What this is
What is a safety device test record?
What is a safety device test record?
It is the evidence that a protective device was demonstrated to operate at its set point on a stated date, by a stated method. It covers mechanical protection such as relief valves and bursting discs, and instrumented protection such as trips, switches and safety instrumented functions. It converts a device from an assumed control into a proven one.
How does a proof test differ from a functional check?
A proof test reveals dangerous undetected failures, so it must exercise the whole chain from sensor through logic solver to final element. A functional check may confirm only part of that chain. Under IEC 61511 the proof test interval feeds the SIL calculation, so a test covering less than the whole loop invalidates the failure rate the design relied on.
What do as found and as left set points mean?
As found is the value the device actually operated at when first tested, before anything was touched. As left is the value after adjustment. Only the as found figure carries diagnostic value, because it shows how far the device drifted in service and whether the interval is short enough.
Scope
When is a safety device test record required?
This record proves a protective device operates at its set point. It is not a general maintenance record, not a control instrument accuracy check, and not the place to argue about the interval. Mixing those in makes it impossible to report proof test coverage separately from routine calibration.
Use this template when
- A relief valve, bursting disc, trip, switch or interlock is due its statutory or risk based proof test
- A protective device has been replaced, repaired or reset and needs re-proving before the plant runs
- A device operated in service unexpectedly and its behaviour and condition need recording
- A safety instrumented function is being tested end to end in a SIL verification cycle
- An audit has questioned whether a listed device has ever actually been tested
Do not use it for
- Maintenance Calibration Record, which covers accuracy of workshop instruments, not the operation of a protective device
- Instrument Loop Check, which verifies a control instrument reads correctly and carries no set point or trip evidence
- Calibration Schedule Review, where the argument about interval length belongs, using the drift history this record produces
- Out of Tolerance Impact Review, which assesses what was affected once a device is found to have been wrong
- Test Equipment Register, which holds the calibration status of the calibrators used here, not the result itself
Compliance mapping
Which IEC 61511 requirements does this satisfy?
The template sits between functional safety and pressure equipment law. IEC 61511 governs instrumented protection, ASME BPVC and the national pressure regimes govern mechanical relief devices, and process safety law requires deficiencies to be corrected before further use.
| Clause | Requirement | Where it lands |
|---|---|---|
| IEC 61511-1, cl.5 | People carrying out proof testing must be competent for that activity, with competence documented. | Outcome |
| IEC 61511-1, cl.10 | The safety requirements specification must state the hazardous event each function prevents, with its set point and required response. | Header |
| IEC 61511-1, cl.11 | The system must act within the process safety time, so response observed on test is judged against that figure rather than against comfort. | Test |
| IEC 61511-1, cl.16 | Proof testing at the interval assumed in SIL verification, revealing dangerous undetected failures across the whole function. | Test |
| IEC 61511-1, cl.19 | Test evidence forms part of the safety lifecycle record and must be retrievable for the life of the function. | Outcome |
| ASME BPVC Section VIII Div. 1, UG-125 | Vessels must be protected by relief devices set so pressure cannot exceed the permitted margin above MAWP. | Header |
| ASME BPVC Section VIII Div. 1, UG-136 | Relief valves must carry an intact seal on the adjustment after setting, so the set point cannot be altered undetected. | Test |
| 29 CFR 1910.119(j) | Mechanical integrity requires testing of relief and vent systems, and correction of deficiencies before further use. | Outcome |
What it does not cover
- Simulation on a function whose SIL claim assumed full coverage, which means the failure rate credited in design has never been tested for.
- An as found set point identical to nameplate on every record, which means values are transcribed rather than measured and the interval cannot be defended.
- Test Equipment Calibrated answered Overdue with a pass still recorded, which means the measurement certifying the device was itself unverified.
- Sealed Or Locked After Test answered No with no follow up, which means the set point can be altered by anyone with a spanner.
