior arrangements set out above.

According to a first aspect, the present invention provides apparatus for testing an emergency valve in which a valve member is movable by an actuator between an open and a closed position, said apparatus comprising means for initiating emergency closure of the valve and means for stopping the closure when the valve member is in a position intermediate its open and closed positions whereby to partially stroke the valve.

Thus the emergency valve is tested at its normal operating speed and this provides a more accurate indication of the state of the emergency valve than operating it unnaturally slowly.

We shall also describe an arrangement in which the partial stroking and hence the testing of the valve is carried out at its normal speed of operation rather than the reduced speed which has hitherto been thought necessary.

Preferably, therefore, we start the closure procedure for the emergency valve in the normal way and stop it before it fully closes.

Said stopping means may include means to maintain the valve member in said position intermediate its open and closed positions.

Where the actuator is operated by fluid, said apparatus may include means to measure the pressure of fluid into or out of the actuator of the valve.

Where the actuator is operated by fluid, said apparatus may include means to measure the flow of fluid into or out of the actuator of the valve.

Means may be provided to analyse of the pressure or flow of said fluid to thereby provide information as to whether the emergency valve is operating satisfactorily.

Means may be provided to measure the flow of fluid through the valve whilst it is partially closed.

According to a second aspect, the present invention provides testing means for partially stroking (ie opening or closing) an emergency valve of the type controlled by an electrical signal on a control line, said means comprising means for connection to said control line. said means including means for providing, on said control line. a relevant electrical signal for a period of time to cause said emergency valve to move to a position intermediate the open and closed position and no further and means to maintain the valve in that intermediate position.

Both said means may comprise timers, whereby the length of time may be

predetermined, but in an alternative arrangement, the length of time of the electrical signal may be determined by measuring a factor which relates to movement of the valve so that the intermediate position in which the valve is to be maintained will be the same or substantially the same and not dependent upon the speed of operation of the valve.

The time taken for different emergency valves to open or close will vary depending upon their size, material Sowing through them, and the actuator driving them, and so to provide for this, in a preferred aspect, the testing means may include at least one variable timing means and a relay means.

By maintaining the emergency valve in a position intermediate the open and closed position for a period of time, it is possible to determine other aspects of operation of the emergency valve. In particular it is possible to determine, by means for example of flow rate, the extent to which the valve and surrounding pipe work is obstructed by deposits of dirt or other material.

Where the emergency valve is of a type where application of an electrical signal keeps it open, and an absence of that signal causes it to be closed by, for example, a spring, said control line is adapted to pass through said testing means from an input terminal to an output terminal, said input terminal and output terminal being connected electrically through a normally closed relay and there is provided variable timer means operable to apply power to said normally closed relay to open said relay for a variable time to partially close/open the valve.

In many applications, fail safe redundancy is required and in that case second timer means may be provided in series with said first mentioned timer means, so that even if one of the timer means fails and continues to apply power to said normally closed relay to keep it open, the other-timer means will-interrupt the power supply.

Similarly, said relay means may be coupled in parallel with a second relay means, said

second relay means being controlled in the same way as the first relay means by one or two of said timer means, whereby, if either of said relay means fails in said open position, the other relay means will close to electrically connect said input and output terminals.

In certain circumstances it might be possible to operate said testing means successively in the time interval before said emergency valve has fully opened/closed and in that way successive strokes might cause the emergency valve to fully open/close. To avoid this, there may be provided a further timer means to interrupt operation of the control switch for a period of time sufficient for a complete cycle of operation to take place.

One of the merits of using the control line to partially stroke the emergency valve is that there is no interference with the mechanism of the emergency valve and, indeed, the size; type of operation, etc, of the valve is irrelevant. Thus a single type of testing means may be provided for partially stroking any type of emergency valve. It is simply necessary to adjust the variable timer means to suit the relevant emergency valve.

Means may also be provided to analyse the operation of the valve. For example, where the valve is a pneumatically actuated valve, the pressure or flow of the air applied or released (in the case of a single acting actuator) to the valve may be measured. From such measurements, the operation of the valve may be analysed.

Alternatively, if the valve is a hydraulically actuated valve, then the flow rate or pressure of the fluid to and from the valve actuator may be measured. The flow rate or pressure measurement may be used to provide an analysis operation of the valve.

In such a way, it is possible to test not only for operation of the actuator/valve assembly, in the sense as to whether the valve will close, but also other factors, such as dirt or corrosion which slows operation of the actuator/valve and which may be used to predict problems in the future.

