A process trip occurs when the safety instrumented system (SIS) places the process in its safe state by commanding an automated valve (Figure 1) or other equipment to its trip state in response to an abnormal process condition. In some cases, a spurious trip occurs because of a valve malfunction. In that case, the valve assembly is tested under real operating conditions, which provides an opportunity to capture valuable valve diagnostic data.
However, such diagnostics data can only be captured when automated valves are fitted with digital valve controllers (DVCs). In this article, we’ll discuss how DVCs can help determine the proof test credit for an automated valve after a process trip.
Process trip
A process trip occurs when the SIS detects an abnormal process condition via sensors such as temperature and pressure, executes the logic and places the process in its safe state by tripping the final elements such as closing an automated valve, stopping a pump, etc. The SIS may communicate with the Basic Process Control System (BPCS) to close a valve downstream of the automated valve as a secondary action.
When a process trip occurs, the main goal is usually to restart the unit or equipment that has been shut down as soon as possible. Plant engineers are busy troubleshooting and correcting problems. Maintenance technicians are busy repairing broken devices. Taking the opportunity to proof test an automated valve will not be a top priority or even an activity under consideration due to the tight schedule after an unplanned shutdown.
Fortunately, if the automated valve is equipped with a DVC, the proof test of the valve can be considered performed with diagnostic data captured by the DVC. Also, a comparison of the diagnostic data with the valve’s baseline can help discover valve deficiencies and degradations that may not show up in a proof test.
Process trips versus proof tests
How can proof test credits be claimed for an automated valve that has failed and caused a process trip? A proof test is a periodic test performed on SIS sensors, logic solvers and final elements — such as automated valves — to discover hidden failures. These failures, if not corrected or removed, may impair the ability of the SIS to take the process to its safe state when an abnormal process condition is detected.
A proof test should be performed as per the proof test interval specified in the Safety Requirement Specifications. This interval is usually determined via an average probability of failure on demand calculation (PFDavg). Some users may choose to proof test based on predetermined intervals, such as proof testing sensors every 24 months and final elements every 48 months instead of relying on the PFDavg calculations.
Automated valve proof tests can be done offline or online. Offline proof tests are usually scheduled during a turnaround, when the process is completely shut down.
Proof testing an automated valve online usually requires a unit or equipment to be shut down, or the valve to be bypassed to prevent a spurious trip, making it inconvenient and costly.
But a proof test can also be accomplished during a process trip.
According to IEC61511-2 Section A.16.3.1.3, “…shutdowns due to actual demand on the SIS during operation may be given credit as proof tests (fully or partial) under given conditions…the next planned proof test may be skipped.”
These conditions are
- The shutdown documents equivalent information as registered during corresponding proof test.
- The shutdown covers all parts of the SIS, and if not, the device or SIS subsystem not activated needs to be tested separately.
- The shutdown occurs within a predetermined maximum time window before the next planned proof test which can then be canceled
When a process trip occurs, about 60% of a Safety Instrumented Function (SIF) proof test can be considered performed. A sample list of activities performed during a proof test, along with those that are performed during a process trip, is shown in Figure 2. Even without an automated valve leak test, data captured by the DVC alone can potentially account for a good amount of proof test coverage for an automated valve.
The exact coverage depends on the design of the automated valve, its DVC and its application. The coverage is estimated based on the valve degradations, the likelihood of their occurrence and the percentage of those degradations that can be detected by a DVC. Fortunately, data acquired by a DVC during a process trip can often be enough to satisfy a major part of the proof test requirements.
If the process trip takes place within a predetermined maximum time window, the end user may choose to leverage the process trip as a proof test by completing steps one through five in Figure 2, which are usually not completed in a process trip. The next scheduled proof test can then be canceled. According to the Norwegian Oil Industry Association, the maximum time window should be the last half of the current proof test interval.
Common causes of valve failure
According to ISA Technical Report 96.05.01, the most likely root causes of automated valve degradations — which can lead to a process trip — include:
- Partial or intermittent sticking of hydraulic or pneumatic system components such as solenoids, pilots, speed controller, etc., due to moisture, debris or alignment issues. This causes a loss of functional margin and makes the valve slow to open or close.
- Binding, galling or other degradation of valve seats or related flow control trim that restricts or resists valve movement.
- Actuator seal degradation caused by compression, wear or looseness that reduces the pressure available to actuate the valve.
- Minor damage to the valve obturator plug, disk or ball caused by system conditions, leakage or debris, including build-up of hydrocarbon products. This causes leakage.
- Complete failure of hydraulic control system components such as solenoids, pilots, speed controller, etc., due to moisture, debris or alignment. The valve will fail to open or close.
All of these conditions can be detected by a Fisher DVC6200SIS digital valve controller (Figure 3).
For example, a valve that is stuck open will exhibit itself as an increase in breakout force. Loss of seat load compared to when the valve assembly was new indicates potential valve leak. The Fisher DVC6200SIS also continuously monitors for internal faults as well as its inputs such as supply pressure. When the DVC6200SIS sees the supply pressure is too low, an alert is generated (Figure 4) so that the end user can take corrective actions.
Other process trip benefits
Diagnostic data captured during a process trip may reveal valve degradations that may not be detected during a proof test. For example, diagnostic data captured during a process trip might indicate a problem with the valve closing completely against the full pressure of the process, which can be an early indication of valve leakage.
The valve stroke time computed by a DVC during a process trip is more accurate under real operating conditions. This results in a more accurate SIF response time (the time from detection of an abnormal condition to final element reaching its trip state), which is compared to the Process Safety Time to ensure the SIF is still meeting its design requirements.
Although automated valves are very reliable, failures identified in a process trip can provide valuable data to prevent future failures. This information can assist with turnaround planning by making sure the needed parts are available before turnaround even begins to potentially shorten the turnaround schedule.
Summary
A process trip can provide the coverage required to delay a valve’s next scheduled proof test, thus saving time and money. Data captured by a DVC can be analyzed to leverage the process trip as a proof test. Even if the end user chooses not to take proof test credits for a process trip, the valve diagnostic data provided by the DVC can help plant personnel make proactive valve maintenance decisions..
