Prooftesting

Critical instruments assigned a Class 1 include those necessary to avoid a failure which may cause the perils listed above or instruments which fail to inform of upset conditions which may result in perils. Testing of these instrument systems may be mandated by regulatory agencies, in-house technical safety review committees, HAZOP studies, or designated as critical by operations supervisors. All of these shutdown systems and alarms must be prooftested in accordance with a proper schedule. [8]... 

Serious Consequences—Class 2. Equipment or the critical instruments serving equipment whose failure could possibly cause, or fail to warn of upset conditions, uncontrolled releases of dangerous materials, situations that could result in accidental fires and explosions. Furthermore these failures could result in serious conditions involving environmental releases, property or production losses, or other non-life-threatening situations. These particular pieces of equipment, the safety shutdown systems and the alarms that serve this equipment are given a slightly lower priority. However, they are also inspected, tested, or prooftested on a regular schedule, but may be allowed to have some leniency in compliance. 

All of the effort expended in designing plant-safety systems is of little value unless accompanied by an adequate prooftest program and regular maintenance. These safety systems—consisting of such components as safety-relief valves, tank vents, critical alarms, and protective isolation and shutdown devices—do not operate on a continuous basis. Rather, they are only called into service periodically to warn of, or to prevent, conditions that could lead to plant accidents. [8]... 

After all, failure of a standby instrument loop, such as a alarm or safety interlock, will not become evident until a potential hazard is detected. Potential defects developing in these loops must be discovered by periodic prooftesting. 

A prooftest program cannot be left to someone s memory. It must follow a well-structured format to accomplish the essential steps, regardless of the myriad of other activities and distractions that tend to absorb all the supervisors and mechanics time. 

When PPG Lake Charles first initiated its prooftest program, efforts to classify which safety devices were truly critical were not defined specific enough. Hence, the original program allowed too many instruments into the test system which created a top-heavy burden. To prevent this from happening, the following information should be developed for critical loops [8]... 

Figure 10-21 Prooftesting a flammable gas detector in a tank farm.

Figure 10-22 Prooftesting a high-pressure switch on a refrigeration unit.

It takes years to develop and fine-tune a prooftest program. Time is required to identify all of the instrument loops that need to be included, and more time is needed to systematically collect or develop data sheets containing basic operational information for each device or loop. During the development stage, test methods need to be defined, and the appropriate personnel responsible for testing must be identified and trained. Finally, test frequencies must be decided. 

In 1998, the PPG Lake Charles facility has about 3,200 loops in its prooftest program. Over the past 20 years the prooftesting definitions have been revised, refined, rewritten, and revised again. There are still three classes in the prooftest program. 

The Safety Instrumented Systems (SIS) and critical alarms assigned a Class 1 include those that have been mandated as such by state or federal agencies an in-house technical safety review committee HAZOP studies and specific alarms deemed critical by operations supervisors. All of these Safety Instrumented Systems and alarms are on a regular prooftesting schedule. 

At PPG, Class 1 Prooftesting also covers 250 Safety Instrumented System loops in the PSM Safety Systems. A Safety Instrumented System (SIS) is composed of sensors, logic solvers, and final control elements for the purpose of taking the process to a safe state when predetermined conditions are violated. SISs are normally controlled by a PLC with the sole function of monitoring a process to insure operation is maintained within the safe operating envelope. 

These are instrument system loops that are necessary to avoid a failure which could result in nonreportable environmental releases, equipment or production losses, or reduced economic life, plus all other systems and alarms that assist operations that require prooftesting. These alarms and shutdown systems include refrigeration units that have less impact or safety or environmental issues than the Class 2 units, important pump shutdown alarms, low pressure utility alarms (well water, cooling tower water, natural gas, instrument air, nitrogen), and numerous low-pressure lubrication alarms. 

Assigning prooftest frequencies for complex, safety-instrumentation loops requires sound engineering judgment for simple systems. For more complex, interlock systems, the frequency is a function of the tolerable hazard rates. For example, DuPont Sabine River Works (Orange, Texas) reported it had 35,000 instruments in service. Every safety interlock is... 

Test-frequency changes to shorten or lengthen the test cycle at PPG are based upon evaluations of prooftest results, performance of the components in the loop, or changes in equipment or service. When the desired test pass rate (100-percent pass rate for Class 1 loops) is not met, causes of failure are evaluated. If warranted, a corrective action (such as a design change, test frequency change or request for further study) is initiated. 

Prevention Engineer. Any resulting changes are documented and retained five years in the Loss Prevention Engineering Prooftest Change file. 

Many of PPG—Lake Charles control loops and shutdown systems are very complicated and it is difficult to prooftest the systems without interrupting production, unless well-planned methods are developed. In the mid-1990s, the importance class and the availability was used to help specify one of the following four methods of prooftesting. 

This is the more normal test situation. For processes where prooftesting the final trip or control element cannot be made available (such as testing a furnace shutdown system), the maintenance mechanics perform a prooftest as described above (complete loop test) with the exception of testing the final trip or control element. All components in the loop including the final element are visually inspected for physical condition. Maintenance takes test credit for the portion of the loop prooftested. 

In the case where the final element is not tested, Operations performs a functional check of that loops final trip element during the next routine startup or shutdown of the process unit. Operations then takes test credit for the final element prooftest, which is listed separately as their responsibility on the Prooftest Program. 

Operations are also assigned independent prooftests (in addition to the split test above) which are functional trips or visual checks of controls and emergency shutdown systems. 

Six independent groups of technical personnel provide prooftesting services. Prooftesting is performed by electricians, critical-metering mechanics, refrigeration mechanics, analyzer-repair technicians, instrument-maintenance personnel, and chemical process operators. 

Once a loop has been prooftested, the results are entered into the mainframe computer, along with the date tested and the condition found. Many employees have read access to this data on many terminals throughout the complex, but only authorized personnel have... 

Figure 10-25 An instrument mechanic prooftests a critical instrument panel.

Have the alarm listings and safety critical prooftest procedures been... 

Serious Consequences—Class 2. Safety Critical instruments whose failure could either cause, or fail to inform of, serious conditions involving environmental releases, property or production losses, or other non-life-threatening situations. These instruments are given a slightly lower priority, but are also prooftested on a regular schedule. 

Normal Consequences—Class 3- Instrument systems that are used to alert the chemical process operator of a nonhazardous abnormal condition that might otherwise be undetected. The failure to react to one of these alarms may create an off-specification product such as a low temperature alarm on certain distillation columns. These systems are not included in the prooftest program. 

Occasionally, there may be business pressures or maintenance scheduling problems that would encourage the delay of prooftesting of safety critical alarms and shutdown systems. Such situations can also delay of vessel inspections and safety relief valve testing. Some type of variance procedure or review policy should be defined to handle this occasional need. Such a policy ought to require the review of all of the inspection and test records on the specific equipment involved as well as an approval of the superintendent of the area. 

---