FUNCTIONAL SAFETY SERVICES
PROOF TEST
PROCEDURES
Maintain the safety performance your system was designed to deliver. Develop proof test procedures that confirm every Safety Instrumented Function remains capable of performing on demand throughout its operating life.
A Safety Instrumented System achieves its SIL target at the point of commissioning based on a set of assumptions: the failure rates of its components, the architecture of its design, and critically, the interval and coverage of proof tests conducted during operation. Remove or weaken the proof testing regime, and the SIL target the system was designed and verified to achieve begins to degrade from the moment it enters service.
This is not a theoretical concern. IEC 61511 defines proof testing as a mandatory operating requirement, not a maintenance preference. The SIL verification calculations that demonstrate a safety function achieves its required PFDavg are built on an assumed proof test interval and an assumed proof test coverage. If the proof tests carried out in the field do not match those assumptions, the system is no longer demonstrably meeting its SIL target, regardless of what the design documentation says.
The problem is compounded by a gap that exists in many functional safety programs: the proof test procedures delivered at commissioning are either absent, incomplete, or written at a level of generality that does not give operations and maintenance teams enough guidance to execute tests with the coverage the SIL calculations assumed. The result is testing that is time-consuming, inconsistent between test cycles, and unable to detect the dangerous undetected failures it was designed to surface.
We develop proof test procedures that close that gap. Structured, specific, and aligned to the SIL verification assumptions that underpin the safety case, our procedures give operations teams a testing regime they can execute consistently and document with confidence.
A proof test is a periodic test of a Safety Instrumented Function conducted while the process is in operation or during a planned shutdown, with the purpose of detecting dangerous failures that the system's online diagnostics cannot reveal. These are the failures that accumulate silently between test cycles, reducing the probability that the SIF will operate correctly when a process demand occurs.
Proof test coverage is the proportion of dangerous undetected failures that a proof test procedure will reveal. A proof test with 100 percent coverage would detect every dangerous undetected failure present in the SIF at the time of testing. In practice, coverage depends on the scope and thoroughness of the test procedure: which components are exercised, whether final elements are fully stroked, whether the logic solver function is confirmed end-to-end, and whether the test conditions adequately simulate a real process demand.
The relationship between proof test coverage and SIL achievement is direct and quantitative. The PFDavg calculation for an SIF includes a term for proof test coverage. A procedure that achieves 90 percent coverage produces a different PFDavg than one that achieves 70 percent, and that difference determines whether the SIL target is being met. Procedures developed without reference to the SIL verification calculations cannot demonstrate that they maintain the safety case.
We develop procedures with explicit coverage analysis, confirming that the test steps specified will achieve the coverage assumed in the SIL verification, and documenting the basis for that assessment so that it can be reviewed during FSA 5 and regulatory audits.
Full Proof Test
A full proof test exercises the complete Safety Instrumented Function from sensor through logic solver to final element, confirming that the SIF will operate correctly end-to-end under simulated demand conditions. Full proof tests provide the highest coverage and are typically conducted during planned shutdowns or turnarounds when process isolation is possible. The procedure includes sensor calibration and trip verification, logic solver function testing, including input processing, logic execution, and output actuation, and full stroke testing of final elements to confirm they achieve the defined safe state within the required response time
Partial Proof Test
A partial proof test exercises a defined subset of the SIF, typically those components that can be tested without process interruption during normal operation. Partial proof tests are conducted more frequently than full tests and contribute to maintaining SIL achievement between turnaround intervals. Common partial proof test activities include partial stroke testing of valves to confirm actuator and positioner functionality without full process isolation, sensor loop testing to the logic solver input, and logic solver diagnostic function confirmation. The coverage of partial tests is carefully assessed and combined with full test coverage in the overall PFDavg calculation.
