Safety prooftesting

Critical instruments assigned a Class 1 include those necessary to avoid a failure which may cause the perils listed above or instruments which fail to inform of upset conditions which may result in perils. Testing of these instrument systems may be mandated by regulatory agencies, in-house technical safety review committees, HAZOP studies, or designated as critical by operations supervisors. All of these shutdown systems and alarms must be prooftested in accordance with a proper schedule. [8]... 

Serious Consequences—Class 2. Equipment or the critical instruments serving equipment whose failure could possibly cause, or fail to warn of upset conditions, uncontrolled releases of dangerous materials, situations that could result in accidental fires and explosions. Furthermore these failures could result in serious conditions involving environmental releases, property or production losses, or other non-life-threatening situations. These particular pieces of equipment, the safety shutdown systems and the alarms that serve this equipment are given a slightly lower priority. However, they are also inspected, tested, or prooftested on a regular schedule, but may be allowed to have some leniency in compliance. 

All of the effort expended in designing plant-safety systems is of little value unless accompanied by an adequate prooftest program and regular maintenance. These safety systems—consisting of such components as safety-relief valves, tank vents, critical alarms, and protective isolation and shutdown devices—do not operate on a continuous basis. Rather, they are only called into service periodically to warn of, or to prevent, conditions that could lead to plant accidents. [8]... 

After all, failure of a standby instrument loop, such as a alarm or safety interlock, will not become evident until a potential hazard is detected. Potential defects developing in these loops must be discovered by periodic prooftesting. 

When PPG Lake Charles first initiated its prooftest program, efforts to classify which safety devices were truly critical were not defined specific enough. Hence, the original program allowed too many instruments into the test system which created a top-heavy burden. To prevent this from happening, the following information should be developed for critical loops [8]... 

The Safety Instrumented Systems (SIS) and critical alarms assigned a Class 1 include those that have been mandated as such by state or federal agencies an in-house technical safety review committee HAZOP studies and specific alarms deemed critical by operations supervisors. All of these Safety Instrumented Systems and alarms are on a regular prooftesting schedule. 

At PPG, Class 1 Prooftesting also covers 250 Safety Instrumented System loops in the PSM Safety Systems. A Safety Instrumented System (SIS) is composed of sensors, logic solvers, and final control elements for the purpose of taking the process to a safe state when predetermined conditions are violated. SISs are normally controlled by a PLC with the sole function of monitoring a process to insure operation is maintained within the safe operating envelope. 

These are instrument system loops that are necessary to avoid a failure which could result in nonreportable environmental releases, equipment or production losses, or reduced economic life, plus all other systems and alarms that assist operations that require prooftesting. These alarms and shutdown systems include refrigeration units that have less impact or safety or environmental issues than the Class 2 units, important pump shutdown alarms, low pressure utility alarms (well water, cooling tower water, natural gas, instrument air, nitrogen), and numerous low-pressure lubrication alarms. 

Assigning prooftest frequencies for complex, safety-instrumentation loops requires sound engineering judgment for simple systems. For more complex, interlock systems, the frequency is a function of the tolerable hazard rates. For example, DuPont Sabine River Works (Orange, Texas) reported it had 35,000 instruments in service. Every safety interlock is... 

Have the alarm listings and safety critical prooftest procedures been... 

Serious Consequences—Class 2. Safety Critical instruments whose failure could either cause, or fail to inform of, serious conditions involving environmental releases, property or production losses, or other non-life-threatening situations. These instruments are given a slightly lower priority, but are also prooftested on a regular schedule. 

Occasionally, there may be business pressures or maintenance scheduling problems that would encourage the delay of prooftesting of safety critical alarms and shutdown systems. Such situations can also delay of vessel inspections and safety relief valve testing. Some type of variance procedure or review policy should be defined to handle this occasional need. Such a policy ought to require the review of all of the inspection and test records on the specific equipment involved as well as an approval of the superintendent of the area. 

Class 1 safety instrumentation loops include alarms and trips on storage tanks containing flammable or toxic liquids, devices to control high temperature and high pressure on exothermic-reaction vessels, and control mechanisms for low-flow, high-temperature fluids on fired heaters. Other Class 1 instruments include alarms that warn of flame failure on fired heaters, and vapor detectors for emergency valve isolation and sprinkler-system activation. All of these alarms, shutdown valves, and other critical instruments are regularly prooftested on a well-defined schedule. 

Class 2 Safety Critical instruments include alarms or trips on refrigeration systems, rectifiers, cooling towers, kettles, and stills. [71 Normal Consequences—Class 3. Instrument systems that are used to alert the chemical pracess operator of a nonhazardous abnormal condition that might otherwise be undetected. The failure to react to one of these alarms may create an off-spec ificalion product such as a low-temperature alarm on certain distillation columns. These systems are not included in the prooftest program. 

The system is visualized in Figure 3 from which it also becomes clear that the detailed operational rules are crucial in determining the reliability of safety systems. For simplicity we assume here that all failures are non-detected (i.e. must be detected by prooftests). This is by no means evident since especially redundant systems can have quite a high diagnostic coverage, such that most failures may be revealed immediately. 

---