requirements, and sets the test coverage
for the demonstration of achieved SIL.
The suite of tests should aim to achieve a
test coverage of 100% at some test interval,
as otherwise a calculation of average
probability of failure on demand (PFDavg) will
result in an ever-increasing value.
The suite of tests must be scheduled
in the maintenance management system
and their results recorded in order to
demonstrate successful proof testing.
SCOPE AND SEQUENCE
What is included in practical proof tests?
There is a hierarchy of tests that can be
carried out which each have decreasing
proof test coverage. As the proof test
coverage decreases, alternative methods
of revealing hidden failures must be
developed (and possibly implemented o -
line on longer intervals) for the parts of
the IPS that are missed by the test.
For example, for testing sensors, such
a hierarchy might have four levels. First
could be a real process test – a test where
process uids at process conditions are
used is the most realistic test of a sensor.
However, this may often not be feasible
without actually introducing the process
hazard that the system is designed to
protect against. Second could be an
injected process test – a test where a
simulation uid is injected
into the sensor as if it is
process uid. Third could be
simulation of a process value
on a sensor – a test where a
smart sensor is instructed to
act as though it has sensed
a given process value. Fourth could
be simulation of electrical signal from
sensor – a test where the electrical signal
(typically 4-20mA or Volt-free contact) is
injected into the transmission from the
sensor, or the sensor is instructed to give
a particular electrical output.
Clearly it will be preferable to use
the methods which are higher in the list
and give higher proof test coverage if
possible. This must be balanced against
practicality, particularly if testing is carried
out with the plant on line.
Likewise, for nal elements, such as
valves, there is a hierarchy for testing.
At the top is a real ow stop – a test
where the process can tolerate a real
activation of the IPS so as to prove that
the nal action of the valve is successful
in interrupting the ow of process uid.
Below that is a full travel test – a test
where the process is not operating or
the valve is bypassed and the IPS can be
activated to cause the valve to fully travel.
Below that is a partial travel test – a test
TEST & MEASUREMENT
where the valve is caused to move over a
(usually small) portion of its overall travel.
Many system components include user
diagnostics, which should form a part of
the proof testing. The manufacturer’s
advice should be followed.
Some IPS depend upon a supporting
system such as a UPS, a hydraulic
reservoir, or steam-traced impulse lines
for correct operation. It is important to
include those in the proof testing.
Redundant
equipment
in IPS, such
as 1-out-of-n
voted relays, or
stopping multiple
spared motor
drives, introduce
their own problems
for testing. All
paths through the
system must be
tested to ensure
that all functionality
is operational and all
failure modes revealed. It may not be
su cient to trigger a test and observe the
end result, as failures may not be revealed
in redundant equipment.
Bypasses or overrides are sometimes
available to facilitate testing. These may
not simply consist of key overrides, but
also include operation of eld valves,
and jamming mechanisms for valves.
Their use needs care, and the test should
ensure they are returned to normal at the
end of testing.
Proof testing is carried out by humans,
and good design of the test to avoid
human failings is of utmost importance.
Ensuring that the testing is in the best
sequence to reveal errors in the most
important parts of the test is critical.
Suitable checks and second-set-of-eyes
techniques should be designed in.
EEMUA 242, Proof Testing Good
Practice for Instrumented Protective
Systems, gives guidance on all the above
and more.
snapfoto105 /stock.adobe.com
Autumn 2020 www.operationsengineer.org.uk 69
/stock.adobe.com
/www.operationsengineer.org.uk