The textbook equation for a single device is short: PFDavg is about λDU times the proof test interval, divided by two. It carries a quiet assumption: that every proof test finds every dangerous undetected failure and returns the device to as-new condition.
Real proof tests do not. A valve stroked closed and open shows that it moves. It does not show whether it seals. A transmitter compared with a reference at one point does not show that it responds correctly across its range. Whatever the test cannot see stays hidden until the device is overhauled or replaced.
Two parameters that change the answer
Proof test coverage (PTC) is the fraction of dangerous undetected failures that the actual test procedure reveals. It belongs to the procedure, not to the device: the same valve can have very different coverage under two different procedures.
Mission time (MT) is how long the device stays in service before it is overhauled or replaced, which is when the failures the test misses are finally removed.
With both, λDU splits into a part revealed every proof test interval and a part that accumulates over the mission time:
PFDavg ≈ PTC · λDU · T/2 + (1 − PTC) · λDU · MT/2
A worked example
A shutdown valve with its solenoid, λDU = 1.5 × 10⁻⁶ per hour, proof tested every year. The figures are illustrative.
- As usually calculated, with a perfect test: 1.5 × 10⁻⁶ × 8,760 / 2 = 6.6 × 10⁻³. SIL 2.
- With a stroke test only, coverage 70 %, valve in service for 15 years (131,400 hours) without overhaul:
0.7 × 1.5 × 10⁻⁶ × 8,760 / 2 = 4.6 × 10⁻³
0.3 × 1.5 × 10⁻⁶ × 131,400 / 2 = 2.96 × 10⁻²
Total 3.4 × 10⁻². That is the SIL 1 band.
Same valve, same interval, same failure rate. The difference is that the second calculation describes the test that is performed. The hidden 30 % dominates, and testing more often barely helps, because the test cannot see it.
What to do about it
- Calculate coverage from the procedure. List the dangerous failure modes of the device and mark which ones each step of the procedure would reveal. The certificate or FMEDA often gives coverage figures for typical tests; check that your procedure matches the one they assume.
- Improve the test before shortening the interval. Adding a seat leak test to a valve stroke, or a multi-point check to a transmitter calibration, raises coverage. That attacks the dominant term directly.
- Set a mission time on purpose. A planned overhaul that restores the device removes the accumulated hidden failures. Put the overhaul interval in the calculation and in the maintenance plan.
- Treat partial stroke testing as an addition. It catches some valve failures between full tests, at its own interval and coverage. It does not replace the full proof test.
- Keep the records. As-found results from each test show whether failures are being found at the rate the calculation expects. That is the evidence an IEC 61511 performance review needs.
The check worth doing today
Take your highest-SIL functions. For each final element, compare the proof test coverage in the verification with what the current test procedure actually does. If the calculation says 100 % and the procedure says "stroke and observe", the calculation is describing a different plant.