Technical Report

Draft ISA-TR96.05.01-2008

Partial Stroke Testing of Automated Block Valves

Version G

Approved Date

ISA-TR96.05.01-2008 Partial Stroke Testing of Automated Block Valves ISBN: Copyright 2008 by ISA. All rights reserved. Not for resale. Printed in the United States of America. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic mechanical, photocopying, recording, or otherwise), without the prior written permission of the Publisher. ISA 67 Alexander Drive P.O. Box 12277 Research Triangle Park, North Carolina 27709

-3-

ISA-TR96.05.01-2008

Preface
This preface, as well as all footnotes and annexes, is included for information purposes and is not part of ISA-TR96.05.01-2008. This document has been prepared as part of the service of ISA towards a goal of uniformity in the field of instrumentation. To be of real value, this document should not be static but should be subject to periodic review. Toward this end, the Society welcomes all comments and criticisms and asks that they be addressed to the Secretary, Standards and Practices Board; ISA; 67 Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: [email protected]. The ISA Standards and Practices Department is aware of the growing need for attention to the metric system of units in general, and the International System of Units (SI) in particular, in the preparation of instrumentation standards. The Department is further aware of the benefits to USA users of ISA standards of incorporating suitable references to the SI (and the metric system) in their business and professional dealings with other countries. Toward this end, this Department will endeavor to introduce SI-acceptable metric units in all new and revised standards, recommended practices, and technical reports to the greatest extent possible. Standard for Use of the International System of Units (SI): The Modern Metric System, published by the American Society for Testing & Materials as IEEE/ASTM SI 1097, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of ISA to encourage and welcome the participation of all concerned individuals and interests in the development of ISA standards, recommended practices, and technical reports. Participation in the ISA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of ISA, or of any of the standards, recommended practices, and technical reports that ISA develops. CAUTION ISA ADHERES TO THE POLICY OF THE AMERICAN NATIONAL STANDARDS INSTITUTE WITH REGARD TO PATENTS. IF ISA IS INFORMED OF AN EXISTING PATENT THAT IS REQUIRED FOR USE OF THE DOCUMENT, IT WILL REQUIRE THE OWNER OF THE PATENT TO EITHER GRANT A ROYALTY-FREE LICENSE FOR USE OF THE PATENT BY USERS COMPLYING WITH THE DOCUMENT OR A LICENSE ON REASONABLE TERMS AND CONDITIONS THAT ARE FREE FROM UNFAIR DISCRIMINATION. EVEN IF ISA IS UNAWARE OF ANY PATENT COVERING THIS DOCUMENT, THE USER IS CAUTIONED THAT IMPLEMENTATION OF THE DOCUMENT MAY REQUIRE USE OF TECHNIQUES, PROCESSES, OR MATERIALS COVERED BY PATENT RIGHTS. ISA TAKES NO POSITION ON THE EXISTENCE OR VALIDITY OF ANY PATENT RIGHTS THAT MAY BE INVOLVED IN IMPLEMENTING THE DOCUMENT. ISA IS NOT RESPONSIBLE FOR IDENTIFYING ALL PATENTS THAT MAY REQUIRE A LICENSE BEFORE IMPLEMENTATION OF THE DOCUMENT OR FOR INVESTIGATING THE VALIDITY OR SCOPE OF ANY PATENTS BROUGHT TO ITS ATTENTION. THE USER SHOULD CAREFULLY INVESTIGATE RELEVANT PATENTS BEFORE USING THE DOCUMENT FOR THE USERS INTENDED APPLICATION. HOWEVER, ISA ASKS THAT ANYONE REVIEWING THIS DOCUMENT WHO IS AWARE OF ANY PATENTS THAT MAY IMPACT IMPLEMENTATION OF THE DOCUMENT NOTIFY THE ISA STANDARDS AND PRACTICES DEPARTMENT OF THE PATENT AND ITS OWNER. ADDITIONALLY, THE USE OF THIS DOCUMENT MAY INVOLVE HAZARDOUS MATERIALS, OPERATIONS OR EQUIPMENT. THE DOCUMENT CANNOT ANTICIPATE ALL POSSIBLE APPLICATIONS OR ADDRESS ALL POSSIBLE SAFETY ISSUES ASSOCIATED WITH USE IN HAZARDOUS CONDITIONS. THE USER OF THIS DOCUMENT MUST EXERCISE SOUND

ISA-TR96.05.01-2008

-4-

PROFESSIONAL JUDGMENT CONCERNING ITS USE AND APPLICABILITY UNDER THE USERS PARTICULAR CIRCUMSTANCES. THE USER MUST ALSO CONSIDER THE APPLICABILITY OF ANY GOVERNMENTAL REGULATORY LIMITATIONS AND ESTABLISHED SAFETY AND HEALTH PRACTICES BEFORE IMPLEMENTING THIS DOCUMENT. THE USER OF THIS DOCUMENT SHOULD BE AWARE THAT THIS DOCUMENT MAY BE IMPACTED BY ELECTRONIC SECURITY ISSUES. THE COMMITTEE HAS NOT YET ADDRESSED THE POTENTIAL ISSUES IN THIS VERSION. The following people served as members of ISA SP96.05 and contributed to this standard: NAME V. Mezzano, Chair W. Weidman, Managing Director G. Alfieri L. Beckman F. Cain K. Gandhi J. Kosler* L. LaBorde* L. Lengyel R. McEver A. Michelson C. Seethepalli A. Summers* Roger Thake F. Washburn* B. Zachary* ______ * One vote per company. COMPANY Fluor Corporation Worley Parsons Biffi Italia SRL SafePlex Systems, Inc. Flowserve Corporation Kellog Brown & Root Rotork Controls Inc. Rotork Fluid System SafePlex Systems Inc. Consultant Sunbelt Supply Kuwait Oil Company SIS-TECH Solutions LP Midland-ACS Rotork Controls SIS-TECH Solutions LP

