Proof Testing and Diagnostic Coverage

Latent failures are the enemy of protection systems; automatic diagnostics plus scheduled proof tests keep the probability of failure on demand inside its target.

The latent-failure problem

A protection function that is never demanded can fail silently and stay failed until the one moment it is needed. Two things hold this at bay: on-line diagnostics that detect failures continuously, and periodic proof tests that exercise the full trip path to reveal what diagnostics miss. Together they set how the probability of failure on demand (PFD) accumulates between tests.

def pfd_avg(lambda_du_per_hr, proof_interval_hr, coverage):
    # undetected dangerous failure rate drives the sawtooth PFD
    lambda_undetected = lambda_du_per_hr * (1 - coverage)
    return lambda_undetected * proof_interval_hr / 2.0

# shorter interval OR higher coverage lowers average PFD
print(pfd_avg(1e-6, proof_interval_hr=8760, coverage=0.9))  # ~4.4e-4

The formula shows the two levers directly: raise diagnostic coverage or shorten the proof interval. Kronos favors automatic partial-stroke and self-test where the actuator allows it, because it raises coverage without a full shutdown, and reserves full proof tests for maintenance windows.

What a proof test must exercise

• The whole path: sensor through logic through final actuator, not just the logic.
• The trip action itself, verified to reach the defined safe state.
• Voting degradation: confirm the function still trips with one channel removed.
• Failsafe defaults: confirm loss of power/heartbeat trips rather than holds.

Coverage and interval are traded against operational reality: full proof tests need a shutdown, so Kronos maximizes automatic self-test and partial-stroke testing that run without stopping the plant, reserving full tests for planned windows. The measured failure rates from every test feed back into the integrity accounting, so assumptions are corrected by evidence over the machine's life rather than fixed at design time. A rate worse than assumed shortens the interval or forces a redesign.

Proof-test results feed the integrity accounting in integrity allocation: if measured failure rates exceed assumptions, the interval shortens or the design changes. During commissioning the first full proof test is run under fault injection to establish the baseline before operation.