A Safety Instrumented Function can be correctly specified, designed and verified at project completion and still lose much of its intended risk reduction during operation if proof tests are missed, bypasses are poorly controlled or dangerous failures remain hidden. Functional safety therefore depends on maintaining the assumptions used in SIL verification throughout the operating life of the plant.
Proof testing, fault management and control of bypasses are among the most important operational activities for preserving SIF performance.
Why proof testing is required
Some dangerous failures are detected automatically by diagnostics, but others remain hidden until a demand occurs or a proof test reveals them. Proof testing is intended to detect these dangerous undetected failures and restore the SIF to a known condition.
The assumed proof-test interval is a key input to SIL verification and PFDavg. If the actual interval becomes significantly longer than the verified interval, the achieved risk reduction may be lower than the design basis.
Proof testing is more than a calibration check
Calibrating a transmitter confirms only part of the SIF. A complete proof-test strategy should consider the sensor, logic, final element and associated interfaces. The objective is to reveal relevant dangerous hidden failures, not simply confirm that an instrument produces a signal.
Where practical, end-to-end testing provides strong evidence that the function can detect the required condition and complete the intended final action.
Proof-test coverage
No practical test necessarily detects every possible dangerous failure. Proof-test coverage represents the proportion of dangerous undetected failures that the procedure is expected to find.
If SIL verification assumes high test coverage, the operating procedure should contain the steps necessary to achieve it. A simplified field test that omits valve stroke, trip logic or final-element checks may not support the calculation assumption.
Partial-stroke testing
Partial-stroke testing can identify some shutdown-valve failures between full proof tests. It can improve diagnostic coverage and reduce average unavailability, but it does not replace a full test unless the verification basis explicitly supports that conclusion.
The engineering team should understand which failure modes the partial test detects and which remain hidden.
Managing proof-test intervals
The required test interval should be stored in the maintenance system and linked to the SIF record. Deferrals should be visible and technically assessed rather than treated like ordinary preventive-maintenance backlog.
If a test cannot be performed on schedule because the plant cannot be shut down, the risk implication should be evaluated and compensating measures considered.
What is a SIF bypass?
A bypass temporarily prevents part or all of a SIF from acting as designed. Bypasses may be needed for maintenance, testing, start-up or troubleshooting, but they reduce protection while active.
A bypass should therefore be authorised, visible to operations, time-limited and supported by an understanding of the risk created by taking the function out of service.
Bypass versus override versus inhibit
Terminology varies between sites. A bypass may suppress an input, an override may force an output or logic state, and an inhibit may prevent a trip from propagating. Regardless of terminology, the important issue is whether the protective function is impaired.
The facility should define these terms consistently so operators and maintainers understand the effect of each action.
Compensating measures
When a SIF is bypassed, temporary risk controls may be required. Examples can include restricting operating conditions, increasing operator monitoring, reducing inventory, suspending certain activities or providing an alternative protective layer.
Compensating measures should match the hazard scenario rather than be generic administrative statements.
Bypass alarms and visibility
The control room should have clear indication that a safety function is bypassed or impaired. Hidden or poorly labelled bypasses create the risk that a plant returns to normal operation without restoring protection.
Shift handover should include active bypasses, expected duration and restoration responsibility.
Time limits and escalation
Bypasses should not remain indefinitely because they gradually become accepted as normal. Sites often use approval levels or escalation requirements as bypass duration increases.
The process should encourage restoration of the safety function and ensure that long-term impairment triggers engineering review.
Fault response
Diagnostics may reveal a failed transmitter, logic channel or valve. The response should consider how much redundancy remains and whether the SIF can still meet its requirement.
A repair-time assumption used in verification should be realistic and should be supported by maintenance response, spare-parts availability and access to competent personnel.
Demand recording
Actual SIF demands provide valuable information. The organisation should record whether the SIF acted successfully, whether any dangerous or spurious failures occurred and whether the demand frequency is consistent with the risk assessment.
If actual demand rate is materially higher than assumed in LOPA, the original SIL basis may need review.
Spurious trips also matter
Functional safety focuses on dangerous failure, but nuisance or spurious trips can create operational pressure to bypass protection. Excessive spurious trips may indicate poor instrument selection, unsuitable voting or process problems.
Improving reliability can therefore support safety by reducing the incentive to defeat protective functions.
Management of change
Changes to trip setpoints, voting, proof-test intervals, logic, sensors or final elements should be controlled through Management of Change. A seemingly minor change can affect the SRS or invalidate part of the SIL verification.
The MOC should identify whether HAZOP, LOPA, verification or validation requires update.
Periodic lifecycle review
Operating data should be used to challenge original assumptions. Proof-test findings, failures, bypass duration, demands and maintenance history can show whether the SIF is performing as expected.
This information can support a Functional Safety Assessment or periodic review of the asset’s functional safety management system.
Linking operations back to SIF requirements
The best operating practices are traceable to the original safety requirement. Operators should know what condition the SIF protects against, maintainers should know what failures the proof test must detect, and engineers should know which assumptions control the verified integrity.
This lifecycle traceability prevents functional safety from becoming a set of disconnected spreadsheets and maintenance tasks.
Functional safety support
Pro Engineers supports operational functional safety reviews, proof-test strategy, bypass management, SIL verification and lifecycle assessment for process facilities.
For help reviewing SIF maintenance assumptions or bringing existing safety functions into a controlled lifecycle, contact Pro Engineers.