The following people served as members of ISA SP96 and contributed to this standard: NAME V. Mezzano, Chair W. Weidman, Managing Director R. Arnold* W. Black G. Blackwell D. Bowman S. Boyle M. Brancaleoni J. Broyles L. Fletcher* S. Gow B. Kornsey C. Lapins D. Lindberg G. Liu S. Loveless T. Matthews* R. Matthis R. McCray R. McEver COMPANY Fluor Corporation Worley Parsons Rotork Controls Inc. Curtiss-Wright Flow Control Corporation Industrial Valve Celanese Canada Inc. Metso Automation USA Inc. Auma Italiana Enbridge Pipelines Inc. Sunbelt Supply Spirax Sarco Inc. Eim Controls Westlock Controls Valmation Syncrude Canada Ltd Puffer-Sweiven Rotork Controls Auma Actuators Inc. SimPro Controls LLC Consultant

-5A. Michelson R. Pape D. Payne P. Plucinski C. Reed D. Reynolds D. Simons W. Stinson R. Vertz F. Washburn* J. Young B. Zachary ______ * One vote per company. Sunbelt Supply Neles-Jamesbury Tyco Valves and Controls New England Controls Koso America Inc. Jordan Controls Inc. J Troy Control Systems BLAC Mueller Steam Specialty Rotork Controls The Dow Chemical Company SIS Tech Solutions

ISA-TR96.05.01-2008

This standard was approved for publication by the ISA Standards and Practices Board on __________ 200_. NAME T. McAvinew, Vice President M. Coppler B. Dumortier D. Dunn W. Holland E. Icayan J. Jamison K. Lindner V. Maggioli A. McCauley G. McFarland R. Reimer N. Sands H. Sasajima T. Schnaare J. Tatera I. Verhappen R. Webb W. Weidman J. Weiss M. Widmeyer M. Zielinski COMPANY Jacobs Engineering Group Ametek Inc. Schneider Electric Aramco Services Company Consultant ACES Inc. Husky Energy Inc. Endress+Hauser Process Solutions AG Feltronics Corporation Chagrin Valley Controls Inc. Emerson Process Mgmt Power & Water Solutions Rockwell Automation E I du Pont Yamatake Corporation Rosemount Inc. Tatera & Associates Inc. MTL Instrument Group Robert C Webb PE Worley Parsons Applied Control Solutions LLC Consultant Emerson Process Management

This page intentionally left blank.

-7-

ISA-TR96.05.01-2008

Contents

Foreword ....................................................................................................................................................... 9 Introduction ................................................................................................................................................. 11 1 2 3 4 5 6 7 7.1 7.2 7.3 7.3.1 7.3.2 8 Scope ................................................................................................................................................. 13 References ......................................................................................................................................... 13 Abbreviations...................................................................................................................................... 13 Definitions........................................................................................................................................... 14 Automated block valve testing............................................................................................................ 15 Partial stroke testing considerations................................................................................................... 16 Partial stroke testing methods ............................................................................................................ 17 Mechanical limiting .................................................................................................................... 18 Position control .......................................................................................................................... 20 Solenoid operated valve ............................................................................................................ 20 Simplex configuration........................................................................................................ 20 2ooN (where N2) Configuration ...................................................................................... 21

Partial stroke testing effect on PFDAVG ................................................................................................ 21

This page intentionally left blank

-9-

ISA-TR96.05.01-2008

Foreword
The information contained in ISA-TR96.05.01-2008 is intended for information purposes only and is not part of the ISA-96 Standard requirements. ISA-TR96.05.01-2008 provides guidance on various criteria to consider when determining whether partial stroke testing would be beneficial and on the different methods used to partial stroke test automated block valves. The users of ISA-TR96.05.01-2008 include owner/operators who use automated block valves in operating environments requiring partial stroke testing to support the block valve mechanical integrity; designers who identify automated block valve applications whose potential failure rate in the operating environment indicates the need for more frequent proof testing than supported by the operability and maintainability requirements; and operations and maintenance personnel who need to understand how partial stroke testing is performed and what it indicates about the mechanical integrity of an automated block valve.

The user of this document should be familiar with the operation of automated block valves and with the quantitative analysis of its average probability of failure on demand (PFDAVG). The quantitative analysis is discussed in ISA-TR84.00.02 (ref. 2.3) and in CCPS/AIChE Guidelines for Safe and Reliable Instrumented Protective Systems (ref. 2.1). THE EXAMPLES OF PARTIAL STROKE TESTING REPRESENT POSSIBLE SYSTEM CONFIGURATIONS AND ARE PROVIDED FOR ILLUSTRATION PURPOSES ONLY. THE DIAGNOSTIC COVERAGE FACTORS ILLUSTRATED SHOULD NOT BE INTERPRETED AS THE ONLY ACCEPTABLE VALUES OR AS RECOMMENDATIONS. THE PERFORMANCE OBTAINED IN ACTUAL APPLICATIONS IS SPECIFIC TO THE OPERATING ENVIRONMENT IN WHICH THE AUTOMATED BLOCK VALVE IS USED. AS SUCH, NO GENERAL RECOMMENDATIONS CAN BE PROVIDED THAT WOULD BE APPLICABLE IN ALL SITUATIONS. THE USER IS CAUTIONED TO CLEARLY UNDERSTAND HOW PARTIAL STROKE TESTING PROVIDES EARLY DETECTION OF VALVE ACTUATION PROBLEMS AND THE SPECIFIC ASSUMPTIONS RELATED TO ANY MANUFACTURERS CLAIMS.