Two preferred embodiments of the invention will now be described by way of example and with reference to the accompanying drawings in which :- Figure 1 is a diagrammatic view of an emergency valve in a pipeline with a single hydraulic or pneumatic acting actuator connected to a first testing means for partially stroking the emergency valve in accordance with a first embodiment of the invention, the system being in a normal condition with the emergency valve open, Figure 1A is a view similar to Figure 1 except that the solenoid valves 13 and 15 are arranged in reverse order, Figure 2 is similar to Figure 1, and Figure 2A is similar to Figure 1 A with the system having been operated to initiate a partial stroke, Figure 3 is similar to Figure 1, and Figure 3A is similar to Figure 1A with the reset prevention timer initiated, Figure 4 is similar to Figure 1, and Figure 4A is similar to Figure 1 A with the means to maintain the emergency valve in the intermediate position operated.

Figure 5 is similar to Figure 1 and Figure 5A is similar to Figure 1A with the reset prevention timer continuing to time out.

Figure 6 is a diagrammatic view of an emergency valve in a pipeline with a single pneumatic acting actuator connected to a testing means for partially stroking the emergency valve in accordance with a second embodiment of the invention.

Figure 6A is a view similar to Figure 6 except that the solenoid valves and are arranged in reverse order.

Figure 7 is a graph of the pneumatic flow being released in the pneumatically operated actuator during emergency closure of the emergency valve, Figure 8 is similar to Figure 7 but shows a point at which a software trigger may be set to initiate the actuator/valve to stop in its intermediate position,

Figure 9 is a superimpo iition of the graph shown in Figures 7 and 8, together with a similar graph ofthe sarne actuator/valve operated to its partial stroke position. The combined graph showing that under test the actuator/valve is closely following its full closure path, Figure 10 shows a plurality of signals for the partial close test, one of which shows a problem in operation of the valve, Figure 11 is a diagrammatic view of an emergency valve in a pipeline with a single hydraulic or pneumatic acting actuator connected to a testing means for partially stroking the emergency valve in accordance with a third embodiment of the invention, Figure 11 A is a view similar to Figure 11 except that the solenoid valves are arranged in reverse order, and Figure 12 is a graph similar to Figure 7 of the pneumatic flow being released in the pneumatically operated actuator during emergency closure of the emergency valve of Figure 11.

Referring to Figure 1 there is shown a first embodiment of an emergency valve 20 in a pipeline 11, the emergency valve being arranged so as to close off the pipeline 11 to prevent the flow of fluid through the pipeline in an emergency. The valve 20 is operated by a single acting actuator 10 and is held open by gas or hydraulic fluid applied at pressure to one side of a piston in a piston/cylinder unit 12. the gas or hydraulic pressure fluid being applied to the piston 12 via a solenoid (or other electrically controlled) valve 13 (ie solenoid 13A. valve 13B), the solenoid valve 13 in the first position (Figure 1 and 2) applying the pressure from a fluid pressure supply 51 to the piston/cylinder unit 12 and in a second position (Figures 3-5) isolating the piston/cylinder unit 12 from the gas or hydraulic pressure supply 51 and connecting it to exhaust via vent 13. In the second position of the solenoid valve 13. with the piston/cylinder unit 12 connected to exhaust and in the absence of gas or hydraulic

pressure to hold the valve 20 in the open position, the valve is immediately closed by means of a metal spring 14 or other means.

In some emergency closure valves the operation may be slower and may take a number of seconds from open to close but in many such valves the operation is rapid and the time from being fully open to fully closed may be as little as one second.

The solenoid valve 13 is held in the position in which pressure is applied to the piston/cylinder unit 12 when an electrical voltage is applied on an electrical controljine 16 and when the voltage on the electrical control line 16 falls to zero, then the solenoid valve moves to the position in which the piston/cylinder unit 12 is isolated from gas or hydraulic pressure from the supply 51 and connected to exhaust. The system is therefore failsafe in that failure of the electrical supply to the solenoid valve, will cause the valve 20 to be closed by the metal spring 14 or other means.

In non fail safe modes the solenoid valve 13 is held in the position in which pressure is applied to the piston/cylinder unit 12 when an electrical voltage is applied on electrical control line 16 and when the voltage on the electrical control line 16 rises, then the solenoid valve moves to the position in which the piston/cylinder unit 12 is isolated from gas or hydraulic pressure from the supply 51.

