Operation, Maintenance, Modification and Decommissioning
Operation, maintenance, modification and decommissioning
This domain tests the in-service phase: proof testing, bypass control, maintenance, management of change, audit, and decommissioning. Expect questions on proof-test coverage, demand tracking, spurious trips, and change impact.
Core rules
- Proof tests must detect the dangerous undetected failures assumed in the SIL calculation; test coverage, procedure, interval, and records matter.
- Bypasses and overrides require authorization, time limits, compensating measures, and logging; a long-term bypass invalidates the SIL claim.
- Maintenance restores designed integrity: calibration, diagnostics, valve testing, and firmware control all need procedures and competence.
- Management of change evaluates any modification for its effect on the SRS, SIL verification, architecture, and operating procedures before implementation.
- Decommissioning needs a plan for safe isolation, removal of safety functions, and interface management with remaining plant.
- Performance monitoring includes demand rate, spurious trip rate, proof-test failures, and bypass duration.
Worked example
An operator wants to extend a SIL 2 transmitter's proof-test interval from 12 to 24 months because access is difficult. The change is not just a schedule edit: PFDavg doubles, possibly pushing the loop above the SIL 2 target, and the maintenance procedure and test coverage must be reviewed. The MOC should include recalculation, approval, updated procedures, and a temporary compensating measure until the change is verified.
Traps
- Treating proof test as a calibration check with no failure detection.
- Leaving a bypass active with no alarm or expiry.
- Changing firmware without configuration control.
- Assuming decommissioning has no functional safety impact.