Proof-test interval

The proof test interval should be selected to achieve the average probability of failure on demand as required in the safety requirements specification. 

There are a number of strategies being used to select the proof test interval for a SIF. 

In the choice of a proof test interval, considerations should be given to the demand rate for Demand Mode systems, the failure rate of each component being tested, and the overall system performance requirements. 

Additionally, monitoring software which proves that the safe state of the valve is reached each time the valve is operated (once per batch, typically every 8 hours) is written. In case of a test failure or if more than 168 hours have elapsed since the last test, the logic solver output stays in the safe state (emergency block valve closed) and the condition is alarmed. This automatic test allows setting the proof test interval in the PFD calculation to 168 hours. 

Given the failure rate of a component and an operational time interval (mission time), one can calculate the reliability of that component. If the component is repairable and the restore rate is estimated, tiie steady state availability of the component can be calculated. If the failure rates, proof test interval, proof test coverage, and component lifetime are known, one can calculate the average probability of fatiure. 

Three time intervals must be known to define what credit may be taken for automatic diagnostic testing and manual proof testing. These three time intervals are the average demand interval, the manual proof test interval and the automatic diagnostic test interval (usually the worst-case time is considered). The three modes and their relationsldps are shown in Table 7.2. 

Mode Demand Interval versus Automatic Diagnostic Interval Demand Interval versus Manual Proof Test Interval Probability Measure... 

Problem Layer of protection analysis has indicated that a demand would occur every 5 years on average for a particular process hazard. Although most automatic diagnostics execute every minute, the worst-case time period for automatic diagnostics within the equipment is once per week. A proof test interval of one year is proposed for a manual test and inspection. Would this SIF be classified as low demand ... 

Problem A set of non-redundant (lool) safety equipment is used to perform a safety instrumented function in low demand mode. The equipment is to be inspected and fully restored every five years. Therefore the manual proof test interval is five years and the manual proof test effectiveness can be assumed to be 100%. 

Component failure rate data and PFDavg/MTTFS calculations for two cases of the above system are shown in Table 12-1 and Table 12-3. SFF calculations and architecture limit checks are shown in Table 12-2 and Table 12-4. An assumption was made that a very effective proof test was performed at the specified proof test interval with proof test coverage of 95% for the sensor (full calibration), 90% for the logic solver and 80% for final element (full stroke test). The calculation results and all other results... 

The results of the PFDavg calculations for case 2 indicate that for a 1-year test interval the PFDavg is 6.36F-02. This provides a Risk Reduction of 16 (SILl). For a 3-year test interval the PFDavg is 9.07F-02. This provides a Risk Reduction of 9.8. This does not meet SIL 1 limits. Fven the one year proof test interval is marginal and there could obviously be some reluctance to implement the function having a risk reduction of 16 for SILl... 

The results of the PFDavg calculations for SIL 3 Case 2 indicate that for a one-year test interval the PFDavg is 7.01E-03. This provides a Risk Reduction of 143 (S1L2). The relative subsystem contribution is shown in Figure 12-10. This clearly shows that the final element design must be improved to achieve a SIL 3 rating for the safety instrumented function. The three-year proof test interval was not calculated. 

The manual proof test interval must also be known. The example will use a one-year manual proof test interval. 

Figure C-13 is a plot of the operating time interval versus the PFD value. Notice that because the manual proof test efficiency is 95%, at the end of each one month manual proof test interval the PFD value never goes back to zero. This has a significant impact on the PFD value at the end of the operating time interval.

A proof test interval of five years is used for the pressure... 

Pre-defined lifetime or proof test interval of subsystems or it elements, and lifetime of released SW. 

For each safety instrumented function operating in demand mode, the required SIL shall be specified in accordance with either Table 3 or Table 4. If Table 4 is used then neither the proof-test interval nor the demand rate shall be used in the determination of safety integrity level. 

NOTE 3 It is important to note that the hardware fault tolerance requirements represent the minimum component or subsystem redundancy. Depending on the application, component failure rate and proof-testing interval, additional redundancy may be required to satisfy the SIL of the SIF according to 11.9. 

The design shall allow for testing of the SIS either end-to-end or in parts. Where the interval between scheduled process downtime is greater than the proof test interval, then on-line testing facilities are required. 

---