Partial Stroke Testing (PST)
Partial stroke testing is a specific technique applied to on-off valves in safety instrumented functions, where the valve is partially stroked, typically 10 to 15 percent of full travel, to confirm that the actuator and valve mechanism are operational without requiring full closure and process interruption. PST can be conducted online during normal operation and contributes proof test coverage for the valve component of an SIF between full proof test intervals. Where PST devices are installed, proof test procedures include the specific steps for initiating, monitoring, and documenting partial stroke tests and confirming that results meet the acceptance criteria assumed in the SIL assessment.
Functional Safety Testing During Commissioning
Commissioning-phase proof testing, carried out as part of site acceptance testing, establishes the baseline against which all subsequent operational proof tests are compared. Commissioning proof tests confirm that the installed system performs its SIF correctly in its actual site configuration, with the field instruments, wiring, and final elements as installed. Procedures developed for commissioning testing are the foundation from which operational proof test procedures are derived, and consistency between the two is essential for maintaining the traceability of the safety case.
Our proof test procedure development is structured to meet the requirements of:
- IEC 61511-1 Clause 16: Operation and maintenance requirements for safety instrumented systems, including proof test planning, execution, and documentation
- IEC 61511-1 Clause 11: Requirements for the development of proof test procedures as part of the SIS operation and maintenance planning
- IEC 61508 Part 2: Proof test requirements for hardware safety functions and diagnostic coverage assessment
- ISA 84 (ANSI/ISA-84.00.01): Equivalent proof test and maintenance requirements for process industry SIS applications
- ISA/IEC 62443: Where proof testing includes confirmation of cybersecurity control integrity for safety-related programmable devices, particularly following firmware updates or configuration changes
A proof test procedure that genuinely maintains SIL achievement is more than a list of steps. It is a controlled document that gives the test team everything they need to execute the test correctly, record the results accurately, and identify failures that require follow-up action.
Each proof test procedure we develop includes:
- Identification of the SIF being tested, with reference to the SRS and SIL verification record
- Prerequisites and preparation steps, including required process conditions, isolation requirements, permit to work references, and tools and equipment needed
- Step-by-step test instructions written in the level of detail appropriate for the maintenance team executing the test, with no ambiguity about what each step requires
- Acceptance criteria for each test step, stating the expected response and the pass or fail condition clearly
- Instructions for handling test failures, including immediate response actions, required notifications, and the process for raising a safety-related defect
- Documentation requirements, including the test record format, the signatures required, and the filing and retention requirements for test records
- Coverage assessment confirming the percentage of dangerous undetected failures that the procedure will reveal, with reference to the SIL verification assumptions
- Proof test interval, consistent with the interval assumed in the PFDavg calculation, with guidance on the maximum permissible overrun before the SIL target is at risk
Proof test procedure development requires an understanding of three things simultaneously: the SIL verification assumptions that define what the test must achieve, the process and operational constraints that define what is practical in the field, and the specific configuration of the installed SIF that defines what each test step must exercise. We bring all three to every procedure development engagement.
SIL Verification and SRS Review
We review the SIL verification calculations and the SRS for each SIF in scope, identifying the proof test interval and coverage assumptions on which the PFDavg calculation is based. These assumptions define the minimum performance requirements that the proof test procedure must meet. Where the SIL verification documentation is incomplete or the coverage assumptions are not explicitly stated, we work with the responsible team to establish them before procedure development begins.
Site and System Familiarisation
We review the as-built design documentation, cause and effect matrices, logic solver configuration records, and instrument data sheets for the SIF. Where site visits are practical, we confirm the installed configuration, access arrangements, and operational constraints that will affect procedure development. Understanding the actual installed system is essential for writing procedures that field teams can execute without improvisation.
Procedure Development and Coverage Analysis
We develop the full procedure for each SIF, including all prerequisites, test steps, acceptance criteria, failure handling instructions, and documentation requirements. We conduct a formal coverage analysis for each procedure, confirming that the test steps specified will achieve the coverage assumed in the SIL verification and documenting the basis for that assessment.
