“Unless you go forward then you are going back.” – Greg Lake
Check valves (CVs) are routinely installed as safeguards against reverse flow. Just as routinely, check valves are dismissed as safeguards during process hazard analysis. If check valves are of no value, then there is no point in installing them. On the other hand, if they serve a purpose, then there must be some credit to take during a Process Hazard Analysis (PHA) or Layer of Protection Analysis (LOPA).
Check valves are not absolute protections against reverse flow. They prevent bulk reverse flow but will often allow small amounts to flow by. There are many different designs for check valves, but all rely on mechanisms that open to allow flow in one direction and close to prevent flow in the reverse direction. These mechanisms have the potential to stick open or to be held open by debris. Many of these mechanisms have the potential to corrode or fall out. Given these concerns, it is easy to see how a black-and-white view of safeguards would lead to the conclusion that no credit should be taken for check valves.
Yet, check valves are still installed. Modern risk assessment does not take a black-and-white view but recognizes that everything fails and those failures have a probability that can be calculated. It is this view that allows some credit to be taken for check valves in PHAs and LOPAs, at least when certain conditions are met. Taking this approach, we need to figure out the specific criteria which must be met to satisfy those conditions and then identify the amount of credit to take for check valves when those conditions are met.
CVs in PHAs
As a matter of practice, a PHA should list all existing safeguards against any particular hazard. Check valves are safeguards against the reverse flow, and when they have been installed, they should be listed. How much credit should be taken during the likelihood assessment, however, is a different question.
The PHA team needs to decide if the check valve is an effective safeguard. Is it used in clean service? Is the hazard one of bulk reverse flow? Does the check valve have a history of successful use? These are all indications that the check valve is an effective safeguard, in which case one level of protection can be achieved. On the other hand, does the check valve have a history of not working? If so, it should receive no credit in the PHA likelihood assessment.
CVs in LOPAs
Check valves are almost exclusively used as safeguards, rather than as active design features. The ball checks in double-diaphragm pumps are a notable exception. As a rule, then, check valves are potential independent layers of protections (IPLs) in a LOPA scenario. It is not typical that the failure of a check valve is the cause of a LOPA scenario; the cause of the reverse flow comes from some other failure. A check valve failure is typically a failure to protect, not a cause.
To be counted as an IPL, a check valve must satisfy the three criteria of all IPLs: effectiveness, independence, and auditability.
Effectiveness. To be considered effective, an IPL must be able to prevent the LOPA scenario from occurring in the absence of all other IPLs. When it performs as designed, it should be able to prevent the event in question all by itself. This is also true of check valves that are to be considered IPLs. Specific to check valves, the scenario should not depend on preventing small reverse flows or on the check valve being bubble tight when in the closed position. Rather, the scenario should only involve bulk reverse flow. The scenario should not include the flow of sticky, dirty, or solids-laden fluids through the check valve, any of which could reasonably be expected to prevent the check mechanism from closing. In any case, any check valve that has a history of being unable to prevent backflow should be considered ineffective.
Independence. Generally, an IPL is independent when the failure of another IPL has no impact on its effectiveness, when its failure has no impact on the effectiveness of another IPL, and when its failure is not the cause of the scenario at hand. Single check valves, being isolated mechanical devices, typically have no difficulty satisfying the criterion of “independence”.
Auditability. An IPL can only be considered auditable when there is a means to verify that the IPL is functioning as intended, and verification is actually performed as scheduled. If a check valve is installed but cannot be tested or inspected, it is not auditable. If a check valve is installed so it can be tested and inspected, but there is not an active audit program that periodically tests and inspects the check valve, it does not satisfy this criterion. Furthermore, if the check valve is audited and found to not work as designed, it must be repaired. In the case of a check valve failure, effectiveness should also be considered. If a test and inspection reveal the failure of a check valve, serious thought should be given to whether the check valve can be considered effective. A typical audit frequency for check valves is annual; however, a different frequency may be justified once the test history is developed.
Credit as an IPL
If a check valve meets the three criteria for consideration as an IPL then it is creditable as a measure of risk reduction. In a LOPA, a single check valve as an IPL is given credit as one order of magnitude (RRF = 10, PFD = 0.1).