This page intentionally left blank.

- 11 -

ISA-TR96.05.01-2008

Introduction
Significant investments have been made in mechanical reliability and preventive maintenance programs for fixed equipment. These programs yielded significant performance improvements, demonstrating that it was acceptable to run the fixed equipment for longer periods between maintenance intervals (or turnarounds). The improvements have extended the maintenance interval to the point where, in some market sectors, the fixed equipment is no longer the weakest link for reliable process operation. Attention is now shifting to standby devices, such as automated block valves, which operate in a demand mode. Standby devices are used in many critical applications, such as instrumented protective systems, safety instrumented systems, life safety systems, emergency shutdown systems, and fire and gas systems (see ref. 3.1). As critical equipment, reliability is important, since failure may result in significant process impact. A reliable standby device operates as intended when required, does not require frequent repair and maintenance, and does not cause an inadvertent process disruption or shutdown. An important aspect of reliability is the capability to detect device failure, e.g., incipient, degraded, safe and dangerous failures, so that identified failures can be corrected, rendering the standby device in the good as new condition. For automated block valves, complete on-line proof testing is limited in many applications. The extension of fixed equipment maintenance intervals (unit outages) has resulted in reduced off-line proof test opportunities. Yet, the automated block valve must meet the required reliability in the operating environment. Partial stroke testing can be used to identify certain failure modes associated with automated block valves. Partial stroke testing can be performed on-line with a wide variety of equipment and can be executed either manually or automatically. This technical report addresses the applications when partial stroke testing may be useful, the various methods used for partial stroke testing, and the advantages and disadvantages of each technology. Partial stroke testing identifies failure modes associated with the block valve actuator and a limited number of failure modes associated with the valve body or internals (e.g., valve stem damage and stem to valve connection). Rising stem and rotary actuators operate differently, so they have a different distribution of failures across common failure modes and some unique failure modes. Consequently, the percentage of the overall valve failures detected is different for rising stem and rotary actuators. None of the partial stroke testing methods presented in this report detects failures associated with the valve seat, e.g., leak tightness.

This page intentionally left blank.

- 13 -

ISA-TR96.05.01-2008

Scope

1.1 ISA-TR96.05.01-2008 is informative and does not contain any mandatory requirements. 1.2 ISA-TR96.05.01-2008 is limited to automated valves normally operating in either a full open or full closed position. 1.3 The boundary of the automated valve includes the following: a) Limit switches and other monitoring devices b) Air regulation and filtration system c) Actuated valves whose fail position is specified as spring-return fail closed, spring-return fail open, or double acting d) Valve body specified to meet the functional requirements for its application 1.4 ISA-TR96.05.01-2008 does not address automated valves used for regulatory control applications. 1.5 Guidance is provided on the following: a) Identifying when partial stroke testing may be useful b) Various criteria to consider when selecting the partial stroke method, e.g., automated versus manual test execution, spurious trip potential, and on-line maintainability c) The advantages and disadvantages of three basic types of partial stroke test methods: mechanical limiting, positioners, and solenoid operated valves d) The use of diagnostic coverage factors in the performance calculations for an automated block valve being partial stroke tested periodically

References

2.1 Guidelines for Safe and Reliable Instrumented Protective Systems, Center for Chemical Process Safety, American Institute of Chemical Engineers, New York, NY 10017, 2006. 2.2 Offshore Reliability Data, OREDA, 3rd edition, ISBN: 82-14-00438-1, Det Norske Veritas, Veritasveien 1, N-1322 Hvik, Norway, 1997. 2.3 ANSI/ISA-TR84.00.02, Safety Instrumented Systems (SIS) Safety Integrity Level (SIL) Evaluation Techniques, ISA, Research Triangle Park, NC, 2002.

Abbreviations

DC diagnostic coverage ISA Instrumentation, Systems, and Automation Society D dangerous failure rate MTTR mean time to repair

