This is a question I often get asked when I’m teaching our FSE100 course on Functional Safety, when we discuss the purpose of Proof Testing and coverage.  It’s amazing how many end users assume perfect proof testing (i.e. 100% coverage), that is capable of finding, all the potential dangerous undetected failures.  It just isn’t the case.  There is no such thing as a perfect proof test for a SIF, despite what some manufacturers would have you believe.

So why is this such a big deal? 

To illustrate this, let’s consider our SIF, which is made up of sensor(s), Logic Solver(s) and Final Element(s), including, any, and all, interface/signal conditioning devices. 

Using simplified equations, we know that:

PFDavg (SIF) = PFDavg (Sensor Subsystem) + PFDavg (Logic Solver) + PFDavg (Final Element subsystem)

Therefore, using our simplified approximation formula and assuming a single element system (ie. HFT =0):

This simplified equation assumes 100% proof test coverage, so what happens when we don’t have 100%?  Now our simplified equation has to be changed to include the coverage factor, but we also now have to consider Mission Time. 

So, what is Mission Time?

Mission Time is the name given to the period of time over which the SIF has to function, without requiring a major overhaul and/or replacement of its equipment.  Mission Time is not the same as Useful Life (the time specified by the manufacturer for its product to function before requiring replacement).  Since a SIF has different equipment with each piece of equipment having different Useful Life, choosing the Mission Time is very important, especially with regards to the target SIL. With imperfect Proof Testing, Mission Time now plays a crucial role in determining the effective SIL of the SIF. 

The following equation and diagram illustrates this further:

Every time a proof test is executed it will only find a portion of the dangerous faults (indicated by Cpt), therefore, Mission Time becomes relevant since it will compound the likelihood of a dangerous fault causing a failure on demand over the Mission Time of the SIF.

Let’s consider the following example:

A SIF has a proof test interval of every 10,000 Hrs (1E4 hrs) and a dangerous failure rate of 100 FITs (100 E-9/hr or 1E-7/hr), with a Mission Time of 200,000 hrs (2E5 hrs)) and a Proof Test Coverage of 80%.  What is the resulting PFDavg assuming a) a Perfect Proof Test and b) using the 80% coverage.

From this we can clearly see the effect of incomplete proof testing and mission time from b), which achieves a SIL level lower than the assumed perfect proof test. What this translates into is illustrated below:

Over time, with incomplete proof testing, we can see that our PFDavg will continue to worsen until it moves from one SIL boundary to another.  This is why we have to consider Useful Life, Proof Test frequency, Proof Test coverage and Mission Time.  Of course, there are many other variables that need to be considered when calculating the achieved SIL of a SIF but these simple equations help illustrate the effect imperfect proof testing has on the PFDavg. 

The goal, therefore, is to design a strategic proof test that can achieve the highest possible coverage factor.  Most manufacturers of SIL-rate equipment will include a suggested proof test and proof test coverage in their safety manual.  If using a tool such as exSILentia to perform SIL verification calculations, exSILentia can determine the coverage factor for each sub-elements of a SIF, based upon the manufacturers’ recommended proof test and coverage.

If this blog has stimulated your interest then please check out the upcoming webinar on this subject.