What the test aims to demonstrate
A safety function may remain inactive for long periods and fail precisely when it is demanded. Periodic tests seek to discover dangerous failures that normal diagnostics do not reveal. They may include sensors, logic, final elements and their connections. Their scope depends on the particular function and the reliability justification used in its design.
Related concept: Safety instrumented systems and SIL.
More than checking a signal
Seeing an indication on a screen does not necessarily demonstrate that the complete protection will act. A transmitter may work while an impulse line is obstructed; a command may be issued without the valve reaching its required position. The procedure must describe which parts are tested and which failures might remain undetected.
The stated test coverage has technical consequences. Complete coverage must not be attributed to a partial check without sufficient justification.
Frequency and acceptance criteria
The interval between tests is established from the design, failure data, service conditions, diagnostics and applicable recommendations. There is no universal frequency valid for every function. An equipment modification or failure experience different from that expected may require the interval to be reviewed.
Acceptance criteria must be defined before testing: response, position, time or other relevant characteristics. If a deviation is found, its impact is assessed and corrective action is documented.
Safety during testing
Testing protection may make it temporarily unavailable. Permits, inhibitions, operating restrictions and communication with the control room need to be controlled. The test itself must not cause an unexpected action or leave a process without protection.
Restoration is essential: remove authorised bypasses and overrides, restore connections and verify the final state. Equipment handover must be recorded unambiguously.
Hypothetical example
A plant tests the automatic closure of an isolation valve. The procedure covers initial detection, transmission of the command and final movement. The test finds a response slower than permitted. The cause is investigated and restrictions are applied before the protection is considered available again, rather than declaring the test satisfactory simply because the valve eventually closed.
Evidence to retain
The record should identify the function, procedure version, test equipment, conditions, results and defects found. It should also identify who performed and reviewed the work. Failure information supports improved maintenance and review of reliability assumptions. A signature without verifiable results provides little evidence of actual availability.