ISA-TR96.05.01-2008

- 14 -

PFDAVG average probability of failure on demand TI Test Interval

Definitions

4.1 bypass: an action taken to override, defeat, disable, or inhibit equipment operation. These actions prevent equipment from operating as required. 4.2 dangerous failure: failure affecting equipment in a system that has the potential to put the system in a fail-to-function state or to cause the process to be put in a hazardous state. 4.3 diagnostic coverage: fractional decrease in the probability of dangerous failure resulting from automated diagnostics that report faults to the operator and take a specified action on fault detection. 4.4 failure: termination of the ability of equipment to function as specified. 4.5 failure mode: a symptom, condition, or effect by which a failure is observed. Failure modes are often divided into three categories: critical, degraded, and incipient. 4.6 failure rate: limit when t goes to 0 of the expected rate at which equipment failures occur in the time interval t to t+t given that no failures have occurred until time t. 4.7 mean time to repair: average time required for equipment to be repaired and returned to normal operation after its failure is detected. 4.8 normal operation: operation of the process within the design envelope. Normal operation includes any planned operational mode, such as steady-state, reduced rates, maintenance, testing, start-up, and shutdown. 4.9 off-line: process equipment is not operational (i.e., shutdown). 4.10 on-line: process equipment is operational (i.e., running, producing product). 4.11 operating environment: where equipment is intended to be used, such as external environmental conditions, process operating conditions, communication robustness, process and system interconnections, and support system quality. 4.12 probability of failure as a function of time (PFD (t)): probability of a device failing such that it cannot respond to a process demand during a specific time period. The average probability of a system failing to respond to a demand in a specified proof test interval is the average probability of failure on demand, (PFDAVG). 4.13 process safety time: time period between a failure occurring in the process or its control system and the occurrence of the hazardous event.

- 15 -

ISA-TR96.05.01-2008

4.14 proof test: a documented test, or series of tests, performed to detect failures in equipment so that, if necessary, the equipment can be restored to its as good as new functionality. This periodic activity validates equipment operation for those functions covered by the specific proof test. 4.15 reliability: related to the probability that the equipment operates according to its specification for a specified period of time under all relevant conditions. 4.16 review: an inspection of the process equipment, drawings, procedures, emergency plans, and/or management systems, etc., usually by an on-site team and usually problem-solving in nature. 4.17 risk: a measure of human injury, environmental damage, or economic loss in terms of the event frequency of occurrence and the severity of the injury, damage or loss. 4.18 safe state: a state of the process where a hazardous event cannot occur. 4.19 spurious trip: refers to a process shutdown, or disruption, due to the spurious operation of a protective function. Other used terms include nuisance trip and false shutdown. 4.20 test interval: time period between two successive proof tests.

Automated block valve testing

In conventional applications, off-line proof testing is used to demonstrate that the block valve can achieve the specified safe state when a process demand occurs. Over the last twenty years, off-line maintenance intervals have become longer, as plant reliability programs have demonstrated that fixed equipment can run longer between maintenance intervals. The requirements for proof testing, however, have remained unchanged. The proof test should demonstrate that the automated block valve can operate as required, such as achieving the safe state position, speed of response, and leak tightness. This technical report does not address testing of valve leak tightness. It addresses the use of manual and automated means of testing the block valves capability to move toward its specified safe state position. Automated means can be implemented to determine whether the block valve is under-stroking (moving too slow) or over-stroking (moving too fast). Block valves can be full stroke tested while the process is on-line by placing the block valve in bypass for the duration of the test. When a bypass line is used, the block valve is not available to operate when required. The test can also be executed without bypass, if a hazard analysis team approves the test. The team should assess the hazards of performing a full stroke test on an in-service block valve and the hazards if the valve does not return to its normal operational state when the test is completed. The test should be conducted according to a written procedure. Verification of test execution should be included in the procedure, as necessary. A full-stroke test of an automated block valve is conducted in a fixed sequence. Work permits may be required for certain applications. Prior to implementing the bypass, the automated block valve assembly and its connections to the process piping should be examined externally, noting any damage or leakage. The pneumatic source should be examined from the connection to the valve actuator to the air exhaust. For example, inspect the instrument air tubing, air filter, and solenoid operated valve vent port. Electrical connections to the equipment should also be examined and any identified deviation from acceptable installation practice should be corrected.

ISA-TR96.05.01-2008

- 16 -

If visual inspection does not reveal any problems that would make the test potentially unsafe, the fullstroke test is executed. The speed of response is important in many applications, since the automated block valve is a major contributor to overall system response time. A valve may not meet the process safety time or operability requirements if it closes (or opens) too slowly when required. The overall system response time should be less than one-half the process safety time for critical applications. When a valve is over-stroking or under-stroking, this may indicate a progressive problem, which may worsen with time. Preventive maintenance activities are necessary to return the automated block valve to the good as new condition. If leak tightness is critical, the proof test should include a leak tightness test whose interval is determined by historical performance and risk-based decision processes. At the conclusion of maintenance activities, operations personnel should confirm that the equipment is placed back in service.

Partial stroke testing considerations

A partial stroke test is a confirmed movement of a block valve from the normal operating state toward the designated safe state. Partial stroke testing can be used to provide early detection of specific automated block valve failure modes. The required degree of movement depends on the block valve type and operating environment. Any component used to conduct the partial stroke test should be specified appropriately for the environmental and operating conditions. Each application should be assessed to ensure that the act of partial stroke testing does not cause a process hazard. The assessment should consider the acceptability of the expected pressure drop or reduction in flow during the test. Precaution should be taken in performing tests under extreme cold ambient temperatures. A partial stroke test demonstrates that the actuator can move the block valve toward the designated safe state. For fail-closed applications, the test does not validate that the block valve will seat or that it is leak tight. If the partial stroke test uses the solenoid operated valve to actuate the block valve, the test also demonstrates the operation of the solenoid operated valve. Regardless of the chosen partial stroke test method, a proof test should be conducted at an interval appropriate to detect incipient and degraded conditions, as well as to detect failures of the automated block valve that are not detected by the partial stroke test. Figure 1 provides a decision flowchart to assist users in identification of block valves as candidates for partial stroke testing. The decision to implement partial stroke testing should consider five primary factors. a) Window of opportunity to test: The process requirements determine the availability of off-line proof test opportunities. If the window of opportunity for full stroke testing is greater than one year, partial stroke testing should be considered. b) Spurious trip potential: When choosing the partial stroke test method, spurious trip prevention is often very important. After all, if an on-line full stroke test was tolerable, the installation would not incorporate partial stroke testing. The process impact of spurious block valve closure should be examined. The installation of partial stroke test facilities may increase the potential for spurious block valve closure, and some partial stroke testing apparatus are more susceptible to safe failures than others. Spurious action may cause process upsets and process hazards, as well as lost production. c) Maintainability: On-line repair capability is typically desirable for partial stroke test. Some partial stroke test equipment requires that the block valve be taken to the safe state for equipment repair. d) User approved equipment: The equipment should be approved by the owner/operator for the application. Partial stroke test facilities should be subjected to analysis and testing and should have demonstrated history in the process sector. e) Alternate means to achieve requirements: Consider using planned outages or unexpected process shutdowns as opportunities for testing prior to process equipment start-up.

