The proof test interval is the cheapest lever in a SIL verification and often the most argued about. Too short and the tests cost production and cause errors; too long and the function does not meet its target.
Finding the maximum interval
For a dominant single channel, PFDavg ≈ λDU · T1 / 2, so
T1,max ≈ 2 · PFD_required / λDU
Worked example: required PFDavg 5 × 10⁻³, valve λDU = 1 × 10⁻⁶ per hour: T1,max ≈ 2 × 5 × 10⁻³ / 10⁻⁶ = 10,000 h, about 14 months. First Out AI gives 4.9 × 10⁻³ at 10,000 h for this case.
With redundancy or imperfect coverage the relation is not linear; use the calculator and try values.
Practical constraints
- Turnaround cycle. Final elements that cannot be tested online are tested at shutdowns: if turnarounds are every 4 years, a design that needs yearly valve tests needs online testing (bypass valves, partial stroke) or redundancy.
- Online testability. Transmitters can usually be tested online one at a time with the logic degraded; valves often cannot.
- Margin. Do not design to exactly the required PFD with the longest interval; leave room for coverage uncertainty and data uncertainty.
- Staggered testing. Testing redundant channels at different times reduces the common cause share slightly and spreads the workload.
- Field feedback. Failures found at tests justify keeping or shortening the interval at the next review; consistently clean tests with good records can support a longer one.
In First Out AI
Use the what-if panel or change T1 per group and recalculate. The result chart shows PFD(t) over the mission time; hover to read the value at any time.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.