In the line between the solenoid valve 13 and the piston cylinder unit 12 there is provided a further solenoid valve 15 (ie solenoid 15A, valve 15B) which in normal operation is held in the position in which pressure passes from the solenoid valve 13 to the piston cylinder unit 12 and in a second position closes the line between the solenoid valve 13 and the piston/cylinder unit 12.

Referring to the Figures 3 and 4 it will be seen that an electrical control line 16, connected to an electrical voltage (which line 16 would normally be connected directly to the solenoid 13A of valve 13) is connected to a testing control means 17 in accordance with the invention.

In the alternative arrangement Figures 1A, 2A 3A and 4A show an arrangement similar to Figures 1,2,3, and 4 but with the solenoid valves 13 and 15 reversed in order.

In other words, electrical power from the electrical control line 16 passes through the testing control means 17 which controls the application of that electrical power along line 41 and 16B to the solenoids 13A, 15A. The testing procedure may be initiated from a superimposed signal on control line 16, by a signal on to contact 42 or by means of alternative devices such as 31.

The exact circuit diagram of the testing control means 17 illustrated in the Figures will not be described in detail as that is readily apparent from the Figures. However, there are provided 3 timer circuits, TM1, TM2, TM3, each powered through line 21 and controlled by signals on respective control terminals 22. Timer TM1 controls switches 24 and 25 as a relay. Similarly timer TM3 controls switch 26 and timer TM2 controls switch 27.

There are also provided two relays RL1, RL2, in parallel which control switches 28,29 respectively and a key operated or push button spring return switch 31 is provided.

The output of switches 28,29 is applied along line 41 to solenoid 13A.

Circuitry 50, the operation of which will be described later, is provided to control the application of the electrical power from the control line 16 to line 16B and thence to solenoid 15A.

In operation, in a normal position, the switches are in the positions shown in Figure 1.

Thus the input voltage from line 16 passes along line 40 through the parallel switches 28,29 to line 41 and thence to the solenoid 13A. The voltage on line 40 is applied to input terminals of switches 24 and 25, input switch 25 isolating that voltage, but switch 24 connecting that voltage to the input terminal of the key operated or push

button spring return switch 31. That switch 31 is normally open. The voltage on line 40 is otherwise used to power the timers TM1, TM2, TM3 and the relays RL1 and RL2.

When it is desired to partially stroke the emergency shut down valve 20, a superimposed signal is applied on line 16 (not shown here) or a key (which prevents unauthorised operation) has to be inserted into the switch 31 or by a push button and switch 31 is closed as shown in Figure 2. The effect of that is to connect the voltage from line 40 via switch 24 to switch 27 and thence to line 42 which connects that voltage to the control terminals 22 of timers TM1 and TM3. This immediately forces the timers TM1 and TM3 to change the state of switches 24, 25 and 26 to the opposite configuration for a predetermined variable length of time-see Figure 3. Alternatively a direct connection onto contact 42 can initiate a partial stroke of the emergency valve.

As a result as shown in Figure 3 the voltage from line 40 passes through switch 25 to line 43 and thence to switch 26, and through to line 44, and thence to the control terminals 32, 33 of relays RL1, RL2. This causes the relays to open switches 28,29 to interrupt the power supply to the line 41.4. As a result in Figure 3, the solenoid valve 13 will be switched to isolate the pressure supply from the piston cylinder unit 12 and the valve 20 will begin to close under the action of spring 14.

It will also be noted that as the switch 24 changes to its other configuration, power to the switch 31 is isolated, but power is supplied to the control terminal 22 of timer TM2. As a result, the timer TM2 opens the switch 27 for a predetermined variable length of time.

After a first predetermined period of time which is adjustable the control circuitry 50 operates to pass the electrical voltage from control line 16 to line 16B to operate solenoid 15A. This first predetermined period of time should be set to be less than the time taken for the valve 20 to fully close and indeed might be set for a period of time equivalent to the valve 20 moving a proportion of its full stroke. This changes the

solenoid control valve 15 from the normally open position shown in Figures 1,2 and 3 to the closed position shown in Figure 4. The effect of this is to seal the pressure within the piston/cylinder unit 12 so as to hold the piston of the piston/cylinder unit 12 in the position intermediate the open and closed position. The control circuit 50 includes timer means or a software trigger (to be described later) which is manually variable to maintain the signal on line 16B to maintain the solenoid valve 15 closed and thereby maintain the piston of the piston/cylinder unit 12 stationery in that intermediate position.