- 17 -

ISA-TR96.05.01-2008

Figure 1 Partial stroke test decision flowchart

ISA-TR96.05.01-2008

- 18 -

Partial stroke testing methods

There are three basic methods for partial-stroke testing: mechanical limiting, position control, and solenoid operated valves. Each method involves varying risk, sophistication and complexity, spurious trip potential, and maintainability. Table 1 provides an overview of the three methods. 7.1 Mechanical limiting

Mechanical limiting methods involve the installation of a mechanical device to limit the degree of valve travel. When mechanical limiting methods are used, the valve is not available for process shutdown during the partial stroke test. The mechanical devices used for partial stroke testing include the use of a valve collar, valve jack, mechanical jammer,or mechanical stop integral to the actuator. Valve collars are slotted pipes that are placed around the valve stem of a rising stem valve. The collar prevents the valve from traveling any farther than the top of the collar. Most fabrication shops can build a valve collar, suitable for test use. Valve collars are normally used for rising stem valves A valve jack or hand jack is a screw that is turned until it reaches a set position. This device limits the actuator movement to the screw set position. The valve jack is ordered from the actuator manufacturer when the actuator is purchased. Valve jacks work with both rising stem and rotary valves. Mechanical jammers are integrated into the rotary valve design. They limit valve rotation when placed in position using a key. A contact can be used to provide indication that the jammer is in the test position. Mechanical stops integral to the actuator limit actuator movement beyond a certain point and include the use of rods, pins, screws, etc. Successful test implementation and return of the block valve to normal operational status is reliant on procedures and verification. A limit switch or visual inspection is used to confirm block valve movement. During the test, the valve is unavailable, so there is a loss of protection during the test. For valve collars and jacks, operator notification that the block valve is unavailable is procedural, so effective communication between operations and maintenance personnel is important. For the jammer, a contact should be provided to initiate an alarm when the key is turned to the test state. Operating procedures should address any actions expected from the operator to support the test. The design of the valve collar should take into account the force that will be placed on the valve stuffing box of the rising stem valve (e.g., globe valve) when the valve is partially stroked. When the test is conducted the valve movement is stopped because the stuffing box hits the collar. This force can damage the stuffing box. Therefore, it is recommended that the valve collar be installed such that it does not hit the packing retaining components or equipment. If the valve collar is not properly installed, the collar may pop off the stem when the actuator applies force to the collar.. This may allow the valve to close, which may cause a spurious trip. The valve collar also creates a potential personnel hazard due to pinching or impact. These methods do not increase the spurious trip potential during normal operation but do increase its potential during the partial-stroke test. For valve collars, the main culprit of spurious trips is popping off of the valve collar. The use of jacks and jammers can cause the valve to move suddenly and violently. Jacks and jammers must be placed in service by the technician; so procedural mistakes can result in the valve closing completely rather than just partially. Therefore, the reliability of these methods is dependent on procedures, training, and proper design specifications.

- 19 -

ISA-TR96.05.01-2008

Table 1 Partial stroke test method summary

Test Method Sophistication Risk Spurious Trip Potential Susceptible to human error during test. Maintenance

Mechanical limiting.

Manual. Local initiation.

Cannot operate during test and is susceptible to undetectable human error.

Low maintenance, mechanical device. For the valve collars and valve jacks no online maintenance provisions are necessary. For valve collars, there is a potential that the valve could be damaged by the test. For the jammer, removal of the valve actuator may be required for maintenance repair/replacement.

Risk of actuator damage and personnel hazards due to pinching or impact.

Position control.

Manual and/or automated. Remote and/or local initiation.

Can operate during the test if system is not bypassed for test.

Susceptible to single failure(s) during normal operation or test.

For installation of the positioner only, the maintenance requirements should not be greater than expected from typical installations. When used in conjunction with a solenoid operated valve, there is an increase in the maintenance requirements. Facilities are generally not supplied to allow online replacement or repair of components.

Solenoid Operated Valves Simplex. Manual and/or automated. Remote and/or local initiation. Can operate during the test if system is not bypassed for test. Susceptible to single failure during normal operation or test Maintenance requirements should not be greater than expected from the typical single solenoid operated valve installations. Facilities are generally not supplied to allow online replacement or repair of components. 2ooN (2-out-of-N devices, N2) Manual and/or automated. Remote and/or local initiation. Can operate during the test if system is not bypassed for test. Not susceptible to single failures during normal operation or test Maintenance requirements should not be greater than expected from the typical redundant solenoid operated valve installations. Facilities are generally installed to allow online replacement or repair of components.

