Increasing Safety through Remote Proof Testing

  • September 13, 2017
  • Rosemount Inc.
  • Feature
Increasing Safety through Remote Proof Testing
Increasing Safety through Remote Proof Testing

By Teddy Tzegazeab, Product Manager, Rosemount 

Regular proof testing is an essential requirement for safety-instrumented systems (SIS) in liquid level measurement applications, as it ensures that they are operating to the necessary safety-integrity level (SIL). Traditionally, proof testing has been performed with multiple technicians in the field and one in the control room (Figure 1), verifying the safety system reaction. This requires a considerable amount of time and effort, can pose safety risks to workers who need to climb tanks to perform the test, could take the process offline for an extended period and can be prone to errors. However, technological advances in modern smart devices are now enabling proof testing to be performed remotely, making the process much quicker, safer and more efficient.

Figure 1

Why periodic proof testing is necessary

A proof test is a periodic procedure performed to detect dangerous undetected failures in a SIS. Frequency of testing varies across industries and facilities, based on the required SIL and the safety system’s undetected dangerous fail rate. Sometimes testing is performed annually, but often intervals are even longer. Testing frequency directly impacts regulatory compliance and safety calculations, such as SIL. Obtaining a high-quality proof test performed at regular intervals is critical in meeting SIL and regulatory requirements. Devices and systems across the process are involved.


Full and partial proof testing

There are two levels of proof testing: full and partial. A full proof test returns the probability of failure on demand (PFD) average back to or close to the instrument’s original targeted level (Figure 2). A partial proof test brings the PFD average back to a percentage of the original level.

Figure 2

A full proof test can be accomplished in two ways. In the first method, the level in the vessel can be raised to the activation point of the instrument being tested, providing functional proof that it still works. The danger of this approach is that if the instrument is a critical-high or high-high level sensor for overfill prevention, and it does not activate during the test, a spill is likely, which could constitute a safety risk. Operators would also have to fill the tank just to test the instrument, which is probably not practical as well as being potentially unsafe.

The second approach is to remove the instrument from the vessel for testing in a simulated vessel using material from the process. There are several considerations with this method. Firstly, the process may need to be taken offline, which may interrupt the overall production process. There will be manpower required to run the test, and there may also be safety issues with exposing personnel to the process or to the environment. Also, the process material used for the test must be disposed of.

It is important to understand that not all level switches can be tested in this manner. Some technologies such as capacitance rely on the reference to ground geometry inside the vessel. Removing the instrument from the vessel for testing would not represent the installed state and would not be a valid test.

In-process partial proof testing involves the level switch or transmitter being “exercised” to ensure that it has no internal problems and all functions are operating properly. In partial proof testing, the level instrument remains installed, and testing is done through a function test performed either locally, typically via a push button or magnetic test point, or initiated remotely via a command transmitted from the control room.

A partial proof test has reduced diagnostic coverage compared with the full proof test, in that it is limited to exercising the electronics and verifying that there are no faults causing a higher output current than desired, preventing the device driving to low values or issues preventing the device from driving to higher values.Performing a partial proof test can help extend the time interval between full proof tests.


Standards for best practice

The API 2350 standard outlines the minimum requirements for atmospheric bulk liquid storage tanks to comply with modern best practices. Its main purpose is to prevent overfills and improve safety. API 2350 does not compete with other, more generic, safety standards, but is intended to complement them. For process-industry applications, the standard for designing a SIS is IEC 61511. Many companies apply both standards, to create consistency in their approach to safety.

Both standards place high importance on regular proof testing. API 2350 states that all overspill-prevention systems that are required to terminate receipt must be tested annually, while the high-high sensor alarm must be tested semi-annually. Additionally, continuous level sensors should be tested annually, and point level sensors semi-annually.

In many cases, high-level alarm testing in process applications requires the fluid level in the vessel to be raised to the high-level alarm limit. The fluid must be moved in and out of the tank under test, increasing the risk of spills. The process can take up to half a day to complete, which can interrupt normal activities. It would also require supervision, with operators monitoring the tank level. This can pose health and safety risks due to the possibility of exposure to the tank contents. While this may have been an acceptable practice in the past, the latest version of API 2350 does not recommend that the tank level be raised above the maximum working level.