Review, Validation, and Handoff
We conduct a structured review of each procedure with the operations and maintenance team who will execute it, confirming that steps are clear, practical, and executable within the operational constraints of the facility. Where the review identifies steps that are impractical as written, we revise the procedure and update the coverage analysis accordingly. Final procedures are handed off in a format ready for use as controlled maintenance documents.
Proof test interval is one of the most operationally significant parameters in a safety lifecycle programme. A shorter interval maintains a lower PFDavg but increases the operational burden on maintenance teams and the risk of introduced failures during testing. A longer interval reduces maintenance demands but allows dangerous undetected failures to accumulate for longer, increasing PFDavg and potentially pushing the system outside its SIL target range.
We support clients in optimising proof test intervals by modelling the relationship between interval, coverage, and PFDavg for each SIF, identifying the interval that achieves the SIL target with the minimum operationally practical testing burden, assessing the impact of partial proof tests on the achievable interval for full proof tests, and evaluating whether diagnostic enhancements, redundancy changes, or component upgrades could support a longer interval without compromising SIL achievement.
Interval optimization is particularly valuable for facilities with long turnaround cycles, where the proof test interval for full proof tests is constrained by process availability, and for systems where test-induced failures have been a historical source of operational disruption.
- Maintained SIL achievement throughout the operating life of each Safety Instrumented Function, not just at the point of commissioning
- A testing regime that is consistent between test cycles, executed with documented evidence, and traceable to the SIL verification assumptions that underpin the safety case
- Clear, executable instructions that reduce the risk of test-induced failures, missed steps, and ambiguous results that generate unnecessary corrective maintenance workload
- A documented coverage assessment for each procedure that confirms SIL maintenance and supports FSA 5 and regulatory audit
- Optimized test intervals that balance SIL achievement against operational burden, supported by quantitative analysis rather than conservative assumptions
- Audit-ready test records that demonstrate due diligence in maintaining the functional safety performance of safety-critical systems through their operating life
- Proof test procedure for each SIF in scope, including prerequisites, step-by-step instructions, acceptance criteria, failure handling guidance, and documentation requirements
- Coverage analysis for each procedure, confirming the percentage of dangerous undetected failures detected and the basis for the assessment
- Proof test schedule aligned to the intervals assumed in the SIL verification calculations
- Test record template for each procedure, structured for consistent field use and audit readiness
- Proof test interval optimization analysis, where requested, including sensitivity modeling and recommendations
- Review record confirming procedure validation with the operations and maintenance team
Proof testing a modern safety instrumented system is not limited to confirming that sensors trip and valves close. Logic solvers run on programmable platforms with configuration files that can be altered. Networks carry signals that safety functions depend on. Firmware updates change system behavior in ways that are not always visible in functional testing. A proof test program that addresses only the traditional electromechanical components of an SIF and ignores the programmable and networked elements is leaving a portion of the dangerous failure space untested.
- Proof test procedures that address the complete SIF, including programmable logic solver configuration, network-dependent signal paths, and diagnostic function confirmation, where relevant to SIL maintenance
- Explicit coverage analysis linked directly to the SIL verification calculations, so that the relationship between the procedure and the safety case is documented and defensible
- Practical procedures written for the teams who will execute them, with a level of detail that eliminates ambiguity without creating unnecessary complexity
- Interval optimization capability that uses quantitative modeling to support decisions about testing frequency, rather than defaulting to conservative assumptions that increase operational burden
- Deep operational experience across high-consequence sectors, including oil and gas, energy, pharmaceuticals, and process manufacturing
We do more than write test steps. We help operations and maintenance teams understand what they are testing, why each step matters, and how the testing regime they follow is maintaining the safety performance of the systems they depend on.
Ready to Develop Proof Test Procedures for Your Safety Systems?
Reach out to our functional safety team. We will review your SIL verification documentation, confirm the coverage requirements for each SIF, and develop proof test procedures that keep your safety systems performing throughout their operating life.