ISA-TR96.05.01-2008 7.2 Position control

- 20 -

Position control uses an electro-pneumatic or electro-hydraulic positioner to move the valve to a predetermined point. This method can be used on rising stem and rotary valves. A limit switch, position transmitter, or positioner equipped with position feedback can be used to verify the partial stroke test. Positioners are available that incorporate partial stroke test capability and test feedback. The test can be conducted automatically according to a fixed schedule or based on manual initiation. These positioners use line monitors or similar equipment to communicate diagnostic information to maintenance systems. Line monitors increase the spurious trip potential during normal operation and cannot be repaired on-line. In general, positioners are integral to the valve and therefore cannot be repaired on-line. Full-flow bypasses are often provided around control valves for this purpose. If full-flow bypasses are not provided, positioner repair may require process shutdown. Positioner vent ports are designed with a Cv that provides good performance in control applications operating over a tight range. The Cv is typically too small for the speed of response required for automated block valve applications. A solenoid operated valve is typically required to achieve the specified speed of response. In special applications, volume boosters or quick exhausts may be required to ensure very fast speed of response. In most applications, a solenoid operated valve is sufficient to achieve the response time. When the partial stroke test is executed using a positioner, the solenoid operated valve is not tested. 7.3 Solenoid operated valve

A partial-stroke test can be accomplished by pulsing a solenoid operated valve. The solenoid operated valve can be the same as the one used for valve actuation, resulting in a lower capital and installation costs for this method than other methods. If the actuation solenoid operated valve is used, this method will also test the solenoid operated valve. Solenoid operated valves are available as packaged systems that incorporate partial stroke capability and test feedback. The test can be conducted automatically according to a fixed schedule or based on manual initiation. 7.3.1 Simplex configuration

For many years, oil and gas production operators in the US coastal waters have used a single solenoid operated valve to partially move emergency block valves. The test was conducted by an operator who turned a field-mounted switch, which de-energized the solenoid coil for as long as the field operator holds the switch. The field operator monitors the block valve position and releases the button when the operator confirms block valve movement. When the block valve moves, it can be inferred that the solenoid operated valve successfully vented. Of course, the main risk is that the operator may hold the switch too long, allowing the block valve to close sufficiently to disrupt the process, resulting in unit shutdown. It is also possible to automate the test using a pulse timer adjusted to achieve the desired valve travel. Valve travel confirmation is accomplished using a limit switch or position transmitter, allowing automated test documentation. Since a failure of the solenoid operated valve or block valve may result in excessive block valve travel, the pulse timer should be voted with the limit switch or position transmitter. If the valve reaches its desired travel point before the pulse timer is finished, the solenoid operated valve is reset. For diagnostics, over-stroke or under-stroke alarms can be configured to let maintenance know if the valve is moving too quickly or too slowly during the test. When a simplex solenoid operated valve is being used to partial stroke test the block valve, the solenoid is de-energized and then re-energized. If the solenoid operated valve does not reset, the test becomes a trip.

- 21 7.3.2 2ooN (where N2) Configuration

ISA-TR96.05.01-2008

The partial stroke test is executed as discussed in 7.3.1, including the execution of the pulse timer test for over-stroke and under-stroke. The spurious trip potential is reduced when the solenoid operated valves are configured in a fault tolerant against spurious failure subsystem, such as 2oo2, 2oo3, and 2oo4. These configurations reduce the potential for a spurious trip during the partial stroke test. In many market sectors, the cost of a spurious trip is sufficiently high to justify the additional capital and installation costs. Although 2ooN configurations are often implemented to avoid spurious trips, they increase the potential for the subsystem to not operate as required. When 2ooN configurations are implemented an evaluation should be performed to determine that the reliability and availability requirements for the block valve are met. 2ooN configurations are acceptable for automated block valve applications, as long as the inspection, preventive maintenance, and proof test practices are sufficient to detect and correct failures. Further improvements can be gained by implementing fault tolerant outputs, for example, two block valves in series with dedicated 2ooN solenoid operated valve configurations.

Partial stroke testing effect on PFDAVG

A proof test can be divided into series of tests conducted at different test intervals. All tests should be executed during validation. A partial test reduces the predicted PFDAVG by the degree of test coverage. The effect of partial testing on the PFDAVG is illustrated in Figure 2.

Figure 2 Effect of partial testing on PFDAVG (see ref. 2.1)

The valve failures are modeled in two parts: 1) those failures detectable by the partial stroke test (PST) and 2) those failures detectable only by full stroke test (FST). A diagnostic coverage model is used to calculate the average probability of failure on demand (PFDAVG). The model consists of three parts (see ref 2.1): 1) The fraction of failures detected by the partial stroke is estimated by multiplying the dangerous failure rate, D, by the diagnostic coverage (DC). 2) The fraction that is not detected by partial stroke, 1-DC, is identified during a full proof test, which demonstrates that the valve operates as specified, including the required safe state action, speed of response, and leak tightness.