Remote partial proof testing

New technology within the latest non-contacting radar and vibrating-fork level detectors is now enabling operators to undertake partial proof testing remotely. This eliminates the need for workers to climb tanks or be exposed to tank contents, therefore providing significant safety benefits.

For some level monitoring technologies, the regulations permit simulating overfill conditions to activate the detector and generate an alarm signal. This simulation eliminates the need for fluid to be moved in and out of the tank to perform the test. It avoids the risk of spills, saves a significant amount of time and increases worker safety and efficiency.

Emerson’s Rosemount HART vibrating-fork level detector (Figure 3), for example, can be remotely proof tested by issuing a HART command. Upon receiving the command, the device enters test mode which cycles the output through wet, dry and fault states. When finished, it returns to normal operation. The process is continually monitored during this time and any change will be reported immediately on test completion. If the partial proof test detects an issue, this too is reported on completion of the test. Since the test can be performed in-process, it can take less than one minute to complete, although the duration is user-programmable in case a longer test is required.

Figure 3

Emerson’s Rosemount 5400 non-contacting radar level transmitter (Figure 4), can be remotely proof tested using dedicated Radar Master software. This enables an operator to perform the proof test simply by inputting a straightforward sequence of settings and commands from an interface. As with the vibrating-fork switch, this remote method of proof testing brings considerable benefits in terms of reducing risk, errors and time, while increasing safety and efficiency.

Figure 4

Guided-wave radar (GWR) sensors do not feature overfill simulation technology. However, recognizing the benefits this feature provides has led to the introduction of an automated high-level alarm testing function for GWR transmitters that does not require the device to be removed from the tank or the level in the tank to be manually raised. This increases the safety of both plant and workers.

Verification reflector functionality is designed for applications requiring periodic transmitter integrity tests to ensure that the level measurement device is functioning correctly. In addition to meeting the recommendations of API 2350, it reduces the risk of accidental spills, and the high-level alarm testing process can be completed more quickly. It also tests the loop from the device to the DCS as well as the device itself.

Compared with traditional diagnostics, which only monitor the transmitter electronics, the verification reflector can also be used to diagnose problems with the upper parts of the probe inside the tank, such as product accumulation, corrosion monitoring and other process-related conditions.


How verification reflector functionality works

In a GWR installation, the device is mounted on top of the tank or chamber with a probe extending the full depth of the vessel. A low-energy pulse of microwaves is sent down the probe and when it reaches the media surface, a reflection is sent back to the transmitter which measures the time taken for the pulse to reach the media surface and be reflected back. An on-board microprocessor accurately calculates the distance to the media surface using time-of-flight principles.

The verification reflector function uses an adjustable reference reflector fitted to the probe of the guided wave radar at a desired height to generate a unique echo signature. The device constantly tracks the reflector echo to determine if the level is above or below the alarm limit.

A test function built into the device software verifies that the GWR has been correctly configured and is correctly tracking the reflector echo. It also confirms that the alarm loop is working with a high-level alarm being displayed in the control room. This test function can be accessed remotely using software packages, as well as locally using a hand-held device.



New technology within the latest level measurement devices provides plants with the ability to remotely perform proof testing to prove the safe operation of an SIS. By simulating overfill conditions to activate the detector and generate an alarm signal, remote proof testing eliminates the need for fluid to be moved in and out of the tank to test level sensors and therefore delivers important benefits. It saves time and significantly reduces the amount of process interruption necessary. It also reduces the risk of accidental spills, and increases safety by eliminating the need for workers to climb tanks and be exposed to tank contents.

About the Author

Teddy Tzegazeab is product manager for Rosemount Vibrating-Fork Level Switch products based at Rosemount Measurement Ltd. in Slough, UK. Teddy has worked for Rosemount since 2000. He originally joined the company as a design engineer working on Rosemount Ultrasonic Level Transmitters then moved on to work on radar transmitters, flow computers and vibrating-fork level switches.

Learn More

Did you enjoy this great article?

Check out our free e-newsletters to read more great articles..