- Equipment Safe To Operate answered Yes where Test Result is Fail, which means the record contradicts itself and reads as a shutdown avoided.
Global
Safety Device Test Record requirements by country
Proof testing is regulated under process safety law rather than general maintenance law. The three regimes below cover most sites using this template, and differ mainly in who sets the interval.
OSHA Process Safety Management, 29 CFR 1910.119(j)
Mechanical integrity for covered processes, with testing following recognised and generally accepted good engineering practice.
The operator sets frequency but must justify it against manufacturer guidance and operating experience, which is what the as found history provides. Deficiencies must be corrected before further use, so an Equipment Safe To Operate answer of No carries legal weight.
Pressure Systems Safety Regulations 2000, reg.8 and reg.9
Relief devices on a relevant pressure system must sit in a written scheme of examination drawn up by a competent person, and be examined in accordance with it.
The interval is not the operator's to choose. Test Interval Months and Statutory Requirement must reflect the written scheme, and a Within Interval answer of Overdue is a breach rather than a housekeeping slip.
Seveso III Directive 2012/18/EU, Annex III
Establishments must operate a safety management system covering operational control and maintenance of safety critical equipment.
Competent authority inspections routinely sample proof test records. One naming the hazardous event in Protects Against and linking a Critical Control ID is far easier to defend than a bare pass sheet.
How to complete it
How to complete a safety device test record, step by step
Filling the fields is trivial. Four judgements decide whether the finished record survives an examination or an incident investigation.
Test Method is a decision, not a description of what was convenient. Partial stroke proves a valve is not seized but not that it closes fully. Bench test proves a relief valve lifts but not that installed pipework behaves the same way. Simulation proves the logic only. If the method does not cover the chain named in Protects Against, schedule the missing coverage rather than letting Test Result imply more than was shown.
Lift, read, record, then adjust. Where As Found Set Point differs from the nameplate value in Set Point, answer Within Tolerance As Found against the device specification, not against whether it felt close enough. The Marginal option exists so near misses stay visible in trending instead of being rounded up to Yes.
Equipment Safe To Operate carries the operational consequence. With restrictions is legitimate, but it obliges someone to state and communicate the restriction, and must not be used to dodge a shutdown the Test Result already implies. Where the answer is No, the record has to reach the engineering manager on shift, not at week end.
Failed Device Analysis is not a repair note. A relief valve that failed because the seat corroded is telling you about every identical valve on the same duty. The judgement is whether the finding is device specific or systemic, and if systemic the CAPA covers the population, not the tag.
What auditors find
Most common safety device test record findings
These recur when proof test records are sampled, with the clause each lands against.
| Finding | Clause | What fixes it |
|---|---|---|
| Trip tested by injecting a signal at the logic solver, final element never stroked. | IEC 61511-1, cl.16 | Restrict Test Method to Full functional test where the SIL claim depends on complete coverage. |
| As Found and As Left set points identical on every record for a device with known drift. | IEC 61511-1, cl.16 | Enforce recording the first lift value before adjustment, and review the as found series at the Calibration Schedule Review. |
| Relief valve returned to service after bench test with no seal fitted or condition recorded. | ASME BPVC Section VIII Div. 1, UG-136 | Make Sealed Or Locked After Test a stop condition, with Not applicable reserved for devices with no adjustable element. |
| Test performed with a pressure calibrator whose own calibration had lapsed. | 29 CFR 1910.119(j) | Answer Test Equipment Calibrated from the Test Equipment Register, and treat Overdue as invalidating the result until repeated. |
| Protects Against left as a generic phrase such as overpressure, with no named event. | IEC 61511-1, cl.10 | Require the specific scenario and link the Critical Control ID so the set point traces back to the hazard study. |
| Devices carried as Overdue for several cycles with no restriction placed on the plant. | Pressure Systems Safety Regulations 2000, reg.9 | Drive an exception from Within Interval into the action route and reassess Equipment Safe To Operate at each deferral. |
Case in point
Case in point: the interlock proven on paper for nine years
A chilled water plant carried a high level trip on a buffer vessel, listed as a safety instrumented function with a claimed SIL 1. Proof test records went back nine years without a single fail, all using the same method: the transmitter was ranged down at the head until the trip annunciated, the alarm was acknowledged, the sheet was signed. Nobody had ever closed the inlet valve as part of the test.
