About Proof-testing

The IEC 61511 standard recommends the use of a functional safety life cycle to: 

1. Analyze situation and document safety requirements
2. Translate requirements into a documented safety system design, using appropriate software and hardware and design methodology
3. Evaluate system against the required integrity and reliability specifications - modify as needed
4. Operate and maintain system according to accepted procedures - document results to ensure performance is maintained throughout the lifecycle

• Safe Undetected (SU): A spurious (untimely) activation of a component when not demanded  
• Safe Detected (SD): A non-critical alarm raised by the device 
• Dangerous Detected (DD): A reported critical diagnostic alarm, which will prevent the safety function from being executed if not corrected 
• Dangerous Undetected (DU): A critical dangerous failure, not identified by the device diagnostics. Remains hidden until the next test or safety function activation. Selecting a device with high diagnostic coverage will minimize DU, and improve safety 

IEC 61508 indicates that Systematic Capability, Architectural Constraints and Probability of Failure of a product must be evaluated. An independent third-party test company such as Exida can provide certification covering all three parts required for the targeted SIL level:

• Systematic Capability requires the device manufacturer’s quality management system to be assessed to ensure procedures are followed to prevent systematic design errors
• A Failure Mode Effects and Diagnostic Analysis (FMEDA) is performed to evaluate the Architectural Constraints 
• Probability of Failure is assessed by calculating the average random probability of a failure 

Probability of Failure on Demand (PFD) 

The risk of a device failing to perform its safety function when required. IEC 61511 states that the interval between proof-tests shall be calculated based on the average PFD (PFD_avg). The individual failure rates, diagnostic coverage and safety function factor are used for calculation of PFD_avg. A lower individual instrument value helps improve the overall reliability. 

Risk Reduction Factor (RRF)  

Risk reduction factor (RRF) is the inverse of the required probability of failure. For example, a required probability of failure value of 0.001 equals an RRF of 1000, which means one dangerous failure every 1000 years.

A comprehensive proof-test verifies all three functional elements of a device – output circuitry, measurement electronics and sensing element. A partial proof-test verifies one or two of them. A partial proof-test is performed to ensure that a device has no internal problems, and it will bring the PFD of a device back to a percentage of the original level and ensure that it fulfills its specified SIL requirement.

A combination of partial proof-tests that covers all three functional elements is considered as a comprehensive proof-test.

In addition to measurement data, modern level devices also provide access to diagnostic features and support remote proof-testing. Failures can be identified in real time. Diagnostic coverage (DC) describes the device’s ability to detect dangerous failures. Proof-test coverage is a measure of how many undetected dangerous failures, not identified by a device’s diagnostics, that can be detected by proof-testing. This is defined as the proof-test coverage (PTC) factor, which should be an as high percentage as possible (ideally 100% for a full test).