Safety instrumented function proof tests generally occur every 1 to 5 years, while supporting functional checks may run monthly or quarterly [S1].
Each safety instrumented function requires its own interval, test scope, acceptance criteria, and auditable record [S2][S3][S4].
Proof Test Interval Is a Calculated Decision
A proof test interval is the period between two tests of a specific safety instrumented function, rather than a calendar interval applied uniformly to an entire safety instrumented system [S4]. The interval should balance the probability of an undetected dangerous failure against the risk created by testing, production interruption, and maintenance workload [S4].
No single frequency fits every protection function. The interval must be established from the design, failure data, service conditions, diagnostics, and applicable recommendations [S3]. An equipment modification, unexpected failure, or departure from assumed operating conditions requires the interval to be reviewed rather than left unchanged [S3].
For a new installation, the starting point is the safety requirements specification and its quantitative target. IEC 61511 requires the interval to be derived from the target average probability of failure on demand, component dangerous failure rates, and achieved proof test coverage, not copied from a generic table or vendor default [S5].
Monthly and Quarterly Checks Do Not Replace Full Proof Tests
Functional checks are suited to confirming selected indications, inputs, outputs, or other accessible elements, but a screen indication does not prove that the complete protection will act [S1][S3]. An impulse-line obstruction, failed command path, or valve that fails to reach its required position can remain hidden when only a signal indication is checked [S3].
Full proof tests provide comprehensive validation of all safety instrumented functions, and their coverage must be justified rather than assumed to be complete. Practical references therefore distinguish monthly or quarterly functional checks from comprehensive proof testing on a 1 to 5 year cycle [S1].
End-to-end actuation is not automatically complete proof coverage. A redundant system with two sensors, a 1oo2 input arrangement, redundant logic solvers, and a final valve requires a procedure capable of demonstrating that each relevant element worked as intended [S4]. Diagnostic coverage assists testing, but no diagnostic system detects every fault, so a valve movement alone cannot substantiate every component [S4].
Select the Test Scope from Failure Coverage
A full end-to-end test may involve sensors, transmitters, logic solvers, final elements, and their connections, but the required scope depends on the function and its reliability justification [S3]. The procedure must identify which components are exercised, which failures may remain undetected, and the achieved coverage used in the quantitative justification [S3][S5].
Partial stroke testing can reduce plant disruption and provide frequent evidence about final-element movement, but it does not automatically test the complete sensor-to-actuator chain. A manual full-stroke test without diagnostic coverage of the trip amplifier or logic solver leaves part of the dangerous failure population unverified [S5].
For instrumented readings, a digital multimeter can support defined electrical checks, but its use does not replace end-to-end functional acceptance. Likewise, a data logger can retain response or movement data only when the procedure specifies the variables, timing, and acceptance limits that must be recorded.
Write Acceptance Criteria Before the Test
Acceptance criteria must be established before execution and may cover response, final position, timing, or other characteristics relevant to the safety function [S3]. A valve that eventually closes does not pass a test when its response is slower than permitted; the deviation requires investigation, documented corrective action, and any necessary operating restrictions before the protection is accepted as available [S3].
Test records should identify the safety function, procedure version, test equipment, operating conditions, results, and defects found [S3]. The record must also identify the person who performed the work and the person who reviewed it, with an unambiguous handover and restoration of the final protective state [S3].
IEC 61511 requires the procedure and results to be retained in a retrievable, auditable form [S5]. A signature without measurable results is weak evidence of actual availability, while retained failure data supports later revision of reliability assumptions and proof test intervals [S3].
Manage the Risk During Protection Testing
Proof testing can temporarily make a safety function unavailable, so permits, inhibitions, operating restrictions, and control-room communication must be controlled during the campaign [S3]. The test must neither cause an unexpected process action nor leave the plant without the required protection [S3].
After testing, authorized bypasses and overrides must be removed, connections restored, and the final state verified [S3]. A plant that staggers tests across several safety functions must also verify that the combined risk and test-group assumptions remain consistent with the safety requirements, rather than treating staggering only as a scheduling convenience [S5].
For systems that depend on controlled shutdown equipment, the test procedure should demonstrate that the final element can reach the specified safe position within the required response time. A DC power supply supporting a logic system may be checked during maintenance, but power availability is only one element of the end-to-end proof.
Revise Intervals When Field Evidence Changes
Proof test intervals should not remain fixed simply because they were set during FEED or commissioning [S5]. Failed transmitter calibration, sticking valves, component replacements, system modifications, and failure history can invalidate assumptions used to calculate the interval [S3][S5].
IEC 61511 Part 1 Clause 11.9.3 is identified as requiring the operator to review and update the proof test regime as new failure data becomes available [S5]. That review requires a usable link between maintenance records, field failures, test results, and the SIL verification calculation; otherwise, the recorded interval can remain detached from actual equipment condition [S5].
Track the next scheduled proof test, every interval review triggered by a failure or modification, and the measured coverage achieved by each test procedure. These signals provide a practical audit trail and expose intervals that are being operated as fixed calendar entries rather than as risk-based safety decisions.