How should a plant test hidden protective functions that may fail without warning?
A protective device can look healthy for years while being unable to perform on demand. A standby pump, trip relay or shutdown interlock may have a hidden failure because normal production never asks it to operate. Failure finding is a deliberate check that the function remains available, not simply a calendar inspection of its appearance.
Identify the function and consequence
Start with a precise function statement, the required response and the demand condition. Ask what happens if the function is unavailable when called upon. Determine whether a failed protective function could combine with another event to create a safety, environmental or production consequence. The consequence determines the rigor of analysis and the need for engineering or process safety review.
Choose a test that demonstrates the function
For each hidden failure mode, specify how a safe, authorized test will reveal it. A relay indicator lamp is not necessarily proof that the final element will actuate. A standby pump running unloaded may not demonstrate that it can supply required flow and pressure. Define the portion of the protective chain to be tested, the test limitations, acceptance criteria and any compensating controls needed while protection is impaired.
Determine the interval from risk and evidence
Failure finding intervals depend on failure probability, consequences, demand frequency, test coverage, proof test effectiveness and applicable requirements. Do not use a universal monthly or annual interval. Reliability centered maintenance analysis, manufacturer data, operating history and any governing safety requirements should inform the choice. Where a formal safety instrumented function exists, follow its approved safety lifecycle and proof test requirements rather than substituting a general PM rule.
Control the test itself
- Obtain operations authorization and a documented procedure.
- Assess whether testing can cause a trip, release, unsafe movement or loss of protection.
- Apply required isolation, permits and management of change controls.
- Record actual response, setpoints, timing and any bypasses.
- Restore the normal configuration and independently verify that bypasses and test connections are removed.
Example and closeout
A standby cooling pump starts on a simulated low pressure demand. The test checks the automatic start command, motor response and achieved discharge pressure under a safe test configuration. A successful local motor start alone would not verify the automatic demand function. Record deficiencies as corrective work, reassess protection while impaired and repeat the relevant acceptance test after repair.
Explore KANE consulting
Discuss practical maintenance and reliability improvements for your facility.
Request a consultation →Related answer: How should standby equipment affect asset criticality?
Technical references
NASA Reliability Centered Maintenance Guide · NASA Preventive Maintenance Strategies