The valve was found seized during an unrelated outage, sitting around eighteen per cent open and unable to drive closed against line pressure. Nine years of passes had proven the sensor and the logic solver and nothing else. The corrective action was not a new valve. It was a rule that Test Method could not be anything but Full functional test for that function, and a review of every other function whose history showed the same shortcut.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
3 sections
- Reference
- MNT-062
- Archetype
- Record
- Record ID
- SDT-2026-000
- Scoring
- Pass or fail
- Direction
- High is good
- Singleton
- No
- Basis
- IEC 61511, ASME BPVC
- Links
- Links Asset, Critical Control
- Tags
- Calibration, Safety
- Sections
- 3
- Fields
- 46
- Follow up fields
- 5
- Repeating sections
- 0
- Links out
- 4
Header
19 fieldsTest ID*
Auto sequence. Format SDT-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Raised By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Area
The area within the site.
Exact Location
Drop a pin for anything hard to find.
Asset*
Asset ID*
Format AST-0000.
Links to FDN-002 Asset ID
Untested Is Unproven
A relief valve that has never lifted, a trip that has never operated and an interlock that has never been tested are assumptions, not protective controls.
Device Type*
Relief valve, bursting disc, high level trip, temperature trip, pressure switch, interlock or safety instrumented function.
Device Reference*
Set Point*
Test Interval Months*
Within Interval*
- Yes3 pts
- Overdue0 pts
Statutory Requirement*
Protects Against*
The specific event this device prevents. If nobody can state it, the set point is probably wrong.
Critical Control ID
Links to FDN-011 Control ID
Test
12 fieldsTest Method*
Full functional test, partial stroke, bench test or simulation. Full functional is the only one that proves the whole chain.
- Full functional testnot scored
- Partial strokenot scored
- Bench testnot scored
- Simulationnot scored
Test Equipment Used
Test Equipment Calibrated*
- Yes3 pts
- Overdue0 pts
As Found Set Point*
Operated At*
Within Tolerance As Found*
- Yes3 pts
- Marginal1 pt
- No0 pts
Operated Fully*
- Yes3 pts
- Partly1 pt
- No0 pts
Reset Correctly*
- Yes3 pts
- No0 pts
Response Time Acceptable
- Yes3 pts
- Marginal1 pt
- No0 pts
Adjustment Made*
As Left Set Point
Sealed Or Locked After Test*
- Yes3 pts
- Not applicable3 pts
- No0 pts
Outcome
15 fieldsTest Result*
- Pass3 pts
- Pass with note2 pts
- Fail0 pts
Device Replaced
Certificate Attached
Failed Device Analysis
A device that failed to operate needs investigation, not just replacement.
Case ID
Thread key
Equipment Safe To Operate*
- Yes3 pts
- With restrictions1 pt
- No0 pts
Next Test Due*
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Technician*
Signature*
Engineering Manager*
Second Signature*
MNT-062 · record IDs look like SDT-2026-000 · Links Asset, Critical Control
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
Proof testing fails on coordination, not technique. The interval slips, the calibrator lapses, the failed device is replaced without anyone asking why.
Holds the device population against the asset register, drives the interval from the written scheme, and raises the exception when Within Interval turns Overdue.
Owns the link between the device and the hazardous event named in Protects Against, so a failed test shows as a degraded layer of protection rather than a maintenance job.
Keeps the test equipment register current so Test Equipment Calibrated is answered from live data, and carries the out of tolerance impact review.