In the alternative arrangement shown in Figure 2A the control circuitry 50 operates to pass the electrical voltage from control line 16 to line 16B to operate solenoid 15A this blocks the supply to the valve 20. The timers in the testing control system 17 via the relays act to remove the signal from solenoid valve 13 lowering the pressure blocked by solenoid valve 15 and the valve 20 begins to move Figure 3 A. After a predetermined length of time the timer's time out changing the state of the relays allowing solenoid valve 13 to reset figure 4A, this causes the valve 20 to stop in its intermediate position.

Whilst the piston is stationery in that intermediate position, it is possible to carry out tests to determine features of the emergency actuator/valve 20. For example, accumulation of dirt or sludge or other material in the valve itself in the pipeline adjacent the valve, or on the gate of the valve, will have an effect, for example, on the flow rate or pressure differential across the valve and this may be used to determine whether the emergency valve 20 requires servicing, cleaning or the like.

For example, frequent operation of the apparatus to partially close the emergency valve 20 in this way can be used to plot the change of effectiveness of the actuator to close the valve, or the state of the valve or pipeline adjacent the valve over the course of time.

After a second predetermined period of time (which starts at the same time as the first

predetermined period and is slightly longer than the first predetermined period of time) and which is adjustable, the timers TM1, TM3 and the switches 24,25,26 will revert to the position shown in Figure 1 in the case of the alternative arrangement to Figure 1A. When TM1, TM3 revert to the position shown in Figure 1, the movement of the switch 25 and/or 26 will interrupt the power supply to the control terminals 32,33 of the relays RL1, RL2 and so the relays will move the switches 28,29 back to the position shown in Figure 1. This will reconnect the voltage from the line 40 to the line 41 to cause the solenoid valve 13 to reconnect the pressure supply to the solenoid 15.

Subsequently, when the control circuitry 50 determines that the valve has been partially closed for a suitable period of time, the connection between line 16 and line 16B is broken so that the solenoid control valve 15 opens. This reconnects the pressure supply via solenoid valves 13 and 15 to the piston/cylinder unit 12 and causes it to move the piston 12 against the spring 14 to move the emergency valve 20 to the normal position shown in Figure 1.

In the case of the alternative arrangement of Figures 1A-5A the control circuit 50 de- energies solenoid valve 15 allowing full pressure to be applied to solenoid valve 13.

It will be understood that if either of the timers TM1, TM3 fail then the power from line 43, 44 to the control terminals 32, 33 of the relays will be interrupted by the other timer operating its relevant switch. Similarly if either of the relays 32, 33 fails to move the switches 28,29 back to their normal position, then again, because the two switches 28,29 are in parallel, either one can provide the connection between input terminal 1 and output terminal 4. In that way there is redundancy in both the timers TMI, TM3 and the relays RL1, RL2 and their switches.

The timer TM2 is arranged to have a longer time (longer than the second predetermined time plus the time provided by circuit 50) before switching 27 back to its normal position than the timers TM1, TM3. The reason for this is that it would otherwise be possible, once the timers TM1, TM3 have returned the switches'4, 25,

26 to the position shown in Figure 1, for an operator to operate switch 31 again before the valve 20 has returned to the fully open position and in that circumstance by successive operation of the switch 31, one could cause the valve 20 to move to a fully closed position. Timer TM2 and switch 27 isolate the switch 31 until a period of time which is sufficient for the valve 20 to open fully. Thus timer TM2 is set so as to maintain switch 27 open from the time the switch 31 is first closed through to a period of time which will allow the valve 20 to open in all circumstances.

One of the advantages of the arrangement of control means set out above is that it can be simply inserted into the electrical control line 16. This is particularly useful where, for example, the valve is remote, for example, is provided on the seabed and allows ready application of the testing means to other types of emergency control valve, for example, emergency control valves with double acting actuators, or with electrical actuators.

As noted above the various timers TM1, TM2, TM3 are of variable timing.

Particularly timers in circuit 50 and TM1, TM3 need to be adjusted for the operation of an individual valve 20. Thus for example when first installing the system, the timers can be turned down so as to operate for the minimum period, and the system operated to see how far the valve 20 strokes, and the time of can be increased slowly until the valve 20 strokes to the desired extent, for example, through 25% of its stroke.