ISA-TR96.05.01-2008

- 22 -

3) The block valve is unavailable when it requires repair and this unavailability is estimated by multiplying the dangerous failure rate by the mean time to repair (MTTR). Two test intervals are thus considered in the analysis: the test interval associated with the PST, TIPST, and the test interval associated with the FST, TIFST. The overall equation can be shown, as follows (see ref. 2.1): PFDAVG = DC * D * TIPST/2 + (1-DC) * D * TIFST/2 + D * MTTR The percentage of failures detectable by partial stroke should consider the following issues: Partial stroke tests using mechanical limiting devices demonstrate the actuator is capable of moving the automated block valve toward the defined safe state Partial stroke tests using position control or solenoid operated valves demonstrate the actuator is capable of moving the automated block valve toward the defined safe state and also identify a limited number of failures in the valve assembly (e.g., valve stem damage and stem-to-valve connection) Neither a full-stroke or partial-stroke test demonstrates leak tightness. If tight shut-off is required to achieve the safe state of the process, leak tightness tests should be conducted according to a riskbased inspection program (1)

Table 2 provides examples of block valve failures and the failure modes experienced when these failures occur. It also identifies the types of tests that can detect the failure modes. These are examples and do not reflect all possible failure modes for actuator and valve types. The percentage for each failure mode varies with actuator type, e.g., rising stem type versus rotary type actuators. The failure modes listed in Table 2 can be compared to the failure mode distributions presented in the Offshore Reliability Data Handbook (OREDA) for various valve types and sizes. The distribution of failures is strongly influenced by process conditions, maintenance strategies, equipment selection, and partial stroke test method. For example, in one process application, a partial stroke test may detect 80% of the failures exhibited by the valve during a specified time period. In this application, the valve failure rate distribution tends toward actuator rather than valve seat problems. A similar partial stroke test may detect only 60% of valve failures in another application because the valve failure rate distribution tends toward valve seat rather than actuator problems. Failure mode distributions should be examined for various valve types, operating environments and leak tightness requirements. If the service is erosive, corrosive, or plugging, the failure rate and failure mode distributions will be different from those shown presented in this technical report. If the valve is specified as tight-shutoff, the contribution of minor seat deformation or scarring to the potential valve failure to operate may be significant. End-user analysis indicates that the percentage detected by a partial-stroke test varies over a wide range. Consequently, users should verify the diagnostic coverage assumption against their own experience with valve failure in the intended application. OREDA data (ref. 3.2 pages 435 through 453) generally indicates that the percentage of the failures detected by a partial-stroke test is between 60 - 85%. The remaining 15 - 40% of the failures must be detectable by a proof test, which demonstrates that the valve operates as specified. This proof test may include speed of response and leak tightness tests, as necessary.

- 23 -

ISA-TR96.05.01-2008

Table 2 Examples of failure modes, effects, and test strategy

Causes Actuator torque/thrust is insufficient to move valve under abnormal operating conditions Actuator spring failure Failure Modes Fails to close Fails to open Fails to close Fails to open Air line to actuator blocked Fails to close Fails to open Actuator failure (diaphragm or seals) Seized packing Fails spuriously Fails to close Fails to open Valve stem sticks or fails Fails to close Fails to open Valve packing is tight Responds too slowly Partial or full-stroke Speed of response test Air line to actuator crimped Responds too slowly Partial or full-stroke Inspection Speed of response test Seat scarred Seat contains debris Seat plugged with deposition or polymerization Valve body fails Leak tightness Leak tightness Leak tightness Leaks externally Full-stroke test with leak test Full-stroke test with leak test Full-stroke test with leak test Risk based inspection Partial or full-stroke Failure detected through spurious operation Partial or full-stroke Partial or full-stroke Test Strategy Specification error, which is identified and corrected through periodic review of the valve specification. Partial or full-stroke

The benefits of partial-stroke testing should be carefully evaluated when the operating environment has a history of causing partial-to-complete valve failure due to seat problems (e.g., erosion, corrosion or pluggage). In these applications and others, the use of partial stroke testing itself may affect the valve failure modes. For example, in rising stem valves, the process of moving the block valve a small amount may result in the formation of a ridge of material at the point on the stem where the partial valve movement stops. This ridge can be sufficient to stop the valve movement when full stroke is required. This effect can be aggravated by normal maintenance activities. When leakage is detected due to the worn area of the stem, maintenance may tighten the packing. The valve is then tight around the worn area of the stem and the ridge becomes very difficult to overcome. Partial stroke testing can also have a preventive maintenance effect, since the movement lubricates the valve. The periodic movement of the valve can improve the performance of its mechanical components. As an example of how the diagnostic coverage affects the device PFDAVG, a 70% diagnostic coverage factor can be substituted into equation (1): PFDAVG = 0.7D * TIPST/2 + 0.3D * TIFST/2 + D * MTTR (2)

ISA-TR96.05.01-2008

- 24 -

Using a dangerous failure rate of 3.03E-06 per hour (see ref. 2.2, page 444), Figure 3 illustrates the PFDAVG when the partial stroke test procedure requires bypassing of valve during the test. Table 3 summarizes the data used to develop this figure. As expected, the partial-stroke testing does improve the PFDAVG. However, when a bypass is implemented during testing, the valve is unavailable, and the PFDAVG is increased by the percentage of time interval spent in bypass. The effect becomes significant when more frequent partial stroke testing (e.g., shorter test interval) is conducted under bypass. The calculation assumes that the total test time is 30 minutes. If the actual test time is longer, the effect will be more pronounced. Figure 4 illustrates the PFDAVG when the test procedure allows the valve to remain in service during the test. Table 4 summarizes the data used to create this figure. Very frequent partialstroke tests yield a lower predicted PFDAVG, when the valve is not bypassed during the test.
3.50E-02 CALCULATION ASSUMES 70% OF VALVE FAILURES ARE DETECTED DURING A PARTIAL STROKE TEST. 3.00E-02 Predicted Average Probability of Failure on Demand THE VALVE IS UNAVAILABLE FOR OPERATION DURING THE PARTIAL STROKE.