Pulls the as found series across the device population, flags functions whose recorded method has never been a full functional test, and holds every write for approval before it touches a record.
This template lives in KnowMaintain — asset maintenance. Work orders, planned maintenance, calibration, reliability and shutdowns.
Meet KnowMaintain→Glossary
Safety Device Test Record definitions and key terms
- Proof test
- A periodic test to detect dangerous failures not revealed by diagnostics, restoring the function to an as new condition as far as practicable. Its interval feeds the SIL calculation.
- As found
- The value or condition of a device at the moment of test, before any adjustment. The only source of drift information on the record.
- Partial stroke test
- Moving a valve through limited travel to confirm it is not seized without interrupting the process. It improves diagnostic coverage but does not replace a full proof test.
- Set point
- The process value at which a protective device is intended to operate. For relief devices it is normally stamped on the nameplate and sealed after setting.
- Process safety time
- The interval between the onset of a deviation and the hazardous event. A protective function must complete its action within that time to be credited as a layer of protection.
FAQ
Frequently asked questions about safety device test record
How is the test interval decided?+
For statutory devices it comes from the written scheme of examination and is not the operator's to change. For instrumented functions it comes from the SIL verification, where a longer interval means a higher probability of failure on demand. Test Interval Months should trace to one of those two.
Can a bench test replace an in situ test for a relief valve?+
It proves the valve lifts at set pressure, the main statutory requirement, but not that the installed inlet and discharge pipework behave as designed. Where inlet pressure loss or back pressure is a known concern, the bench result needs an installation review alongside it.
Why does the template require two signatures?+
The technician and the engineering manager answer different questions. The technician attests to what was observed. The manager accepts the consequence recorded in Equipment Safe To Operate and Next Test Due. Separating them stops a shutdown decision being taken quietly at the point of test.
What should happen when a device fails?+
A Fail opens Failed Device Analysis and Case ID. The device is repaired or replaced, retested and recorded again, and the analysis asks whether identical devices on similar duty share the mechanism. Replacement alone closes the tag and leaves the population risk untouched.
Does Marginal count as a pass?+
It scores one rather than zero, so it does not fail the record, but it stays visible. A run of Marginal answers on one device is a stronger case for shortening the interval than a single outright failure.
Can the template be changed?+
Yes. Fields, options, scores and conditional rules are editable, and the links to the asset and critical control registers come with it. The edit worth making early is tightening Test Method for named safety instrumented functions.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Calibration and Measurement
Maintenance Calibration Record
Records calibration of maintenance instruments such as torque wrenches, pressure gauges and multimeters
Instrument Loop Check
Verifies a control instrument reads correctly from sensor through to display or control system
Calibration Schedule Review
Reviews whether calibration intervals are still appropriate based on drift history
Test Equipment Register
Lists every gauge, meter and instrument used to make quality decisions, with its calibration status
Calibration Record
Records the calibration of a piece of test equipment, including standard used, result and next due date
Gage R&R Study
Measures how much of the observed variation comes from the measurement system rather than the product, separating repeatability of the gauge from reproducibility between operators
More in Calibration
Maintenance Calibration Record
Records calibration of maintenance instruments such as torque wrenches, pressure gauges and multimeters
Instrument Loop Check
Verifies a control instrument reads correctly from sensor through to display or control system
Calibration Schedule Review
Reviews whether calibration intervals are still appropriate based on drift history
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- IEC 61511-1:2016, Functional safety for the process industry sector, cl.10, cl.11, cl.16 and cl.19
- ASME BPVC Section VIII Division 1, UG-125 to UG-136, pressure relief devices
- OSHA 29 CFR 1910.119(j), Process safety management: mechanical integrity
- Pressure Systems Safety Regulations 2000 (SI 2000/128), reg.8 and reg.9
- Seveso III Directive 2012/18/EU, Annex III, safety management system requirements
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.