Referring to Figure 6 and the alternative arrangement shown in Figure 6A there is shown a apparatus comprising a second embodiment of the invention. Where appropriate the same reference numerals as used in Figure 1 are used. There are a number of differences from the embodiment of Figure 1 but the two major ones are that the apparatus includes means for measuring the pressure or flow of the pneumatic fluid applied or released from the actuator and uses that measurement of pressure or flow to control operation of the solenoids 15 in place of the timer circuits in the embodiment shown in Figures 1 to 5.

The arrangement of Figure 6 and the alternative arrangement shown in Figure 6A includes an emergency valve 20 operated by an actuator 10 comprising a piston/cylinder unit as shown in Figure 1, pneumatic pressure being released in the case of a single acting actuated valve or applied in the case of a double acting actuated valve (not shown here) to the actuator 10 via the solenoid valves 15,13, from a supply 51. The solenoids 15A, 13A of solenoid control valves 15, 13 are electrically controlled by lines 113,105 respectively, the line 105 is connected to a testing system 100 which includes a pressure sensor 101 configured either to measure pressure directly or to measure differential pressure and hence measure blow, which sensor 101 is connected by a line 102 to the pressure line 103 interconnecting the solenoid valve 15 and the actuator 10. In this way the pressure sensor 101 measures the pressure of the gas or air on the side of the piston opposite the spring within the actuator 10. The signal line 16 of Figure 1 is also connected to the testing system 100. The testing system 100 may include an electrical output line (not shown) which provides an electrical/electronic signal indicating the pressure sensed by the sensor 101 which may be passed to a suitable computer. In this case also, the signal line 16 is also connected to the line 113.

In operation, therefore, removal of the signal on the line 16 is applied to the solenoid 13A which operates the valve 13 to disconnect the air supply 51 to the actuator 10 and to connect the actuator 10 to exhaust via the solenoid valve 13. At a point during the movement of the valve 20 by the actuator, the solenoid valve 15 is closed under the control of a signal line 105 to provide the partial stroking as set out in the embodiment of Figures 1 to 5 and in the alternative arrangement 1A to SA. Thereafter solenoid valve 13 is again switched so as to reconnect the pressure air supply from 51 via the solenoid 13 to the solenoid 15 so that when the solenoid 15 is opened again then the actuator is operated to open the valve 20 by the pressure air supply to the piston acting against the spring in the actuator 10. Once again the configuration changes need to be included here.

In the case of the alternative arrangement of Figures 1 A to SA solenoid valve 15 is

engergised blocking the supply to the actuator 10. Solenoid valve 13 is then de- energised allowing the actuator 10 and valve 20 to begin moving. Thereafter solenoid valve 13 is re-energised blocking any further discharge of fluid/gas from the actuator 10, this action stops the movement of the emergency valve 20 in its intermediate position. After a predetermined time solenoid valve 15 is de-energised allowing full pressure from supply 51, at the same time solenoid valve 13 is re-energised allowing full pressure from supply 51 to the actuator 10, this has the action of restoring the emergency valve and actuator to their normal position.

As noted, there is provided an electrical output indicating the measurement of pressure sensed by the sensor 101 and this can be used for a number of purposes as will be described hereafter.

We now refer to the graph of Figure 7 the vertical scale of which is the pressure measured by the pressure sensor 101 during emergency operation of the valve 20 (which in the case of differential pressure measurement is a measure of pneumatic flow). The horizontal scale is time. Figures 7-10 show the release of air flowing from the actuator/valve assembly the trace portion 120 can be ignored as this is a time period in which the output of the pressure sensor 101 is sensing no flow (in the case of the differential method) or no change in pressure (in the case of direct pressure readings). When the emergency valve is to be closed the solenoid valve 13 is operated so as to connect pressure line 103 to exhaust and under the operation of the spring or by means of applied pressure for double acting actuated valves, the piston in the actuator moves so as to close valve 20 and the air in the system is exhausted. This is shown by the trace 122 where the pressure is reduced or flow is reducing from the peak at 125 to a lower value at 126. In practice the lower value 126 is not zero since the valve 20 will be closed before the pressure in the cylinder of the actuator 10 has reduced to zero. After the valve 20 has closed residual air pressure decays as is shown by the trace 123 to a value 124. The time interval between the trace 121 and the lower value 126 which sets out the time over which it takes the valve 20 to close is in this case less than one second as the valve is operating at full speed.

Figure 8 is a copy of Figure 7 which shows a point 127. Whereas in the arrangement of Figures 1 to 5 the closure of the solenoid valve 15 was controlled by timers, in the present arrangement it may alternatively be provided by a measurement of the pressure. In other words, one may select a position along the trace 122 at which to close the solenoid valve 15. In the case of Figure 8, the position chosen is at 127.

