Remotely proof-testing to improve SIS performance

The primary functions of safety instrumented systems (SIS) are to bring processes to a safe state and to prevent safety incidents. Systems will include the sensors, final control elements and logic solvers for each of the safety instrumented functions (SIF) that they perform. Instruments and systems need to be periodically proof-tested to ensure that the equipment will work properly when there is a safety demand, and to verify that SIFs are operating at the necessary safety integrity level (SIL) for their application. 

Proof-tests will be conducted in accordance with the safety manual of an individual device to evaluate its ability to perform its safety function and uncover dangerous undetected failures. 

The proof-testing of SIFs needs to be performed at regular intervals to meet SIL and regulatory requirements. Both API 2350, which addresses overfill prevention for petroleum storage tanks, and IEC 61511 – the process industry’s standard for designing a SIS – place high importance on regular proof-testing and both standards are often applied. API 2350 states that all overfill prevention systems required to terminate receipt must be tested annually, and high-high sensor alarms must be tested semi-annually. It states that continuous level sensors must be tested once a year and point level sensors semi-annually.

For level measurement and monitoring applications in SIS installations proof-tests have traditionally been carried out by technicians in the field, with another worker stationed in the control room to verify the system reaction. In addition to being prone to errors, performing proof-tests in this way consumes significant amounts of time and can lead to the process being offline for an extended time.

Digital technology in today’s instrumentation now enable proof-testing to be performed remotely, making the procedure faster, safer and more efficient.

For point level switches and detectors installed in SIS applications, two types of proof-tests are performed to comply with API 2350 and IEC 61511: full and partial. While a full proof-test will return the instrument’s probability of failure on demand (PFD) average back to, or close to, its original targeted level, a partial proof-test will bring the PFD average back to a percentage of the original level. As a partial proof-test detects only a percentage of potential failures, a full proof-test must subsequently be carried out after a given time interval to return the instrument to its original PFD average.

During a full proof-test the level measurement switch can remain in service or be taken out of service. When a switch remains in service, the fluid level in the vessel can be raised to the activation point of the instrument to prove that it operates correctly. However, if the switch is a critical-high or high-high level sensor for overfill prevention, and it fails to activate during the test, a spill could occur. For this reason, changing the liquid to potentially unsafe levels is often prohibited. In cases where the instrument is removed from service to be tested in a simulated vessel the process may have to be taken offline, which could affect the overall production process. Some technologies, such as capacitance-based devices, rely on the reference to ground geometry inside the vessel. Removing that type of switch from the vessel would mean that it was not being tested in its installed state and would thereby invalidate the proof-test.

During partial proof-testing, the switch almost always remains in service, but the coverage of testing is reduced compared to a full test. Partial proof-tests are usually limited to exercising the processing and output electronics. Input electronics are usually excluded from the test, since the device’s wet-side does not see a physical change in state.

Partial proof-testing does not replace a full proof-test, but it can provide justification for extending the time interval between full tests. This minimises interruptions to the process without sacrificing SIL capability and functional safety.

Local and remote initiation

There are two ways that a partial proof-test can be initiated – either locally from the switch itself, or remotely via an electronic signal being transmitted to the device. A local test can be activated either by pushing a button or via a magnetic test-point located on the side of the housing. This is activated by holding a magnet to the test-point, which causes the output state to change, simulating the alarm condition and enabling a functional test of the switch and the system connected to it.

One way that partial proof-tests can be initiated remotely is by transmitting a signal from a separate external switching unit installed in a control panel or cabinet. In this solution, one-channel or three-channel versions are available that enable connection to up to three level switches. Consideration must be given to control panel or cabinet space. In a large plant space may be required for tens, or even hundreds of switching units which must be wired to the level switches. When three-channel units are installed, it is vital to identify which switch is connected to which channel to ensure the correct switch is tested. 

To prevent accidental use test buttons are accessed through pinholes at the front of the switching unit. Activating the buttons can be difficult, requiring the use of a small instrument and this can create a potential risk of shorting the switching unit. Opening the panel provides easier access but prevents operators from seeing the identification labelling. 

Another method for remotely initiating partial proof-tests is to have this functionality integrated into the switch, enabling an operator to issue a command from the control room without the need to install a separate switching unit in the control panel. Modern vibrating fork level detectors initiate remote partial proof-testing in this way, helping to reduce complexity. 

When a device receives the command, it enters test mode, whereby its fork frequency is simulated for on, off and alarm conditions. The test exercises the processing and output electronics of the device and can take less than one minute to complete the test cycle. On completion of the proof-test, a status is displayed on the control room system to show whether it was successful or not. The device then automatically returns to operational mode.

The remote partial proof-testing capability of the latest vibrating fork level detectors can enable full proof-test intervals to be safely extended to up to ten years, providing the freedom to schedule tests around planned shutdowns. While solutions using external switching units provide a means of remotely initiating partial proof-tests, this method involves various extra complexities. In contrast, the latest generation of vibrating fork level detectors, with integrated remote proof-testing functionality, are less complex.