Completion, verification, authorisation: three decisions before a machine goes back to work

Most maintenance systems record one event at the end of a repair: the work order is closed. That single status usually stands for three separate things, and they are worth pulling apart because each is done by a different person, answers a different question and fails in a different way.

1. Completion. The technician has done the work specified and recorded what they found and what they did. The question it answers is whether the job was done.
2. Verification. A competent person has checked that the repair works and that nothing disturbed to reach it has been left wrong. The question is whether the machine now functions as it should.
3. Authorisation. Someone with the authority has decided the machine may be used, knowing the verification result and anything else still open on it. The question is whether it should go back to work.

On a simple job the same person may do all three within minutes, and that can be entirely appropriate. On safety-critical systems, or after a major repair, merging them is where the regulators' reports start.

What goes wrong after maintenance

The NSW Resources Regulator reviewed 18 fires on mobile plant at open-cut coal mines over six months of 2021. Nine occurred within the first shift after the plant was returned to service, and ten came from workmanship errors 'likely to have been detected by visual inspection by a supervisor or a short period of workshop commissioning'.^⁠[1] In other words, the work had been completed, and in many cases a short verification step would have found the error.

Its 2024 bulletin on steering failures describes the same gap from another direction. One vehicle had 'recently returned from overhaul', and a steering cylinder fitting had not been given the additional turns its specification required. The regulator's recommendation names the missing step: 'recommissioning checks with supervisor sign-off to verify the plant is safe to return to service without maintenance induced faults/failures'.^⁠[2]

Queensland alerts show the third decision being taken without the information it needed. After a haul truck lost power and was reset, it went back into service with the operator unaware that the event could degrade its park brake; the second loss of power, on a ramp, ended in a 200-metre rollback.^⁠[3] A light vehicle's fail-safe brake interlock had been disabled by a damaged door switch, and the pre-starts did not include testing the interlock, so nothing showed that a safety function had gone.^⁠[4]

What verification should cover

The West Australian mines regulator's description of defect control ends with the plant being 'inspected and tested before it is returned to service', against the specification of the manufacturer or the competent person who assessed the defect.^⁠[6] In practice a useful verification covers more than the component that was replaced.

• The repaired function, tested as a function. A brake that holds on the test slope, a pump that makes its duty point, a cylinder that holds pressure. Seeing that the new part is fitted is not the same test.
• Whatever was disturbed to get to it. Hoses moved, connectors unplugged, guards removed, fasteners undone. Among the causes in the NSW fire review were diesel fittings disturbed during repairs and not tightened before the plant went back to work, gaskets pinched or not replaced, fasteners left out or wrongly tensioned, and oil-soaked lagging left in place.^⁠[1]
• Safety-critical functions nearby. Emergency stops, interlocks, dead-man and hold-to-run controls, steering and brakes. Queensland's coal inspectorate is explicit that 'a visual inspection alone may not identify a defeated or ineffective controls', and asks that pre-starts include a functional test.^⁠[5]
• A run under load, where the system allows it. Leaks, heat and loose fixings often show only once the machine has worked for a while, which is one reason the first shift matters.
• A result someone can read later. What was tested, the reading or outcome, who did it and when. A test that is not recorded cannot be relied on by the person deciding whether to authorise.

Who should authorise

The person who did the work is well placed to verify most of it and poorly placed to be the only check on a safety-critical repair, for the ordinary reason that people find it hard to see their own errors. The theme-park ride's own breakdown procedure, examined at the Queensland inquest, recognised this: for essential safety equipment, 'an independent functional safety test should be carried out before the equipment is permitted to return to service'.^⁠[7] The NSW recommendation of 'supervisor sign-off' points the same way.^⁠[2]

Authorisation also has to account for things the repair did not touch: other open defects on the machine, restrictions such as a speed limit or a lifting derating, anything the next operator needs to know, and whether a stand-down applied by someone else is still justified. That is why it is usually a supervisor's or engineer's decision rather than the technician's, and why it should be written down with a reason.

The first shift back

Because so many post-maintenance failures appear early, some sites treat the first shift after a major repair as part of the verification: the operator is told what was done, the first pre-start pays particular attention to the area of the work, and any abnormal reading in the first hours goes straight back to the maintainer. It costs very little, and the 2021 fire figures suggest where the return is.^⁠[1]

In Mainte the completion note, any inspection and the reinstatement of a stood-down machine are separate records, each with its own person, time and reason; From a failed check to a safe return to service shows how they connect.