Proof testing and partial stroke — the test that never closes the valve

A safety instrumented function spends essentially all of its life doing nothing. Its failure mode is to sit there, apparently healthy, in a state where it would not act if asked. The proof test is the only thing standing between that condition and a plant that believes it is protected.

Which makes it striking how often the proof test on record does not test the part of the loop that fails.

Interval and coverage are both in the calculation

The probability of failure on demand for a function depends on its devices’ failure rates, on how often it is tested, and on how much of it the test exercises. The first two are familiar. The third is where most real plants lose their SIL claim.

In a typical function the field devices dominate the failure rate, and the final element is usually the single largest contributor. A test that injects a signal at the input card and watches the output card de-energise exercises the most reliable third of the loop. Performed diligently every year and recorded properly, it creates confidence that is not supported by anything.

What a full proof test is

End to end: a real input at the sensor, or as close to real as can be arranged, through the logic, to a final element that is confirmed to have gone to its safe position and to be tight when it gets there.

The parts that get left out, in order of how often:

• Seat leakage. The valve closed. Whether it sealed is a separate measurement, and on a function whose purpose is to isolate an inventory it is the measurement that matters.
• Stroke time. The safety requirement specification states a closing time because the hazard analysis assumed one. A valve that closes in forty-five seconds against a specified fifteen has failed the test, and without a stated criterion it gets recorded as a pass.
• The sensor’s process connection. Injecting a current at the transmitter terminals tests everything except the impulse line and the tapping, which are where the blockages are. See impulse lines and tapping points.
• The trip setting itself, as opposed to the device. A trip at the wrong value operates perfectly and too late.
• The voting. On a two-out-of-three arrangement, each channel has to be tested independently, or a failed channel stays hidden behind the two that work.

Partial stroke testing: what it buys

Partial stroke moves a shutdown valve ten to twenty per cent and returns it, online, without tripping the process. It is normally initiated from a digital valve controller or a dedicated device, and the signature of the movement is recorded.

What it genuinely addresses is stiction — a valve that has sat in one position for two years and has seized in its packing or its seat. That is a large share of real final element failures, and partial stroke finds it while the plant is running, which no other test does.

What it cannot do is prove the valve reaches its seat, or seals when it gets there, or completes its travel in the required time. The last part of the travel is exactly where a valve with deposits or a damaged seat will fail.

So the credit taken in the calculation is a diagnostic coverage figure applied to the final element, well short of complete, and the correct use of it is to extend the full proof test interval, not to replace the full test. A plant that has stopped doing full tests because it has partial stroke has taken a credit it did not earn.

Bypasses, which are where the real exposure sits

A function under test or under maintenance is a function that is not protecting anything. That is accepted and manageable; what is not manageable is a bypass nobody is tracking.

The elements of a defensible arrangement are short:

1. Authorisation at a level that matches the risk, not by the technician who needs it.
2. A live register — what is bypassed right now, by whom, since when, why.
3. An expiry, with escalation when it passes rather than a renewal by habit.
4. Visibility on the operator’s console, not only in the logic.
5. Compensating measures stated for the period: a person watching a reading, a reduced rate, a manual isolation.
6. Removal confirmed and recorded, with a functional check afterwards.

The finding that recurs on audit is a bypass applied during a commissioning activity three years ago, never removed, invisible on the console, on a function the plant believes is in service. See alarm management for the same pathology in a different system.

As-found failures are the data the programme exists to produce

A proof test that passes tells you the function worked today. A proof test that fails as-found tells you the function was unavailable for some part of the interval just ended, and that is the information the whole programme is built to generate.

The record should establish how long it may have been failed, whether a demand occurred in that period, what the failure mode was, and whether the mode suggests a change to the interval, the device or the design. Accumulated across the plant, these as-found results are what lets the assumed failure rates be replaced with the plant’s own — which is the point at which the SIL claim stops being a vendor’s number and becomes the plant’s.

Where this goes next

• Safety instrumented systems — SIL, the safety lifecycle and where the proof test interval comes from.
• Control valves — the final element and how it fails.
• Impulse lines and tapping points — the part of the sensor subsystem that signal injection never reaches.
• Alarm management — the protection layer upstream of the trip.