Often, multiple check valves are installed on the same process pipeline in order to achieve greater risk reduction. There is a limit to the amount of risk reduction that can be achieved with multiple check valves, however. At some point, the problem that causes one check valve to fail will cause all check valves in the pipeline to fail. This introduces the concept of common cause failure, which must be treated with caution. Common cause failure must be taken into account because it directly affects the credit that may be given when using more than one check valve as a means of protection.
Two Check Valves. If there were no common cause failures, the Risk Reduction Factor (RRF) for two check valves would be:
RRF = 10 x 10 = 100,
The Probability of Failure on Demand (PFD) would be:
PFD = 0.1 x 0.1 = 0.01.
However, as much as 10% of all problems that would cause one check valve to fail are of a nature to cause all check valves in that service to fail, especially when they are of the same design. This means that the calculation for the PFD for two check valves would be:
PFD = (0.1 x 90%) x (0.1 x 90%) + (0.1 x 10%) = 0.0181 à 0.01,
Likewise, the RRF would be:
RRF = 1/PFD = 1 / 0.0181 = 55 à 100
When looking at this level of risk reduction, it is still reasonable to consider the risk reduction from a pair check valves in series as two orders of magnitude. So, for LOPA, it is reasonable to take credit for two check valves, especially when they are of different design reduction for redundant check valves with common cause failure.
Three or More Check Valves. Given that two check valves in series are better than a single check valve, does it follow that three check valves in series are better still?
When considering three check valves with no common cause failures, the RRF would be:
RRF = 10 x 10 x 10 = 1,000
The PFD for three check valves in series with no common cause failures would be:
0.1 x 0.1 x 0.1 = 0.001.
Once a 10% common cause failure rate is included, however, the PFD for three check valves gets much worse:
PFD = (0.1 x 90%) x (0.1 x 90%) x (0.1 x 90%) + (0.1 x 10%) = 0.0107 à 0.01 ≠ 0.001,
Likewise, the RRF would be:
RRF = 1/PFD = 1 / 0.0107 = 93 à 100 ≠ 1,000
Clearly, the risk reduction provided by three check valves is still only two orders of magnitude. Moreover, additional check valves do not make it better than two orders of magnitude. Therefore, it is appropriate to take credit for one check valve or two check valves that qualify as IPLs, but no more than two.
Going Forward
Check valves are safeguards that prevent hazardous conditions that result from a reverse bulk flow. They should be acknowledged in PHAs. The amount of credit that should be taken for a check valve in a PHA depends on the service and history of the check valve. In a LOPA, check valves should be evaluated as any other IPL, for effectiveness, independence, and auditability. Assuming that a check valve meets the criteria of an IPL, the credit for a check valve is one order of magnitude. A second check valve can increase the credit to two orders of magnitude, but credit should not be taken for more than two check valves. How does your facility take credit for check valves? Does it ensure that the specific criteria are met so that credit can be taken during PHAs and LOPAs? If it doesn’t, now would be a good time to discuss the approach your facility wants to take with check valves so that everyone is on the same page when the topic arises later during reviews.
Hello Ashtyn,
you make an interesting point in the article above. However, I will still suggest that one should refer API Standard 521, Clause no. 4.4.9.3 which clearly states the guidelines to be followed during design calculations where check valves are used. The failure of check valve not only causes reverse flow but can also lead to over pressurization of the upstream side of the check valve. The scenario requires case-by-case evaluation. I would have been happy if you had referenced the stipulations of API Standard 521 with respect to the point you are trying to make.
In the risk analyses and SIL studies I have reviewed over the last 10 years it has become usual to accept two check valves as a SIL 2 risk reduction meaure provided that they are of different types. I have accepted this provided that the valves are inspected in detail and tested during 3 or 4 year turn round maintenance.
Great article.. as they say, less is more sometimes.
Great article!!
Good summary!
Good article. Cost Benefits Analyses can further qualify requirement for 2 (or 3) NRVs in series.
Nice article. It is true that credit for check valves are not taken and always installed in design stage as a protection for reverse flow!!
Prioritising and classifying the check valves based on its criticality and carrying out periodical inspection will give confidence to take credit as IPL.
What are the common cause failures for the check valves other than the service conditions .
Nicely explained. I have experienced that the maintenance schedule do not include NRV as there are too many NRV’s installed in petrochemical or refining industry. Thus it is really difficult to prove the effectiveness of the NRV.