CASE
STUDY
TESTING THE WHOLE FUNCTION:
PROOF TEST PROCEDURES FOR A POWER GENERATOR
A power generation operator was proof testing its safety instrumented functions diligently, on intervals set by maintenance scheduling, using procedures that tested individual devices rather than the function end to end. Both the intervals and the procedures were rebuilt.
| Challenge | Solution | Result |
|---|---|---|
| Proof test intervals set by maintenance convenience, procedures testing devices not functions. | Intervals derived from SIL requirements, procedures rewritten to test end to end. | Defensible test regime, with the interval each SIL claim depends on restored. |
Project Background
The operator runs generation assets with safety instrumented functions protecting turbines, boilers and auxiliary systems. Its maintenance organization was disciplined: tests were scheduled, performed and recorded, and the completion rate was high. What had never been established was whether the tests being performed were the tests the safety integrity claims depended on. Intervals had been set to align with existing maintenance outages, which is operationally sensible and has no necessary relationship to the interval a SIL calculation assumes. The procedures themselves had been written by instrument technicians, device by device, which is how instrument maintenance is normally organized.
Two separate problems compounded each other. The interval problem was arithmetic: average probability of failure on demand depends directly on the proof test interval, so a function tested every three years when its SIL calculation assumed annual testing does not achieve the claimed integrity, regardless of how well the test is performed. The operator had no calculation establishing what interval each function required, so there was no way to know which tests were adequate.
The procedure problem was subtler and more consequential. Testing a sensor confirms the sensor works. Testing a final element confirms the final element works. Neither confirms that the function works, because the function includes the logic, the interconnections, the trip settings and the response time, and a device-by-device test exercises none of those as a chain. A facility can have a perfect test record on every component of a safety instrumented function and never have tested the function.
There was also a practical constraint familiar to any generator. End-to-end testing of a function that trips a turbine cannot be performed while the unit is generating. Any revised regime had to be achievable within the outage pattern the business actually operates, not an idealized one, or it would be quietly abandoned.
Arista Cyber established the interval each function required, then rebuilt the procedures to test functions end to end, designed around the operator's real outage pattern rather than a theoretical one.
Function and Test Inventory
Established which safety instrumented functions exist, how each is currently tested, and at what interval.
Required Interval Derivation
Determined from the SIL requirement and the installed architecture what proof test interval each function actually requires.
Interval Gap Analysis
Compared required intervals against actual practice and identified every function tested less often than its integrity claim assumes.
Procedure Review
Assessed each existing procedure for what it genuinely demonstrates, distinguishing device tests from end-to-end function tests.
Procedure Rewrite
Rewrote procedures to test each function as a chain, including logic, trip settings and response, with pass criteria stated.
Outage Alignment
Mapped the required test regime onto the operator's actual outage pattern and identified where partial testing techniques could bridge the gap.
Records and Competence
Established what each test must record to serve as evidence, and what competence the person performing it requires.
Each safety instrumented function now has a proof test interval derived from its integrity requirement rather than from maintenance convenience, and a procedure that tests the function end to end with stated pass criteria. The operator can demonstrate not only that testing occurs but that the testing performed supports the integrity claimed.
The interval gap analysis produced an outcome the operator had not anticipated. Not every function needed more frequent testing. Several were being tested more often than their requirement demanded, which consumed outage time and maintenance resource without improving the safety case. Reallocating that effort toward the functions that genuinely needed shorter intervals meant most of the gap closed within the existing resource envelope rather than requiring additional outage time.
The procedure rewrite had a secondary effect worth noting. Writing a test that exercises a function as a chain requires stating what the function is supposed to do, which in several cases nobody had written down. Those gaps fed back into the operator's safety requirements documentation. The records and competence step completed the picture: a test performed correctly but recorded inadequately provides no evidence, and a test performed by someone without the competence to interpret the result provides little assurance. Both are now specified.
Who Should Engage Arista Cyber?
Operators whose proof test intervals were set by maintenance scheduling rather than by integrity requirements, those whose test procedures exercise devices rather than complete functions, and anyone unable to demonstrate that their testing supports the SIL they claim.
What's the Next Step?
Ready to confirm that the testing you perform supports the integrity you claim? Contact Arista Cyber to scope a proof test review.
- Request a proof test interval and procedure review
- Commission SIL verification to establish the intervals your functions require
- Schedule a functional safety lifecycle assessment