2.50E-02

2.00E-02

1.50E-02

6 mo FST 1 yr FST 2 yr FST 3 yr FST 4 yr FST 5 yr FST

1.00E-02

5.00E-03

0.00E+00 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 Partial Stroke Test Interval (hrs)

Figure 3 Relationship between partial stroke test interval and PFDAVG - valve is unavailable during the test

- 25 -

ISA-TR96.05.01-2008

Table 3 Average probability of failure on demand as a function of partial stroke test interval and full stroke test interval when valve is not available during the test
PARTIAL STROKE TEST INTERVAL (HOURS) 168 336 730 1460 2190 4380 8760 4380 5.36E-03 4.05E-03 3.67E-03 4.10E-03 4.76E-03 6.85E-03 8760 7.35E-03 6.04E-03 5.66E-03 6.09E-03 6.75E-03 8.96E-03 1.35E-02 FULL STROKE TEST INTERVAL (HOURS) 17520 1.13E-02 1.00E-02 9.64E-03 1.01E-02 1.07E-02 1.29E-02 1.75E-02 26280 1.53E-02 1.40E-02 1.36E-02 1.41E-02 1.47E-02 1.69E-02 2.15E-02 35040 1.93E-02 1.80E-02 1.76E-02 1.80E-02 1.87E-02 2.09E-02 2.55E-02 43800 2.33E-02 2.20E-02 2.16E-02 2.20E-02 2.27E-02 2.49E-02 2.95E-02

3.50E-02 CALCULATION ASSUMES 70% OF VALVE FAILURES ARE DETECTED DURING A PARTIAL STROKE TEST. 3.00E-02 Predicted Average Probability of Failure on Demand THE VALVE IS AVAILABLE FOR OPERATION DURING THE PARTIAL STROKE.

2.50E-02

2.00E-02

1.50E-02

6 mo FST 1 yr FST 2 yr FST 3 yr FST 4 yr FST 5 yr FST

1.00E-02

5.00E-03

0.00E+00 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 Partial Stroke Test Interval (hrs)

Figure 4 Relationship between partial stroke test interval and PFDAVG - valve is available during the test

ISA-TR96.05.01-2008

- 26 -

Table 4 Average probability of failure on demand as a function of partial stroke test interval and full stroke test interval when valve is available during the test
PARTIAL STROKE TEST INTERVAL (HOURS) 168 336 730 1460 2190 4380 8760 4380 2.39E-03 2.56E-03 2.98E-03 3.76E-03 4.53E-03 6.85E-03 8760 4.38E-03 4.56E-03 4.97E-03 5.75E-03 6.52E-03 8.84E-03 1.35E-02 FULL STROKE TEST INTERVAL (HOURS) 17520 8.36E-03 8.54E-03 8.95E-03 9.73E-03 1.05E-02 1.28E-02 1.75E-02 26280 1.23E-02 1.25E-02 1.29E-02 1.37E-02 1.45E-02 1.68E-02 2.15E-02 35040 1.63E-02 1.65E-02 1.69E-02 1.77E-02 1.85E-02 2.08E-02 2.54E-02 43800 2.03E-02 2.05E-02 2.09E-02 2.17E-02 2.24E-02 2.48E-02 2.94E-02

For both test procedures, partial-stroke testing yields a lower predicted PFDAVG. For example, 5-year fullstroke test achieves a PFDAVG of 6.66E-02. A 5-year full-stroke test supplemented with a 1-month (730 hours) partial stroke test can achieve a predicted PFDAVG of 2.09E-02, which is an approximately 69% reduction in the predicted PFDAVG, when the valve is available during test. However, based on this analysis, the automated block valve PFDAVG remains greater than 0.02, regardless of the partial stroke test interval, when the full-stroke test interval is 5 years or more. In the cases of 1-year (8,760 hours) and 2-year (17,520 hours) full-stroke testing, a single block valve can achieve a predicted PFDAVG less than 0.01 when supplemented with frequent partial-stroke tests. Again, it is cautioned that these trends indicate predicted changes in the PFDAVG. A particular application may have a different failure mode, failure distribution, and failure rate. No matter what the predictive calculations indicate, the valve must undergo sufficient inspection, preventive maintenance, and proof testing to meet the owner/operator expectations in the operating environment.

Developing and promulgating sound consensus standards, recommended practices, and technical reports is one of ISAs primary goals. To achieve this goal the Standards and Practices Department relies on the technical expertise and efforts of volunteer committee members, chairmen and reviewers. ISA is an American National Standards Institute (ANSI) accredited organization. ISA administers United States Technical Advisory Groups (USTAGs) and provides secretariat support for International Electrotechnical Commission (IEC) and International Organization for Standardization (ISO) committees that develop process measurement and control standards. To obtain additional information on the Societys standards program, please write: ISA Attn: Standards Department 67 Alexander Drive P.O. Box 12277 Research Triangle Park, NC 27709 ISBN: