Crediting check valves as IPLs? Testing protocol to better understand check valve reliability

Conventional process safety wisdom assumes that check valves are not reliable safeguards. Experience indicates that check valves are prone to failure and that they may fail undetected. Therefore, the conservative assumption is that check valves may be listed in process hazard analyses as safeguards, but they are rarely considered to meet the standards required of an independent protection layer (IPL). Independent protection layers must be effective, independent, and auditable. Although indepen-dence is readily achievable by check valves, confirming and routinely auditing effective-ness is rarely pursued. And maintenance practices for check valves are often insufficient. Little data is available from operating companies regarding failure and leakage rates for different check valve types in various service applications or at various stages of service life. This paper examines a testing protocol that was put in place in 2014 for the purpose of testing check valves in order to apply layer of protection analysis (LOPA) credit to these valves for reverse flow scenarios. In order to understand check valve performance expectations, leakage allowances for new check valves are reviewed. Industry guidance and standards regarding consideration of check valves as safeguards or IPLs are also discussed. The analysis of new valve standards and the assessment of process safety requirements are the basis for establishing the pass/fail thresholds for the tests. The goal of sharing this information is that the discussion will stimulate others to consider the opportunity and the need to set-up similar testing and to begin gathering and sharing a larger body of data on check valve performance in various applications. Accumulation of check valve performance data and sharing of that data should lead to better understanding of check valve performance by type, size, age, and service. Better performance may be achieved where maintenance is improved and where learnings are applied to selection and design. In instances where requirements are met and credit is due, check valves may be credited in PHA and LOPA. 1

Note: API 521 lists check valves as "causes" for overpressure scenarios; however, the discussion regarding reverse flow scenarios is much the same. 3 As such, we list check valves as safeguards in process hazard reviews, but check valves rarely meet the standards required for considering the check valve or check valves in series as an independent protection layer (IPL). Check valves are recognized for having the potential to fail, to fail undetected (ie, latent failure), and to fail suddenly or catastrophically. Check valves are also recognized to operate in severe service because moving parts are present in the flow stream.
However, lack of testing and inspection data remain a primary obstacle to being able to better assess and quantify the actual performance, failure modes, and failure frequencies for check valves.
Although inspection, maintenance, and testing (IMT) are considered essential to assure the performance and reliability of any piece of mechanical equipment, check valves generally do not receive the same attention as other equipment and components. 4 The lack of routine inspection and/or maintenance may in part explain why check valves are considered unreliable. This paper advocates changing the paradigm. Critical check valves need to not only be inspected but also tested for leakage rates in order to assure their reliability. Where defects are found, check valves should be repaired and returned to acceptable condition. That means that the installation configuration must allow for future inspection, maintenance, and testing. Maintenance work must be planned, scheduled, and completed. History on the performance of check valves in various applications, for various types and sizes, and at various stages of their service life will allow for better design and selection of check valves for the particular application. Assuring proper function of check valves may allow for more robust process safety design by sharing the burden of protection across more disparate safeguarding devices and independent protective layers. Understanding the actual performance of check valves allows for attributing appropriate credit, where it is due, and also allows resources to focus attention on hazards that have a larger actual gap between target risk levels and current assessed risk.
While testing check valves is necessary to allow for potential crediting of check valves as independent protection layers (IPLs), inspection programs must also be in place to identify insipient failures. Inspections reveal conditions that are precursors to failures such as mechanical damage, fouling, debris, and looseness that are not yet manifested as leakage. The particular application, hazards, and consequences must be thoroughly understood in order to consider PHA and/or LOPA credit for individual or redundant check valve installations. This paper discusses an example testing protocol that was written and implemented for several new check valves that were installed in an oil and gas processing plant in 2014. In preparation for that testing, standards that define maximum allowable leakage rates for new valves were reviewed. Guidance from industry publications on considering check valves as safeguards or IPLs was also reviewed. The analysis of valve standards and the assessment of process safety requirements were the basis for establishing the pass/fail thresholds. Key take-aways and experiences from the preparation and testing are summarized.

| HISTORY
Early publications of process safety hazard analysis methodology including CCPS LOPA (2001) 5  Inspection and testing protocol including threshold leakage rates must be defined depending on which of the above configurations is applicable. When establishing threshold leakage acceptance rates, it is important to consider the amount of leakage that is deemed tolerable within the particular process system in question. Process equipment rating and capacity, reactivity hazards, relief device capacity (where applicable), upstream rotating equipment impacts, and other factors for a given scenario must be considered. As with all IPLs, each check valve IPL must prevent the consequence of concern.
It is important to note that option 3 references a single IPL that is comprised of a specific PSV or PSV setting and a specific check valve  Refer to Table 1 for a summary of check valve probability of failure guidance based on several references discussed above. This table summarizes potential PHA or LOPA credit that may be given when check valves are maintained, inspected, and tested and considered with regard to special considerations stipulated in the guidance documents. Table 1 also shows discrepancies between guidance documents.  Note: All values assume that appropriate inspection and testing is conducted and that special considerations have be reviewed for the scenario and for the application of the generic probability of failure value given. **See text for discussion of discrepancies.     Recent updates to major standards have resulted in some convergence of leakage limits. Table 3 and Table 4 show maximum allowable valve seat leakage rates for various valve sizes as defined by API 598, 12 MSS SP-61, 14 API 6D, 15 and ISO 5208 13 using consistent units of measure. Table 3 and Table 4 reference tests conducted using liquid and gas, respectively. Manufacturer performance standards for two example manufacturers are also shown. Values shown in Table 3 F I G U R E 1 Overview comparing check and block valve seat leakage allowance, liquid test [12][13][14][15][16] and The assumption of complete failure means that the normal opera-  The word slight in this sentence is misplaced as this assumption for leakage represents the "severe" failure case having "significant"

|
leakage rates. Leakage rates discussed later in this paper in conjunction with testing protocol also support the position that this reverse flowrate assumption represents "severe" rather than "slight" or "normal" leakage of the check valve.
In order to utilize this guidance and credit the entire IPL, both the relief valve(s) and the check valves, must be maintained via company preventative maintenance (PM), inspection, and repair programs. It is important to note that this guidance is provided and is often used in lieu of known quantitatively tested check valve leakage rates, which explains the "conservative" assumptions that are used in API 521 (2014), 3 (2008) 11 for assumed leakage rates. While "severe" leakage assumptions may be considered conservative based on the magnitude of reverse flow allowed by the calculation, data is not available that supports the notion that the failure mode described by the API 521 (2014) 3 "severe" failure is more likely to occur than "complete" failure as described by full loss of internal parts. From this standpoint, using the API 521 (2014) 3 "severe" failure assumption to calculate reverse flow rate may not be prudent without seat leakage testing data and/or failure modes and failure frequency data to support that approach.

| Alternative characterization of seat leakage
An alternative characterization to the three check valve leakage con-  Additionally, isolation requirements must be considered. In order to assure that the leakage measured is going in the direction assumed, such as in reverse across the check valve The testing protocol for dual valves vs the single valve was similar. The primary difference was that having two valves added complexity and steps to the configuration and procedure. Additionally, in this particular configuration, isolation of the location was attempted via double block and bleed rather than using blinds. Because of the number of testing points involved and a desire to minimize cost of additional pressure transmitters (PTs), a tubing manifold and valving was designed, built, and installed that would allow for usage of certain pressure transmitters in more than one testing configuration. However, achieving a successful leak test of this manifold proved difficult.
Successful leak tests were also required of double block and bleed valving to the process. Refer to Figure 4 for a simplified depiction of

| DEFINING MAXIMUM ALLOWABLE SEAT LEAKAGE THRESHOLDS
So what level of leakage is the threshold for "acceptable?" In order to answer this question, the hazard scenario including consequence severity must be understood. The engineer should recognize the concept of process safety time with respect to progression towards the hazardous event. In selecting the threshold for allowable leakage also called maximum allowable leakage rate (MALR), the engineer or other personnel who set up the testing procedure should look at several different points of reference for expected and/or acceptable leakage.
In the sample test procedure described here, Test 1, the following thresholds were identified in the procedure as points of reference. Table 5  The specific technical origin of these API 521 (2014) 3 leakage rate assumptions for "severe" failure is not clear. Current API 521 committee members are only aware that the values were adopted from a member company participating on the committee. It is possible that due to lack of leakage rate data, very high leakage rate assumptions were chosen using an abundance of caution. No data is known that supports the assumption that check valves commonly fail in a manner that results in these high leakage rates. Also, no data is provided that supports the assumption that "severe" failure is more likely than "complete" failure.

Rates shown in
Since little to no data is available for typical "normal" check valve leakage rates, establishing an appropriate initial limit is challenging.
However, as was made clear by defining the various thresholds, a limit well below the "severe" leakage rate referenced in API 521 (2014) 3 and at or near new valve allowable leakage rates is an appropriate limit to assure that the check valve is performing its function as Little data is currently available regarding typical or "normal" leakage rates for check valves that have been in operation. Likewise, little data is available regarding check valve failure modes and frequencies.
This void was a driver for designing and performing these field tests and for writing this paper.
3 Numerical estimates for "normal" leakage rates are not offered by API 521 3,11 or by CCPS IE/IPL. 2 API 521 3,11 indicates it is the responsibility of the user to determine normal leakage rates.

| CONCLUSIONS
Check valves perform an important and often critical function in process equipment. Therefore, check valve performance and reliability should be a foremost concern for operating companies.
Check valve performance and reliability should be managed through maintenance programs that include inspection, testing, and repair of check valves. Check valves have historically not received proper attention in inspection and maintenance programs.