How remote proof testing can improve performance in safety instrumented systems

Even though safety is the top priority for process plant owners and operators, accidents do unfortunately still happen. However, properly designed and implemented safety instrumented systems (SIS) help to reduce the risk of an accident occurring. The primary functions of an SIS is to bring processes to a safe state and to prevent safety incidents. An SIS includes the sensors, final control elements and logic solvers for each of the safety instrumented functions (SIFs) that they perform. Instruments and systems must be periodically proof tested to ensure that this equipment will work properly when there is a safety demand, and to verify that SIFs are operating at the necessary safety integrity level (SIL) for their application.

Proof tests are operational tests conducted in accordance with the safety manual of an individual device to evaluate its ability to perform its safety function and uncover dangerous undetected failures. These are failures which prevent the device from performing its primary function and remain undetected by the device during normal operation.

The proof testing of SIFs must be performed at regular intervals to meet SIL and regulatory requirements. Both API 2350, which addresses overfill prevention for petroleum storage tanks, and IEC 61511, the process industry’s standard for designing an SIS, place high importance on regular proof testing. To create consistency in their approach to safety, many companies apply both standards. API 2350 states that all overfill prevention systems that are required to terminate receipt must be tested annually, and high-high sensor alarms must be tested semi-annually. It states that continuous level sensors must be tested once a year and point level sensors semi-annually.

Proof testing methods

For level measurement and monitoring applications in SIS installations, such as devices employed for overfill prevention duty, proof tests have traditionally been carried out by technicians in the field, with another worker stationed in the control room to verify the reaction of the system. This method can involve workers having to climb tanks to access instruments and perform the proof test. This can expose them to a hazardous environment and put their safety at risk. In addition to being prone to errors, performing proof tests in this way also consumes a significant amount of time and effort and can lead to the process being offline for an extended time, thereby affecting profitability.

Increasingly fierce competition within the process industry means that companies are constantly seeking ways to optimise processes and improve worker efficiency while maximising safety. The digital technology available in modern instrumentation facilitates this by enabling proof testing to be performed remotely instead of via the traditional on-location approach, therefore making the procedure faster, safer and more efficient.

For point level switches and detectors installed in SIS applications, two types of proof tests are performed to comply with API 2350 and IEC 61511: full and partial. While a full proof test will return the instrument’s probability of failure on demand (PFD average) back to, or close to, its original targeted level, a partial proof test will bring the PFD average back to a percentage of the original level. As a partial proof test detects only a percentage of potential failures, a full proof test must subsequently be carried out after a given time interval to return the instrument to its original PFD average.

Figure 1: The effect on probability of failure after carrying out a comprehensive (full) proof test and a partial proof test.

During a full proof test the level measurement switch can remain in service or, if required, be taken out of service. When a switch remains in service, the fluid level in the vessel can be raised to the activation point of the instrument to prove that it operates correctly. However, if the switch is a critical-high or high-high level sensor for overfill prevention, and it fails to activate during the test, a spill could occur. For this reason, changing the liquid to potentially unsafe levels is often prohibited. In cases where the instrument is removed from service to be tested in a simulated vessel – known as an immersion test – the process may have to be taken offline, which could affect the overall production process. For full proof testing of level switches, it is important to remember that some technologies, such as capacitance-based devices, rely on the reference-to-ground geometry inside the vessel. Removing that type of switch from the vessel would mean that it was not being tested in its installed state and would thereby invalidate the proof test.

During partial proof testing, the switch almost always remains in service, but the coverage of testing is reduced compared to a full test. Partial proof tests are usually limited to exercising the processing and output electronics only. The input electronics are usually excluded from the test, since the device’s wet-side does not see a physical change in state, i.e. going from wet to dry.

Partial proof-testing does not replace a full proof test, but it can provide justification for extending the time interval between full tests. This minimises interruptions to the process and production, reduces potential plant downtime, improves output, and reduces worker exposure to hazardous environments without sacrificing SIL capability and functional safety.

Local and remote initiation

There are two ways in which a partial proof-test can be initiated – either locally from the switch itself, or remotely via an electronic signal being transmitted to the device. Different automation technology suppliers offer different mechanisms for conducting tests. A local test can be activated either by pushing a button or via a magnetic test-point located on the side of the housing. This is activated by holding a magnet to the test point, which causes the output state to change, simulating the alarm condition and enabling a functional test of the switch and the system connected to it.

Figure 2: Remote partial proof tests can be initiated by an operator issuing a command from the control room.

External switching units

One way in which partial proof tests can be initiated remotely is by transmitting a signal from a separate external switching unit installed in a control panel or cabinet. In this solution, one-channel or three-channel versions are available that enable connection to up to three level switches. Consideration must be given to control panel or cabinet space. In a large plant or tank farm, available space may be required for tens, or even hundreds, of switching units, which must be wired to the level switches. When three-channel units are installed, operators must carefully identify which switch is connected to which channel to ensure the correct switch is tested. This can be challenging if tag identifications indicating which switch corresponds to which channel go astray.

To prevent accidental use, test buttons are accessed through pinholes at the front of the switching unit. One drawback is that activating the buttons can be difficult, requiring the use of a small instrument. This procedure can create a potential risk of shorting the switching unit should the instrument contact exposed circuitry. Opening the panel provides easier access but prevents operators from seeing the identification labelling. This can lead to confusion over which diagnostics correspond to which switch. Ultimately, these complexities could lead to an operator mistaking which device has been tested, climbing the wrong tank to service the wrong overfill prevention device, or shutting down the wrong tank.

Reducing complexity

Another method for remotely initiating partial proof tests is to have this functionality integrated into the switch, enabling an operator to issue a command from the comfort of their control room without the need to install a separate switching unit in the control panel. Modern vibrating fork level detectors initiate remote partial proof testing in this way. This integral method reduces complexity by eliminating the need for extra wiring and control panel space and makes the procedure much easier to use compared with the external switching unit solution. It also provides significant safety benefits by keeping workers away from hazardous environments.

When a device receives the command, it enters test mode, whereby its fork frequency is simulated for on, off and alarm conditions. The test exercises the processing and output electronics of the device and can take less than one minute to complete the test cycle, thereby providing a significant reduction in terms of time compared to other methods. On completion of the proof test, a status is displayed on the control room system to show whether it was successful or not. The device then automatically returns to operational mode, thereby eliminating the risk of it accidentally being left in test mode.

Figure 3: The remote partial proof-testing capability of the latest vibrating fork level detectors provides a safe, quick, simple and cost-effective way to establish their integrity.

Conclusion

The remote partial proof testing capability of the latest vibrating fork level detectors provides a safe, quick, simple and cost-effective way to establish their integrity. Crucially, this method can enable full proof test intervals to be safely extended to five or even ten years, thereby providing the freedom to schedule such tests around planned shutdowns, to improve plant efficiency. Various options are available as a means of remotely initiating a proof test, but consideration should be given to which methods are easiest to use and reduce the risk of human error. Solutions using external switching units provide a means of remotely initiating partial proof tests, but this method involves various extra complexities. In contrast, the latest generation of vibrating fork level detectors with integrated remote proof testing functionality are less complex, therefore making the procedure easier for operators and reducing the risk of human error.

To learn about the remote partial proof-testing capability of Emerson’s Rosemount 2140 Level Detector, visit www.emerson.com/en-us/catalog/rosemount-2140-detector-vibrating-fork.

Top image: Traditional proof-testing methods require operators to enter hazardous locations or work at height to access devices, which poses a potential risk to their safety. ©stock.adobe.com/au/Okea.