Thus the testing system 100 reads the pressure or flow output from the sensor 101 and when the pressure or flow has reduced from the peak 125 down to the point 127 then a signal is passed along line 105 to operate the solenoid valve 15 to close it. This is the so-called software trigger. The software trigger may be automatically adjusted to compensate for variables such as pressure or temperature changes in and surrounding the actuator/valve assembly, thereby arresting the movement of the valve/actuator at the preferred partial or intermediate closing distance.

Figure 9 shows a superimposition of the signal of Figures 7 and 8 with the output signal in a case where the solenoid valve 15 is closed when the pressure trace reaches the point 127. In practice, the signal from the pressure sensor 101 is not recorded beyond the point 127 and thereby falls to zero.

By operating the solenoid 15 in accordance with the predetermined chosen point 127 it is not necessary to use all of the timers as set out in the arrangement of Figures 1 to 4 although the timers may be retained as a back up. In other words, the timers may be set to operate in normal circumstances at a point in time beyond the point 127.

It will be understood that as the arrangement now provides a detailed output of the pressure or flow change as the actuator 10 is operated it enables one to determine whether the actuator is operating in its proper form (and, at its correct operating speed).

Referring to Figure 10, there are shown two traces similar to those shown in Figures 7 to 9 in respect of partial stroking of the valve 20 Trace 132 is a trace of an actual operation of the valve 20 at a later time it can be seen

that this is outside (ie below) the trace 131. It is therefore possible to determine that there is a problem with the valve or actuator particularly when the valve has partially closed (the trace 132 in the initial sequence of closure of the valve is satisfactory and only becomes unsatisfactory as the valve closes). Thus whilst the emergency shutdown valve 20 may be operating whilst the trace 132 is taken, it is possible to predict that there is a problem which may get worse over time and may cause the valve not to operate correctly.

Automatic monitoring systems may be added to produce a valve test failure report.

The principle of Figures 6-10 can be applied to single acting hydraulic or pneumatic emergency shut down valves, in which case we measure fluid pressure, and to double acting hydraulic or pneumatic emergency shut down valves.

We now refer to the third embodiment of the invention illustrated with reference to Figures 11 and an alternative arrangement in Figures 1 lA which once again show the solenoid valves arranged in reverse order..

In essence, the arrangement of Figure 11 is similar to Figure 6 except as detailed as follows. The same reference numerals are used as Figure 6 for the same or corresponding components.

The major differences are that in Figure 11 the pressure sensor 101 senses pressure between the valves 13. 15 and a flow sensor 201 is provided to sense flow between the valve 15 and the actuator 10. An optional position sensor 202 is provided on the shaft between the actuator 10 and the valve 20. The outputs of the sensors 101. 201. and 202 are passed by respective electrical lines to the testing system 100.

The testing system 100 includes a simple button which is manually operated to start the test (although remote operation is also envisaged) and has three lamps which indicate whether the emergency valve has failed the test, or a fault has been found (which

whilst not failing the test indicates that maintenance is required) or that it passed the test.

The testing system may include a microprocessor and analyse the data itself or may pass the data from the sensors to a remote computer system where the analysis is carried out.

We will now describe a test sequence which whilst described with reference to the arrangement of Figure 11 is generally applicable to the first and second embodiments of the invention.

Diagnostic mode (for embodiment of Fig 11) On initiation, the apparatus will go into a diagnostic mode by running an internal diagnostic check of the electronics. It will then:- A] Test Solenoid valve 15 by applying power to the solenoid 15A thereby blocking the pneumatic signal to the actuator 10. Power is then momentarily removed from the solenoid valve 13 and then restored to check whether the pressure falls between solenoid valves 13 and 15, and that there is no flow between solenoid valve 15 and the actuator. If no flow is detected this will indicate that solenoid valve 15 is healthy and the sequence will continue; should flow be detected this would indicate that solenoid valve 15 is faulty, and the sequence will be aborted and a solenoid valve 15 failure indicated to the user by means of illuminating the relevant lamps 203-205.

B] Test Solenoid valve 13 by removing power momentarily to solenoid valve 13 and observing that flow exists by means of the flow sensor 201. Should flow be detected this would indicate that solenoid valve 13 is healthy and the sequence will continue; should no flow be detected this would indicate that solenoid valve 13 has not operated and the sequence will be aborted and an solenoid valve 13 failure indicated to the user by means of illuminating the relevant lamps 203-205. Should flow be detected for a

period of more than a predetermined number of Msec, this would indicate that solenoid valve 13 has failed to re-arm; in this case solenoid valve 15 will be operated to prevent the emergency valve 20 from closing and the sequence will be aborted and a solenoid valve 13 failure indicated to the user by means of illuminating the relevant lamps 203-205.

Failure of any of the self-tests can be displayed on the computer display (if connected), or can be indicated by means of illuminating the relevant lamps 203-205 The diagnostic mode for the arrangement of Figure 11 A is similar except that no testing of the solenoid valves takes place Set Up Mode During set-up of the emergency valve (i. e. when it is first installed) the apparatus removes the electrical signal from solenoid valve 13 to allow the emergency valve 20 to close fully. During the closure a reading is taken by the flow sensor of exhausting air from actuator 10, and this reading is used as a datum against which future measurements are analysed (see top trace Figure 12) Solenoid valve 13 is then re-energised to allow the actuator 10 to return to normal.

The apparatus is then controlled by interrupting the electrical supply to cause partial movement in 10% steps (i. e. 10,20 30 depending on the movement required). This is carried out by de-energising solenoid valve 13 to allow the emergency valve 20 to begin moving. At a predetermined point solenoid valve 15 will energise, arresting the movement of the emergency valve 20.

(In the case of the alternative arrangement of Figure 11 A, the solenoid valve 15 is engergised, blocking the supply to the actuator 10. Solenoid valve 13 is then de- energised allowing the actuator 10 and valve 20 to begin moving. Thereafter solenoid valve 13 is re-energised blocking any further discharge of fluid/gas from the actuator

10, this action stops the movement of the emergency valve 20 in its intermediate position. After a predetermined time solenoid valve 15 is de-energised allowing full pressure from supply 51, at the same time solenoid valve 13 is re-energised allowing full pressure from supply 51 to the actuator 10, this has the action of restoring the emergency valve and actuator to their normal position.) During this process a reading is taken by the flow sensor of the flow of exhausting air from actuator. This reading is used as a datum against which future measurements are analysed (see bottom trace Figure 12). Solenoid valve 15 is now de-energised to allow the emergency valve 20 to move to its normal position.

At any point in the following sequence, should the electrical signal on line 16 be removed the emergency valve 20 will close.

Test Mode Once the apparatus has been through the set-up mode, it enters the test mode. In the test mode the apparatus will :- De-energise solenoid valve 13 and energie solenoid valve 15 to allow the actuator 10 to move to the partial stroke position. Solenoid valve 13 is re-energized immediately after solenoid valve 15, thereby avoiding the prospect of a spurious trip should solenoid valve 15 have failed to engage.

(In the case of the arrangement of Figure 11 A solenoid valve 15 is energized prior to solenoid valve 13 being de-energised to arrest the movement of the emergency valve 20.) The svstem is failsafe in that failure of the electrical supply to the solenoid valve 13, will cause the valve 20 to be closed by the metal spring 14 or other means.

Additionally should the unit 100 sense a failure in the electrical supply it will continue

to monitor the flow/pressure sensors in order to store a full closure trace of the emergency valve for analysis purposes against previously held data.

During the partial stroke movement a reading is taken by the flow sensor of the flow rate of the air exhausting from actuator 10, and this reading is used as a comparison against the initial measurements taken at set-up. (see bottom trace Figure 12).

A comparison algorithm within the system 100 or the computer checks the traces. The original set-up trace is compared to the test data. Should an anomaly be detected, the system will illuminate the relevant lamps 203-205 to display to the operator the condition of the emergency valve 20 assembly.

Should the lamp display indicate a fault, the information can be downloaded from the apparatus unit for further analysis. The information is analysed on a computer housing the necessary software. Algorithms analyse the data to give best-fit results against previously held data.

Figure 12 shows a graph of airflow taken during a full stroke test. Prior to the test the actuator had been fully stroked repeatedly in order to obtain a minimum value of breakout force. The dased line on the graph shows the superimposition of a graph taken from a partial stroke of 30%. A number of deductions can be made from the graph and from the nature of the mechanical operation of the actuator.

As soon as the actuator is allowed to vent to atmosphere there will be a rapid increase (A) in flow rate. The flow rate will peak at a level (B) determined by size of the venting orifice and the difference between operating and atmospheric pressures. From this peak the flow rate will diminish steadily as the pressure of the air in the actuator falls to a point that equals atmospheric pressure (E). Provided that nothing changes during this period then the graph, although non-linear, would be entirely predictable. In the case of a spring-operated actuator (of the type in use) a point will be reached (C) where the air pressure inside the actuator is no longer able to restrain the spring-loaded

piston in the piston/spring unit 12 and the piston will move. Since the piston will now assist the exhaustion of gas from the piston/spring unit 12, the flow rate will now fall at a lesser rate (C-D) until the piston is again restrained this time by the cylinder end stop.

From this point (D) the flow rate will again drop sharply and will finally cease (E) when all air has been exhausted from the actuator and any associated pipes. The ratio of A-C to C-E is determined by the pressure difference (between operating and atmospheric pressures), and the strength of the spring.

During subsequent tests differences observed between A and C will be due to the effects of (a) temperature change, (b) changes in operating pressure, (c) changes in atmospheric pressure, (d) obstruction to air flow, (e) Failure in associated equipment (solenoid valve or measuring transducer).

These effects would also apply to the remainder of the graph and would again become the sole source of differences observed between D and E although, in the case of a partial stroke test, this portion of the graph would not be available for examination.

The portion of the graph between C and D could, in addition to the above effects, be distorted by changes in the operation of the spring-loaded piston.

Temperate and pressure may be monitored and their effects compensated for or minimise (e. g. a regulated pressure supply) and compensation derived from (and applied to) portion A-C can also be applied to C-D.

The case of an obstruction to the airflow should be distinguishable by not only a reduction in flow rate but also a marked change in the slope of B-C. as the total actuator exhaustion time would be significantly increased.

Failure in associated equipment would cause a marked distortion of the graph between A-C resulting in the immediate termination of the test and would be recorded as a fault.

Given that compensation derived from B-C may be applied to C-D then any remaining distortion of the graph in this area must be due to changes in the actuator's operation and the same reasoning would apply to the portion C-F during a partial stroke test.

Assuming that pressure and temperature remain unaltered, when a partial stroke test is performed for a given percentage of the complete stroke the volume, and pressure, of the air remaining in the actuator must have a constant value. Following directly from this the volume of air exhausted from the actuator, represented as A-F on the graph, must also be a constant value and that this volume of air represents the maximum that can be released if the desired % closure not to be exceeded. (If the release of this volume of air results in a pressure differential (between actuator and atmosphere) which, subtracted from the force exerted by the spring, leaves a spring force that is less than the required breakout force then the actuator will not operate.) Other than leakage, which would show as a constant flow prior to actuator operation, there is nothing that can increase the flow rate and any changes in the actuator must result in a diminished flow. Any changes perceived, after compensation, must be due to (a) Increase in breakout force.

(b) Weakening of the spring due to ageing.

(c) Spring failure.

Assuming that the actuator has been undisturbed for sufficient increases in breakout force will give rise to distortion of the graph in the region B-F. A likely effect is that point C will be moved closer to point F on the graph. Any delay in piston movement

will result in exhaustion to a lower level of pressure and hence a lower flow, before the spring is able to assist in the exhaustion process and reduce the rate of fall. Depending on the delay due to breakout force, and given that the exhaust valve is opened for a fixed time, this will mean that a slightly smaller volume of air will be exhausted and that the piston will not move to the full value of partial closure. It is also possible that as the piston breaks free it will"kick"and cause a characteristic"bounce"in the flow pattern. Compensation for increases in breakout force by increasing the time allowed for exhaustion is limited by other factors. The difference in the volume of air exhausted, due to the delay in the piston moving, is likely to be small and this will limit timing changes to equally small increments. (If the breakout force required should increase beyond a certain point then the pressure drop required to achieve it will mean that there is insufficient air left in the cylinder to halt the actuator at the required position.) This could lead to unwanted full or near full closure. Reapplying the air supply could increase the safe timing"window"but this would be limited to, the time taken by the piston travelling the required distance against a much reduced air pressure, less the time taken to build up pressure to the level needed.

Weakening of the spring due to ageing gives rise to very similar distortions of the flow pattern as those caused by increased breakout force. Examination of the slope C-F should allow differentiation between the two causes, as a weakened spring would not assist the exhaustion of air to the same extent.

If the partial stroke test were to be repeated immediately then effects due to breakout force would be minimised. A comparison of the two tests would enable the effect breakout force to be evaluated and establish definitely whether changes were due to breakout force or spring weakening or a combination of both.

The invention is not restricted to the details of the foregoing example.