Regular proof-testing is an essential requirement for safety instrumented systems (SIS) in liquid level measurement applications, as it ensures that they are operating to the necessary safety integrity level. Traditionally, proof-testing has been performed with multiple technicians in the field and one in the control room, verifying the safety system reaction. This requires a considerable amount of time and effort, can pose safety risks to workers who need to climb tanks to perform the test, could take the process offline for an extended period, and can be prone to errors. However, technological advances in modern smart devices are now enabling proof-testing to be performed remotely, making the process much quicker, safer and more efficient.
Why periodic proof-testing is necessary
A proof-test is a periodic procedure performed to detect dangerous undetected failures in a safety-related system. Frequency of testing varies across industries and facilities, based on the required safety integrity level and the safety system’s undetected dangerous fail rate. Sometimes testing is performed annually, but often intervals are even longer. Testing frequency directly impacts regulatory compliance and safety calculations, such as Safety Integrity Level (SIL). Obtaining a high-quality proof-test performed at regular intervals is critical in meeting SIL and regulatory requirements. Devices and systems across the process are involved.
Full and partial proof-testing
There are two levels of proof-testing: full and partial. A full proof-test returns the PFD (probability of failure on demand) average back to or close to the instrument’s original targeted level. A partial proof-test brings the PFD average back to a percentage of the original level.
A full proof-test can be accomplished in two ways. In the first method, the level in the vessel can be raised to the activation point of the instrument being tested, providing functional proof that it still works. The danger of this approach is that if the instrument is a critical-high or high-high level sensor for overfill prevention, and it does not activate during the test, a spill is likely, which could constitute a safety risk. Operators would also have to fill the tank just to test the instrument, which is not practical as well as being potentially unsafe.
The second approach is to remove the instrument from the vessel for testing in a simulated vessel using material from the process. There are several considerations with this method. Firstly, the process may need to be taken offline, which may interrupt the overall production process. There will be manpower required to run the test, and there may also be safety issues with exposing personnel to the process or to the environment. Also, the process material used for the test must be disposed of.
Standards for best practice
The API 2350 standard outlines the minimum requirements for atmospheric bulk liquid storage tanks to comply with modern best practices. Its main purpose is to prevent overfills and improve safety. API 2350 does not compete with other, more generic, safety standards, but is intended to complement them. For the process industry, the standard for designing a SIS is IEC 61511. Many companies apply both standards, to create consistency in their approach to safety.
Both standards place high importance on regular proof-testing. API 2350 states that all overspill prevention systems that are required to terminate receipt must be tested annually, while the high-high sensor alarm must be tested semi-annually. Additionally, continuous level sensors should be tested once a year, and point level sensors semi-annually.
In many cases, high-level alarm testing in process applications requires the fluid level in the vessel to be raised to the high-level alarm limit. The fluid must be moved in and out of the tank under test –increasing the risk of spills. The process can take up to half a day to complete, which can interrupt normal activities. It would also require supervision, with operators monitoring the tank level. This can pose health and safety risks due to the possibility of exposure to the tank contents.
Remote partial proof-testing
New technology within the latest non-contacting radar and vibrating fork level detectors is now enabling operators to undertake partial proof-testing remotely. This eliminates the need for workers to climb tanks and/or be exposed to tank contents, and therefore provides significant safety benefits.
For some level monitoring technologies, the regulations permit simulating overfill conditions to activate the detector and generate an alarm signal. This simulation eliminates the need for fluid to be moved in and out of the tank to perform the test, avoids the risk of spills, saves a significant amount of time, and increases worker safety and efficiency.
Emerson’s Rosemount HART vibrating fork level detector, for example, can be remotely proof-tested by issuing a HART command. Upon receiving the command, the device then enters test mode. This cycles the output through wet, dry and fault states, then returns into normal operation. The process is continually monitored during this time and any change will be reported immediately on test completion. If the partial proof-test detects an issue, this too is reported on completion of the test. Since the test can be performed in process it can take less than one minute to complete, although the duration is user-programmable in case a longer test is required.
Emerson’s Rosemount 5400 non-contacting radar level transmitter can be remotely proof-tested using dedicated Radar Master software. This enables an operator to perform the proof-test simply by inputting a straightforward sequence of settings and commands from their interface. As with the vibrating fork switch, this remote method of proof-testing brings considerable benefits in terms of reducing risk and errors, saving time, and increasing safety and efficiency.
Guided wave radar (GWR) sensors do not feature overfill simulation technology. However, recognising the benefits that this feature would provide has led to the introduction of an automated high-level alarm testing function for GWR transmitters that does not require the device to be removed from the tank, or the level in the tank to be manually raised, therefore increasing the safety of both plant and workers.
Verification reflector functionality is designed for applications requiring periodic transmitter integrity tests to ensure that the level measurement device is functioning correctly.
Conclusion
New technology within the latest level measurement devices provides plants with the ability to remotely perform proof-testing to prove the safe operation of an SIS. By simulating overfill conditions to activate the detector and generate an alarm signal, remote proof-testing eliminates the need for fluid to be moved in and out of the tank to test level sensors and therefore delivers important benefits. It saves time, significantly reduces the amount of process interruption necessary, reduces the risk of accidental spills, and eliminates the need for workers to climb tanks and be exposed to tank contents, therefore increasing safety.
