For many operating companies, the most difficult part of complying with safety standards is the testing of final elements, especially emergency block valves.

Traditionally, emergency block valves have been tested at unit turnaround, using a full-stroke test to demonstrate performance. Thirty years ago, turnarounds were every two to three years, but improvements in mechanical reliability and predictive and preventive maintenance programs are extending unit turnarounds to five, six, or more years.

No doubt, extending turnaround periods can yield significant economic returns, but extended turnaround periods also mean emergency block valves are expected to go longer between full functional tests, yet still provide the same level of protection performance. This just isn't possible; thus other means of ensuring safety systems maintain the required risk reduction are needed, partial stroke testing being an example.

Successful implementation of the safety lifecycle model defined in the ANSI/ISA S84.01-1996 and IEC 61508 safety standards hinge on one design constraint—the safety integrity level (SIL). SIL is a numerical benchmark, related to the probability of failure on demand (PFD) and is affected by design robustness, including device integrity, voting, and common cause faults. Also affecting the SIL is diagnostic coverage and testing intervals of partial-stroke testing to supplement full-stroke testing to reduce a block valve's PFD. The amount of reduction is dependent on the valve and its application environment, thus there is a need to accurately determine the impact of the partial-stroke test on PFD (See sidebar PFD calculations are critical).

To overcome the safety system performance degradation of longer testing intervals, many companies are conducting online testing of safety-related valves, but this requires additional facilities, such as full-flow bypasses and possible production impacting procedures, such as reducing production flow rates during testing.

To maintain safe operations, procedures must include a list of the actions to be taken when the valve is in bypass, such as reducing production rates, monitoring defined process variables, or executing a shutdown.

An option to a full-stroke test is a partial-stroke test. The test involves moving the valve a minimum of 15%, to test a portion of valve failure modes, with the remainder of failure modes being tested during a full-stroke test. The main purpose and benefit of partial-stroke testing is to reduce the required full-stroke testing frequency and associated operational impact.

If partial-stroke testing reveals a problem, maintenance is still required. That means installing full-flow bypass facilities or shutting down the process. Since the full-flow bypass is used only during maintenance, and not required for testing, there is no loss of safety integrity.

Three basic types of partial-stroke test equipment exist: mechanical limiting, position control, and solenoid valves. Each type involves different levels of sophistication and risk.

Mechanical limiting involves the installation of a mechanical device, such as a collar, valve jack, or jammer, to limit the degree of valve travel. When mechanical limiting methods are used, the valve is unavailable for process shutdown.

Valve collars are slotted pipes placed around the valve stem of a linear valve. The collar prevents the valve from traveling any farther than the top of the collar. Any reasonably competent fabrication shop can build a valve collar, suitable for test use.

Valve jacks are a screw turned to a set position, thus limiting valve actuator travel. Valve jacks are integral with the valve actuator and usually only available from the original actuator manufacturer.

Mechanical jammers resemble slotted rods designed to limit rotation of rotary valves. Because jammers are integrated into the valve, they must be purchased from the original valve manufacturer. Jammers can often be fitted with a key switch that activates a control room annunciator when the key is used.

Mechanical limiting methods are inexpensive in capital and installation costs but unless fitted with a limit switch, valve movement requires visual verification, and thus can be personnel intensive. Successful implementation and return to normal operational status are completely procedure driven. Where valve collars and jacks are used, bypass notification to the control room is also procedural.

The biggest drawback to mechanical limiting methods is the lack of assurance the valve has been returned to normal operating status. There is no foolproof way to know the jack or jammer has been completely retracted without actuating the valve. Furthermore, unauthorized use of the valve jack or jammer cannot be determined by casual inspection. This means valves can be out of service with no one aware.

Mechanical limiting methods do not add to the normal operating spurious process trip rate. However, there is potential for a spurious process trip during partial-stroke testing. For valve collars, the main cause of spurious trips is an improper installation that permits the collar to "pop off" the stem as the valve begins to move. Jacks and jammers must be placed in service by technicians or mechanics, so procedural mistakes can result in the valve closing completely rather than just partially. This makes mechanical limiting methods only as good as the written procedures and technician/mechanic training.

Position control uses an analog positioner to move the valve to a predetermined setting and is applicable to a variety of valve types. Since most emergency block valves are not installed with a positioner, this method requires installation of additional hardware. Also, positioner operation requires a 4-20 mA analog output, typically not a part of safety instrumented systems (SIS).

Validation of position control testing can be enhanced using smart or intelligent positioners and a HART (Highway Addressable Remote Transmitter) maintenance station that collects test information and generates test documentation.

When position control is used with partial-stroke testing a limit switch, valve position transmitter or visual inspection is required to verify successful completion of the tests.

Some vendors promote the use of the positioner in lieu of a solenoid for valve actuation, however the vent port (Cv) of most positioners is not large enough to accommodate rapid valve closure. Consequently, a separate solenoid valve should be installed between the positioner and the actuator, also ensuring safety protection remains in tact during partial-stroke testing.

Because the positioner can fail and vent air from the valve actuator, the positioner does contribute to the spurious process trip rate during normal operation.

Solenoid valves can be used to conduct partial-stroke testing by pulsing the electrical signal to the emergency valve actuator solenoid. This solution requires additional SIS programming to accommodate an adjustable timed pulsed output to achieve the desired valve travel. When using pulsed solenoid valves, special consideration is required to ensure the emergency valve does not travel too far and cause a spurious process trip. Provision should include the use of a position transmitter or limit switch and voted software logic that forces the solenoid valve to return to the safe position. Depending on plant operational philosophies, the test can be automated to run on a regular frequency or manually initiated.

Since the valve is never bypassed or disabled, it remains available for emergency shutdown during the test. As with all partial-stroke testing methods, a full-flow bypass is required to allow maintenance to be performed without a process shutdown.

Use of redundant solenoids reduces the chance of spurious process trips occurring as a result of a solenoid valve failure during the test.

The three partial-stroke-testing methods discussed provide measurable improvement of the PFD over full-stroke testing alone. Amount of improvement depends on the specification, configuration, and application environment.

Regardless of the method selected, procedures must be written to ensure the block valve is not tripped during testing, the test is properly carried out, incorrect valve performance is documented, and maintenance is performed to return the valve to fully functional status. This means that documentation requirements for the partial-stroke test are the same as for full-stroke test. Since a full-flow bypass is still required for maintenance, facilities and procedures must be in place to ensure restricted use of the bypass.

The main benefit of partial-stroke testing is to reduce full-stroke testing intervals and help ensure SISs meet the demands of extended plant turnaround periods.