2.0. Certification and Proof Testing
Certification and proof testing are two important steps in the safety life cycle process. In the first part, discussions will be on various issues related to certification. In the other part, the discussion will be on proof testing methods and proof test intervals.
2.1. Certification (By Third Party)
Certification is mainly concerned with the reliability of functional safety and associated testing and certification of the product for SIL. Normative standards establish minimum requirements for the design, testing, and performance of these safety devices necessary to maintain protection of personnel, property, and the environment already discussed. These standards provide specifications to address safety and reliability based on means and methods to reduce the risks to as low as reasonably practicable as well as optimizing the process for risks. These are applicable to instrumentation as well as FGS.
2.1.1. Basics Issues Related to Certification
Functional safety demands continue to increase. SIS designers (for end users to comply to IEC 61511) for electrical/electronics/programmable electronics (E/E/PE) prefer to integrate safety certified products (sensors, logic solver, and final element) into their systems and require manufacturers to provide certificates/assessments in regard to IEC 61508. At present almost all markets demand compliance to both functional safety testing and international standards for safety, especially compliance to IEC 61508 and IEC 61511. The IEC 61508 standard establishes the requirements for manufacturers to follow during product development to ensure that developed products offer a high level of resistance to random hardware and “systematic” design failures. Therefore this is extremely important for businesses seeking to expand internationally. Products and systems must possess high standards of safety, reliability, and quality. If products fail to meet functional and other safety requirements on account of faulty design/technical defects/faulty sequence of events/human failure, then the environment, people, and property could be endangered. In the process of third party certification, manufacturers are offered expert opinions to combat such eventualities.
With functional safety testing and certification one can expect to receive a number of financial benefits, for example:
• Compliance with domestic and international standards
• Reduced risk liability with documented safety standards
• Compliance from fulfilling requirements in the standard, hence better technical quality of the product
• The majority of certifying authorities have a global network, so it is possible to use these experts to integrate safety-related products produced at different locations into SIS and applications.
• Benefit from fast audit times and utilization of expert opinion especially in planning, design and testing of the products
• Possibility to challenge competitors on account of authentic third party certification
Compliance is evaluated by a certifying authority, which assesses and certifies that a product has been designed and developed in accordance with the standard. Similar to third party certification and approval, a certifying authority provides benefits [15,16] like:
• Assurances that safety-related products are built with sufficient functional safety to meet the intended SIL.
• Proof that the product meets the requirements of the relevant product standards.
SIL is a qualitative measure of safety and a quantitative measure of the safety level. It is not just the probability of failure. Because of the complexity of today's devices, tests should be carried out parallel to product development. Streamlining development efforts are an important advantage for manufacturers.
2.1.2. Coverage and Documentation for Certification
• Total proposed facility documentation to be presented for documentation assessment. If recommended by a certifying authority, necessary modification/augmentation should be incorporated.
• Product development stages to be assessed
• Assessment of product design and testing process against IEC 61508
• Assessment of business process
• Relevant lessons learned assessment
• Operational safety assessment:
• Technical assessment of product design to ensure requirements of standard are met.
• Depending on applicability, assessment for “proven in use”
• Assessment of failure modes, effects, and diagnostic analysis (FMEDA)
• Assessment of probability of failure on demand (PFD)/probability of failure per hour calculations
• Assessment of validation planning and associated activities
• Assessment of verification activities
• Documentation of complete assessment results
• Final auditing of entire activities
• On successful final audit report, issuance of certificate
Many of the certifying authorities use their own software tools (e.g., Exida's Safety Case tool) for the entire system.
2.1.3. Discussions on Various Points on SIL Certification
International standards IEC 61508 and 61511 do not mention specific requirements for acquiring/issuing SIL certification. Naturally, there remains scope for a variety of interpretations. From the foregoing it is clear that such certifications are issued for SIL ratings. It is therefore suggested to look at the following issues carefully:
• Why is SIL important? From Chapter VIII it is clear that SIL rating corresponds to the PFD for SIF, hence SIS. Also it is clear that the higher the SIL target, the lower the PFD and better the performance of SIS.
• What does SIL rating mean? SIL rating signifies that the entire system, not just an individual product, will reduce the risk to a specific level. Also from the discussions in Chapter VIII, it is clear that SIL rating of the system is dictated by the minimum SIL rating, hence SIL suitability of the individual device is immaterial when SIL rating of the entire system is inadequate.
• Certification: Both products and processes can receive such a certification. Certification for the former is most common and is issued by an independent agency to show that the appropriate SIL calculations have been performed and analysis has been completed on a product. Self-certification, though not common, is also possible. Such certifications are used to signify that it is compatible for use within a system up to the certified SIL. As discussed earlier, FMEDA is normally used to determine the safe/unsafe and detected/undetected failure modes of a product. FMEDA is useful for calculations of safety failure fraction and PFD. Although not common, full certification of IEC 61508 is also possible for manufacturer's design and quality processes.
• Who can issue certificates? According to the standards there are no preferred agencies or companies that have the authority to issue SIL certifications. However, Clauses 8.2.15–8.2.18 along with Tables 4 and 5 of IEC 61508-1:2010 do specify minimum levels of independence of those carrying out a functional safety assessment. It is always better to have a very close look at this part of the standard to understand authority for issuance of the certificates. A variety of consulting firms and agencies provide SIL-related services and in some cases generate certificates. Here the main approach is complying with the functional safety standards. After the standards have been in place for so many years, it is always better to have the product duly certified by independent third party established certifying agencies. During certification, experts will look carefully inside a product's design, safety, and reliability. There will be a thorough audit and after passing the audit, SIL certification will be issued with FMEDA (hardware probabilistic failure analysis based on a huge collection of data) numbers. All these will help in the development of the product. For the self-certified method, it will be prudent to ask for and check a “detailed assessment report,” a document that describes the steps completed to show compliance to IEC 61508. In this regard the blog http://www.exida.com/Blog/Who-certifies-the-certification-agency may be referred to. According to Dr. William Goble “I have yet to see a valid self-certification.” Having said this, one needs to remember and understand that using certified products alone cannot ensure safety of the entire system forever. It is not something that can be bought and applied. Certification can only help in selecting appropriate safe and reliable products for the application. System performance depends on a multitude of factors such as accurate placement, installation, correct maintenance, proof testing, etc. [14]. Now, focus will be on another important issue of proof testing and proof testing interval.
2.2. Proof Testing (With Proof Testing Interval)
With the help of the proof test phase and inspection, results are analyzed to verify that actual performance matches expectations. Demand mode functions need periodic tests to validate their operation and availability. The acceptance criteria for the proof test establish the minimum threshold for successful operation of the SIF. Passing the proof test directly validates the SIF at the time of the test. It is important to remember that some degree of inspection and maintenance is also expected, concurrent with the proof test [19].
The proof test is defined in Clause 3.2.58 of IEC 61511:2003 (see Appendix I). Proof testing is a very important issue pertinent to SIS. The main objective of proof testing is to manipulate the process variable in a simulating mode under various operating conditions, without actually driving the system to the demand condition. This means that the aim is to achieve a full end-to-end test of the system. However, this is a theoretical requirement and practicability is very much dependent on the nature of the process, the process materials, associated risks, and on the tolerable upsets to the process and to production. The effectiveness of SIS proof tests confirms correct operation of sensors and final elements. IEC 61511:2003 Clause 16.3 discusses proof testing and testing intervals. Also in proof testing, good practice guidelines are available in IEC 61508:2010. The major issues covered under proof testing shall include but not be limited to the following:
• Proof testing principles
• Proof testing types and procedures
• Format of proof testing procedures
• Proof test records
• Planning and scheduling
• Competence
• MOC
A typical flow chart describing the proof testing process is shown in Fig. X/2.2-1. Let the discussions begin with proof testing principles followed by types of tests and procedure.
2.2.1. Basic Proof Testing Principles
The basic principles of proof testing are:
• The proof test of an SIS should reflect real operating conditions as accurately as possible. If possible, the SIS will be activated by manipulating process variables without driving the dangerous situation. If at all the process is driven in the demand state, followed by a proper risk assessment, accompanied by additional controls.
• When process variables cannot be safely or reasonably practicably manipulated, then the correct operation of sensors should be attained by other means, such as comparison with other measurements.
• The inherent difficulties associated with testing valves and inline flow meters are addressed during the design phase of SIS with additional means, for example, additional corroborative measurements.
• Proof tests should address the necessary functional safety requirements of SIS, such as response time and valve leakage class.
Figure X/2.2-1 Safety instrumentation system (SIS) proof testing process. PFD, probability of failure on demand; PTI, proof test interval.
• Correct operation of each sensor and final element
• Correct logic action
• Correct alarms and indications
2.2.2. Types of Proof Testing
There are three methods for proof testing, namely, direct testing, other methods, and partial proof testing.
• Direct testing: In direct testing, test equipment is normally used to create specific conditions and then the response of the component is observed. A typically direct test simulation method includes:
• Specific process conditions
• Calibration
• Valve stroking
• Trip condition simulation
• Simulation of electrical signals, etc.
This means that direct testing methods attempt to simulate a situation to reflect real operating conditions as accurately as possible without driving the system to a demand situation. The direct test methods are conducted at the proof test interval assumed in the PFD calculation.
• Other methods: These may be used when direct testing is not possible. Typical other methods include: cross-checking sensor history data against other instruments with the same range coverage, periodic replacement and sampled testing of single-use components, valve overhauls to ensure tight shutoff, etc. These other methods are conducted at the proof test interval assumed in the PFD calculation.
• Partial proof testing: The following are the major issues related to partial proof testing:
• Good practice as per IEC 61511-1:2003 (Clause 11.2.5) requires that testing requirements are considered during the design stage. Therefore for new facilities, testing should be built into the design to facilitate online testing.
• Judgment by a competent person is necessary for implementation of partial proof testing. Such decisions are taken on the basis of the component types, relative costs of periodic maintenance, replacement and overhaul, and the access to the equipment.
• At times it is not possible to reveal all of the undetected failure modes at the proof test interval assumed in the PFD calculation, for example, on account of operational constraints. In such cases, a partial proof testing can be applied as long as the overall integrity requirements of the SIS are met.
• A partial proof testing strategy requires the definition of two or more proof test intervals, as shown in Fig. X/2.2.2-1 [10,23]. Normally, this is defined as a more frequent partial test followed by a less frequent full test (typically to fit in with normal plant shutdown periods).
• For each of the defined proof test intervals, it is necessary to define which failure modes of the components will be tested, and which will not be tested [17].
• The partial proof test details need to be recorded in the proof test procedure. This also is applicable for direct testing and/or other methods.
• Each component has different requirements, so for each component, it is necessary to determine which failure modes are revealed at each of the defined proof test intervals and marry this with the PFD calculation. Therefore partial proof testing requires detailed understanding of the components’ failure modes and their relative failure rates. When the result of the PFD calculation meets the required PFD, then the partial proof testing strategy is valid, otherwise there will be calls for a redesign. All undetected dangerous failure modes must be revealed at some point, otherwise SIS will have a lower than required PFD [17].
• Many modern component manufacturers design and provide test and built-in diagnostic facilities in their devices so that the unrevealed failure modes are insignificant in the expected lifetime. However, a partial test can reveal the reality, especially when the devices are operated beyond their lifetime or there are changes in actual operating conditions (operational constraints). Normally, manufacturers’ safety manuals furnish details about such issues. These need to be read carefully.
• The significance of partial proof testing will be clear from Fig. X/2.2.2-1. From Appendix B2 of IEC 61508-6:2010 one can access the formula for PFD calculations. Assuming MTTR is much smaller than proof test interval, dangerous failure rate λD and proof test interval Ti are directly related with PFDav as per the following equation in its simplest form:
(X/2.2.2-1)
So, for the loop comprising sensor (S), logic solver (LS), and final elements (FEs):
(X/2.2.2-2)
From these equations, it is clear that lower the Ti value, the proportionately lower is the PFDav. This is detailed in Fig. X/2.2.2-1 [courtesy Appendix 3 [20] of the Health and Safety Executive (HSE)]. In this case a full proof test interval is assumed to be 4 years. Also from the figure, it is seen that with proof testing in between, the PFDav value can be kept below the required PFDav. It also shows that in addition to the full proof test interval there are partial test intervals, which means that in partial proof tests there may be more proof test intervals based on devices (for different failures and failure rates).
2.2.3. Basic Proof Test Procedure
The following are major issues related to proof testing:
• Standard: As per IEC 61511-1:2003 standard (Clauses 16.3.1.2 and 16.3.1.4) all components in SIS shall be subject to a proof test and any deficiencies found shall be repaired in a safe and timely manner.
• Purpose: Proof tests are meant to reveal all undetected failure modes that would prevent the SIS operating as per SRS, even if this is completed at different intervals (e.g., partial testing). Proof testing should be designed and developed in a way to reveal any reasonably foreseeable undetected failure mode, that is, unrevealed (dangerous) fault conditions in each of the components (e.g., sensors, logic solvers, and final elements) in each SIF, and in the means of connecting the SIS to the process.
• Human error: The proof test procedures should be designed in such a manner that it would minimize human error. For this, a checklist including tick boxes and cross-checking for critical steps could be helpful. Many structure the tests in a way so that errors that could be introduced are revealed by subsequent test steps [17].
• Overrides: All SIS overrides are subject to strict controls to ensure safe application and timely removal.
• Requirements for partial proof testing: As discussed earlier, for partial testing of SIS, the impact on process operation, functional safety, and overall test coverage must be established with the help of proper assessment and as necessary additional controls need to be deployed without disturbing SIS installation.
• Installations: SIS installations are tested on an as-found basis.
• Inspection: As per IEC 61511-1:2003 (Clause 16.3.2) as part of proof testing each SIS shall be subject to periodic visual inspection, including all components. This is to detect and ensure that there are no unauthorized modifications or deteriorations, etc., for example, missing bolts or instrument covers, rusted brackets, open wires, etc. The level of inspection depends greatly on the site conditions and access controls.
• Responsibility: All SIS components should be subject to appropriate maintenance, usually described by the component manufacturer [17].
• Procedure documents and timings: In an actual case the proof test procedure may not follow a single procedure document, but may be made up of different documents, for example, reference to other procedures. Also it may include procedures for testing different parts of SIS at different times. However, in all such cases, measures should be taken to ensure no failure modes or components are missed. It may include partial test procedures and full test procedures.
• Proof testing process description: For understanding the process, Fig. X/2.2-1 may be referred to. The process starts after calculating the PFD for SIS to meet the requirements of PFDs; if not, then it is to be redesigned. When the PFD calculations meet the requirements then all the failure modes are identified. For each of failure modes pertinent to each SIF in SIS, proof testing and inspections are carried out. As seen in Clause 2.2.2, there are three ways in which proof testing can be carried out. First, a check is made to see if direct testing is possible, which is then recorded. After recording, the test looks for another set of failure modes. When direct testing is not possible, then other means or partial testing are considered. If none of them are possible or valid for partial testing, then it is necessary to redesign the system. Whenever any failure mode, other method, or partial testing is valid and done, then, as discussed earlier, it is recorded and another failure mode is sought. In this way when all failure modes are tested the process is complete and proceeds to the maintenance phase.
2.2.4. Documentations
This is very important because proper record keeping could help in future analysis and resolving future maintenance problems. Also traceable data keeping is helpful in dealing with regulatory authorities. As per IEC 61511-1:2003 Clause 16.3.3 “The user shall maintain records that certify that proof tests and inspections were completed as required.” Minimum data recording shall include but not be limited to:
• Description of the tests and inspections performed including the following:
• Dates
• Name of the person(s)
• Results of the tests and inspection
Based on the foregoing the following are the details of basic data to be recorded:
• Steps undertaken during testing
• Results of steps
• Details of all faults
• Details of corrective actions including:
• Recording of time to repair
• Effectiveness of remedial action
• Test duration (start and end time)
• Details of tester and approving authority:
• Signature
• Date
2.2.5. Planning and Scheduling
Proof test planning is an integral part of safety management planning and it is dictated by the need to maintain the functional safety of the system and should never be compromised with other aspects such as operation/production needs or business policies. As this is very much an object-oriented program, it is justifiable that suitable explanations will be made prior to its adoption.
2.2.6. Competence
All persons concerned with the proof test must be competent to carry out the job. Also the responsibility of each of these persons must be well defined. The approval process of verification and validation cannot be overestimated. So, those who will verify the documented proof test must be experienced as well as experts in this field, so that they can check and verify the adequacy of the tests. Also they must be well aware of what is demonstrated and what the object is.
2.2.7. Discussions
Here, a few pertinent points will be discussed:
• Influencing factors: The following are influencing factors for proof test results:
• Scope and coverage
• Partial testing
• Trip initiations
• Overrides
• Calibration
• Diagnostics
• Diagnostic coverage
• Proof test approaches: Proof tests of “wetted parts” are not always the same. In some cases pressure injection to the main impulse line with isolation and vent valves may be possible, but in a case where there are chances of leakage of energy or fluids, such an approach may not be feasible. So, based on this some of the major approaches are:
There are major testing problems with valves and inline flow meters, for example, the sealing capabilities of valves under operating conditions. Also some processes pose high risks during shutdown and startup and there is a real need for SIS. When proof testing is likely to prove difficult, then the design phase of SIS should seek to provide the specified functions and integrity in a manner that accommodates these difficulties [18]. Use of proven capabilities of smart positioners could be a solution. Inline flow meters present very little scope to apply proof tests. The use of an alternative approach or portable measurements to corroborate inline flow measurements could be considered!
Another important aspect in safety is area classification of the plant based on hazardous situations. We will now focus on this in a separate section.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.