After maintenance: proving restoration of the required function

Start with a map of what changed

List the components removed, connections opened, settings altered, software loaded, isolations applied and supporting services disturbed. Include adjacent equipment used for access. Replacing a pump seal may involve coupling alignment, cooling or flush lines and valve positions; replacing a transmitter may affect scaling, alarm logic and impulse connections. The work title alone rarely captures that full boundary.

HSE’s maintenance guidance identifies incorrect assembly, direction, settings and restoration as important failure paths. These public process-industry examples provide a general checklist of mechanisms, not acceptance limits for a vessel. Use the actual job scope and approved equipment documents to decide which checks are necessary. Adding a long unrelated checklist can distract from the connections that were genuinely disturbed.

Define acceptance before the result is known

Specify the required flow, pressure, leakage condition, response time, protection setting or other relevant criterion before testing. Include the operating state and measurement method. “Runs normally” is difficult to challenge after a hurried restart; a defined measurable criterion permits a clear comparison and exposes an inadequate test.

If a manufacturer’s value applies at a specified speed, fluid condition or load, reproduce those conditions or document the justified correction. A cold static leak check and a hot operating leak check can reveal different defects. Acceptance should reflect the function and consequences of failure. Generic examples in training material do not authorize changing approved limits to fit an inconvenient result.

Separate assembly checks from performance checks

Before energization, confirm the relevant assembly and configuration through the approved safe work process. Examples include component identity, orientation, closure of disturbed pressure boundaries, correct connections and removal of tools. Some critical features become inaccessible after closure, so their evidence must be captured at the appropriate hold point rather than inferred later from a successful run.

Performance testing then asks whether the assembled system delivers the required service. A pump can rotate in the wrong direction and still move some liquid; a valve can indicate open while its flow path remains restricted. A successful start therefore cannot replace all physical checks. Conversely, correct assembly records do not prove adequate output under load. The two kinds of evidence support different failure questions.

Check the installed measurement loop

An original example uses a 4–20 mA pressure transmitter intended for 0–10 bar. At 12 mA, the correct linear indication is (12 − 4)/(20 − 4) × 10 = 5 bar. If a replacement display is mistakenly configured for 0–16 bar, the same signal reads 8 bar. A healthy transmitter and intact wiring can therefore coexist with a materially wrong installed reading.

Testing only zero would miss this span mismatch because both scales show zero at 4 mA. Use suitable points across the required range and verify the end-to-end indication and relevant logic according to the approved procedure. A simulated current proves a different boundary from applying a physical pressure to the sensor. Record which method was used and avoid claiming coverage of untested impulse lines or sensing elements.

Restore protection and automatic operation

A local equipment test may not exercise the alarm, trip, automatic transfer or remote command that was disturbed. HSE control-system guidance includes post-maintenance reinstatement and proof testing and calls for verified restoration of sensors after tests. The underlying lesson is to track temporary states and verify the protective function within its approved boundary.

List bypasses, forced values, jumpers, inhibited alarms and temporary setpoints introduced for the job. Release requires confirmation of the intended final state, with any authorized remaining impairment clearly controlled. A screen icon can disagree with a physical selector or valve. Use evidence appropriate to the item and consequence. Do not remove or test protective functions through improvised methods merely to complete a checklist.

Use staged testing and explicit stop conditions

Progress from appropriate static checks to controlled operation and relevant load, following the equipment procedure. Specify conditions that require stopping and reassessment, such as unexpected leakage, abnormal vibration, unstable pressure or incorrect protection behaviour. A test is an opportunity to detect a problem, not an obligation to continue until the planned duration expires.

Coordinate with the operator responsible for the system and any connected services. A test of one cooling pump can affect machinery elsewhere; a generator test can change the electrical operating arrangement. Record the configuration and who has control. Where a required test cannot be completed, the outstanding scope should remain visible in the release decision instead of disappearing when the physical repair work is finished.

Make independent checks target specific errors

An independent check is useful when it can detect an error the original worker may have missed. The checker needs the specification, item identity and observable feature, not just a request to endorse a signature. Re-reading the same incorrect label or accepting the installer’s verbal account creates little independence. Checks at critical inaccessible steps may be more valuable than a broad final inspection.

Independence does not require every minor task to have a second person. Select checks by consequence, error likelihood and detectability, in line with the applicable procedure. If two people rely on the same wrong drawing revision, their agreement does not correct the shared information error. Verify reference documents and equipment identity as part of the work design, then record what the second check actually established.

Plan observations after the immediate test

Some maintenance defects appear only after thermal expansion, settling, sustained load or the first operating cycle. A suitable post-release observation can therefore complement the immediate functional test. Define the condition to observe, who reviews it and what finding reopens the job. This should follow the equipment’s actual failure mechanisms and approved instructions, not an arbitrary universal waiting time.

For example, a connection that is dry during a cold static check may behave differently after heating and pressure cycling. That possibility does not authorize release when the immediate acceptance criteria are unmet. It explains why an initial pass and a planned follow-up can both be necessary. Keep any temporary restriction explicit, and ensure the later observation becomes a recorded result rather than an unowned promise in a handover note.

Separate technical release from work-order closure

Technical release should summarize achieved function, restored configuration, test results, unresolved limitations and authorization. Administrative closure records labour and materials but cannot supply missing functional evidence. A completed purchase or a signed contractor report does not automatically mean the ship’s system is ready for its intended duty.

Retain unsuccessful tests and subsequent corrective actions. If a defect recurs shortly after maintenance, the as-found and as-left records help distinguish an ineffective repair, an introduced defect and a different failure mechanism. Trend repeated restoration errors to improve the task itself. Verification succeeds when it demonstrates required service and exposes residual uncertainty, not when every job closes on schedule.

Sources

• Maintenance procedures · HSE · Source check date: 2026-10-06
• Control systems · HSE · Source check date: 2026-10-06